{ "Event": { "published": true, "date": "2022-05-11", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-05-11", "timestamp": 1652313781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "a58eaf65-5509-490e-bde0-fa81f208a15e", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "712413d4-d13f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652283095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283095, "uuid": "60bf9ba8-2cff-41c0-8b13-a31a4b953687", "comment": "Malware payload (Mirai)", "value": "a1547771d8910ccb1aa67377837b4a2a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283095, "uuid": "9d7a8056-97a2-4751-bf0a-c196a31bea15", "comment": "Malware payload (Mirai)", "value": "006b0236917118cc2bad287fb4dbbb92dafacb8a5f6f34ee97bbff2e5509567f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283095, "uuid": "97c2f80f-bb23-4c04-a230-5993ec9c30d7", "comment": "Malware payload (Mirai)", "value": "b7870dc90d90a055d3bb00e416abaa71f5992440", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283095, "uuid": "dfc3b569-8abe-4562-9a3e-0f9c034558bb", "comment": "Malware payload (Mirai)", "value": "16dd079e75ba302ad114fc390207d85e22804fa5ecd61f1145aa2ba6693bdb5d1d3e858acf482073672b8e345c643631", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283095, "uuid": "f81a8976-e23b-4adb-bfe1-4e14ec403f8a", "value": "T135736CC4A683D9F2DC124AB030B7FF319A32E2BB2156D9D7E3E89973AC41542950774E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283095, "uuid": "16e85200-9b5d-4ff5-a6d7-12520b008fee", "value": "1536:L4NGZbUN08OrmE38D95eOVZqEul/c7g5UT8EH6OASLk:FgN08OrmE3M59qEu/yg5YJHtk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652283095, "uuid": "65627707-a372-4bce-812a-c1bd12c40e67", "value": 76436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652283095, "uuid": "39dcebc0-599d-40da-ba4b-5c35bb9c2eb2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283095, "uuid": "cf5168d9-6785-4e88-b05b-a13d4bb0a3d4", "value": "a1547771d8910ccb1aa67377837b4a2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adf8978a-d14e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652289639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289639, "uuid": "dfc89520-e98e-4624-bc95-8ec9555f42ab", "comment": "Malware payload", "value": "511a585195c831a897923b1d200b80e5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289639, "uuid": "621736dd-f361-44e7-8abf-dd04758e1cb7", "comment": "Malware payload", "value": "00adbfe9f07318aa8e1f73b9027d5e7b044f294b1707ff75b0d420bcceead37f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289639, "uuid": "f993c9ed-836e-4483-ae2a-d5f722fa29a9", "comment": "Malware payload", "value": "36059857fda24f0b6f10b3ef99fa3920e0fb45a1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289639, "uuid": "2f2307ab-44c6-4834-a52d-f6d8684b4483", "comment": "Malware payload", "value": "bc5c31b80cee0245acb663f097c6609a34a3b64781eb420fc49045e56d28d69077f6451d49adcb21bf74d21e70872ada", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289639, "uuid": "5bcfb7b5-f88e-42df-ad01-b447dee3d6f7", "value": "T10703F134030161F4D565B77E69930BF0AA240F623B038E93E5C570FAAE936297A63BD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289639, "uuid": "4d08c456-6014-4b66-b11b-be5aaafca422", "value": "768:tkRdVMqfF6yk6e83nlcZXAiKFLZBphBf5+sqy2uaNB8G+JgGlzDpxYsQ:C76qfF6oe8OwjLzphBf5+sgyGqVrYv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652289639, "uuid": "374ad7ef-2bc0-4237-9c00-70835a006512", "value": 39300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652289639, "uuid": "28036dc3-b704-40df-a641-a7c7478c32d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289639, "uuid": "5b22af07-b26f-4469-8ca6-bf513adc44dd", "value": "511a585195c831a897923b1d200b80e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9291b40c-d163-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652298613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652298613, "uuid": "4483d480-53f8-495e-908c-a9e9197037ac", "comment": "Malware payload", "value": "fecfa7b85903caaa6da8014106e9ddc7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652298613, "uuid": "43effde5-a31f-4cbc-8600-48e754df0360", "comment": "Malware payload", "value": "00af285b57de017a1c199f7780570231f675343919c593178af8ed4d8b2765c4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652298613, "uuid": "6d963f25-d0fd-4f75-89b6-4d2eeace486d", "comment": "Malware payload", "value": "df79b59fc10e97294341c1c64021e46b0aac04f6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652298613, "uuid": "a1db3b62-209e-49a6-b82b-a97aeac4f724", "comment": "Malware payload", "value": "aa0079d312c5a92f5bc6d8a07e211f6372827cfca834304ccdf79c366e31e980e0a5bd55d1b2684cd5cc22c9de83eaf3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652298613, "uuid": "8acf20c0-5aaf-43a0-ba82-5758f2d1ad8d", "value": "T1DE05BF22BB5CBF65E63BD3788050841043F1A70FF72AD55A3CB7648A5572FC193A2E26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652298613, "uuid": "c5cd0edd-11d3-40ad-a0b3-5972a5c1f7f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652298613, "uuid": "3a64e7a8-dfda-4997-b1c1-71facb17a154", "value": "24576:G1Akr2Z5/ZAYCUOlGpK22n3fViURR0ZS:wrw5/ZAAOlSq3P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652298613, "uuid": "3ad73351-1e7e-452d-8184-39093412a21c", "value": 867840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652298613, "uuid": "7f4d5f1b-1736-43f3-bc19-1e18a43a30e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652298613, "uuid": "3a0d90c6-c318-495a-a3f9-1363a50dbf2f", "value": "ATTACHED FILE (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5d52290-d13e-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1652282834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282834, "uuid": "d78b2d88-fc28-4e0d-af57-ce906f36abe2", "comment": "Malware payload (NanoCore)", "value": "dbffb4682e330d635295ccdd92fe99c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282834, "uuid": "25796626-a63d-45ea-9176-9c1d1c59d1e9", "comment": "Malware payload (NanoCore)", "value": "011c5f305852ea8ef82a26bae0d7b6f59fd70f431b91edb25df06863e0001bc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282834, "uuid": "3afe2dbb-72b0-401e-8e15-f584b6628e3f", "comment": "Malware payload (NanoCore)", "value": "ba03bbac64d96bfbd3067803a8b08466b8fb0d3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282834, "uuid": "6ea95f53-0710-4d3a-a3dc-448bce80df03", "comment": "Malware payload (NanoCore)", "value": "f74dee0f138b37159b215cebf26258875e28e610b812ae0914c21aecca934a6e037cc9d9a497c052f6edf0ace9cc6f9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652282834, "uuid": "4de466b4-5159-4a6f-b10e-61afbc7b0d2d", "value": "T187E4011CBAF7DA22D16E2B3990F280945771BE89A033D31E35DC134E9F16B9349467A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652282834, "uuid": "880574c1-ae31-4f56-81c4-4649d61a593d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652282834, "uuid": "c20152d4-f2e6-48d0-8ce8-3e72c9260cc3", "value": "12288:QF/3DpQp9V5XXkkXIqvCQOeZ/xWzWsCXQhpKn+nj4/sHtNdC8Sgp:QF/3DG/YkvvWeZ/xWzWsQQhsnCOcdv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652282834, "uuid": "5dbeaad0-3470-45f0-83a2-b58e986f61bf", "value": 707584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652282834, "uuid": "559f0d84-415f-42c6-9b86-950d0be93835", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652282834, "uuid": "803565fc-dcab-423d-b4b5-f1da69bd51ca", "value": "QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7b45bd2-d115-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652265201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652265201, "uuid": "5c559910-b7fa-4bda-b857-46ffc1dba2c3", "comment": "Malware payload (AgentTesla)", "value": "69a36194c762a5ef462575f71b9ba0f3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652265201, "uuid": "9043129f-8519-4574-9ec6-9f8cb4745271", "comment": "Malware payload (AgentTesla)", "value": "03fb638724597e20f6102deff728cdd8265eecc3f08e54e373c304b4c0718c42", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652265201, "uuid": "851e5933-0c30-487f-be7e-3f3b9b787a45", "comment": "Malware payload (AgentTesla)", "value": "60f9c4ccb4c22314a38ebed7e5c10318e0a0ede8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652265201, "uuid": "4d8da13e-b98b-4461-bb25-dd9ab8ec2a76", "comment": "Malware payload (AgentTesla)", "value": "a0a769269031cbec59ea0d05ea4070ee66ea78cf60c9155e1c96ec51d21f18f41a5a3bc02320cb10739d9e1a803128ae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652265201, "uuid": "65d1fb94-c5f0-4e16-b29c-d42f4226b956", "value": "T1F2E40218BAE6EE12D1BE0F37C5F5505107B9BF197533E31F2AC4110EAA12B930A467A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652265201, "uuid": "e26127f8-6b16-48f4-8723-07df04bbe36c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652265201, "uuid": "fc17558a-0287-4d12-8eb7-6b060c40c433", "value": "12288:S2DpOpNObzwJuO488T6L1ylqLaXpfj71/f9VGXLLZXmyoFbEccHpo8CJ5p:JDovOb0ABRT6L1oimpL71/POFF8QHvCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652265201, "uuid": "9f58a43d-e2a5-4f4b-8c00-022e57881bf1", "value": 701952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652265201, "uuid": "045ec5d6-c536-457b-bbf5-4436b0740959", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652265201, "uuid": "5ba44646-d88f-4aaf-86ea-dc4d213c2114", "value": "Proformal invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5499e232-d129-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652273598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652273598, "uuid": "c521ed90-2203-4bab-894a-476c3345d8e7", "comment": "Malware payload (AgentTesla)", "value": "86af9b0651e9119b8301591858a0ae42", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652273598, "uuid": "ab78ff3a-63a1-4b7c-a411-5d4e02b92caa", "comment": "Malware payload (AgentTesla)", "value": "072c306b7a630402d820184d6e616982e4b13e9fca7422acefda913690fb89e2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652273598, "uuid": "9b3fdcfb-0a9f-400e-8bc1-ec79ba74875a", "comment": "Malware payload (AgentTesla)", "value": "08f9b5f392c456ff86e7a215eaa1c11ad15195a5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652273598, "uuid": "94031d87-0ad6-46d3-bfea-c08182eefc67", "comment": "Malware payload (AgentTesla)", "value": "06671d87c42b980a2316eab8d5e5cca26f71415f0b20b40ce936c55f6ac8fb9a7b63fe9379c74c0f2df4d5fa094502d6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652273598, "uuid": "2f8d7314-8914-4b40-8d02-1003b43db71f", "value": "T1729423C4F223A63192A4E2BCA6C4C1A56175FC930713B4591BD9BBCDFFFC2D58A42609", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652273598, "uuid": "6e6bb7dd-b07b-46f3-82ca-0aa5d5f77fc2", "value": "6144:GY+GQc+C0EgZicdeqm3XLj8Hz/KRSd2rnNzZSBXg4k36+wmrlG+3ej+rAMls:GY9EptYqOLj8Huc0pNSx9k36Eo6Bu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652273598, "uuid": "b6c75303-ac78-4004-8636-2fd5ede8a630", "value": 420053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652273598, "uuid": "6e262984-0c19-441e-a769-523a5f05f9d8", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652273598, "uuid": "3e12342d-0f4b-4818-8938-c1031231caf1", "value": "Outstanding Invoices.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e591a9f5-d15e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1652296605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652296605, "uuid": "ab5a5088-0d5d-49d4-b6b8-92909e985846", "comment": "Malware payload (Quakbot)", "value": "19373f588f7b55362cf2b82c74496db6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652296605, "uuid": "a2f5bbe8-4bdd-437f-b9a7-ecdea1006280", "comment": "Malware payload (Quakbot)", "value": "084af3708e5f84433cbcfe640f635222f2c01988d67196b936604ef37fe53c32", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652296605, "uuid": "ea769e46-a792-4fb1-b4f5-1624ad0baa2d", "comment": "Malware payload (Quakbot)", "value": "ec97a67aa401ada130b4cee30a3191eb7b326ba5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652296605, "uuid": "cbd401dc-bebb-44cf-9027-feba7ffd9d55", "comment": "Malware payload (Quakbot)", "value": "00086779297bd34d9fe44ad87969e1cdb7c25f0ecd76cdc6c3b1b6c9eb7bc915900bec22031dc84782547dc2db657e8b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652296605, "uuid": "2d75e06a-92af-4c33-afe0-53c86e647ca0", "value": "T19945E083EC7482B4C0FD713672484A885533348F9058BF86AA751AFE7F659792C64AFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652296605, "uuid": "1f33fdc6-54b8-4390-8fb0-2a321e83d4e9", "value": "24576:fN276lKRQKSinDi8htLQKSinDi8htGQKSinDi8htdQKSinDi8htDPH5sjl+opcMy:l27cbK1DpaK1DpzK1DpEK1Dp95VSr+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652296605, "uuid": "21816e11-7fd4-41c9-b7df-682a6b138f36", "value": 1172795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652296605, "uuid": "f9397c8a-10f6-467f-81bd-70bc3c89f660", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652296605, "uuid": "533a2e0a-4ca5-4825-a742-cd45e546cbc1", "value": "z3047242716.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a478a4cd-d139-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652280604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652280604, "uuid": "f928cb21-55f1-4c9a-bd77-00ec94081778", "comment": "Malware payload (Mirai)", "value": "0f4f5eab3f3aab58148c2ddaed23927f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652280604, "uuid": "1556aebe-ca05-4b18-89a0-a4ff07a78bec", "comment": "Malware payload (Mirai)", "value": "09ccdad260532d66b3cad6c85df8a7fe7e5cc93ffb86b50f7b216ba0b55fa14e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652280604, "uuid": "17e79de3-a78a-4076-a1c2-0b819e18ce05", "comment": "Malware payload (Mirai)", "value": "cacf023fb39f6970338543f0433d76333b3ab1a2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652280604, "uuid": "2bf99da4-3c9b-443c-9576-f4fc52268452", "comment": "Malware payload (Mirai)", "value": "c3364d2f05eb87474fc02a940d657ec0a4a291ed8b4cff64f1e7a4d9ed73a0ef8a3d2601faf080d8c502cdc291c01d80", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652280604, "uuid": "440db08e-c9cb-4eac-97f1-8bb7dc93d5e5", "value": "T18C4329C4A6C3F9FADC11197C716AAF729E73E03BB135EE8AC3D915739911602910239E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652280604, "uuid": "afa811dc-fcc2-4578-b9f1-dd4fab87e5dc", "value": "1536:T+aBMuFoUEgyFcZGSWY/aKVv76SXIVVSr:T+CMuFogyFcZGSWY/bVT6oIVIr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652280604, "uuid": "da04f47a-7551-4324-8cf0-ad1cebd2674b", "value": 58652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652280604, "uuid": "e28512b4-9ede-4092-a303-e0477fbad567", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652280604, "uuid": "962004a4-9797-4cfb-a38a-8eb3487c5273", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a4de233-d154-11ec-8e58-42010a9c0032", "comment": "Malware payload (FormBook)", "timestamp": 1652291995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652291995, "uuid": "b4f2da89-6780-4367-8316-380d89641e2b", "comment": "Malware payload (FormBook)", "value": "ec296d625c976a4aaddc706e63d1d413", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652291995, "uuid": "74ce3fa8-1cf4-4855-9ea5-13548317ca0d", "comment": "Malware payload (FormBook)", "value": "0a4a31c38a5ea9eb589521b2839b995e0270e6dc07405fb27dabd01d18d90b51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652291995, "uuid": "f1343e5a-9999-42ad-be68-3cab407addbc", "comment": "Malware payload (FormBook)", "value": "c1e5925482c014444efa1695930095aea073af76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652291995, "uuid": "69ef7644-b3b8-47de-8d22-a3957bda4e29", "comment": "Malware payload (FormBook)", "value": "5136df9a0c65855ce563162c7ccf11c4409f12aa02ab63dc4c98744744b8003c9544895244b7a244a3fd243ea2cdfc2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652291995, "uuid": "5462c121-bd19-49d6-a086-4f6d97fe93ba", "value": "T11AE40118F2EAEB12F0BE6F7690F9501453B8BD0AA533D30F198C164E5E537930A91B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652291995, "uuid": "4f4c6bb9-9678-40e1-b652-950a56bbe457", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652291995, "uuid": "f0b29d4c-5ad6-4ba4-a918-6200d6637a95", "value": "12288:KCpipAVIHg8RvpTaK9mAoE+PdFOFImOlyC43SPKZd2Pp:KCgHLeK9bFNUnhb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652291995, "uuid": "33a79347-6bb7-4f5d-b643-3f1f61a11d75", "value": 669184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652291995, "uuid": "dd1ca7ac-2c03-412a-bdfc-14604f3b887c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652291995, "uuid": "ddf4bc49-b169-4516-9f5f-bfaa0975298f", "value": "SecuriteInfo.com.W32.AIDetectNet.01.20360.29913", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90217073-d146-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1652286153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652286153, "uuid": "a015250d-01fd-4d0d-b406-a544f1511935", "comment": "Malware payload (AveMariaRAT)", "value": "c29c58206e113f5e7c9068c38c3e6a5d", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652286153, "uuid": "3b238ec7-823f-446a-b6a5-f6a7426cc8fd", "comment": "Malware payload (AveMariaRAT)", "value": "0b2bfb9e06a4a926b8cba73fe9e9dfb793bb37b6d153cababbf33db1757104ba", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652286153, "uuid": "a4b27419-ca19-4736-afbb-895639b6b639", "comment": "Malware payload (AveMariaRAT)", "value": "7499b92bd22ac449768230c48bd00ef41779a74a", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652286153, "uuid": "7eefc606-7dec-47e3-bb0c-8fb5c5c60177", "comment": "Malware payload (AveMariaRAT)", "value": "32ac64d2012983eda1cb52e0f3b4120d53c1fb97932f3c9f2e938f1456ab48842c1fce3b082cf63898610c1a0eb42fd4", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652286153, "uuid": "baeb61ca-a349-4d77-81fd-9152d3d8b33a", "value": "T153C40218B6EADB16D6FD3B3AD0FA501407B5BF06A037D70E2088124D5E5B3A74D817AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652286153, "uuid": "4fba552c-329b-4204-9982-7f3fa4f6c800", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652286153, "uuid": "3f6f1ff3-3f60-47a2-9d72-cb99f979b358", "value": "12288:7Ktokh+MpcpBYILcepjZh6Clfe/VcUXBtfcM8Hw7WJmCPKlp:7K2kh+MKHYYc0l2/V9XvcM8HaPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652286153, "uuid": "cf3b5205-3774-493b-9190-0d3a1f362098", "value": 577536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652286153, "uuid": "2e00e740-4b5a-4b0b-af70-14ce3c8ce9f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652286153, "uuid": "2d72c097-2dce-4ae2-95ba-f31f5f141dd1", "value": "DHL0011100001110011.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc836908-d169-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652301260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652301260, "uuid": "f499ed1d-dba4-45d8-a5e0-2974757d581d", "comment": "Malware payload (RedLineStealer)", "value": "f79cf3a06b1198214c9c258beac6853a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652301260, "uuid": "25401d31-5399-496c-b342-b03eb3928f57", "comment": "Malware payload (RedLineStealer)", "value": "0c20d0148493e6494e468c0888664a6858ed5120a13d4e938f5cf6bc9d009f57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652301260, "uuid": "c3a1bef3-1d26-45e5-9ee2-7e1bb2f3c1f0", "comment": "Malware payload (RedLineStealer)", "value": "55171b58a1935180cc5864254940c093a664969e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652301260, "uuid": "7973f50e-8df2-4f91-90c7-5d9650843b09", "comment": "Malware payload (RedLineStealer)", "value": "0b42dbf2dce9701226cd105d3c0c7e2f660f4e5dee30e33a9ec05cc9d626c0601a5db406815479aad3f295eccc714669", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652301260, "uuid": "f8248121-ea59-46dc-8c99-89d55f9474c2", "value": "T18F556B938301531FE3827435C0DCAE35720A56702A2F7C976B145BAEDB2B2C15A79F9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652301260, "uuid": "d927111e-04d6-4496-9da8-80a744cd4949", "value": "9de116a58a6964e888a644a836e6e83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652301260, "uuid": "65c6f0e6-8dd5-476e-a147-a4d86481c5ac", "value": "24576:2DBo4GNLlxXuj7ZhnWaTj6TpLOyqYxbx/zTrOR27AtDFnuZm5mfqT9i8Xm8WoZUx:aBo4YjefPgpLMYxb1+2UXnC7fqQ8Xuem", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652301260, "uuid": "748fbbf8-f9d9-4de4-98e7-00002431a3d5", "value": 1400288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652301260, "uuid": "849272d6-722f-4aa0-b241-562beb040ec3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652301260, "uuid": "35064e92-0eeb-4a2c-a049-e00d31d83197", "value": "Elden Ring Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed146fbd-d13d-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652282444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282444, "uuid": "8dc7769d-726a-49ec-ac40-5af70432e4a1", "comment": "Malware payload (SnakeKeylogger)", "value": "c70d8f28581213471551c0b9708f5646", "object_relation": "md5", "Tag": [ { "name": "lz", "colour": "#6CE4E4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282444, "uuid": "05add995-821f-4e3d-9586-fdb8ebd35aec", "comment": "Malware payload (SnakeKeylogger)", "value": "0c59865692215c67235016edc20ed18e8e31e469ac1a7ae9402a243af9d9dfa4", "object_relation": "sha256", "Tag": [ { "name": "lz", "colour": "#6CE4E4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282444, "uuid": "bcb91eff-dfb7-4055-b180-49735361964b", "comment": "Malware payload (SnakeKeylogger)", "value": "5ffa1177853080a5298503a3d438d4ecbdd3f749", "object_relation": "sha1", "Tag": [ { "name": "lz", "colour": "#6CE4E4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282444, "uuid": "bc6fde7a-3c43-4ea2-8c6e-a0a898a43887", "comment": "Malware payload (SnakeKeylogger)", "value": "1b6be4cb7a63e1792db5c85394bd98d4e1692d8dd0b4d426cb9d757f4f46dfa37b84dd8f3de728be19a69af6fc9d58ec", "object_relation": "sha3-384", "Tag": [ { "name": "lz", "colour": "#6CE4E4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652282444, "uuid": "bd2f8292-ec56-4c94-845b-a6c4ada26b74", "value": "T190B42393EF94E9627FB188122767B7950DE7C590D5C2B900ECB8C22253C1B4EEB78B45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652282444, "uuid": "bf13ff9d-8782-42b2-bf7e-8ca32c6c647c", "value": "12288:vP6sPwSjyj0fKKFsoMABCtH5iMCZMYKJNu6NppiM4SIr:visPpuj0f9FsoroIMCWNuV3r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652282444, "uuid": "245e66dc-5bc4-4c4c-a81a-bf8896199996", "value": 517285, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652282444, "uuid": "4cb71096-06e4-4547-ae4e-121311f99a56", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652282444, "uuid": "340c6eaf-4e9f-4eb8-a70c-b25c6fb23685", "value": "price offer.pdf.lz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c537df9f-d104-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652257896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652257896, "uuid": "1e5a6330-15b9-498d-814a-d3ad97d4d2aa", "comment": "Malware payload (RedLineStealer)", "value": "45e6027bb48e1e40f2fa9754f1d8f305", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652257896, "uuid": "d32654d5-84d5-47b1-9739-58250024511d", "comment": "Malware payload (RedLineStealer)", "value": "0d3658c6008c73e83032157ea86c0dba932dc7cac226e666d25f7de0b20a4aea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652257896, "uuid": "ef53a29a-ac6f-4289-aa13-15bae92b1ba6", "comment": "Malware payload (RedLineStealer)", "value": "8030d12d0fbdba15515501443a55bf9c6c5b15c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652257896, "uuid": "3ea38a18-f3a4-411a-a3b6-ce983bed6778", "comment": "Malware payload (RedLineStealer)", "value": "acd25e71d5520cb258c446bae7efd658fb2c7b6f0e3d74a364655b69d14756b1f29ac694e291a18734284a640cd207f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652257896, "uuid": "0c93a8f3-029b-481d-aa6d-cf9b316eadb7", "value": "T1A304BEF0D489E093CB7CB63DBEDF59A106265541937E4AFF591886E00E8B35200E99FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652257896, "uuid": "334f4291-0633-4fde-9577-9ef5808b33e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652257896, "uuid": "a3500bda-9958-4a9f-9a7d-c127d41a8f21", "value": "3072:KQ8buj3rUehJgJ6e5Iowzlyv/tjhsT6ljY4uaB2tx7sOIqYps0Hk:KQ86j7UehJgJ65oiCFjhdpY4urtx7sGC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652257896, "uuid": "5095b087-5ad5-4408-98a5-c2b6802a89ca", "value": 178688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652257896, "uuid": "a34b0279-6ae6-4e12-addc-5724fdceec10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652257896, "uuid": "9f6b672b-d834-4527-bb5f-f387e841d0c9", "value": "45e6027bb48e1e40f2fa9754f1d8f305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b029ea2-d150-11ec-8e58-42010a9c0032", "comment": "Malware payload (BumbleBee)", "timestamp": 1652290440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652290440, "uuid": "ea3b70ce-9f2d-4316-b74a-30c261562bbc", "comment": "Malware payload (BumbleBee)", "value": "81f790dea35027f8e963d46fa7a0f42e", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652290440, "uuid": "76f3a998-48d4-4ca8-8f38-5b0c52931bfe", "comment": "Malware payload (BumbleBee)", "value": "0d740a348362171814cb314a48d763e336407904a36fa278eaf390c5743ec33b", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652290440, "uuid": "1b3b764c-c642-4642-b12d-71c19ea347e0", "comment": "Malware payload (BumbleBee)", "value": "72d2dd08c371b91a4aa20f582b7cfb4bab60ae75", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652290440, "uuid": "0942c1bd-cf77-4e61-9a47-40d5da5d5563", "comment": "Malware payload (BumbleBee)", "value": "d4e5f1838b08495180807616b65278459fdb54f749c3f2502e308639cf2dfe2c91ca882b64a4f57aea30560233f321ea", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652290440, "uuid": "579d1eda-f6c4-4a11-b06b-fbd63ed64585", "value": "T10D559FD763EE3861E2C0A57786847579483FB76B85E327E82E564E3A1F284107F70E24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652290440, "uuid": "cf79ae38-6580-467c-897c-95e23ed6c73d", "value": "24576:PSjYvwTRvpA44SNKeysw9VJFtyzDf5WF313pyLS9cUGt2Z8gUHc43Zx:PSjY4TRvyem9VJFAXM7pGDRt2ZxTqZx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652290440, "uuid": "0b3b4ea8-49dc-47aa-9bad-62f5efc76c65", "value": 1306624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652290440, "uuid": "d930a553-4249-4eb9-b7e2-f9db549a203a", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652290440, "uuid": "3e7a9e27-d495-46bb-a45a-b7e0253b04d4", "value": "Wolseley IG project_details02.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2b2eeff-d121-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652270374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652270374, "uuid": "661291f3-a3cd-46c7-8a95-4b533e12090f", "comment": "Malware payload (Formbook)", "value": "43f4cb99c87c5cb01705ae73fcd0680b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652270374, "uuid": "9b9a0ed3-fec7-4dde-bf5c-06980754571e", "comment": "Malware payload (Formbook)", "value": "0df7f1a2806492968e56fab8298a3285a1663c83827cf5f9ab053aee46675a0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652270374, "uuid": "ce9a9536-8801-4b52-a84f-dfb904076e48", "comment": "Malware payload (Formbook)", "value": "64387a06fbad1e4c3f9db91f3e21f2edfbf70815", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652270374, "uuid": "a7f25eec-6954-46f7-b991-51a3a13e50c6", "comment": "Malware payload (Formbook)", "value": "2940001b85bc4de1b651be59eed58727f19c455c7acfc4426ab2196c4443d203062da5d5d0df0962ff5f0dcc8e7d9970", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652270374, "uuid": "8cfad40f-423c-414b-851a-d83b2e2eabc5", "value": "T1B6D4021CB3E7DA12C2BD2F36C8F5442557F8FA499137E30E26CC260D6A0279B49527A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652270374, "uuid": "7f28a489-bb6d-4dbb-9a4b-5255da1f31a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652270374, "uuid": "03686c8f-4ae6-4d90-9d78-111aff50c0cb", "value": "12288:riGupKpy66wk4jmpcxwGVmDT2Uhkv0Zk4OFO6U3LQlVt/Dip:rixsQ66wxjmpUpVmDaUOv0u4LQlHi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652270374, "uuid": "78fb7f5e-0dfa-4a83-9170-bc161838b7fc", "value": 652800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652270374, "uuid": "dfee688a-b695-4b93-b0f8-7916ee6256f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652270374, "uuid": "ddac190e-4137-42ac-9ac6-fccc75402453", "value": "SecuriteInfo.com.W32.AIDetectNet.01.23560.555", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2894268-d10b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652260898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652260898, "uuid": "315bf993-3694-44ea-b38b-19182420c45c", "comment": "Malware payload (Mirai)", "value": "c9b8887faff7c072a8da9309bb027367", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652260898, "uuid": "46dbeeca-212e-46bb-99ed-fa5f403c7fcb", "comment": "Malware payload (Mirai)", "value": "109e4a1bdbe3c1a3642666659e1dab51b7ac8345bb789c103e2b16d4f4fbbe2e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652260898, "uuid": "a3136bae-bf95-4b12-9817-839e35ffcdc4", "comment": "Malware payload (Mirai)", "value": "593a213c617420c851737cbc11d50a79a7af5f56", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652260898, "uuid": "ecd68334-55fb-400a-9cca-94235a692610", "comment": "Malware payload (Mirai)", "value": "5212ef4691ff9585343d86d2f01c68eeb1774f67c7dab362f1644b41e0337b218a4efe7ec505de0eef785ba96a9bcf18", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652260898, "uuid": "d91bc0d1-6bb1-4fdc-8f23-9c3587c89de6", "value": "T193633C46FD909613CAD246B7FA4E42897B2A13A8E2EE32079D266F5137CB45F4E37041", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652260898, "uuid": "a5c4cdc2-07ab-41c7-97c1-9067192f2a78", "value": "1536:LTtvFVfcIm6nGKbTHuHn27DKA28ZvRy+g1sQin8mc1zldQ:vPVvGKbTHuHn0DK1ik+aninRMnQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652260898, "uuid": "2122931b-ff9c-4c2c-8393-c587cc5384e5", "value": 71352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652260898, "uuid": "92717e4a-b7d7-400a-a15a-246dfc4ec2c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652260898, "uuid": "80a9d07c-1062-4999-85e6-c3994c7bcc2d", "value": "c9b8887faff7c072a8da9309bb027367", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fb82980-d163-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652298608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652298608, "uuid": "75a73e82-0459-4384-9be2-935d5bda373c", "comment": "Malware payload", "value": "fded428462929e0bf602322946fec6ef", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652298608, "uuid": "98b285be-8337-4827-a97f-cc22f86e8d0d", "comment": "Malware payload", "value": "110fe349fa6c312528ef6eda220f65e4877d691f818f724c7ef6d17b6e59755f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652298608, "uuid": "4e91b76e-cd1c-494a-97c8-419ed9420ebc", "comment": "Malware payload", "value": "037cdd8e3722689ee6fa98e7c387c3a6e16e58ed", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652298608, "uuid": "fa7cf6e1-5f52-4019-95d7-18d53255d6be", "comment": "Malware payload", "value": "7368ffe74f9bc7a030d5a359bd28f5519bae3a277aa37fcb39149de0d5de2ae4a1b48a7885bc90a70b00a94d30d516bf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652298608, "uuid": "89e2dc0d-3690-4d81-a677-40a49c3a328c", "value": "T140F2E124B317DC93D47846F6ECB38B4B2271C2A7A6BA37F54531A1188EA20D3BD74155", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652298608, "uuid": "4e66d8bf-5f82-4f8f-b6da-8c90eeab8233", "value": "768:uO4cZsn1INUixYhLsZFqqY7lUqDk+cj9TbvnRQcg1uon3Cr77I3U4:4cZGIoh4PqT7lUdj9TbvnacC3r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652298608, "uuid": "a3d7673a-e653-4769-bea5-4687b3c5ec75", "value": 37164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652298608, "uuid": "47e50960-cfb5-4188-8a9b-2d7f63873380", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652298608, "uuid": "d059529a-6110-4344-b186-3a14eb48a6f3", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c692aaa-d0f9-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652253076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652253076, "uuid": "1c2c41b4-bc70-4108-a45c-6da78fb2d568", "comment": "Malware payload (RedLineStealer)", "value": "9bd45cd6e09bd084176af96760509d7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652253076, "uuid": "0050a1d8-3cd8-45a3-be7a-425b37df079b", "comment": "Malware payload (RedLineStealer)", "value": "132f7874d3c91ebd406c6cfab4a4bfe19c3b8b126e15a3002128d7d4b1eae3d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652253076, "uuid": "4dcfc9c6-c6b4-4f7a-a491-087cd8754d2b", "comment": "Malware payload (RedLineStealer)", "value": "73237f01f80eecfe9df58b9f4db58c091e56de92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652253076, "uuid": "8cabbd8c-5649-4476-ad8a-ecb77b7ead64", "comment": "Malware payload (RedLineStealer)", "value": "968721d9e518c72e9d2304fd47964f0ced071d1c20df3d4e89fca6b6c54a03ae687e46295f535ed337f11f6dc30c0d74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652253076, "uuid": "91b86004-365d-4596-a2a4-da5d11ee03f6", "value": "T11184CF04BFA0D034F1B712F4887AC6A87A2D7DB15B2454CBA2D93AEE56356D0ED3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652253076, "uuid": "ea09a8fe-cefc-4de1-8066-13e28c134e64", "value": "03d741c0997afad4183375be70028b61", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652253076, "uuid": "f05869c0-cda8-4cc2-9305-5f21d062ccd2", "value": "6144:myH3Fg+QMzPkLukDVOOSPGpuvlCkC04I5sNRQC0EafImVGfOWNSVs/8G9WTwD3o:va+9oCkDVOOSPGAlPALQfVNWNSVrG4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652253076, "uuid": "bca7ef60-f9db-496a-b317-baa268ea406d", "value": 384000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652253076, "uuid": "137e3530-fa69-4dba-831f-4e969a294e3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652253076, "uuid": "95db4f3f-da04-4b76-b705-22b9d691738a", "value": "132f7874d3c91ebd406c6cfab4a4bfe19c3b8b126e15a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28f090f4-d0fa-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652253338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652253338, "uuid": "79d9c8d0-b078-4f69-aeeb-dd4fadab4112", "comment": "Malware payload", "value": "13bb0e82b70434eef4d56050b432735a", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652253338, "uuid": "f667dbfc-322e-4edc-94fb-dc3dd89987cf", "comment": "Malware payload", "value": "13ba7a7b47471e8a7e396895a950e0fa23ee781b0db8dd549f4bc7ab46991d78", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652253338, "uuid": "ec446a80-29a7-45f7-87ee-3792abff62c9", "comment": "Malware payload", "value": "49c9502b979e98762169738c6114fc28d1bf7074", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652253338, "uuid": "cd9746ec-28cd-4821-a45a-095451061ba3", "comment": "Malware payload", "value": "d0f97653b1eb6a6789e707c2fd7ea477caf7dac12ee8f61d4887c963ad90345e97a61d6c824e68216b6420d4a4889695", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652253338, "uuid": "aae0dc0c-3de3-4879-ae57-934b500e3fa4", "value": "T162D61253F246623DD4AB0A358A27BA50DD3B6B61A6469C2F47F008CC9F355C8293FB17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652253338, "uuid": "a5d5ec2d-787b-434a-a106-ab8a3afcd6b2", "value": "9a9b5139acb4817e84ebd4912972ad01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652253338, "uuid": "11cb0c03-62a3-41e3-b48b-e560f73492d6", "value": "196608:lstz7ypoxtLXUWoUvD7PEpzoq6TxHmVfzFDOMu8pkx+XxGGdzlE:lsVupox6Wo4PEpzoq+mdJOBVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652253338, "uuid": "762c8374-c019-4712-8d75-13aa940ccac3", "value": 12812288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652253338, "uuid": "882e30de-5d28-4356-9e7d-bb2dd5fbed43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652253338, "uuid": "affc6a3f-4e58-489d-a953-c0fbb4b064b7", "value": "0830\u6388\u6743\uff08\u6740\u6bd2\u963b\u6b62\u8bf7\u6dfb\u52a0\u4fe1\u4efb\uff09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8efc43be-d163-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652298607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652298607, "uuid": "f8642eaa-cd8b-475d-8939-123b913069ca", "comment": "Malware payload (Mirai)", "value": "650098cec4e80e7f548981ad1b6b5454", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652298607, "uuid": "46d88890-3130-4043-8ee9-f0280220e1ca", "comment": "Malware payload (Mirai)", "value": "1401b6d26de8e36717ffc3af5e9e1a81be94b430724eb4b344c2e3d976cde227", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652298607, "uuid": "78625935-48bd-4303-8d16-fbd18826a125", "comment": "Malware payload (Mirai)", "value": "e0ffd7ced33f64208cbffc1e41d95d57069f230e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652298607, "uuid": "4527529a-fbce-4549-bf30-9a7faaaa692e", "comment": "Malware payload (Mirai)", "value": "a241002a0aefb6dcc08d8111afd3a7d97efd7844038530aa038d510c414cd3bf10690c2c42476b6f6546e23c392aab67", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652298607, "uuid": "d3852cb5-8da7-41ef-bfa9-3f5de231afba", "value": "T11DD2D1E3C5F61E54E2CE91321DFFBE9D4819862C808249BCFF78B07D7462759AA28311", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652298607, "uuid": "c5544bca-2356-4e88-b1e1-57f98a32a869", "value": "768:SovtjEfzImdIgdFdYFOClDTmnbcuyD7UryqO:fdazjI2ry6nouy8mqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652298607, "uuid": "393cca79-b88b-44a0-a329-32a7b18d0a9b", "value": 29776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652298607, "uuid": "6367cbbc-4d5b-40a9-9836-867db8ae0963", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652298607, "uuid": "f8cc956f-8288-469b-b7fc-2ce69339813f", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9165da5-d129-11ec-8e58-42010a9c0032", "comment": "Malware payload (Blackmoon)", "timestamp": 1652273847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652273847, "uuid": "963a0b7b-418b-4443-b29c-9855473f4f8a", "comment": "Malware payload (Blackmoon)", "value": "04f9f9265ebf716fb8d155ea311d7e39", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652273847, "uuid": "86f14c73-c2c2-4e98-a526-29abaeb9fdb8", "comment": "Malware payload (Blackmoon)", "value": "14096f9b01306019cb0f790402eab8be314a1332b6d9cdb0ccf35c56aed175b7", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652273847, "uuid": "5e1a972b-a782-48cc-8e83-98e77cf4a6cb", "comment": "Malware payload (Blackmoon)", "value": "a1d6b62a2e24d683cdd579a52cf1c862dc379bb0", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652273847, "uuid": "a21aea3f-d468-439e-8f93-5476c41b6a32", "comment": "Malware payload (Blackmoon)", "value": "fac7f0da0cf7d7d7a5e271dd095764df7ed056c6d13ba5639f0bd40de3b7389a10150ff0fae5c750dc1cf4cdbc9dfb2e", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652273847, "uuid": "f0c67565-7d20-4579-bb22-245c9a447e1e", "value": "T10645AE33B644F8CAE364207CF1B057603DF96A566C6C80DBAE915E293C7295B2E4770E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652273847, "uuid": "c7986553-ec51-4e54-bd86-7ece50cba852", "value": "4d2ad662f0a5e9d21ad01c4944f8cad9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652273847, "uuid": "d712ded1-9b33-45c7-aeb9-6f7e0267d462", "value": "24576:tgbQ9+3D+NwPhe/z2d1PzKJT+cxaBhZuGlMdFbURZPNxgVkuu2ZUZpYQTtu:2M0z+NwJZd5cT+eoZuGlMfbiZ7wvQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652273847, "uuid": "7bd0887f-9534-453e-85ac-4c73baeef7a8", "value": 1249380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652273847, "uuid": "ad48afa2-9eec-4662-9d95-5056ffd922fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652273847, "uuid": "289056f6-e870-4ac0-9794-06a820adc279", "value": "QQ\u622a\u56fe2022-05-07 203509.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7fd89ed-d13b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652281469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652281469, "uuid": "67ce92b4-0633-4716-8a48-c0787aab67b0", "comment": "Malware payload (Mirai)", "value": "11ae82e6f767938d4f8a72fbe4a3e5b0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652281469, "uuid": "edcfb550-f41e-4387-a923-2586373d51a6", "comment": "Malware payload (Mirai)", "value": "143a02927b786c8ede99e17bddcf18a257c1f323cbd54ad644d1188ec8e4931f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652281469, "uuid": "f8a5ec5c-d394-434a-9540-ae1a2b58353b", "comment": "Malware payload (Mirai)", "value": "cbb30badf18d07285975b1120550aa9c8889c2fc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652281469, "uuid": "affb72e5-9de0-4d3d-8ef7-73c0ac89926f", "comment": "Malware payload (Mirai)", "value": "5b1c647eb54cd31578009f380367ac6156269ed8591e60571e0c6f3c4dd43e8bae06039d8ef01cc54db4a95f4c2282ce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652281469, "uuid": "e28ab195-f6df-467f-ad9f-44135e054894", "value": "T1E1533AD9B4019E7CF5CBEBBA81620E09F931721160931B277767FE83BE320689C56D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652281469, "uuid": "853ebff8-9c75-4f55-aaff-6507121ea6ff", "value": "1536:F/JtX8DqNAGryDYS+BTfO7lJHg1p7HUqWPLvg6VlHB948g:FfAGmDYvMJqpgtDjHDW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652281469, "uuid": "38e9dca2-fb13-4f8e-a458-d037deb54f50", "value": 61068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652281469, "uuid": "07d5c110-76f4-4401-858d-98cdbda9c750", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652281469, "uuid": "621859a7-064d-4121-8153-f76477cfd680", "value": "11ae82e6f767938d4f8a72fbe4a3e5b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5305e86-d0f9-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652253252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652253252, "uuid": "ef40a179-bc3a-4054-9b52-1dfbd0d3d918", "comment": "Malware payload", "value": "b21f0fb286f616dd500a2be35df1c126", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Magniber", "colour": "#9269C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652253252, "uuid": "fc18e8d5-792b-4e9f-8bf4-75fe50e436f1", "comment": "Malware payload", "value": "14dbcc8fc713a26f46b78ba0bc169eb4abdd6083a4bbf62357e83b989489c358", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Magniber", "colour": "#9269C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652253252, "uuid": "7f5a75e9-7fbc-4a75-80a6-1951fa54e59f", "comment": "Malware payload", "value": "062992560fdf03e31ccea3d8e8078f500d615f1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Magniber", "colour": "#9269C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652253252, "uuid": "5769b7fa-18e1-4fb6-b9b7-2a4bb3c1eb2f", "comment": "Malware payload", "value": "7822919d0c1bfa95978efd72cf68cf32f3772e11ed9ca5215fa02658ce37707f9bb8a1b2a4da5b542f8f80bbc2626807", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Magniber", "colour": "#9269C5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652253252, "uuid": "5815fa06-b139-4af0-b6e2-b591aaef3bed", "value": "T156455165B3D518D9C377EA3FA5806ECB71EBC6C7470F01126205A586D089E0B6E8B72F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652253252, "uuid": "3936b027-f560-448e-898e-100fa84d62b4", "value": "768:63ZUHcXDMNEtmaI88bMWH04fB+UMRp5VVhV/APZ131vTf/5PFXX3XH/RTpjNBNdf:8ZUHcXQNKmaI88gWHDfBQw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652253252, "uuid": "8ca86ccf-1228-4f2c-a1de-abf019715249", "value": 1197568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652253252, "uuid": "49a253ed-65ef-433b-b2ce-ca704b7ac702", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652253252, "uuid": "91d1c4dd-bfe8-4b21-b36e-515877220438", "value": "Binaryltamwpuw3rs8k.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afb99b1d-d13c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652281911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652281911, "uuid": "00133006-1e63-4831-813c-e40cd13b922e", "comment": "Malware payload (Mirai)", "value": "affcd3e5d17b753c8560c7dba5707295", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652281911, "uuid": "4ec04d0c-a271-439e-ba32-bb41f0bcd566", "comment": "Malware payload (Mirai)", "value": "15b36a9e4b2a64c63e5413b46f2cbec76d77742f0cc8cb618559be8776042940", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652281911, "uuid": "93e316e0-93cd-40ff-9599-ed7cf1bc961f", "comment": "Malware payload (Mirai)", "value": "1a54fd4e38e48c57e6b307072e88af33f0ead09c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652281911, "uuid": "1e96a2be-51a1-422e-b075-b27ae17dc4ec", "comment": "Malware payload (Mirai)", "value": "7f8d7c817db6320af4f044f6813998de22ddf9b10e13fea6f5b88469509b51126e424a7bdf6ea99064457536d762250d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652281911, "uuid": "caff0b57-5ed3-4ab6-931e-cf0860b4257c", "value": "T1FF43AEA1C0A9ACA8D64845B8B614CD3E9323E00456A33DFAD65AC756F04F9FCF41D3B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652281911, "uuid": "b395839c-4f58-4254-a2c7-4a284b246b34", "value": "1536:e/IlPAgaaxEwtMw3Eo7s1vnhFfs3/bj1LA5yCzCOy:eAl4/Be3/7s1vXf+DRAQCz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652281911, "uuid": "67383cd2-7ba9-4091-bd38-6e08a741fc30", "value": 59296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652281911, "uuid": "eac52b0f-db02-47a5-aac1-ae1e0cc49843", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652281911, "uuid": "5d39e9d1-a66f-4089-92ee-acea2c8c64a9", "value": "affcd3e5d17b753c8560c7dba5707295", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24ff8dcf-d11c-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652267935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652267935, "uuid": "b1d4877f-c649-4902-ac4c-bc0d2dc03c89", "comment": "Malware payload (SnakeKeylogger)", "value": "f20ac8e1693d17c15a5485b10be6f846", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652267935, "uuid": "4875645e-221d-46cc-85aa-60edbaa6ef49", "comment": "Malware payload (SnakeKeylogger)", "value": "16877fe05ef87c7ddd8437e14cfce8304561bc90ef8111cf173d15fbbcf57ec3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652267935, "uuid": "fe43abca-27db-48e0-9a60-b20721324542", "comment": "Malware payload (SnakeKeylogger)", "value": "135bb58cd307f42694ee68675c61283af4b551cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652267935, "uuid": "edeb1731-6ad6-4ffe-b5e0-f0ba03d063f1", "comment": "Malware payload (SnakeKeylogger)", "value": "80fcd14b2dcf22352d5b7e1a07c94740faf440140ef4858916d9197791698c72d35b769fa8860b8342f42f93d9c07e3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652267935, "uuid": "0f133a83-372c-49cc-8e85-7a3b5ef66e0c", "value": "T1CE456B0C47669601CC9446B6FDB627A73B73C7BCACA24B1B1A81313A9817FAE5D40DC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652267935, "uuid": "9d626ea6-9aa7-478f-8214-d9d3f6133777", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652267935, "uuid": "cb526cd2-6b24-4ef1-bf58-326c67b414f9", "value": "12288:ihPwElWiVCAUAUDNrpMssTOkrCM1rRLMBo6BRKjO90DcSj4u+1PBVQUmEiDbukz5:Sl6P9lpMHTL+MpgXzKjO9NtCl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652267935, "uuid": "04d27011-a51a-46bb-8a3e-68873e788598", "value": 1229312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652267935, "uuid": "af87e7c7-c39f-45d9-9ecc-0cbb11395c8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652267935, "uuid": "626a6756-941a-4867-91b0-85fa4509e73e", "value": "Inv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc5a58c1-d10d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652261800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261800, "uuid": "c423bcf3-baa4-4c8c-b65f-58009139c57d", "comment": "Malware payload (Mirai)", "value": "5e75d0f9cb28cfdb83fca924d13f203d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261800, "uuid": "8af0c6c6-7cfc-4ec8-8a8f-bee7edee69f3", "comment": "Malware payload (Mirai)", "value": "1767503571958c5efd87c3b05a7ad3c1460f5ea4fc8115ecdd00d2740ef413f9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261800, "uuid": "1ad3ae5c-e876-427c-b190-15312823d9a3", "comment": "Malware payload (Mirai)", "value": "98d06088cd5f9c40df5fbf3caf9983e64c726e74", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261800, "uuid": "2df6c532-4a66-4dff-b8d4-7609b3fd399d", "comment": "Malware payload (Mirai)", "value": "45adc43868ec0c8b094d48126032dbe3932d3d44d1f8b14be0418218f51213f9450a9d3c5d923790d832a00be51763f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652261800, "uuid": "0b1c0e44-6cd9-4dd6-a87f-97ac16541257", "value": "T1D77319827C81AA26C7D017BBFA6F108E33156BA8D1DA73438C155F5577CA80F0DA7B86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652261800, "uuid": "00dac650-9c30-493b-a1cc-e43e00248734", "value": "1536:ufzomOUDUrqVC+Oe97OBo/qMH/HMBLpJeZWaeJ8M:ufzomOUUBLTwnsl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652261800, "uuid": "2a9af240-0638-45c5-aa30-beb36a5fce23", "value": 80280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652261800, "uuid": "73316d33-94e3-48fb-9c24-06872e7b8345", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652261800, "uuid": "6c62238c-6635-48cd-8f7f-c94d0e0a3df4", "value": "5e75d0f9cb28cfdb83fca924d13f203d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2f6d9eb-d133-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652278105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652278105, "uuid": "0c495a3c-cc5c-4249-8512-b56da9c38c15", "comment": "Malware payload (Formbook)", "value": "7b2abde77babb8daaec320d09c98caf0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652278105, "uuid": "00e1dbf6-c19c-423a-bd32-c5145ea0c3e3", "comment": "Malware payload (Formbook)", "value": "17c87a1bd3533a6021d796cc76ee966d6fd9e80581b7add6a2d1e719621f31a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652278105, "uuid": "8f2942a8-809a-4e46-9766-613d11181820", "comment": "Malware payload (Formbook)", "value": "727e51d76284fe1b0755e555dedfa83ca0a43499", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652278105, "uuid": "0e90b791-e10e-4ec4-b51b-dbcb401f1ef9", "comment": "Malware payload (Formbook)", "value": "283897786c92d6cdd487cb5b3b9ffc31fcce0164a71738fc071dfebe968574d4640a0b1888d20afb8a69779f6ec5cb71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652278105, "uuid": "cbf71164-7da7-446f-a912-bb4d38acba04", "value": "T109355A62B2E1D837C4725A785C067E755BB5BD10ED38A8066AECECC85B34ED13B21393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652278105, "uuid": "bfc98142-2219-4a6c-995d-b9162ab01135", "value": "a394cc215dbb58f1799a34551bb75374", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652278105, "uuid": "7d39fff1-9068-40cd-a232-39c9d98d2384", "value": "12288:vxx+UPkKD0b5PK/Chm9pbJh8k4LYIZzUzs1WHmVDIF5+RgML9r4FKI4/8:pECA5PKKupbJhqEIZzymVDJvwJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652278105, "uuid": "7641daf7-f5a2-4c20-9528-2c2b51867170", "value": 1146368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652278105, "uuid": "ab71e64d-7c01-43fb-ad4a-eb8d72384b6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652278105, "uuid": "680c6f5c-1853-4e37-a070-934de32bb60a", "value": "Comanda atasata.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efd65fcf-d10d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652261833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261833, "uuid": "878a01b4-794d-4519-b0f9-fc44d0ad906b", "comment": "Malware payload (Mirai)", "value": "a068c6ecf6247241b21706a8af49f2ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261833, "uuid": "0ea13cac-2fe4-4445-be07-a01ff7c58dbf", "comment": "Malware payload (Mirai)", "value": "17f8b9b0969b3bf47883b0de70a9596cab9525414f138423559795fc802b1f94", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261833, "uuid": "58ce23bb-2029-4c5c-a32b-955555b05b52", "comment": "Malware payload (Mirai)", "value": "ede9806aa0e517eca8c2fbb6b936edd70efa3eba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261833, "uuid": "b28102af-81bd-4de7-97e0-530fe183e221", "comment": "Malware payload (Mirai)", "value": "11eb80c48b083cb3d675738336b5c0bf256f9a8a792134515f0a3ec53caf44a3fb5b9a11c7e82cf657cab8fc9c2b55be", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652261833, "uuid": "b90d6888-aa2c-4f86-8f07-f477bc88083e", "value": "T1CB63F9827C81AA3AC7D017BBFAAF109E3350ABE8D1DA7253CC154B5176C650F0D67B86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652261833, "uuid": "1b6eb79a-5e72-47e4-b8f8-2f42041e14f4", "value": "1536:rvpMPHug5RlFyZS/l+UAuYkpzg0FS0ykFShYceZWYCNqxEM:rBMPHugc0lFSKcwcUt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652261833, "uuid": "81062311-566b-433a-bf5a-7ab9a00935ea", "value": 70872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652261833, "uuid": "dd342832-4844-40b1-bb4e-8b4ca5f73bd1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652261833, "uuid": "c198dc61-adec-4d1b-bd65-7c3a486db742", "value": "a068c6ecf6247241b21706a8af49f2ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49980e2e-d13f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652283028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283028, "uuid": "518e1ed2-36d9-42dc-95ac-2507f5780142", "comment": "Malware payload (Mirai)", "value": "ddee797fee42d80a868f6754f8d58f2e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283028, "uuid": "b6d8df38-9066-4a2d-90ed-e631f5c67410", "comment": "Malware payload (Mirai)", "value": "18394c911dd3b56abd2cee7bf9b36ce62cbe21430038885ffa0c4d16ebb80c03", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283028, "uuid": "33a309cc-feb6-4d0b-a325-1a43046bbf75", "comment": "Malware payload (Mirai)", "value": "00b9c1a0cfafceb79a0ec2a1c985f9724d6464a3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283028, "uuid": "f38b2093-6259-4637-af08-36895d808b96", "comment": "Malware payload (Mirai)", "value": "b91db03eab715762d734a9ab5d9f7b5b2716ae3bd7d3c2ed750b7b13c24fefe84e646ed166a5d6122274ee29cc6d8aae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283028, "uuid": "16c0015b-205b-49f8-8dbf-d1014e74dd1a", "value": "T15C93734D3E219F7DFFAC823887B75A21A64823DA66E1C585D05CFA021E7034E741FBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283028, "uuid": "8f80d6e3-80f5-47c5-bd1a-5c806daaeb91", "value": "1536:K/YRdrDd6C6gb/ZVyDYjMbwqZ9f0vfwW9ufY1C+KBtyRirfXDOiOs38:KgHrD8/gb/zyDv9f0HD9FC+KBtyR6/D4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652283028, "uuid": "435ad9e4-dae7-4636-ad04-26d012c7f3d0", "value": 89332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652283028, "uuid": "487d21f2-200e-4d2f-be08-803342cc18a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283028, "uuid": "14b64dac-b6f3-42b1-a714-ae7cc7563751", "value": "ddee797fee42d80a868f6754f8d58f2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3bd9127-d105-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652258403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652258403, "uuid": "04c2f63c-0579-4c61-aad0-b2a65ae32640", "comment": "Malware payload (Formbook)", "value": "e4ff99e7542ea17d4e3d84cd7be4f020", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652258403, "uuid": "2b215fba-c11d-4593-98ed-212d96df0320", "comment": "Malware payload (Formbook)", "value": "19364abe28c03c6d69f26c105546b9ff360900b613f06e3fe28c35365c3c6bb1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652258403, "uuid": "25c631f8-bb5f-4fef-8192-fe12a60802c7", "comment": "Malware payload (Formbook)", "value": "65519a2a193af5ff1d7939b0589cbcfdac2fbf57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652258403, "uuid": "c99436cb-59a6-472f-abe1-24942181c240", "comment": "Malware payload (Formbook)", "value": "323a89e041eb21a9652b311d7b1023b3aab8b5001a9009b00583b8f622f1b3054a205d25bb6d03fd9fcf28de7913e235", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652258403, "uuid": "434f63c6-0cd2-48d9-b735-d3b66741e3a6", "value": "T14C353962B2D1D437C13206785C063EB65BBA7D10ED34A946AAECEDC85B35ED03B25393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652258403, "uuid": "5ce4b0e8-3bdf-4661-b703-1a76c4a79736", "value": "a394cc215dbb58f1799a34551bb75374", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652258403, "uuid": "8601ba78-4bb0-4f24-ae80-dd6f102540a8", "value": "12288:vxx+UPkKD0b5PK/Chm9pbJh8k4LYIZzUzs1WHmVDIF5+RgML9r4FKI4/8:pECA5PKKupbJhqEIZzymVDJvwJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652258403, "uuid": "5654a1dc-525b-46e9-8060-7f2ca08948fe", "value": 1146368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652258403, "uuid": "62f81079-d9e9-4e33-bc9a-32aba0b86159", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652258403, "uuid": "14818898-f26d-4a0b-83d5-1e436eaad597", "value": "SecuriteInfo.com.Variant.Zusy.423667.1117.15766", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddceff76-d0f0-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652249347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652249347, "uuid": "4ebbc872-7dca-4268-ae59-4061d4d8dc23", "comment": "Malware payload (AgentTesla)", "value": "07b9fae9ce35e8ad22476a7f4f08df95", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652249347, "uuid": "048dbb8d-4655-457c-a7fa-31ce73cc60c7", "comment": "Malware payload (AgentTesla)", "value": "194cdc48ee3eae3ad3c46197f6fac0a1d9d4dcf860c3c9360d92046614295e18", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652249347, "uuid": "59b025a3-3dbe-44d4-8b84-f45305db7f9b", "comment": "Malware payload (AgentTesla)", "value": "0b0d54af545cc59947166aff1fb2bfe4070315fc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652249347, "uuid": "f80d04b6-766f-4310-b52d-8240ec4e9713", "comment": "Malware payload (AgentTesla)", "value": "49607b9132a5ef198947e607272ac704e63f0ccc83c96cfa4c8ccd037a08ae1f4e23b1e0e54976971d7520c61811ad96", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652249347, "uuid": "afc4a9d5-6bb3-43c5-ba29-34ce9dd9e7e0", "value": "T1BC9423520BA2535142F903B36F8895A9EAA129E5DFEC4C7F133060B1D31D68679C8F9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652249347, "uuid": "2496a4a5-3f0a-44cc-be22-eea94201ccca", "value": "6144:OwNYEY9jNsMFXerOMQ88Ett70Jny3kFYkGZ4H6yiXyh/pYJw0KFYlnvglLzqIN0f:UHFXeh8cIie3FHRR/pOllnM0gDXGeQx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652249347, "uuid": "fbb3d23f-162e-4b5b-a29a-015d47b8eae8", "value": 440942, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652249347, "uuid": "f05c93bb-ca25-4df7-9a44-21e757782010", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652249347, "uuid": "90b151a8-11a6-41cb-aaa1-f32443a9daa9", "value": "PDA bank slip.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6c275d4-d10d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652261790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261790, "uuid": "43667a15-80db-419c-9061-44ff99ec8d43", "comment": "Malware payload (Mirai)", "value": "6e9d228d8262221977e0d7ee79b5b246", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261790, "uuid": "8ef0a89f-bc92-45a7-803f-69ceb6d6cf5f", "comment": "Malware payload (Mirai)", "value": "1c1b33de045e1831e7c4db9f92a88f490603f7ad9cadeaaaad49e9cfeef611d8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261790, "uuid": "7a9ea9ac-f896-488b-9b30-1f7c778c6183", "comment": "Malware payload (Mirai)", "value": "3bdce4934ef9f3970160c8df55adb01b395f2a1b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261790, "uuid": "85fb275f-fc47-470a-8476-b51cfa2d5cec", "comment": "Malware payload (Mirai)", "value": "20617ccaf85173e89cc5996eb426dbee1b9b823705e98d3da498405173ae712d701f6793c84400f55dc68cb0c80ec699", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652261790, "uuid": "dfb44944-d059-4f54-bcb0-17196061e697", "value": "T16C63ADA8D079ED9CC66586B8F54485355B23E008A2633DF7DA83C3A6406BEECF5057F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652261790, "uuid": "9dfa6b60-9211-4119-b60a-47ce3be92c96", "value": "1536:C/de+O0oGXaasT2CC1VFNO+XjsrzS02cfs3oGb2BbagqC8liZ:CleSpXsC1VfO+6zS0Rf+NChagqu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652261790, "uuid": "af62d19f-ca2c-4d31-ac81-8575acdbb364", "value": 72760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652261790, "uuid": "39f76b7f-23e5-40b5-968a-d162aa84e39b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652261790, "uuid": "aca0b8ba-094c-421a-b595-875921f02681", "value": "6e9d228d8262221977e0d7ee79b5b246", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35975eb5-d13f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652282995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282995, "uuid": "1c63428c-064a-4b86-a81c-8dc5e120cd8f", "comment": "Malware payload (Mirai)", "value": "5e79da953fbbb53889f1470038a8203e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282995, "uuid": "3aba7e87-ce9c-4405-aded-db73d6fe26e6", "comment": "Malware payload (Mirai)", "value": "1c58d8cb9def6ec0e6d9e923cbe8c9cf765d394dce22c7257eb916606c56d4bc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282995, "uuid": "5455a815-812a-4e0d-9305-9821cc40dce5", "comment": "Malware payload (Mirai)", "value": "9cfb9803d4dde53583ce8005c302490f60ca9582", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282995, "uuid": "f7e711cc-3948-412a-b469-350546e9c1f4", "comment": "Malware payload (Mirai)", "value": "8095ae6393a785d2278669b271c712d28b562d5e91ef673715328cb84b30ace33a47f296814dd101b91eec4b68fe24fa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652282995, "uuid": "16d670fc-98f1-4d1c-9f64-caa77838e553", "value": "T1E6534B0277684F0BF9E61AF4243F1BD483AEED9025E4B589A90FC7454635F33489AE8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652282995, "uuid": "9cc1572a-c5c2-4f67-afe1-31c781361ea2", "value": "768:nIiJ5+DoVsS+5voNV9o0p8BJAIGsllk5M90eE6Ou4TlW2c5sjgi+DDiZ/vbBbsVf:YDca0yJJzk5cfOxJgbDOZ/vbuN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652282995, "uuid": "dc3a58de-a61a-4fe3-8f18-6e3a0427af4f", "value": 66468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652282995, "uuid": "0269fdf2-5d3c-4bfc-ad07-ae90332ff54f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652282995, "uuid": "40e2dec3-d2d9-497b-a809-380b628cdafa", "value": "5e79da953fbbb53889f1470038a8203e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13fe6780-d186-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652313433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652313433, "uuid": "68e96483-1fe5-4c17-beaa-647b8818a594", "comment": "Malware payload (AgentTesla)", "value": "141cbe46b73bb43d2347fd30c6b9da36", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652313433, "uuid": "8d04422f-ffc1-447a-83bd-7edf36609b82", "comment": "Malware payload (AgentTesla)", "value": "1c8d6e9b23109160dd236fe2c78679c08620c7ab790d042932cd9d78206195d9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652313433, "uuid": "77c342c9-6759-4ac2-b9b2-7b65cbbdfb0e", "comment": "Malware payload (AgentTesla)", "value": "7e3e35cd63edb6a2be449b3e27903bbaf455d6e4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652313433, "uuid": "33dd3650-bbeb-4a0e-8d29-d5dfb7d0aba8", "comment": "Malware payload (AgentTesla)", "value": "7b8f276f680f6d269191fcf7dd2dc2861602c32fcab248bfbff1aaa0f5fc1ff1bea5b1f29c9977706bcc2460c91dfcbe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652313433, "uuid": "a5e93761-c6a8-4d4a-b04e-6e25f0c942cf", "value": "T15A35CFA2F74C7F65D63BC7764050482003E2AB1FFB2AD1167EB2248F5573B81A662D27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652313433, "uuid": "aaeca163-6447-4330-8cea-b25296b9980f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652313433, "uuid": "26b6dac1-eb06-43dc-bc23-73ad92694941", "value": "24576:SGnX33oa1qMQG1lOpBcg9r/zrzEZte0bG2eFUhWVnu:r33B16EopeAH4XeYGb8WVn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652313433, "uuid": "eccac576-3c05-474b-ba00-f80a2e2d594f", "value": 1071616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652313433, "uuid": "b568bd77-1046-4712-8109-cbeaae611411", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652313433, "uuid": "5b036ab1-0046-4072-9a62-83a3198a3afe", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "950c2b9f-d13d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652282296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282296, "uuid": "329c5b7e-7c53-40f8-ae56-ac0f5509bcc9", "comment": "Malware payload (Mirai)", "value": "0014162678ce3cfa5a9a0291fe053875", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282296, "uuid": "a4a3424a-1247-4812-be79-b6b3aecf0450", "comment": "Malware payload (Mirai)", "value": "1c9e753923055fa73c1112919a8932337fa0efef0300af346e8cc4fa867ba6f6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282296, "uuid": "bb144115-5917-47bf-9452-8cdcf8d3a6e6", "comment": "Malware payload (Mirai)", "value": "9a8a403a2c4b283ddc554d945866a86aeede85ad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282296, "uuid": "ab440c20-4431-4351-b2c2-3b6bb145d738", "comment": "Malware payload (Mirai)", "value": "0ba886ab757ae00242e3b07a25d58a70dc6a526b1c1f89a0ed0e8014e84e989d767e137f99ab32a7779e5e4f2e9d3925", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652282296, "uuid": "8c9fd379-4027-4ac1-ab5e-6e15ccafba44", "value": "T126436C01B7984E0BF6D61EF1393F2BE483AEED8011F1B584690FD7424272E73494AE99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652282296, "uuid": "9a7418dc-3635-4c06-9aa5-b565dad883ba", "value": "768:Milih6vgDmRK0uyZLRr4FAjL1QcgQGh/e2ARmGnVfHW2Wgw0svIsVDtiEBT4:+DmvZL9jCc1GhWRVv+gwymD8EW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652282296, "uuid": "955b803d-8756-41b8-8275-31fa0e186c4f", "value": 59052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652282296, "uuid": "cfec254d-c4b0-4f7c-aa02-bf5f96774e33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652282296, "uuid": "ded41f5b-cf5a-4d58-9219-20287f5df96c", "value": "0014162678ce3cfa5a9a0291fe053875", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49728efe-d0f2-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652249957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652249957, "uuid": "b3e4fc8b-0126-4c72-87cd-f55671bbef56", "comment": "Malware payload", "value": "77429b7f82c0b8f1db9b1312466ae47b", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652249957, "uuid": "b4e8b4e7-3220-48d9-9a60-d4879f02bd52", "comment": "Malware payload", "value": "1e6f804616317860f96df7c201978b02151e0ffc87dc20d507326e1109659ca4", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652249957, "uuid": "9092be01-1628-4567-9d30-055dccd8b824", "comment": "Malware payload", "value": "e44d164fd362df3e75dcf1970b4eedf24f27bb95", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652249957, "uuid": "64371e3c-41e8-4896-853c-97b5e84c052a", "comment": "Malware payload", "value": "86db8d1c7a6fed8ff6fc980e92354b92ac9ed1c7be58779a5da71e338771adae08b85e612a00a08b3e3bace7fcb21edf", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652249957, "uuid": "f810a270-4df6-4826-9886-5dbce836dace", "value": "T18E25BF16FF54D0B2E983B1FF4483CC277C2C91C9A18EA1A729B5275B483CAC5172B69D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652249957, "uuid": "d69058fb-3131-43b6-9ad3-3df15d279df2", "value": "24576:J1cfxIxQ8jvzZ88I81Kx2xIzgG6aJF1Erh:J1cfxIQp80xPz6aJbErh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652249957, "uuid": "a34041e5-1380-4803-a844-0c3d8eeb2cc7", "value": 980043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652249957, "uuid": "2ad557c6-1a88-44e5-af85-ef9dbe9e2086", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652249957, "uuid": "a90884b4-85ec-48fa-92f9-8d23a199823d", "value": "PacketDoubler.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "792d59d3-d156-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652292987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652292987, "uuid": "54afeefb-1f4f-4c30-9205-e8f7854d5a59", "comment": "Malware payload (Heodo)", "value": "aa26e4b82130147b0f3e625b04995f07", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652292987, "uuid": "aab17360-705f-45f8-9b78-430d3ff4ad02", "comment": "Malware payload (Heodo)", "value": "1e9d66214e14db47f910fa05eeebb9331dbfcccc0672829a3f007571c3acf309", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652292987, "uuid": "c3b4ff44-4cef-45d9-a056-4809ddcd5702", "comment": "Malware payload (Heodo)", "value": "2f37bb761ebe9ab82dc08dd146c6b173b5c908a6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652292987, "uuid": "bc889c67-85dd-4e0f-bf55-e2d36cd16905", "comment": "Malware payload (Heodo)", "value": "aa05d6668d1a53326484512f9b2f106da51feeb5d195822a05d03ecaf76ae1043b2018421147f18729577ba691c914fb", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652292987, "uuid": "f0c5b6c4-e65a-4af2-8d43-81f1864af924", "value": "T1B8B4BF06B3A504B9E467C174C9735952E672BC121761AAFF33A0436A2F37FE06A3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652292987, "uuid": "fb6a6546-1002-4483-8572-afd60c0a4851", "value": "6196af15ce9ababd9a592319b3043ede", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652292987, "uuid": "0ef1419b-4828-4dc0-93a8-c909a7dbb2c1", "value": "6144:iuD3jumQgXW2jLi1QPy+hSVL+ymioha0dtUPM1UlTIqNtF1FMytrf:ZDLVXW2j21QC1+yZoXtUPMg9Z1FMyB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652292987, "uuid": "4b3b7499-06f8-4c6b-bd36-26fa260bf212", "value": 513536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652292987, "uuid": "a6024ac7-dbc4-447e-9996-62071b7da5f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652292987, "uuid": "5d27c0d7-cbb2-47e1-9ae4-1b4e7e118e85", "value": "aa26e4b82130147b0f3e625b04995f07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a009e96-d0ee-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652248133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652248133, "uuid": "3943d46d-9323-46d6-a892-eef74256428f", "comment": "Malware payload (AgentTesla)", "value": "8bf7f587e3314fe35b081827d9dcb7e5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652248133, "uuid": "8704a9c3-d9f8-4d71-8ff6-094c6c774eb9", "comment": "Malware payload (AgentTesla)", "value": "1ff60b63b8847c80b9f638ee1c4c3221ae73a5d977b778b432c008c77d129f32", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652248133, "uuid": "d0af14f8-1427-4fd4-bd67-484f2ff0a1df", "comment": "Malware payload (AgentTesla)", "value": "5c54a68330f1ac2ea60d0087c14e940cb3ead51e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652248133, "uuid": "ed1b4302-3e41-466c-bbe4-9fba42362f19", "comment": "Malware payload (AgentTesla)", "value": "d073e930ff3331da0260d58accbe14c4f503d4ceb0db2e3a2617245cb515d838a3d7ff30ee945762593de03c89cf3958", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652248133, "uuid": "59a2e19d-49b7-40fe-9e9a-80177b37b5f9", "value": "T1A1D4BD6666A21F94C8A9517980EB0B42332DBF8B5146E36F0771E66F7FF77B48928001", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652248133, "uuid": "a3973f4d-542c-44fd-9a98-c4fbd3c933f2", "value": "6144:n5fYM1ZrCel4H7S+EKKpWq1SbG2EatmZdoY4NaoL/bnt7i6:nXH2RH76B1fXatmZSY6ay/bt+6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652248133, "uuid": "cc57c911-c46a-4a8a-bbef-4a084fd3634f", "value": 610014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652248133, "uuid": "bfca2c21-36e5-438b-9ca5-c498579ffd5f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652248133, "uuid": "6c5b7731-ebcb-4b24-9b6a-913b64ab19d8", "value": "DHL new shipping information.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9ff500e-d14c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652288827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652288827, "uuid": "fa914488-2159-4c3f-85df-b77448023ed8", "comment": "Malware payload (Loki)", "value": "feee8b87461c723c97241cb87f4297a6", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652288827, "uuid": "41f4f4c9-9b0b-4b43-870d-94efad697754", "comment": "Malware payload (Loki)", "value": "21775c3aef04a856ec55d7ff360e37b259aa20ec7a00daa542d4873837ede1b2", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652288827, "uuid": "19568d70-a95f-453d-a17b-f36e4670c120", "comment": "Malware payload (Loki)", "value": "4ebc6da9266d91cb6a119692b889fd423b1a6902", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652288827, "uuid": "914958d5-4842-45db-b941-5315987ad74e", "comment": "Malware payload (Loki)", "value": "7b825c2d82b2f7ce9edd97246e47c077e3e17e6ed80861ebc3f8eeada8436b4ee608531651e5784a7c00480d4968066f", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652288827, "uuid": "768cf080-bfd9-49d9-976b-14b659384fb8", "value": "T1BF040201BEDEDB00E38CE1B19512A1715331FC933D9CC53A6B2E763E9331E9B692A156", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652288827, "uuid": "02c36fa5-0303-4014-adb7-898263cc3990", "value": "3072:96KJpt+uyoZhjMDdD7UUzdpqLE3vn/vc9Go2SgMnDd9j9uKqOOLVYzcQ9Rpxk9P8:QKAuyoL4DdBdpuEfMH1g635KLTQPk9P8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652288827, "uuid": "1771d6b1-448d-4148-b9f2-42168ad44bed", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652288827, "uuid": "f318bcf5-7d49-4ec3-9fa3-1ca66df05c8a", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652288827, "uuid": "5f81c93b-f8f9-429b-9f98-49226ce4129a", "value": "PI211119.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63975daa-d0f5-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652251289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652251289, "uuid": "74fe91a3-b251-4675-b3c6-9a144480b76d", "comment": "Malware payload (RedLineStealer)", "value": "a1c0b5c95ef6b71f4732fb2f1be9a40a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652251289, "uuid": "f6086bb0-c37a-4488-8949-faa7a9685a78", "comment": "Malware payload (RedLineStealer)", "value": "22f35118527508fb9e7794918d24203ec739633ceda17a9667e8a236133e0037", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652251289, "uuid": "24e7efd6-4ef8-447e-93e7-59ccc2d102ea", "comment": "Malware payload (RedLineStealer)", "value": "d311e4f61937350b1311dbca54add05032995c5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652251289, "uuid": "de098ee1-c160-4db1-9b07-6a09d7454f5b", "comment": "Malware payload (RedLineStealer)", "value": "a7c15aef4ea6668d8b28c84e27c34b2d6842db62eea263550c85318342f62aa6e887570ac876286dc0c470aa66d936d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652251289, "uuid": "618a869d-6836-4e7e-b012-240f4a970d71", "value": "T1E784A4C1F2DC149FE06690B288775D32992322B99A3D850A205F7D3B7FEB3434962F56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652251289, "uuid": "655a7880-27a1-4475-b280-0aefabf0f15c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652251289, "uuid": "1be0c16a-67c0-4348-8488-9433d911de59", "value": "6144:ktB15v+P005txx1hwCNVaAg1UKxtEwRoYV0+kGv:k715vXGtDoCNV9g1BxtEwRoYV0+k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652251289, "uuid": "c24cf51e-5ec7-4bfc-96c9-be62b89883fa", "value": 390144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652251289, "uuid": "fedd670f-6db1-485a-99ef-412fb1b96963", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652251289, "uuid": "9d59ed30-92f8-473b-aa0f-753fdfb0b339", "value": "90-566-2022REAL ESTATEINVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "104a6cab-d171-11ec-8e58-42010a9c0032", "comment": "Malware payload (Vjw0rm)", "timestamp": 1652304407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652304407, "uuid": "ff1ba38c-8c67-4085-b1df-a923f012a8ab", "comment": "Malware payload (Vjw0rm)", "value": "95d94a7e29aa554e670713c38dffb3ff", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652304407, "uuid": "75bf8bb2-d730-4fa2-8ce4-6244db88a900", "comment": "Malware payload (Vjw0rm)", "value": "23e877c6b69a0d58d26611969cfb04c07381654b2462b10af911cbf44b36afab", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652304407, "uuid": "d7673cad-2000-43bb-89e8-9d819d3e952f", "comment": "Malware payload (Vjw0rm)", "value": "3b36e2ae4e03063979b59a9728fae5bb16f7e086", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652304407, "uuid": "47e239f5-73b4-43af-9527-301f496f9c3b", "comment": "Malware payload (Vjw0rm)", "value": "c4e48da52e9127462fa00f7f394bb92fb5d2ce9f3de7a96e9d9e0dac300e071d5d2c6eb95f79273467f4a7c53abe681e", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652304407, "uuid": "c7828aec-4806-497a-8459-88f04e64a359", "value": "T1B3533BFA2B0E78F0CB1868FD27159A643C0B947BA28121C4D4099A427D767DF07B9D9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652304407, "uuid": "92942c93-bf85-4206-be5a-cad91f064254", "value": "384:7YZsA16W34k8Wc1iKzTi1zwiXMNmiz1aRjJMNmiz1R6RTiQKIXfis1R8Wc1iKzT4:7YG06hc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652304407, "uuid": "21ebae97-c340-4599-98df-858052aa710f", "value": 64968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652304407, "uuid": "7496b905-b13c-4ce9-a2ff-ec3a9e2eb390", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652304407, "uuid": "40bbc453-6ae0-4ab3-9a87-3463f3f5a50f", "value": "InfoReleveID00215002504.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4d51c36-d17c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652309408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652309408, "uuid": "394d43f0-abf8-4436-b1f8-a42b1528e26d", "comment": "Malware payload (Mirai)", "value": "66852cb6ad0873d81879e7700f2860c6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652309408, "uuid": "262d57f5-d455-48bc-a994-f594182eb430", "comment": "Malware payload (Mirai)", "value": "25ac220c78d3dc19e55ca08328a55369ca4a3622932a47497cc1a7ac477cf5cf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652309408, "uuid": "b59fc2d5-5ece-4aab-8e52-f95ae38a5a32", "comment": "Malware payload (Mirai)", "value": "f318146bdd4e032f3c948a0bd26ccb10db774a1b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652309408, "uuid": "ec9d1e96-26bc-4271-8bae-b252843badd3", "comment": "Malware payload (Mirai)", "value": "336cd26fad5f20cee02d51b211c253f83e880162e513f03f9a5c68b5eed4a6b8dc659d34fd1ba663da472c9b94b9cd50", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652309408, "uuid": "df213009-f3be-4289-9773-13a5ecc7623b", "value": "T1D1532885BC81DA52CAC4237AFA2E41CD371563E8D1EF72139D221F1077CA81F0E6769A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652309408, "uuid": "4a646261-2780-4a65-9608-55468cd397bf", "value": "1536:EcBmwG18KzXiFrZ4mH0o6ayT69mT2MgPrpX3ic7Y:EcwwGoUGyX2MG1X35", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652309408, "uuid": "b5af101d-4cbb-4dcd-8795-2b9e39f67605", "value": 66556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652309408, "uuid": "e269ab8d-2b2c-47a2-bbf1-95c6d759539c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652309408, "uuid": "f32e3d6c-ebdb-4773-9146-0eae66c99ae7", "value": "arm-20220511-2250", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7bad9cb-d153-11ec-8e58-42010a9c0032", "comment": "Malware payload (BumbleBee)", "timestamp": 1652291776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652291776, "uuid": "e7dd9076-9edf-41d0-8ad4-ed6a1db3b786", "comment": "Malware payload (BumbleBee)", "value": "b07d064220b48ac3b110e6ebe1e4f542", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652291776, "uuid": "b36162a5-672b-4ced-9338-a58c2857c02d", "comment": "Malware payload (BumbleBee)", "value": "25ccf19af5dac51ec76ce6da1d2958d5dee34e50e78938b187b627f8771317d1", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652291776, "uuid": "ebcc18b5-cc60-486b-86c3-6c764dd17fbe", "comment": "Malware payload (BumbleBee)", "value": "c3bb172894a4e0e1ecc93fcd1bd78450ab4ca195", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652291776, "uuid": "e1586fd8-77ac-44e6-89ff-bd9b1004fc6f", "comment": "Malware payload (BumbleBee)", "value": "1c98d8b685cc08f5d2e97ddd043860402701b88099085fdc33f99fc4d200ae40d9b845c03f8a332b8aca593fe442ac80", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652291776, "uuid": "f4e61641-8698-435d-9347-5fc80d400da1", "value": "T148459FD763EE3C61E2C0A5B786847579483FB76B85E327E82E564E3A1E284107F70D24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652291776, "uuid": "d7da6b89-ca7c-4410-b247-b6b1b7a6f93d", "value": "220e1d3578c56ebb1f1193aed07050a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652291776, "uuid": "154b945d-538b-4b52-ab63-b81783a4b493", "value": "24576:dSjYvwTRvpA44SNKeysw9VJFtyzDf5WF313pyLS9cUGt2Z8gUHc43Zx:dSjY4TRvyem9VJFAXM7pGDRt2ZxTqZx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652291776, "uuid": "2a03ab14-333d-48c2-877e-350b316db93f", "value": 1252864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652291776, "uuid": "8449e364-bc2a-438e-a2ae-c907278de027", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652291776, "uuid": "c61bbe8d-7190-41f2-ae19-d7d8027511be", "value": "desk.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75aaa090-d13f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652283102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283102, "uuid": "49c644a9-67a7-4b3f-8f6d-74bdadce50bf", "comment": "Malware payload (Mirai)", "value": "6d30585803ddd2c6a4b32abd1d4bd5fd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283102, "uuid": "70407d31-f4e6-4009-9070-389a4348dde0", "comment": "Malware payload (Mirai)", "value": "27a5d1e744615738e53e89906465ee051ac10c0ed0db8fde04ddfd98d0fcafba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283102, "uuid": "b08ddd4c-1418-4f09-b81d-74b34adc17dc", "comment": "Malware payload (Mirai)", "value": "e2ed9c8b6a1574d1a34cbd240944e4e983d1b03d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283102, "uuid": "f597a511-2170-4550-bcc1-7d17d5a90b16", "comment": "Malware payload (Mirai)", "value": "acffa242d263062bc2c615c337c5624e8428a4b351a2eef6e39f30b0a8af870cfc51add0d29e0e3873ff1a76c3b8bb2b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283102, "uuid": "16c8e90c-b7bf-4675-80b0-c1f912cbeae0", "value": "T1BE6319817C80AA26C7D0177BFAAF008E33156BD8E1DB73478C141F95769A81F0D6BB5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283102, "uuid": "9271f289-4279-4f6c-9992-788adcc6261f", "value": "1536:hzfhWp4L9B8outRhu96TUQdXtfavKx3V88HxouJeZWDFI8BM:hzfhWpXT8eCKw2FbO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652283102, "uuid": "da9fc37b-251b-458f-8f5b-94f7c75c7ad1", "value": 71864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652283102, "uuid": "3dbd78b3-f515-4c7e-be1a-9c102a749e48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283102, "uuid": "7f331635-7e0d-42e4-8f9b-af7bc3b15158", "value": "6d30585803ddd2c6a4b32abd1d4bd5fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75fd4009-d0d6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652238006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652238006, "uuid": "3d829adf-06a5-47a1-93b9-945c38b41308", "comment": "Malware payload (Mirai)", "value": "b69267854cc300a621b391e587d2fb81", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652238006, "uuid": "f873c698-aca2-4597-bd4d-9dda51940391", "comment": "Malware payload (Mirai)", "value": "2819a9b05ffe6e4f01ce4a21099a19885011a67bfc8b8c161cd221ffe6203083", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652238006, "uuid": "9e557b75-3cb2-4f4c-9b83-9129f4edbe1c", "comment": "Malware payload (Mirai)", "value": "a88751ce9c1f5f53a638bcb1a3d2493e1ff5ce90", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652238006, "uuid": "0e51f9a1-418f-4ea2-bf22-821d5805a023", "comment": "Malware payload (Mirai)", "value": "e27ee88bbd9bd4d8e8a0e2b7a4a8f0b3df2cc809286cac436f0ad124b372f36044d0340392c8602c7913311647031415", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652238006, "uuid": "c9bc8024-310a-4162-8327-3b424d7331b4", "value": "T10523F29383DF046695762A329C9656A1E8DF0FB992B5783B6C4F80FD51D32C80FF0885", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652238006, "uuid": "2e36f921-4c63-4a85-982b-a04386f8d65f", "value": "768:NDCgWOahgoceo2vpnFPMaw5HMwB9bQXWpY4oXUQ69q3UELKYGI1lnIKNRrOrTHM/:NDCgWO6ZpvpFPMaw5zB98/3XXvLyS1XN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652238006, "uuid": "e6f6b32d-905a-42ad-9d6a-85b6992c1f15", "value": 48428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652238006, "uuid": "58ba3663-9d2e-4634-b6aa-5b459907144a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652238006, "uuid": "d71eda2a-4089-4ac4-a7ea-64bfc98c1ca1", "value": "sora.arm7-20220511-0300", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bccd1a07-d0c9-11ec-8e58-42010a9c0032", "comment": "Malware payload (IcedID)", "timestamp": 1652232541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652232541, "uuid": "3efbdf8b-ba9c-45c2-a75a-69bbdd2cad82", "comment": "Malware payload (IcedID)", "value": "305412e03b95f0352a990a36f6eeee8d", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "StolenImages", "colour": "#7FF60B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652232541, "uuid": "f1072b7c-babc-4923-a6ee-4caa4afbd7f9", "comment": "Malware payload (IcedID)", "value": "285a89655c163017d021914c48bc5dd4914a52cb6048381eb20345d6ddead59c", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "StolenImages", "colour": "#7FF60B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652232541, "uuid": "afbd23e9-f09a-4b7f-89c8-cd20780bd54f", "comment": "Malware payload (IcedID)", "value": "b76fb14c56498b79bac7e27e551ae06047fc32d9", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "StolenImages", "colour": "#7FF60B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652232541, "uuid": "9f8460ea-bf50-481c-8efd-113e9eee0f6e", "comment": "Malware payload (IcedID)", "value": "273ce3be08d6b1a900720f1717f421bb74e127376e755ca807ef17b0297caeb3d195fd07007d2093ed890500eb713d86", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "StolenImages", "colour": "#7FF60B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652232541, "uuid": "8c5243aa-7a3e-43d7-9c31-b7c6cdf325f4", "value": "T1B0A59FB8B6146CE3D66E577BC9D77DD913B227228A9BD8C9807577C305B3362EE02804", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652232541, "uuid": "a2507634-5594-41a7-90e1-69bc22503d64", "value": "12288:TMOZsM2/zZD5zFR7UM7zTogg+3XEg7WFvrLFWIqFGDEVAU3:TM+svlDlFRP3HpWFvrLMI8kEVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652232541, "uuid": "29beb2b5-c98c-4ca5-9510-bbec366aa696", "value": 2097152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652232541, "uuid": "b041bbdf-416f-4f09-b1bd-fe59a69cbe6f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652232541, "uuid": "2b3ba1df-4561-4583-9099-489e62da989f", "value": "StolenImages_Evidence.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de555a27-d12f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1652276406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652276406, "uuid": "dd9a4276-f47b-4e4f-ab2d-c95535601fcd", "comment": "Malware payload (Quakbot)", "value": "3c5934fff81b00faf1ab7e1092d23258", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652276406, "uuid": "814a5ac7-357b-4bbc-a75a-655c504898c9", "comment": "Malware payload (Quakbot)", "value": "287e58447d9ce7ee50187c29dc59551266c0819e222ac71ecf415c8063978e94", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652276406, "uuid": "1bfe6da2-f88f-4498-a0e9-bd13459e3590", "comment": "Malware payload (Quakbot)", "value": "b1b70e6b6c0df6b55515d91618d48f029c8d95ea", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652276406, "uuid": "e65157d3-f282-4df5-8fef-ae7b519cdecb", "comment": "Malware payload (Quakbot)", "value": "94827429ec9f69e79d45a9fb515f1469247f8e4cef05e1d1fbc0c2677ee58f6a825a9b083b59312a67b11cfda4951914", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652276406, "uuid": "7061a63b-bdb9-42c9-b52a-bd59cff11adf", "value": "T15D35AE7BE2397C3BD2360B7805514370D6B62DEE103D768A16D1BEA49B3E1CF75226A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652276406, "uuid": "634de3d6-afaa-45d1-99b2-01b0ac93de6d", "value": "24576:LVLFUM0yA0yK0yA0yu0yQ0yi0yg0ys0y80yg0yQ0y00y00yg0yw0yc0yc0y40y8j:LNFcytyrytyfydyjyNypyZyNydyRyRy/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652276406, "uuid": "db0976f5-9d32-47e9-842d-a9f766fb93eb", "value": 1067406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652276406, "uuid": "2745d202-f26e-41f5-9d3d-63639c4f8d4a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652276406, "uuid": "3f9b0721-72ce-4206-ad2f-8647e037b3a3", "value": "x1867352557.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "718785ae-d0ec-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652247447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652247447, "uuid": "ce41abad-4d68-4100-bd0f-d5bd0b869bdf", "comment": "Malware payload (AgentTesla)", "value": "3acf1fc839bc3fa50baccef1679f117e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652247447, "uuid": "5142f6f0-eb89-4aff-84d2-aa969e78a44c", "comment": "Malware payload (AgentTesla)", "value": "294f474790e387c27574d3786346002d696aa7770f957afc9dce9ab3383a2298", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652247447, "uuid": "99130d04-1e25-451f-8a42-fc2528216233", "comment": "Malware payload (AgentTesla)", "value": "04444a11fb02de4cdd96853bedf011d23ee4402c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652247447, "uuid": "d9f953bd-e0d9-4366-ae2d-1041539f3571", "comment": "Malware payload (AgentTesla)", "value": "94dcff2e17f115c413fd3d49171ebe9d1fc91180ac1e601e5a1d56f5763c1c7f5a0973a3a0e6658b931ecaf7c95e1ce5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652247447, "uuid": "a8d2bf49-8c3f-4467-9998-cdb6d916df52", "value": "T18CE4122827E8DB61D57E3F7525B920085BB9FA15793AF30E4FC0298C69627C10E50BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652247447, "uuid": "eba2982c-0969-4cfe-aaf9-115492b86d5c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652247447, "uuid": "e6f9256b-e6b3-4daa-8b19-fbedebe0ab11", "value": "12288:CCpHpZssqERDiNzltsKyQpKsmpmJMQudig+iXkwBkU+Tu3MREUWip:CCRMsqERDGzMBQw/pya1kVU+TQMRWi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652247447, "uuid": "70fc4d0f-56c3-4b24-b59d-5248f8bda7b2", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652247447, "uuid": "f3068c9a-0650-45e5-b0cd-dc94bb60ef91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652247447, "uuid": "4e602d5a-2629-4404-baf4-8779526fdcf2", "value": "SecuriteInfo.com.W32.AIDetectNet.01.13497.25708", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b43b7ce5-d17c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652309407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652309407, "uuid": "52a12c0e-a619-4d7d-8273-566e062c0b19", "comment": "Malware payload (Mirai)", "value": "d6ba755c9ed01aa1e087ae28f003b946", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652309407, "uuid": "a3382c94-dffb-48d9-87d2-5d352afc7268", "comment": "Malware payload (Mirai)", "value": "29c1954c72d99b9ee5a1558e7be3f4ad802b2298fd53fd17babd631c0da18a72", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652309407, "uuid": "e1dcc629-4c94-4a6d-a451-368357b2ab33", "comment": "Malware payload (Mirai)", "value": "faaf8919df9515893431ae6fd1fe94c4632a16fc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652309407, "uuid": "a6671387-a65c-4253-a6a0-bfde90beafaa", "comment": "Malware payload (Mirai)", "value": "43a3d62098f4f826d7daf532105e671491166bf4bcf9063ba1a9ba60c5c5c1953acc67f01724b096c08f79edeb793d1b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652309407, "uuid": "409f402b-8c78-4cda-9241-3f20d30dfa8c", "value": "T106435AC5D693E8FAEC010976217BBF328A76F13E2069E9D3E3995922AD46503D40736C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652309407, "uuid": "f88dc90a-6162-4a88-b2e0-2878365b8f9a", "value": "1536:uq5CIbmgv9j+9tyfHVuca7qEk4EjeO1xM/XM:aIbmgvl+9yHsca7BRfOf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652309407, "uuid": "e34eb5f5-58b3-4601-823c-500444247a49", "value": 59760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652309407, "uuid": "29ca10a0-ca18-48c7-a50d-5398e881faed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652309407, "uuid": "c06df1d5-c84a-411f-9025-9a1f9a045384", "value": "x86-20220511-2250", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ccc11d2-d14b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Vjw0rm)", "timestamp": 1652288161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652288161, "uuid": "d6b7f727-b01c-48cb-a711-7df7c2c24786", "comment": "Malware payload (Vjw0rm)", "value": "d0ba0fe21bf9d8fb4e03d08a326f8f56", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652288161, "uuid": "197db72e-9d1b-4bad-9737-9a06fe319943", "comment": "Malware payload (Vjw0rm)", "value": "29ea901e52ccc57b80dbcf639ae63a45e704960ebe97f6c957e22c0f61e2e88b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652288161, "uuid": "098ac014-19ee-4cab-b4a4-90e35f85e2d2", "comment": "Malware payload (Vjw0rm)", "value": "9a4aa8045782bd40df865ac4c35151a5d11ddee2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652288161, "uuid": "0b0f0862-fc82-45d1-a7e8-a1461fdf8ebe", "comment": "Malware payload (Vjw0rm)", "value": "4cd0631ca666a7254a95bb9544a41ddb259019ad943096139d5aa35b97e0ce11e6ab3af341f32a1849b6f8c6a77abeef", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652288161, "uuid": "1a179de1-fce7-4035-9696-9b6f9bd8b0e4", "value": "T19423F5CC7D61A0AECAA895767C3E2CC947F4624BE042938E360F72001BB9749DB9E55C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652288161, "uuid": "a875d1b0-5a0b-47b9-85c1-90dc84c62541", "value": "768:B0CdxROcFKJ5tFqL5rukQqxU1UtRv3wsahd6Rdf9XgdHZq+IrK:B0kxRoFq1DdO1UtB3w7dudf9XgJyK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652288161, "uuid": "87c4cce1-2df0-43b2-8c22-cdd903456f33", "value": 47800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652288161, "uuid": "59b5eff1-6395-4ec5-9e79-2bfa1cae03b4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652288161, "uuid": "2414777b-acc5-4ad4-ae7c-f8aef1a08b2f", "value": "Voicemailmessage102210.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c155e98d-d10c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652261325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261325, "uuid": "c0f0d8a4-acbb-44c3-9ef5-316ac8d1f4c4", "comment": "Malware payload (Mirai)", "value": "eb819da3457f7dfc8dada9c25d15a8aa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261325, "uuid": "12c303a5-0847-4958-bff7-84007841ac13", "comment": "Malware payload (Mirai)", "value": "29f2d0f07e22179ff0a75fda359f8744244a335040a0a68fff23f795403c4310", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261325, "uuid": "e7517d83-05fa-43c9-a286-982d357bf187", "comment": "Malware payload (Mirai)", "value": "45c7f0ff83499e8d955a08cb5d1ec560c04bba8a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261325, "uuid": "56c66670-2042-4599-8d3c-70d033424ff0", "comment": "Malware payload (Mirai)", "value": "bb8b3f5469c1c0e45fc1d27c2ca6049400f6ff4b02fb556b48f452de77900fe5545760f34efec8c965b3c94b2599e5f1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652261325, "uuid": "3753d70b-6fd6-4372-ac2d-ec5eae0bb389", "value": "T18D93A309BFA05EF7E8AFCC3345D92745288D655A21A83F79B930D928B21B24F15E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652261325, "uuid": "a1cde200-caf0-4b14-a3e9-62dc2ec88c56", "value": "1536:a5DnSB+v5DjQm2t17xk49d6xZLu8vJ4TGo8S:a5TSB+v5DjQmY1GFrvhrS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652261325, "uuid": "224d985a-0cab-4501-8f44-abc8d1a393e5", "value": 92512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652261325, "uuid": "5be03cf0-947e-41b1-821b-11fbfeb9d74b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652261325, "uuid": "cbf5d991-313b-45a3-a368-565828156860", "value": "eb819da3457f7dfc8dada9c25d15a8aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fec0bca-d140-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652283576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283576, "uuid": "2980d255-5ea5-49b8-be52-cb3b584433af", "comment": "Malware payload", "value": "a5484753c57e0cd3ad01d1724ab225c9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283576, "uuid": "54f0be45-0ae4-4d0b-a6e9-4360fde1ef05", "comment": "Malware payload", "value": "2a6361ff4869848ef7c5b2a36b1869ba5f49f6ef3a771c67adaa172d18546d66", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283576, "uuid": "9a288780-c379-48ce-b445-304c97417e67", "comment": "Malware payload", "value": "4e69865d78f3952cf386edcf85925882797ad6da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283576, "uuid": "3d2ec58b-0512-436b-b2f1-39d5b7c60c20", "comment": "Malware payload", "value": "da6942e5f3fc2905feac933b3a2af3cb2b99354051d59240658be4ea68e143201304638d8fb45b2e445159f8e7b1bd68", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283576, "uuid": "d19981c1-4630-4ed2-81a5-1235393e57ba", "value": "T16146D01177864B11FC2EE2B4CD868246D5F2BC358FD487EF53B8B728BAB66530518236", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283576, "uuid": "80806b39-bd07-4cf6-b6b7-a64b1df62838", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283576, "uuid": "e29dfd47-58a2-4d0e-b2fc-7e7537277432", "value": "98304:8zCdmVnJSPUnsn2HfhqaJ6ej4s55QfOTspu5IylyOtuto3lec0:8zCdqnJSAimfhR6LUKWWuVoOEg0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652283576, "uuid": "f7558a62-284c-459a-bcde-e927f79fb630", "value": 5791232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652283576, "uuid": "d33b3d1b-6175-4786-a9c0-38f409654020", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283576, "uuid": "33b8820f-9dde-4250-9eac-5ae346f61d69", "value": "a5484753c57e0cd3ad01d1724ab225c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3497745d-d0ee-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652248204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652248204, "uuid": "12cc4294-7113-4a35-a014-56f97e95f1e6", "comment": "Malware payload (Mirai)", "value": "2bf017df150732fd7fbe12eb1377f5fa", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652248204, "uuid": "81afe120-1d71-46e1-a169-d34c914c2e5c", "comment": "Malware payload (Mirai)", "value": "2b8c71d1ee2d59fd957dea5bd91d12c3cde9310e4fd09665a1efabd28a997681", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652248204, "uuid": "8fa1556e-07c8-48ee-bd10-7e8dcc79bd96", "comment": "Malware payload (Mirai)", "value": "3beca5ee5ceaad0196ae83c6514941109fb30862", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652248204, "uuid": "e3486692-88f6-43d2-b151-5be5bc70498a", "comment": "Malware payload (Mirai)", "value": "591fc9de51acb61b7b73648f77518808b9586571796157f8cac4f61a433342ce1f515bb23c94a108d13139c62de3979c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652248204, "uuid": "4d72a59d-ad31-4f39-b42a-67fac81fd60e", "value": "T1A7F34C46AA419A13C0D7177AFAAF024933239B64D3DB73069D186FF43F87A5E0E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652248204, "uuid": "a242c25b-7a61-49c1-b5cb-a2c9b206fd1d", "value": "3072:/XdUsBQ9dMAbkT2oZduvJyaYHxEWKiCtXWhR8NqkY9CXra8M/9GxqxmOWvEsBV:+SEoTuxyaYHxEWKi4Wf1r9CXr5M/9Gg2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652248204, "uuid": "5f541075-4c41-4c6a-a143-82cf7c9cb446", "value": 172717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652248204, "uuid": "6b6e2c49-fed4-400d-9bab-9a49234e9739", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652248204, "uuid": "d1e5d4e8-053c-43fa-8e41-b4f8ee5b5483", "value": "garm7-20220511-0550", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88888104-d142-11ec-8e58-42010a9c0032", "comment": "Malware payload (Sodinokibi)", "timestamp": 1652284423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652284423, "uuid": "33818cb2-ef4a-41fe-b048-77555d0faef8", "comment": "Malware payload (Sodinokibi)", "value": "a80bcbe62fd8d070796a757e3ca2a21b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652284423, "uuid": "84473bbb-d325-4da5-8034-c8f9982e4c75", "comment": "Malware payload (Sodinokibi)", "value": "2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652284423, "uuid": "ef1ca35b-1848-455e-9cdf-92e0d237fd40", "comment": "Malware payload (Sodinokibi)", "value": "d9edd7a50a0e94cf764c7c5d77361e83cb62ccac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652284423, "uuid": "de6404a6-6ba5-4f15-a8aa-e84f53807c27", "comment": "Malware payload (Sodinokibi)", "value": "0facc37121d47e12fe9fd0553fec3ac6390b699cbec518780c029382afde53535d2079f48f193ed92141a4e4dd605c23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652284423, "uuid": "56239258-e6d5-4d47-9c98-cecd52e84e9f", "value": "T18504E126E9910AB3D4B381F312371FD6A6BFFD3804652AAAC3727944166D0E1E91D393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652284423, "uuid": "fb75fc62-64fe-45b4-a59b-dfd3c4487c38", "value": "9014e39262404e977fd8e4e75cce30e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652284423, "uuid": "057e3184-0565-4850-b087-1b3e9e8d5972", "value": "3072:koppvXda3yJQZiiyDlsXdKp0FkynOl9Sn02br3:kGC3zZiXZsNygvOjS02v3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652284423, "uuid": "4a92b582-4f82-4e08-8947-5c970345fc9f", "value": 185344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652284423, "uuid": "bb4813cd-5619-44a8-a223-06d9dbbefcef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652284423, "uuid": "bdaf6762-cbcd-45bb-bc3e-dca3a862bec4", "value": "2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f06f2841-d13a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Nitol)", "timestamp": 1652281161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652281161, "uuid": "bb34328b-220a-4161-baae-71a3d5624179", "comment": "Malware payload (Nitol)", "value": "d8ae9b134d6e77d4800349df8258aec7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652281161, "uuid": "012946fe-4d40-4bfd-90db-33abbe91ef93", "comment": "Malware payload (Nitol)", "value": "2bc7fa0667a9b1b81742c83ec7cf6efdee608f0f3a643027331a79610ec11701", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652281161, "uuid": "6b004d6a-8038-4fc3-b4eb-ebb70e61be4e", "comment": "Malware payload (Nitol)", "value": "0b7bbcaa70aa0a1f11dc9f93de08e5f9b2ba6d5c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652281161, "uuid": "28620593-b3f2-49e8-b4ab-1877ac758f05", "comment": "Malware payload (Nitol)", "value": "53f016e64814c52c030db8b3b761b0b3336231bfc9eeb704e77bd9d28dd03776f0695cf879584e48537f5c6b46b2e538", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652281161, "uuid": "5a201ece-7769-4217-99f1-993aa354c7c8", "value": "T1CA647C1233E1C877D5A601334A92C359B2F6BE51AD3686477BD03B0EEE70252CF25B69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652281161, "uuid": "7391c521-1823-4314-966f-54ee8e07a45f", "value": "4660d4f55970ca074db150bc25297558", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652281161, "uuid": "11b64496-f671-496f-b91c-d8e7e506e5ed", "value": "6144:ULwpEFWtfJqN4ACGWkDQoYshnGMApM9LXYvEPf:NqN4ACGWCQmGMApM9TGEPf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652281161, "uuid": "329de9ed-f771-4a58-b819-6cc87283c5f1", "value": 315392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652281161, "uuid": "812e6dc6-4f17-4d8f-94f5-d3a7bec80edb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652281161, "uuid": "c692650b-d9fa-4711-b11a-60f59503285b", "value": "d8ae9b134d6e77d4800349df8258aec7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a997e45-d0c9-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652232350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652232350, "uuid": "241d4ba4-acfc-48d8-a557-c160dbfa1c1d", "comment": "Malware payload", "value": "410187123c9b4037843163327b9f5363", "object_relation": "md5", "Tag": [ { "name": "Evasion", "colour": "#ED2010", "exportable": true, "hide_tag": false }, { "name": "G0nnac0pe-Kekware", "colour": "#D9A267", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652232350, "uuid": "a63c4d38-761b-41cb-99b8-61e66af194ef", "comment": "Malware payload", "value": "3262ece43e7135c9ed6788588bae269ed75db800964d48cfb762542e0d003259", "object_relation": "sha256", "Tag": [ { "name": "Evasion", "colour": "#ED2010", "exportable": true, "hide_tag": false }, { "name": "G0nnac0pe-Kekware", "colour": "#D9A267", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652232350, "uuid": "766451f4-5495-4d6a-8d4c-31fa4e23b879", "comment": "Malware payload", "value": "5287f5c312b9ee139dee67bc01a4b0d2734100f6", "object_relation": "sha1", "Tag": [ { "name": "Evasion", "colour": "#ED2010", "exportable": true, "hide_tag": false }, { "name": "G0nnac0pe-Kekware", "colour": "#D9A267", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652232350, "uuid": "39b182d7-4f44-4a62-922c-baa0fa495f92", "comment": "Malware payload", "value": "7215d65fee6812a3e563476ef51e209324c1e9eabbbad32da28f93d97dfa39317f28d1205c328428be0236e9563dac79", "object_relation": "sha3-384", "Tag": [ { "name": "Evasion", "colour": "#ED2010", "exportable": true, "hide_tag": false }, { "name": "G0nnac0pe-Kekware", "colour": "#D9A267", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652232350, "uuid": "22bf0371-fdd5-4a87-a88d-625ec26568f3", "value": "T109E0E8E3C88E080C2CC22C300AC93B80D0C36C5CF4D006FA3762085B4D8BB8073D823A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652232350, "uuid": "65aeef6f-f989-45a4-b573-931760455742", "value": "6:h+8Gnz8Gnz8Gnz8Gnz8Gnz8Gnz8Gnz8GnacoO9s8qOLh8X0oK/DMIbpmTb4:pIgIgIgIgIgIgIgIatO9s8JGko1k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652232350, "uuid": "2317be65-2520-4cc2-a3d5-be1aebadf8d5", "value": 310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652232350, "uuid": "984bcf91-3827-47ca-b43e-2704040dc787", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652232350, "uuid": "d9282a14-777a-41fe-9ea3-27b4d1acde33", "value": "Read Me.txt.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf412479-d118-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652266502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652266502, "uuid": "eb31aeb3-2c05-4093-b403-5580e712d82e", "comment": "Malware payload (Formbook)", "value": "7b29f996c313caf095b998a9bda95744", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652266502, "uuid": "05a44b08-74de-4114-a272-1b77774b3ca1", "comment": "Malware payload (Formbook)", "value": "32fae9922417d6405bf60144d819d5e02b44060fa8f07e5e71c824725f44307f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652266502, "uuid": "f190bd4c-51cc-4553-bb62-321d66132619", "comment": "Malware payload (Formbook)", "value": "8e0f7213b6428434547a29b4ad9a60550ec8ba7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652266502, "uuid": "d7ccd587-f1c1-4712-8e53-56ee3b94509e", "comment": "Malware payload (Formbook)", "value": "50eefa18a797764b64987c158eb2ef967a0c97417f10a65169d2069cbf92da62c047d8e65ffd2dc2f81d87ea7efa3236", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652266502, "uuid": "ba7265c2-f517-421d-8e4a-98eebb4ccca5", "value": "T1464412146168D5D7EAE71B320CFEEB5A8C668C3521B1325727A09F47AE7B720DD0F182", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652266502, "uuid": "90b7d443-f66b-4c3d-8050-22fa92788853", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652266502, "uuid": "64918463-51c0-4e52-87f4-a4b595b39f77", "value": "6144:LOtIONJrKyXf4N6z1bY4SIZGYbQxxdqL++Omk1MorO3:LOLzrKyAN6deIvizn+KSo4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652266502, "uuid": "cfd39188-094d-4dcc-8bf0-9ae26ea358e3", "value": 259219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652266502, "uuid": "be5c04b2-06e3-46e7-aca6-04aad2c98850", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652266502, "uuid": "321e0008-1ccd-4143-84d6-caa711b91a1c", "value": "SecuriteInfo.com.Variant.Jaik.72878.19052.6747", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8db33404-d0c0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mekotio)", "timestamp": 1652228597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652228597, "uuid": "a26b7bd0-0ed0-4f7c-86ee-5c80540f148e", "comment": "Malware payload (Mekotio)", "value": "92058b84ad179d74ac6868406db10aad", "object_relation": "md5", "Tag": [ { "name": "CL", "colour": "#5EDEA7", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652228597, "uuid": "dd4dd89e-9fbb-4163-8003-5ef8e290c59a", "comment": "Malware payload (Mekotio)", "value": "333daa7da050f7c0c38d56bf0b42e1b2702715cb87fa462457ce4d89b340d0fe", "object_relation": "sha256", "Tag": [ { "name": "CL", "colour": "#5EDEA7", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652228597, "uuid": "bd4bc2d1-a5db-4ef7-ac53-289e91770f52", "comment": "Malware payload (Mekotio)", "value": "f1c5e236a2bc0a7a622076c5b5833c9250a27054", "object_relation": "sha1", "Tag": [ { "name": "CL", "colour": "#5EDEA7", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652228597, "uuid": "3fea9d73-47a0-47ba-bf3a-9c1353dd71ec", "comment": "Malware payload (Mekotio)", "value": "f2900b06526d45dd0583d8f8951db77a6a6d1c8afbd0c35af78d379834e48618da1ddb0b00b9a8d973127135c91be557", "object_relation": "sha3-384", "Tag": [ { "name": "CL", "colour": "#5EDEA7", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652228597, "uuid": "039fa92c-aac8-4a40-862e-a385bb6f4f42", "value": "T13AE56D22F288613EC0EB1AB6CC37D6159C3B7A716B12DC5757E4094C4F35982BA7AB07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652228597, "uuid": "0958a9dc-7184-4bf7-b384-2db186eed692", "value": "49152:8wiYYtw5cPhBQJ6KhgSpH7BRut7pIaHW4Y8T8gxorSFy8NitjVqoASA:+YYt7TQJtDujNChgVADtMCA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652228597, "uuid": "96ecbda0-e525-4e6b-9c96-65cf3c5b6c3d", "value": 3278336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652228597, "uuid": "de76ac1e-aca6-468e-a1b1-156af4ffdcbf", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652228597, "uuid": "4eccf7cf-edba-43d2-ba4a-fa5e969ea50e", "value": "MTT0001450001.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e205349a-d10d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652261809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261809, "uuid": "7d10d535-c7b2-4f62-814a-2a8314cc428f", "comment": "Malware payload (Mirai)", "value": "7e8b8aa67fc12353a3522d44b31559fa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261809, "uuid": "f1308f79-da25-4ad3-9706-4c7d7e86c688", "comment": "Malware payload (Mirai)", "value": "33ae5ff6ea3b4945e437c21568e7b7c1d2bae67542368dc50d6d18a2f5f52a13", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261809, "uuid": "61af8527-0d5e-4bc8-b144-b1351a6ca25b", "comment": "Malware payload (Mirai)", "value": "3c2080e7baf704a5bb9ef65ba781e511b103d343", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261809, "uuid": "f5c60f6f-0025-4cca-85ca-c0380800cbcc", "comment": "Malware payload (Mirai)", "value": "1701bacb85ed5fe499b54b74e63bec5b4254e2d60e63a1b000aa73c7198ef72786f43a4112b941cdb133de4cdb4f11a1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652261809, "uuid": "a371439f-72ce-407b-ae39-15198fd7964e", "value": "T191834C20A97D2E26C1D0B57F22FB8315B2E2270E26B4965D7C760F4FFF2464068572B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652261809, "uuid": "e667966f-9566-43f5-956e-e153021475cb", "value": "1536:49eb2RVvTRssZva1/2ncGZcq7x3axNcFFhzki6vFf3fAfiqFt7FFp:ch+NcKvFHAffFtzp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652261809, "uuid": "ffb17938-65bf-4ace-a6eb-4c914783eb26", "value": 82764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652261809, "uuid": "99ebdcbf-fe62-461d-a124-041cb83efae1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652261809, "uuid": "757e4852-521a-472b-a83a-7d26950be773", "value": "7e8b8aa67fc12353a3522d44b31559fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ac77f10-d0f3-11ec-8e58-42010a9c0032", "comment": "Malware payload (SocGholish)", "timestamp": 1652250335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652250335, "uuid": "1adf5272-3b16-4520-a663-f2b4f1bbbe69", "comment": "Malware payload (SocGholish)", "value": "f5b0692949de3428938d8b4155430e83", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652250335, "uuid": "ffae8953-96d9-4943-85ce-e83f62cb415b", "comment": "Malware payload (SocGholish)", "value": "3439524fe8f2eaf2103e3943f5a92a57aef76b1919aba3abf417ea57e53305d7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652250335, "uuid": "ea16863d-647f-4124-a7dd-84b08c8c18ad", "comment": "Malware payload (SocGholish)", "value": "e87acba3200ea45587fc46c19b896f244a0a6f9b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652250335, "uuid": "8d24204d-d071-478a-83b9-63a278c404c7", "comment": "Malware payload (SocGholish)", "value": "0769e18ba09cb3df5694c9d54d54b7d170fe0286e9b0b0468dd4b5133691f5d6c474b937529cad139def1c8377460fd4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652250335, "uuid": "ec5f0661-a24b-44b4-a85b-74af1035a76f", "value": "T11E41BF86F18F904E87C73F05D13D5488EABEDD36A0A8956C6F418284BDE02794355EAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652250335, "uuid": "1e363f35-ea0d-4d00-9105-f2cfaaa9769d", "value": "48:15L0HsKzE+9/5tJqbMM26oolEqh3wMXPCWXnpyuPsa:3ms6Es/IblEqhgMXEuPsa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652250335, "uuid": "565d21f8-6c4e-436c-952c-8f59048c1215", "value": 1913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652250335, "uuid": "90907014-084b-4511-8c77-23157a56d66e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652250335, "uuid": "17dbe0c0-7634-480e-a0ec-07dd59c7dfc5", "value": "Chrome.Quick.Update.ver.102.71.50601.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce779a38-d122-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652270796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652270796, "uuid": "556f2b68-c139-4264-9c27-891fea7d895d", "comment": "Malware payload (AgentTesla)", "value": "c6a2c2d6aee75c0eda793b84520245cf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652270796, "uuid": "03cdfcff-f6cf-4dab-b938-5118645101d9", "comment": "Malware payload (AgentTesla)", "value": "343b5796eb99f958b247b2e59bd91a348abeac3e55d0eee41b8293be64e51ac1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652270796, "uuid": "e6eb814d-7d6f-4fda-a518-a2140ec84b1a", "comment": "Malware payload (AgentTesla)", "value": "df35b2122f52abab4ada2884dfff28d061647212", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652270796, "uuid": "b1edf6a4-a6a8-457d-90ca-a72903c1efca", "comment": "Malware payload (AgentTesla)", "value": "e5db4b8cfa70be5381bd0bdf0c975a11bfd567baabaf98451224d58606fbd58799a6bfe2240ebbd3013c80182bce80ed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652270796, "uuid": "36556705-3287-499c-ba45-dafd197c9824", "value": "T1C6E4021CFAF6C712D1AD6F3B90F7441007BAAC09A973E75E2A88224DAE067D74D50367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652270796, "uuid": "3465520d-3c56-449b-8901-2a9f0aa23ced", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652270796, "uuid": "5ee59e94-90c9-44d3-a9c0-b4e7c69d5744", "value": "12288:VCjeVp6pDnV7fQDAEe85GFYbGX1Z7cHk77o+s2+azvS13KAEp:cjeVg/zQDA9ObGlZ7cE77o+b7zvSpKB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652270796, "uuid": "37ebad35-cb6a-4236-baa7-ad06674db304", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652270796, "uuid": "4ca8ed65-a502-4a36-aae3-02d749e29740", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652270796, "uuid": "e4d8324b-0dfb-465d-8994-926cf12bb213", "value": "product offer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d89e8c8-d0f5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652251172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652251172, "uuid": "dadd58d0-f98a-4e82-bb94-d2f097fcc99a", "comment": "Malware payload (Loki)", "value": "6e672aca7d0a9440057a1aba78593d82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652251172, "uuid": "ca4ccab7-2501-4b6b-b39e-36cc6929aeaa", "comment": "Malware payload (Loki)", "value": "348c4a66d4844d4636c90862d8b9c481e58fd38df59ba25a4b46744868e46800", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652251172, "uuid": "2e29170b-6366-4d9c-a2d5-24217a6e310c", "comment": "Malware payload (Loki)", "value": "a1337f76ffeae54377f14de945e09a34316149bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652251172, "uuid": "2e4c7dc5-f6b1-449a-b4be-633f706449a1", "comment": "Malware payload (Loki)", "value": "e63980052a87e4c31f5c0c2201cbcbc07ea49ff140f0c03d4a3605ac278b01af1932657f7a6748650a4e096ef8afce8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652251172, "uuid": "53a5ce3f-b30d-4a6d-ac97-cf8cee800046", "value": "T19EC4020823E8DB61E9BE2F78607D20156EB9BC567537F31D1FD0589D29A3B811A243B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652251172, "uuid": "58afeef2-5cad-4447-8ef9-e2ddc7f5ab1c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652251172, "uuid": "2f2e8743-9f60-41cd-ae0d-0d96fbb8031d", "value": "12288:mp9p1Cpchs2Dwyoaj+CegESCtZzIdmlW2LTOa2LJSp:mTnCGs2DHodCegqw2W+TtqS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652251172, "uuid": "ae2f6583-6023-41ba-9534-bf9d9aecc3ec", "value": 557056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652251172, "uuid": "8e676d1e-421c-4ebb-9c28-c9ae593ca706", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652251172, "uuid": "45abeaa6-933f-40a5-9824-25d1368a95da", "value": "PO SPECIFICATION LIST A AND B WITH DRAWING SHEET.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdc7a571-d10d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652261856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261856, "uuid": "bacbac3b-4107-402b-9c0f-1366eb8daff1", "comment": "Malware payload (Mirai)", "value": "34320433354184e1d6b4f3d642215918", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261856, "uuid": "ad76a9d4-1e5e-4133-bcaa-062bfb259908", "comment": "Malware payload (Mirai)", "value": "36cf9121286678882b264f6887b6e6e38bb3917f9bba4bc51faa3f6048308031", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261856, "uuid": "5339f762-2633-4de1-b87f-3d5d444c652a", "comment": "Malware payload (Mirai)", "value": "f212112b83804720bf742680f50f8f52b7d7ad1e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261856, "uuid": "2b1bcaac-3fe5-4872-bd32-930eaed1445c", "comment": "Malware payload (Mirai)", "value": "e2e5d1c22eeba3b47e0e068edc45e6e5868cfd1f83b9b431601ed6c2a05c141befeb23ed9214c88f6ccc8d056831e275", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652261856, "uuid": "6f8c2b01-633f-46b4-b39b-c80c37e7708a", "value": "T104733BC8A493E8F4DC1406782176BB735E73F13AB139ED9BD3E99567A801B02D00A36D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652261856, "uuid": "fc610cf7-4442-4872-b1b7-d2d7cad79258", "value": "1536:jwOgQ8JS4OZm3/W97kJ2f4ol+QLk+ltLugvSWy/ReAwJt8A73elr:s39HJ2f4ol+QLk+ltLugvSWy/oAm8iuh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652261856, "uuid": "b2e95bec-d527-4fed-8edd-233f1caf36dd", "value": 74328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652261856, "uuid": "43393f3a-085b-4ae7-8d41-a99ce39d2c2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652261856, "uuid": "4630347c-741c-4d3c-9183-35a028a515a3", "value": "34320433354184e1d6b4f3d642215918", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d05384a-d154-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652292000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652292000, "uuid": "7ecb7e5c-b93a-440d-a677-311c65a4e125", "comment": "Malware payload (Formbook)", "value": "79c46056fb002fcd31fba21bae0d9221", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652292000, "uuid": "c2e06535-1a36-4ac8-9154-74143216ef08", "comment": "Malware payload (Formbook)", "value": "37708373f6b4deb76e61c7a9c65200bba9f9d7ca7ebcd82d09242dd9231fa072", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652292000, "uuid": "eee3adf5-723e-46a6-826b-021b361d5fec", "comment": "Malware payload (Formbook)", "value": "56280d53bd4c977debbc0e36ff0b7a3f3b3e3786", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652292000, "uuid": "e8429af6-f86d-42e5-b6c7-7bf3426f1ced", "comment": "Malware payload (Formbook)", "value": "25b95620f0ff863ecb79061ccc07518b3cd1763fe31fdc4486baf6476a497436ee4c436b409bfe037ca49f9c51825dc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652292000, "uuid": "3b446396-915d-4276-8f36-e5ae2dcb8c52", "value": "T128C4231636FD4B12EA7A0BFA5482422003B9BFEB7130E74E4F4258DA6B93B115613F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652292000, "uuid": "c9093c7a-4ae8-4ec0-af8d-14ca86ccbbed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652292000, "uuid": "7a35ab2c-b60b-47dc-bd21-c7e40a9083e7", "value": "12288:XAmeu0m2jup+6QL8WuVfNUjEaF+Bqgbvy9GZQNk88UWIgRf/GzFB2ORvJ:10mwuUpQWuEgFBq6vy9EPKg1/EB2ORv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652292000, "uuid": "be8ab7ac-805b-4c2d-9ea2-d89e9424be36", "value": 577536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652292000, "uuid": "6b1ee047-6c7c-4c6a-8ef2-ceba538cfe12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652292000, "uuid": "f480e181-9e7a-45a6-a86f-a6440a4fd694", "value": "SecuriteInfo.com.Variant.MSILHeracles.37963.6224.26571", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c832567-d128-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652273048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652273048, "uuid": "8dd61be9-8193-4dc4-87ff-32d47a0658fd", "comment": "Malware payload (Loki)", "value": "cab12c2b8f5a1b841b3a5434def747bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652273048, "uuid": "2dceacd1-ee4b-4952-b652-25e3a94cfad9", "comment": "Malware payload (Loki)", "value": "3807df31a0db07c4ea7b4e06c0f8c2db76e3c84071319d1e1b356c62f3872512", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652273048, "uuid": "bec80751-f71e-47b0-aee4-36e412c2faf6", "comment": "Malware payload (Loki)", "value": "9cd5b29581dd8062ac3f46d118d4280c15d75aa7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652273048, "uuid": "4bc81827-f8d7-4b44-88d2-239d3b277e49", "comment": "Malware payload (Loki)", "value": "0ec6cc524a3f41e74fa9809ebd7da0c33a50e832731ac16c083ceb99342b974528fd0cd31570f7c925574780366ce787", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652273048, "uuid": "981b04e0-8842-413b-8824-32c93d86f438", "value": "T1FD0412147294D943DEA29E36AFB352A54EF699362474518F17D03ADD3DB3603EB0F202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652273048, "uuid": "95173697-0647-4e6e-89d1-9dfdace9c663", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652273048, "uuid": "303a6745-d0fe-4f80-b73a-cd20ff731131", "value": "3072:LODZGPEounbj2TWdwzcwEK7ck5aoRAo8nKPABGXUBgxEHY5e7JsxOZISno:LOtIOjKWdwz4oa6AzKPAIXPCl9sxMISo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652273048, "uuid": "25896ff2-9046-4b79-a292-4a23b85fc4c0", "value": 183477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652273048, "uuid": "9cb1ea95-6898-48a5-b9b7-66801a391f4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652273048, "uuid": "0e283b4d-d453-41bb-94d3-18a47667269f", "value": "SecuriteInfo.com.Variant.Jaik.72878.27733.1946", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb48dd72-d16b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652302144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652302144, "uuid": "ec392b22-38b7-4b30-819f-96bdcfa7f6e4", "comment": "Malware payload", "value": "b786d15ba596b444e8c0c2b730810e6a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652302144, "uuid": "7203a7e4-2e4b-476d-9b4e-6528347d6a7f", "comment": "Malware payload", "value": "3877c0c96fa52ca6dcf32b9556deb64181d6e532a7c882c14e6d8043129e8971", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652302144, "uuid": "10cd484c-ac4c-46a4-9bb7-923cf980d563", "comment": "Malware payload", "value": "f51533f87fe3d18c055b0961e8464c78f44bfa43", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652302144, "uuid": "b19dd2b1-104a-4420-804a-b0478bcc70a9", "comment": "Malware payload", "value": "616f78bc404daf5f15084484dfe2c4ac815bdf36d7ef6d3c16f6c3f69971d496ff061b79bfa9be3711e7c51652808771", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652302144, "uuid": "c5c2b971-3338-464f-879e-6a038fc0cfda", "value": "T10C03F133DAE9F5744F6114F0C62D001277ACEDE091E43A93423B1288EF961A17BF8AD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652302144, "uuid": "668967a9-80eb-403f-9646-9be6b2c845c3", "value": "768:zFxeRuTAS+BwWv/zmeCLwCQSovOVrVwW9OUMvq3U7rm:zLeMX+BwWvbsLwCucrnua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652302144, "uuid": "3917c677-26d3-484f-afeb-5aa965524e32", "value": 40936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652302144, "uuid": "26a78539-de27-4264-9b61-3893138c71a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652302144, "uuid": "9444dc85-037d-4f6a-90b4-869f005ae9ec", "value": "b786d15ba596b444e8c0c2b730810e6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19d18b2a-d106-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652258467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652258467, "uuid": "2b7ae1fc-3753-466e-a0ab-0c6bc4fe333b", "comment": "Malware payload (SnakeKeylogger)", "value": "a3f3ba1c1e80eb5e3a6eab827a8beaad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652258467, "uuid": "150c1de5-c0f4-47b2-be4b-fc34930c5188", "comment": "Malware payload (SnakeKeylogger)", "value": "395684a702c00aab157831c4a22745a500a07494272e138cb48675da4635452b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652258467, "uuid": "1234cc50-20ae-4cd8-aedb-757e2471eee9", "comment": "Malware payload (SnakeKeylogger)", "value": "17d4b4c7c51abb442e38602d7c55f08d58813802", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652258467, "uuid": "87a99cf9-baa8-41f2-8cb5-07a24677fba1", "comment": "Malware payload (SnakeKeylogger)", "value": "1837f0109531246e8dd0c728653bad33cfb3a8ea5b988c1dca6f2cc43ce07b6d1d18d2e1153d41aadc1d4c4ddb9faeb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652258467, "uuid": "d06e224a-03b3-43a4-aee3-3a0ee011f69a", "value": "T15973C181F244D896E91729F39C6FDA30206B7E9E8579861D3247BA1949F3303206FE5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652258467, "uuid": "7395c8f1-25c9-42be-a4c7-3db0f00194d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652258467, "uuid": "dd88571c-d535-4ae2-89ac-b6ae4ef8d867", "value": "1536:stsJq9x5h3VB7E4sf65NiJtmghrOy7BCRIRPCNfDHO4GACFLhSizXTMQAA+6JH2d:s2+3r7E4sf65NiJtmghrOy7BCRIVCNfr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652258467, "uuid": "1ba28875-f056-4f68-b179-f83c7ff68430", "value": 76288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652258467, "uuid": "ee7e52d0-349e-40e7-8db3-0fbd1f9ddf7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652258467, "uuid": "f27039e1-cb88-4b33-b97e-30c134a6b845", "value": "Halkbank_Ekstre_20220327_073712_983787.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a2f3746-d123-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652270896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652270896, "uuid": "2681b341-292f-46a8-926b-39a922722bb2", "comment": "Malware payload (AgentTesla)", "value": "ac0d016f7b0142368d17f980947a9b92", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652270896, "uuid": "cdcbde23-2334-47d4-99dd-17008d65ac33", "comment": "Malware payload (AgentTesla)", "value": "3982f95e9287b4848e04b2ae0e9b329720842a5cb221dff83f1ed48e2f7ad6fe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652270896, "uuid": "9038c98f-1bb3-4b42-80ce-46ee3f07faec", "comment": "Malware payload (AgentTesla)", "value": "49e36b3dbdeb3cd4a130dcbe7e96b262cfac661b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652270896, "uuid": "1beafdff-0afe-4e32-b0dc-6fbbb1811f8a", "comment": "Malware payload (AgentTesla)", "value": "0c863c8e5f127c76e5db83e6a8458ad94843981eb9656d1c916d55aba9cc17189f5e0efc20f4a72664eacaead42bbdd5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652270896, "uuid": "6eba468e-30bc-4b07-b7bf-8a8fe2f8e1e5", "value": "T109E4120426E8AB55C5BF7FBA607D30151FB9B815A436E31E4FC0A89D79137E14E283A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652270896, "uuid": "a924cf09-fb1c-4c7d-ba60-f1c1b65df83e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652270896, "uuid": "a5861d45-1d6b-41b6-859c-d7a4f99cc897", "value": "12288:PpipdeC6hFZ7CLEv2aeNYnQ/iO7H3VXPiHpys7N8CZIK5aBHEQ7p:PArGh30EVeNYnQ/iKiHpZ7Nb6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652270896, "uuid": "0886c81c-7d3d-4795-be6e-4244c6bd8762", "value": 694272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652270896, "uuid": "50d0abac-3388-4e99-a727-123692ad624e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652270896, "uuid": "166c705f-f3ec-4b6c-8ada-d2d2e0d31d19", "value": "PO EM212843_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b28beb2f-d16a-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652301673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652301673, "uuid": "ed369a39-b8ad-41c5-be8f-c0cad4133d42", "comment": "Malware payload", "value": "98a3bfa68be957f870c91ff2b18bbe04", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652301673, "uuid": "66d1bf8d-dcc0-40b3-8402-652b902289b5", "comment": "Malware payload", "value": "39fd19512c9f57df5adcd08f5a2163d333cb6c00cf8d0e13ee9e6bf3101677bb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652301673, "uuid": "a1bedee9-d344-48cf-a959-a5ac6355830d", "comment": "Malware payload", "value": "c6fec04bbfd30776f79b8f73b44ce0fd30c0b9f5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652301673, "uuid": "d1893ee5-c8af-4033-8266-3e255c80ac32", "comment": "Malware payload", "value": "980b0a2fa7a708c2cce9d7a0a400e379f35aef338633dbb85b94dd13065e74b3137c0685a8e41a51adc16226a63d6fdc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652301673, "uuid": "4759f50c-3faa-463f-aa6e-e7cd63dd4c4a", "value": "T1E803E17907C101BBD2A194BB82AF5F600E711F792092B80B4341F7E25F86175B8B6DF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652301673, "uuid": "8b40f76f-c8f3-4350-abd0-d28cae9e977a", "value": "768:iBDB81ok1vtadUlz6LjxdyD5FXYvqC4qkVFq7V5UPqdVQYNzQUBqJgGlzDpxYsM:M8h1vtGp32D5FovT4qqqoYDNzROVrY/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652301673, "uuid": "b09495d8-1403-4e50-b4f4-d179350b62c4", "value": 39336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652301673, "uuid": "b006eef9-3775-40a8-82b4-2760ffe76959", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652301673, "uuid": "70bf8bdf-90ab-4d8f-b310-34c7ae57b270", "value": "98a3bfa68be957f870c91ff2b18bbe04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da0b9cc9-d0f0-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652249341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652249341, "uuid": "06c6a8a7-0a4e-40f7-9378-6c0fb497c415", "comment": "Malware payload (AgentTesla)", "value": "d30fa6bc227726eccec95a1fc3f3f216", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652249341, "uuid": "577b4eda-3c0e-4a62-9ea1-43f9dd00d0d6", "comment": "Malware payload (AgentTesla)", "value": "3a0e5452e2746b6a47a2766f187ae9aca3bc51723be0ecd9c25dd3ca5f894fe3", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652249341, "uuid": "d3d5661c-68c3-4092-86d4-3a91a6655d95", "comment": "Malware payload (AgentTesla)", "value": "65f03f2b620b461b95a4080acca1c77c90d17d1a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652249341, "uuid": "4f3b0dee-9b55-4b1e-bc12-c38909b3805c", "comment": "Malware payload (AgentTesla)", "value": "422bbd4d45ddb6eb650a298bfebfc29854e1de2903d7a6f8895ce123d601355b5080414b20cf8a06b918f1dcf5f8fc58", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652249341, "uuid": "2573f120-f1ca-4c70-a8d1-a9a088cc4769", "value": "T19C9423614693835151ED03F36E88E5A2ED616AF1D6EC4C3B13306075C32968E7BC8EAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652249341, "uuid": "731b42ab-42aa-4ba8-9a44-ed703d92d7d1", "value": "12288:IVFFFedKOIYM3HXR3/pYZZLo0gD7SeHBG0F:IVFFcAl3jYqPrF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652249341, "uuid": "c86b9ced-283b-45dc-80b5-5ebb37c355cb", "value": 440987, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652249341, "uuid": "73bc2d10-e039-489c-bcc2-e16f987bd83f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652249341, "uuid": "44857171-0cee-45f7-b82a-5bf714aed480", "value": "Attachments.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f79905c7-d17f-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652310808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652310808, "uuid": "c03da071-fbdb-4ce6-a065-d2df5f9bbda4", "comment": "Malware payload", "value": "734c11aa8847bc6169fd56dacb482591", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652310808, "uuid": "dcac6c8e-d0c7-4703-af74-adb142ebc2ca", "comment": "Malware payload", "value": "3b121ece72676422e17261e8e7358c7451298bb59bd45cccde2a9236c7fb4365", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652310808, "uuid": "3840c059-64a5-43d9-8c9a-2d169aabbb74", "comment": "Malware payload", "value": "d6967236d7775d8291777e125372bf0e58b0e97e", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652310808, "uuid": "c825957d-b9ce-441d-b1a0-6de6020f2944", "comment": "Malware payload", "value": "76b72970cbfd34c6a252b2d1385c96856b8da6988225086257e1cdfd65881c472071ca774cda56e28afd4582bf211d58", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652310808, "uuid": "345dbfd4-c512-4eab-9841-7d37d9469a79", "value": "T1203533153B81AE6FCC11C87249B480A6D5B532A92DC259217842D142FDAEEC31F9EE7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652310808, "uuid": "47687ddc-ac65-4929-9574-9abc8438bf58", "value": "24576:kVS1RIK2UvdedhfCg2stZ+0KY5e68yL317Z6mB:kg1RIuvded5e6bKY5eyL317ZD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652310808, "uuid": "3b002fba-9fc2-400c-a3e1-99edb689a461", "value": 1105504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652310808, "uuid": "1913b88c-6ea2-4172-ae3c-35959b943392", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652310808, "uuid": "944cec6c-609b-4e28-98d6-b864f0d182e5", "value": "ComplianceReportCopy_52681157_May_11.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "261e65da-d110-11ec-8e58-42010a9c0032", "comment": "Malware payload (AsyncRAT)", "timestamp": 1652262783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652262783, "uuid": "4f685102-372e-4574-8d55-7ba78f11761a", "comment": "Malware payload (AsyncRAT)", "value": "0ba927f03c0cf30091450bfb68cfd18d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652262783, "uuid": "d61639c8-dc9a-4efa-993a-4abba50c3b9a", "comment": "Malware payload (AsyncRAT)", "value": "3b57d23ef709ec37fb6166168181f0a32c14f8af434ea24c4ce01e2898363ef6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652262783, "uuid": "a72a653f-d606-44e6-bf89-2b49f409b0f3", "comment": "Malware payload (AsyncRAT)", "value": "07eabf7cfef01bb303841fb27c7942d2c5a12d1e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652262783, "uuid": "eccc272f-3bfe-4c56-90a2-dcc1c5507b2d", "comment": "Malware payload (AsyncRAT)", "value": "cab682b58e6a8c09139e108a8c01ba1f2ca9c28378c890bc2fa487ba3953a64eca419c5d60c64827609085718301bbba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652262783, "uuid": "fb6d4a85-a128-4b30-983d-c70380f1a49b", "value": "T185232A003BE9812BF2BE4F78A9F26145467AF2637603D54D2CC451DB4713FC69A42AEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652262783, "uuid": "0b0d0911-e87a-4e75-bd55-63f8a79ee04f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652262783, "uuid": "f6769e27-b02f-433c-b2bb-1be5aecff200", "value": "768:MuwCfTg46YbWUn8jjmo2qrXM4pxYAv0PPIYvjbsgX3iH1QCy6o9Ky6BDZSx:MuwCfTgp/2MMGdYbbjXSeK7dSx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652262783, "uuid": "100692f7-a748-49b9-85c9-5cf8bdbbb3f4", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652262783, "uuid": "b1ac08b7-8d6e-4edf-9118-1b523861f7a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652262783, "uuid": "0eb0ca2e-4f5a-49f3-a1b8-9b81161d2f48", "value": "0ba927f03c0cf30091450bfb68cfd18d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "653125b6-d0eb-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652246997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652246997, "uuid": "c7ddb899-dd82-4f84-809a-e8526f8ed596", "comment": "Malware payload (AgentTesla)", "value": "382f6ea7936ea958eda62cf9452fcbb0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652246997, "uuid": "6dab4dcc-0ecc-48d5-87ba-335261d1cb88", "comment": "Malware payload (AgentTesla)", "value": "3b8a153ee8b331fbb8152f5efc11160906112f4fdaa97dd44c6cbd49bc2b6ef7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652246997, "uuid": "55c8d9ef-84b8-4530-8b37-a1688a5cd17b", "comment": "Malware payload (AgentTesla)", "value": "3b492fc79ace1587690309a62cb819fc600625e7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652246997, "uuid": "c7dcbfb9-a68c-41a5-b8d8-c72b5a6ab9de", "comment": "Malware payload (AgentTesla)", "value": "1d547b448a7da2a4bfa19b3e0540cf674c3204bfb60bb35ed3a021fc6e3d348094574c4211327fbed8fcd26bd2826708", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652246997, "uuid": "ff051b66-438f-41fe-822e-9fb0403bb11b", "value": "T10E9423520BA2535142F903B36F8895A9E6A129F6DFEC4C7F133060B1D31D28679C8F9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652246997, "uuid": "5c68f4c2-14e3-460d-91bf-4ce2b739efc2", "value": "6144:RwNYEY9jNsMFXerOMQ88Ett70Jny3kFYkGZ4H6yiXyh/pYJw0KFYlnvglLzqIN0m:7HFXeh8cIie3FHRR/pOllnM0gDXGeQM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652246997, "uuid": "bb89faa0-7e4f-4d91-af14-fe43eefdb9bd", "value": 440968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652246997, "uuid": "64fd3a66-d858-43e3-ba3d-e3ac2191ab8b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652246997, "uuid": "47c8fd56-277d-4f13-9ef9-664858a87903", "value": "SOA PDA SETTLEMENT PAYMENT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2334944-d0c9-11ec-8e58-42010a9c0032", "comment": "Malware payload (IcedID)", "timestamp": 1652232604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652232604, "uuid": "bdfe934a-87ba-4696-a895-d4e752928f1f", "comment": "Malware payload (IcedID)", "value": "d6b0e79b3ccd9d6600a3cafa7c468267", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652232604, "uuid": "169d68a1-0326-4211-a3a0-9b13e0b7e428", "comment": "Malware payload (IcedID)", "value": "3cbc08dc4f11379f6e080a7b6dad3e2f7c53202e08f461100f4ce4f5b869811a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652232604, "uuid": "2cf7dad8-4cab-4a61-8877-f4bbdf87fee9", "comment": "Malware payload (IcedID)", "value": "88b7ad4c058a1238712849f950ae3411d6dc8a03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652232604, "uuid": "5dd289a3-5721-4957-9002-94876ccff3c3", "comment": "Malware payload (IcedID)", "value": "41fcc38d62127fbc024dd50657706af3bf15cadf7583ddab05b192cadb5dc95915c23952145dd8e7b819c1b3511896e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652232604, "uuid": "328b34f4-78cc-4571-85ea-77315dbe5c50", "value": "T18BC4AFB876147CD6E66F567BC9D6BCDD13B627228ACBA8CD806477C30563372EE02805", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652232604, "uuid": "09b6617a-cbdc-4f4d-8b23-e2abf04a5b27", "value": "05b82023beedae5ff5647068c869c0f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652232604, "uuid": "a7518521-eaee-4e56-95fc-7f701b47f7b3", "value": "12288:jMOZsM2/zZD5zFR7UM7zTogg+3XEg7WFvrLFWIqFGDEVAU3:jM+svlDlFRP3HpWFvrLMI8kEVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652232604, "uuid": "16c99c70-044e-4563-99ef-0e78410870d6", "value": 590336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652232604, "uuid": "a28eb2e7-8c12-4346-8646-a72efc09c5e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652232604, "uuid": "db523cfc-cb37-4347-acc8-7fcaef69e783", "value": "giotro.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc042cd5-d14e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652289663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289663, "uuid": "66aa849b-bcc7-46d2-bce3-0ad9868bb93d", "comment": "Malware payload", "value": "dbe971da61272c01fa6a14510c9839f4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289663, "uuid": "46a1cece-9180-4b7a-86be-91c9bf8ac576", "comment": "Malware payload", "value": "3d071b55235dd732fe977cb00edf6bdb366791e19fc9963935a2839e874a71df", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289663, "uuid": "1b0fc968-3b07-46c7-a207-c684584a4280", "comment": "Malware payload", "value": "38e37404220a2fd751a1eca232d1f03bbf713ff2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289663, "uuid": "d831a91d-6ea6-42f6-80f7-fd10470cc4d0", "comment": "Malware payload", "value": "b8281f41d75d3d56560d71b5c34ab150dfadafcafe6573eed6e2b7e3f15748f2f7b778a5f842501a96c70be8ffd66a35", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289663, "uuid": "4ac90655-4318-4307-88e4-d918c98aaf61", "value": "T15103F1E7E51CC5B5EFB005B5EE3B4043A14B2CADE4849012F7A0407F1EE22B1BA9D5D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289663, "uuid": "a87e2ba0-97ba-4f60-b770-1e14bfef90a3", "value": "768:nkJ56p6b4LMXOPAppDyVsgrgepgy52Q8Lw956eKpNALnq3U7V1:64p6b4Q+PGGVsgrFz6w956bpNEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652289663, "uuid": "62490a86-ab6a-4a65-b371-c8520a52d231", "value": 40876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652289663, "uuid": "98a051c5-9ce1-4d7d-a6fa-10dfc1227cb6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289663, "uuid": "60d6dac8-0f45-4d5a-a4e4-b269a7b6dc53", "value": "dbe971da61272c01fa6a14510c9839f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c9178a5-d0ef-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652248647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652248647, "uuid": "98487293-46a2-4000-9ba6-ebee45561754", "comment": "Malware payload", "value": "e308f2559ba5010e492b99ea9e350b3b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652248647, "uuid": "4ba50fd9-6ede-4f07-aab3-e49d5baf5bf1", "comment": "Malware payload", "value": "3d10fa199856942dc50bb810376aa0e06a08ad01699871f945c7e3fe6198266f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652248647, "uuid": "fd82f7ae-a024-4be9-ad76-1ace722f451c", "comment": "Malware payload", "value": "311a7576597da1b3f6aeb9ac2c8f8588ac8aac30", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652248647, "uuid": "1e1fe860-32b1-42c0-9319-46c1b70e2ed8", "comment": "Malware payload", "value": "27452382e041bbca707a9c3918595d93f070ad9320733b4ac5445983bf1e7cbaac86c2b54794c4e42d06fefbf25d8b91", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652248647, "uuid": "5c0f1dcc-6abd-4316-9395-2cfa62c5dc92", "value": "T160A51409A147E67BFCEC08A7455080D0C29D7FAA7B528CCDE93AD686150F482F7B6D87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652248647, "uuid": "242c5e6c-afdd-4679-895b-f42b2b7be1f6", "value": "e92b2275a730f59940462780c383a1b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652248647, "uuid": "4c00cbae-d72e-47bc-9241-6adbce314049", "value": "24576:I/XEXjJSFHUKK45HU5yyYu4bDuC4mx32OkJgcvdWCqFg4wRekQrnFw8ZXWPD9WJT:I/oS1H2BmLt3kJFICqa4z+lM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652248647, "uuid": "97435f27-974d-49bc-ba6e-84ecac09e6f4", "value": 2125395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652248647, "uuid": "591ce8da-3151-4164-80a3-dc7fe29f5d83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652248647, "uuid": "93decd88-8fc5-44f5-85de-42683bc17360", "value": "e308f2559ba5010e492b99ea9e350b3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36ab7aa4-d0e6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652244771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652244771, "uuid": "6dd61dfe-fd75-41a4-a482-b51befb046c0", "comment": "Malware payload (Formbook)", "value": "de052543f764a5427b3e82a4f5247f34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652244771, "uuid": "31161e85-acb4-492f-a11d-a53bebe27191", "comment": "Malware payload (Formbook)", "value": "3d23366eb40c060cf56ff358c51fbf2dde54c1c63ddf508185ad59856f817ff8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652244771, "uuid": "0f94b16a-e372-41e9-aff6-2ea9094ca735", "comment": "Malware payload (Formbook)", "value": "e2566dc506501c53a2dbfc3df109405abd580dee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652244771, "uuid": "42aadd51-eafd-4e2f-970c-05bdb5b17c11", "comment": "Malware payload (Formbook)", "value": "a367e23586a9402c25936ed40d071756603b82dc823c3768d2c6140ad4f9a8aa583a2a820b1645c84f1292802e9c18cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652244771, "uuid": "eaa00b92-a0d9-4ad9-8aea-50dbcb768eff", "value": "T162541241A72BC977C8A53F7515146A367EB9BC35FCAC2207BB107924263331CE6CE692", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652244771, "uuid": "bf37fc55-f81d-4fc4-95cd-9af480ef3548", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652244771, "uuid": "def52c70-2c80-4ef8-9958-42d07d1f477d", "value": "6144:TOtIoF6rwA/TIEm+0bP9ghrBXCyQn4Hq2j3riLzMrTK:TOdFC4Em+0SBCbnAriUrTK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652244771, "uuid": "aeca3b9e-fd52-4b4a-b273-af99bcfbb89f", "value": 288822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652244771, "uuid": "0efb8aee-5d9f-4579-9e32-690886d93ae1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652244771, "uuid": "54c80a83-1bb6-4393-b4ad-7a8333dcd2a3", "value": "Slip_POWR-47QOU60_xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e8d4940-d10d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652261535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261535, "uuid": "60d84d25-7d3d-411a-8b14-8414bb6d0eb4", "comment": "Malware payload (Formbook)", "value": "eca9c292a855b6c5eca13752d6c46cf1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261535, "uuid": "b19d6a9e-1ade-4735-8c80-9a5fa514c811", "comment": "Malware payload (Formbook)", "value": "3f3ecd25d139e30aefd3ecdd6514068a97e224def019650aa721e0d27a8f2e6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261535, "uuid": "3e68015a-6fde-4abe-a2d9-77548d01ebc0", "comment": "Malware payload (Formbook)", "value": "987d55ae5e37fe7c96a0a657e34ea4a0eab96a27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261535, "uuid": "a9013c30-e733-40e6-8080-3d0328b047d8", "comment": "Malware payload (Formbook)", "value": "a69c1fef9d08d48b59567923fb26576b1d83a5050c202684d0f9d6ac9155478f086a968c5296293ce9ad5cb8af11faa1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652261535, "uuid": "71093aa6-3090-42c6-be42-c510a6c676b6", "value": "T178E4011D7AFBCA12D57D2B36C0F5506407B9AE059033E31F25DC224EAF223974A56BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652261535, "uuid": "354e0268-aa30-4788-9487-3879066aa5d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652261535, "uuid": "def6f1d4-9294-4ed6-a983-1eadf1a6a062", "value": "12288:qWAVsnpQpXBvTqglzsAJEZardhtkY4lBhSwiokKm4sQ/jjhQFFsrsp:qQSFBv2qggEZardKBhSwiBK3/vm6s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652261535, "uuid": "0075b2a3-f77c-4261-9e1d-1fd4cbaf465f", "value": 681984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652261535, "uuid": "babe6bff-8dbb-48bd-ace7-ac3223deadb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652261535, "uuid": "5a0a5aae-dbda-4c42-b7bc-7480e46d6096", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7767dad7-d0eb-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652247028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652247028, "uuid": "3390f855-eef3-4f1c-9bd2-264c24c5af94", "comment": "Malware payload (AgentTesla)", "value": "a56d3460621101f0f5b5493c00aa2523", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652247028, "uuid": "3e42c8d2-8717-4436-adeb-32d3137b66a7", "comment": "Malware payload (AgentTesla)", "value": "3f714c220b1c7ecf0b7b00974d2c7912961df2558ce4085bbb7dbb7afd9b4b27", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652247028, "uuid": "081b873f-fd24-4ea3-8846-0a2a27d52d66", "comment": "Malware payload (AgentTesla)", "value": "cc64e819c458d586d4b6792f5c67f14350599f48", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652247028, "uuid": "5fec9451-7a31-4d7c-9a98-4a687c60a16c", "comment": "Malware payload (AgentTesla)", "value": "d60cbd04fe6bf5667799988e171bc8aac1da7eaa63b9e022f233146cc534cb2635f37b6b12461bca8e06f965c8759ec7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652247028, "uuid": "eb721496-f7c5-4740-9ec8-9977c69992b9", "value": "T1D29423520BA2535142F903B36F8C95A9EAA129E5DFEC4C7F133060B1D31D68679C8F9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652247028, "uuid": "cf9b1a69-6d38-4762-a41a-6a3f021b5367", "value": "6144:gwNYEY9jNsMFXerOMQ88Ett70Jny3kFYkGZ4H6yiXyh/pYJw0KFYlnvglLzqIN0N:+HFXeh8cIie3FHRR/pOllnM0gDXGeQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652247028, "uuid": "dfa8ee35-820b-49c3-b1be-3ad03bd64b05", "value": 440946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652247028, "uuid": "54bf78c3-c066-481d-8fee-78f3aaed6d2c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652247028, "uuid": "a4b12f19-e0c9-44ca-aced-5e79ab5ce86b", "value": "Purchase Order..zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7821c63-d10b-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652260906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652260906, "uuid": "91e21d3d-862d-4c50-ae5a-9358c36c9dbf", "comment": "Malware payload (AgentTesla)", "value": "f87cbbd240d565031368cbad73ce2808", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652260906, "uuid": "adc04f97-4189-48e8-8e0f-e48d1e192c21", "comment": "Malware payload (AgentTesla)", "value": "40853234e58df42c24b61ccede5e0f086d800e095c94951d2abaf18ad1c367ba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652260906, "uuid": "f0c20951-d720-4663-b7d0-090d0f387ce8", "comment": "Malware payload (AgentTesla)", "value": "6659e161315a206b9bfbe7070c050b1f32f5ddca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652260906, "uuid": "06480d76-6ec1-4920-822b-708a6682f7ff", "comment": "Malware payload (AgentTesla)", "value": "bd9a95435a8dceac4386957ea6f71206c9e87a01a71fa886f3c15c79eac431516f6ea48c12676616e5c8fce336b2a4ac", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652260906, "uuid": "674b4e07-5571-444a-9ff8-6dfcd4945dd3", "value": "T1EDF41228F2EBD911E17D2B3A80F9A11447BABE16E423D70F23CC234E5E127970A55797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652260906, "uuid": "5bded9dc-12c2-41b2-af60-ee398665f560", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652260906, "uuid": "0abc2b17-5151-4f19-a92a-45ce28493aa3", "value": "12288:vCpypqOPeoYOIUdzijA78+9GD+sZPfeZ4giNzHkY8S2eSLU+dHA19p:qczPeoXIU5ijAu7xfjdgY5/SBq9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652260906, "uuid": "58890327-8fb0-429f-bbaa-1e830b549bac", "value": 723968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652260906, "uuid": "cee78785-9c7d-4516-af9e-a81c8f8c904b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652260906, "uuid": "e0a71b65-1281-4d38-ac77-89f2824e413d", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f524624-d109-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652259738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652259738, "uuid": "7ca17a98-b543-4995-861f-d26c59688fd3", "comment": "Malware payload (Formbook)", "value": "af8e2192f8e67182761b3e533d017af7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652259738, "uuid": "f15f44f9-96c7-42e8-987a-12eac728d63b", "comment": "Malware payload (Formbook)", "value": "40fbb07da69abd2e9af76579e314905103c73059c02b77c74adf81ab97eaa099", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652259738, "uuid": "c4af3cd8-d4be-41e7-be30-fccf00f732f1", "comment": "Malware payload (Formbook)", "value": "e9a55a5e8cc2cdc571b965f0719a9e92bd749f21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652259738, "uuid": "361089c1-616f-44e7-9384-34ab48073e09", "comment": "Malware payload (Formbook)", "value": "e4016eb212e1680901ddaf398965a37dd186c025f06b16edd00418e9c9828981f929930f72be6820b75341deb783361d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652259738, "uuid": "c9095950-4727-4d2d-bf2c-07f35111d0a0", "value": "T1123412612382D1B3F1633F785D76FB60C6DE862614E4A6171B143A48BDE3750E72F192", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652259738, "uuid": "8dc618e8-d4ad-4b7e-800b-237ff9020af6", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652259738, "uuid": "b31fcb53-db12-496c-9ab3-57f7be72218a", "value": "6144:LOtIO8I2kAL/IWtUgogR4EUW98kNrJd9bsd0WA8HxZT8F:LOLUVtUgR4E5+UJk0W3xZTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652259738, "uuid": "b401334b-0e8c-4cc2-80b0-97e663308e91", "value": 251155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652259738, "uuid": "9b0375f7-c6cd-44b1-9baf-a6fca9da8fb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652259738, "uuid": "42a0f593-d64a-4e04-972b-e32172762764", "value": "berthing.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c209e2b3-d11b-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1652267769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652267769, "uuid": "eb7b19df-61d1-4fcb-a8bd-9c237521b755", "comment": "Malware payload (GuLoader)", "value": "fb1d131568bdd2fa951608534f83a75c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652267769, "uuid": "4b0d235e-111e-4cfc-abb9-123658fd1e61", "comment": "Malware payload (GuLoader)", "value": "42625067621ac2dba6b95e565a48454637f46185356034da214a00a3d453c971", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652267769, "uuid": "b30ec185-84a1-4a0b-b1d9-96798bb70c7a", "comment": "Malware payload (GuLoader)", "value": "ff02df2cb07c221b8ed3583c6dafb8c0e35684f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652267769, "uuid": "ff8d9a38-de9c-465a-9ce0-3b65395c430b", "comment": "Malware payload (GuLoader)", "value": "fa588f4327a3c87939a2d13934421e6877adf0ac1e203149c7c33d770a3636899f7761e45e89333d25de003a5c335752", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652267769, "uuid": "42ec348d-6aa9-48a4-a98c-00cedb962eb7", "value": "T12344D01E3225C4E6F88883765F3A9B0B198FAC03219105177772BBB99B39383C95F5D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652267769, "uuid": "a1b6e5c1-9c2f-49e3-a38c-63b0c5a1750d", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652267769, "uuid": "79300745-5d64-4030-8849-cf4999771c5a", "value": "6144:s3yztNlmkDzzo+3sYIEJwqq1XPo6BktVrQGs20z:s3+FvzxsPXj1/o6Aiz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652267769, "uuid": "9057d205-d0c1-4eca-b339-39245f1f7bf4", "value": 254208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652267769, "uuid": "ad5d571c-0563-490e-a47c-830ca3e727bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652267769, "uuid": "d4448e8e-15a7-4153-b050-02bda00e4155", "value": "Transferencia.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45d28cb7-d0ff-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652255534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652255534, "uuid": "1aff119e-041c-4ecd-ae3b-d118f8d7c0ec", "comment": "Malware payload", "value": "a38802a6634224f5f78fb4371fa279b3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652255534, "uuid": "d8f323df-6068-4cf6-be6e-b41a00f41582", "comment": "Malware payload", "value": "42fddd0c48879242ca31ff29ae52aa4cfb168e7876d9d90516b0e3deb9349cf3", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652255534, "uuid": "f7445d0d-f9dc-48fb-a8fa-007b6ad9402b", "comment": "Malware payload", "value": "666d4ad02515a52d2979ec98687070795872786e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652255534, "uuid": "d17742c7-ccc1-48c4-8dc1-46ea2afac1c3", "comment": "Malware payload", "value": "eb3bb1be1ab919fcf409d8ec4c9eaa848706b77f6e587884b04e1ab102f96405e44b7c939f2b53f92cd75de42279129b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652255534, "uuid": "77b3db18-0494-47d7-9452-281675c5c957", "value": "T17E85EF31B133BA87C3160561565FBF4553287F43B2C55F4CB04EFAF82CE68A6A38694A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652255534, "uuid": "c822fbe9-610c-4ea1-882a-d1fb71dce574", "value": "1536:Vch6dtRGWbCtpl5kmrJ//RFxXxBpzB9TBtiBqK8Qf6YXkY0kY0kY92i3e+6fw5bf:B4g0s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652255534, "uuid": "64454b0f-b639-40a1-b9b8-427579134012", "value": 1813199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652255534, "uuid": "52b1c584-f50d-4d9c-88d8-ef463774699f", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652255534, "uuid": "1d88d1ea-d4b7-434c-9e99-e5aadb9e960f", "value": "308RFQ-Signals SA.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4c54acf-d164-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652299207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652299207, "uuid": "4c7485e6-2f1d-4125-a308-25530c873924", "comment": "Malware payload (Mirai)", "value": "86036a36098c1fe88605f260815bda78", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652299207, "uuid": "2525d9da-7273-480b-8f28-53c4f282968b", "comment": "Malware payload (Mirai)", "value": "43a3d49420b0874c1388457bb182458730b658f3bc2facfa2d66e757622a1858", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652299207, "uuid": "095f1e80-6945-43eb-84d5-b6bad3b2b715", "comment": "Malware payload (Mirai)", "value": "c731d6c6414dc4e3385dfb7738926bc0e9c66573", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652299207, "uuid": "6f96b23d-2c1c-471d-8393-9c774f47027f", "comment": "Malware payload (Mirai)", "value": "bc655ea6acb4fceec771677924078a7fbc35e5328de07d4723d7f31b354be9ad376286f3ec64e82173d146c32316cc41", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652299207, "uuid": "8c7fc7c4-24d9-48f6-8411-6554ca0b8903", "value": "T1C2B2E011BAAC4DD2A6704D33DF5C8393B34703BAD0DD744029265A24DDCD82725EAAAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652299207, "uuid": "65777dc8-1d5d-41b9-912a-90deb3baaebc", "value": "768:c9MhmNhHXqPpY5IpXetXpsIifmqwz+s3Uoz7:c9QmNhHXqxRpXgXpUf2z7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652299207, "uuid": "2885b3a7-9689-4b93-8446-c9024d7f5562", "value": 24648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652299207, "uuid": "ba499754-6bec-4f17-9179-4f051cf35d1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652299207, "uuid": "c67c8546-c611-4992-9352-09f980b849b9", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b00ceff-d129-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652273582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652273582, "uuid": "20a02a34-4af5-4a43-a9ff-a174ec20e978", "comment": "Malware payload (AgentTesla)", "value": "aa5d0195eed3f1bb2688a43b0b7909ae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652273582, "uuid": "c79e74e5-8875-4985-96e6-92be76323dbc", "comment": "Malware payload (AgentTesla)", "value": "45e2e4d5951f95af966ff0da049c907841167c2231d0fc2c28c1370666a218f3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652273582, "uuid": "00c7af1a-e649-488e-be31-2bfe3e5012f0", "comment": "Malware payload (AgentTesla)", "value": "1de37b6d6d63d3af51e7d9993e8be7187c8bb610", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652273582, "uuid": "afc142c9-cb15-4bae-9ce5-63e3057b65da", "comment": "Malware payload (AgentTesla)", "value": "f91be5a66994d325a148e2b2d8f5862ea0c729b62db8b1b124f612cc7b1acf55daf32d67d1d56ea72ed871a01bb71a09", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652273582, "uuid": "c6d92346-82cd-451d-a7fe-5fc3e985b026", "value": "T194D4170067FC6605F6FBFF2169B421514ABABD9EBE39D10D1A92058E4EB1F40D960B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652273582, "uuid": "bce82d15-c854-4438-9db9-256fa26b8d66", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652273582, "uuid": "6ec666a9-7404-4321-8af6-51ef6feefcc8", "value": "6144:uxnjd+RR7ng2WMdPXoiXOQN5RWoIlIAwUOohQmAsKCkR6OzKOWyq+WxIRkSruN:05yJdP3OQN5y2UBhQpPRtop+ESrK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652273582, "uuid": "2a2d9419-abb3-483c-848a-7b3d3c10aa39", "value": 600576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652273582, "uuid": "e2ddde02-fd38-43ec-99ad-13b6e8cfe5c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652273582, "uuid": "507eb2c5-5c1d-4b8e-aa82-d0a14358d2d8", "value": "NEW PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fc4bdb5-d156-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652292998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652292998, "uuid": "79ebb574-2861-43a1-b459-e14af172a16c", "comment": "Malware payload (Heodo)", "value": "7dc75c82497fc725756bcfb3629c72c5", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652292998, "uuid": "d9355939-de97-4d09-9602-143adf1baf4a", "comment": "Malware payload (Heodo)", "value": "46cf5738072d6642056d3b7227446ce089261aa83b258db4845d3f1246824309", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652292998, "uuid": "d5975542-f9c7-4166-b0b7-8eb67bff82e4", "comment": "Malware payload (Heodo)", "value": "8fa811fb62752166a97190987c2b8b4ab309b959", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652292998, "uuid": "2ca60b8c-222e-48fe-9b68-965d1ae6f91d", "comment": "Malware payload (Heodo)", "value": "0548f4c36d1ec47bfbcf65bb163c78e3cfe6d79f45ee9fcc0ba5e4090b391fd24f0793a00d2577c0701c6bfc8fcca34d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652292998, "uuid": "568daefe-d8df-4db7-85b2-528216d9d74c", "value": "T190B4BF06B3A504B9E467C174C9735952E672BC121761AAFF33A0436A2F37FE06A3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652292998, "uuid": "5f91f213-9605-4079-84e4-6a06c98161f2", "value": "6196af15ce9ababd9a592319b3043ede", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652292998, "uuid": "93ce2fb8-d9df-4b11-abe7-5f4e2642f7ef", "value": "6144:iuD3jumQgXW2jLi1QPy+hSVL+ymiohazdtUPM1UlTIqNtF1FMytrf:ZDLVXW2j21QC1+yZoqtUPMg9Z1FMyB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652292998, "uuid": "35ddc91f-3d96-4eb1-be22-ca43de5edd6b", "value": 513536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652292998, "uuid": "baf09819-3948-42c1-a6b7-87e70dd29079", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652292998, "uuid": "e82ea0f3-f4a4-4042-a2cd-0b4df466c7e7", "value": "7dc75c82497fc725756bcfb3629c72c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "898e3131-d140-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1652283565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283565, "uuid": "63258532-cb5d-40ad-9d2c-4cf9e502d7a6", "comment": "Malware payload (Smoke Loader)", "value": "163776d17fbe428eba6edd9532dbb4e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283565, "uuid": "5443c8c0-970c-4805-87bf-2340c8921ccb", "comment": "Malware payload (Smoke Loader)", "value": "49272c2faf2a46c091c8b266c5bcca756ff471878e544cd6a4c5fa3273842a97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283565, "uuid": "26ddacae-1d37-4260-878b-4e70f4800f1c", "comment": "Malware payload (Smoke Loader)", "value": "9b185809fa3297ff2c311933b2108350488d098e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283565, "uuid": "b89fdf27-6688-4c98-b0ac-ba985c90ea84", "comment": "Malware payload (Smoke Loader)", "value": "9205fe6677f004200f126f53a493028baddad1c2385f416d1466f815ffd565db75ca1d1aade4c392d1db8753bdc3ad2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283565, "uuid": "9a371ab9-0805-4bd8-8535-6b7d25462a42", "value": "T1A0C425C573949013EC575A304FA383CA9729FCD0BE34719B2265F36E0B3AAD26E65B05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283565, "uuid": "08ae1941-60c9-4ac9-9a59-fb56f67d185f", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283565, "uuid": "167f61b5-3c89-4b36-80fe-b9cb047928d2", "value": "1536:9Vrae78zjORCDGwfdCSog01313gs5g8ApbpjEZ8nVSBpX:97ahKyd2n31Z5IplaSV8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652283565, "uuid": "f5e8d87c-ac55-4c8f-b78e-56c1c5b8a4f8", "value": 556544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652283565, "uuid": "0f29c327-0547-4d3e-b997-382f4fb54cc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283565, "uuid": "637b909a-2dd0-4ac1-80d2-0402251fc117", "value": "163776d17fbe428eba6edd9532dbb4e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d87ec8a-d134-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652278391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652278391, "uuid": "90ac971a-056e-421c-b93a-617e6d5415a7", "comment": "Malware payload (AgentTesla)", "value": "dc53ae4d13a8cd0107a09556f3265356", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652278391, "uuid": "66618263-b7e2-4ece-8544-9bfdf97f2ff1", "comment": "Malware payload (AgentTesla)", "value": "4927c86dc4aded9410ba188fbe33fba1bc527103be0e66693e23a245e731479f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652278391, "uuid": "d26e60db-3f34-4040-9add-f8bcf8bc5fef", "comment": "Malware payload (AgentTesla)", "value": "1124e3b690eed1f7a346a0ec729e7bec3b540d20", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652278391, "uuid": "0fde2b87-0cc9-4475-b602-4578c05db8d4", "comment": "Malware payload (AgentTesla)", "value": "31073348f3c91147748114ed547333cde0ab5a633a8d9e9fa9d4d835574f0d6aecf187333bcdd79c808aee85d97d0fb9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652278391, "uuid": "5a054aa5-6a54-4edd-9e56-eb215d87838a", "value": "T184E4120426E89B65D9FE2F7630B921556AB4BD89B036D31D8EC07D8D7A277D208603B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652278391, "uuid": "4ec4045e-76ac-4f2c-b782-0505c128ba78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652278391, "uuid": "3ef42eac-9da6-42e0-95e3-7bb7b5a57b5e", "value": "12288:0vprpLObT2VaAaAdeRgRROZIu8zr52KNPVxRVfmtHckpw6/VHjWp:0v1leRgIT8zggi8odHK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652278391, "uuid": "fd1aa9c0-7a16-4d62-ab8f-bbef587afe8c", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652278391, "uuid": "6853dffb-95af-4e02-b36b-692c5f19fcc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652278391, "uuid": "78dcb97b-a8e1-4825-a6e3-1b65a65766ad", "value": "payment receipt.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "985f493c-d123-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652271135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652271135, "uuid": "801756ab-5394-41fc-b104-c111f6224d44", "comment": "Malware payload (AgentTesla)", "value": "ddbdd7db7c1f9786ba4af972861adca2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652271135, "uuid": "546313c6-5ee5-4c19-8544-ab824e4a6b01", "comment": "Malware payload (AgentTesla)", "value": "4963bff2b77dc1a67489feed30040050360b2e06563343383af529a2ca21fc9d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652271135, "uuid": "0fd2a826-5270-4443-834e-b7d6447dc4b4", "comment": "Malware payload (AgentTesla)", "value": "5c68c3232a413ea1f0d14ebfcbcb616b9a4a00db", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652271135, "uuid": "ed910415-bbca-49d8-a333-edd13ee4ed91", "comment": "Malware payload (AgentTesla)", "value": "f4f9da02009cd7b4c0cf74dbbf214729b75dfcbe8041c37a475d1b935c764dc47374f760877ed60730eb67705b369ccb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652271135, "uuid": "cbcdccab-6409-422b-9f2f-9149b9a078c7", "value": "T128138DC6ABF58F43C71C9771A4AB82451738E1503B42E34B9B48516D4F633EF2D9D12A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652271135, "uuid": "4d961e5c-326b-470c-a6a1-95d1e5be352b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652271135, "uuid": "f9093ce4-2d06-432e-86da-7e0d1ee350b6", "value": "768:jaLhHQLMOLoAzYILnUvyJ5UfC9E7LscIcV//Aeal9hR:jaLhwLBEAzYILnC+fE7vIcV/4eG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652271135, "uuid": "4a7e1bb2-3cde-42bb-bb54-f990dd55de0a", "value": 42032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652271135, "uuid": "dfce3bac-d62a-40fd-99ac-d22ce4947388", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652271135, "uuid": "78dca69d-9ecc-4e8f-83b9-4e21fcb6bb64", "value": "Po-AS47748.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69ec5003-d14d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652289096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289096, "uuid": "028180dc-ea06-4011-9f1c-19451e40f5bf", "comment": "Malware payload (Heodo)", "value": "92a23997ac025db70c86a72d0b2b3795", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289096, "uuid": "832fedc7-ecb2-405e-94c2-e4925089f4f5", "comment": "Malware payload (Heodo)", "value": "4a18d9c74c763d165d598ef0f2df9339009825edf54b2ef2f2d8bcba5cd33289", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289096, "uuid": "af58534f-525a-4ad1-aade-5e24827621c6", "comment": "Malware payload (Heodo)", "value": "0f0267a384b0d70c80b4c6f429bd3ae5e5b613fc", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289096, "uuid": "4f59407b-f83c-4673-9ee4-5aa4a7ee490c", "comment": "Malware payload (Heodo)", "value": "863d5f39d04e956b40908f00930633695ce70e264dc8a470c520723395322c97fef2ec48b9d021251d66438eb8a8b4e6", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289096, "uuid": "23a730da-5495-421b-a9e7-2354964c8408", "value": "T1DF62D10864BCF4B0CE5CC1F4BA908753704B6C49728936A63BFA6803D77040B7E47959", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289096, "uuid": "6dceb006-5d9d-4471-91ee-1d14c145a340", "value": "384:H4+ZVZlY8Utsy3KQ9du5eDFzliY9CgPiEi9vSWZlVRRoe/wTWkKo:Y+ZTlY8egQnvBlJ9BPiVl/RRtwFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652289096, "uuid": "c2034d8b-4a6a-433f-9b3e-9e76d639b00b", "value": 14883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652289096, "uuid": "54a46c81-f5f8-4c07-907e-4291cf33c34e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289096, "uuid": "d96936d8-955d-4b97-aa56-8825dd5a7fd0", "value": "doc_11052022.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b8e0b4c-d163-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652298628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652298628, "uuid": "49cb6cbe-b929-4724-8cfb-e8ffba6724c8", "comment": "Malware payload", "value": "f4bcd616bb1f6b78c079400b45bd02f7", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652298628, "uuid": "38b78c14-27b9-41e2-89fa-b9568a507fb3", "comment": "Malware payload", "value": "4b04725291980b03b3564f50a09cb4a709db51e86dbd69a8f94f8266480f0a6c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652298628, "uuid": "97d53b21-6764-4936-bda2-52f2dfc1d73c", "comment": "Malware payload", "value": "dff9e6b3981c4fd837b440a2efc11dae7a24f7cd", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652298628, "uuid": "507f8e64-0590-4528-a660-daac13e0a353", "comment": "Malware payload", "value": "5e9a7ead850c035dc11dec0e5b1a2a038337db084f6b6e1a3a84ae9d3980ffee1cdcd034e765da7c9dfa1b79e5a73cd0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652298628, "uuid": "2d97bf0a-019a-4e29-9566-c255e345e140", "value": "T14CB4BF06B3A504B9E467C174C9735952E672BC121761AAFF33A0436A2F37FE06A3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652298628, "uuid": "ae9fcf1e-7ec9-4fe6-82f7-eaf4b22b8752", "value": "6196af15ce9ababd9a592319b3043ede", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652298628, "uuid": "c296dd49-2bc4-4872-897f-3f201aae046b", "value": "6144:iuD3jumQgXW2jLi1QPy+hSVL+ymiohakdtUPM1UlTIqNtF1FMytrf:ZDLVXW2j21QC1+yZoXtUPMg9Z1FMyB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652298628, "uuid": "4b372125-68e2-4bf8-8f1f-20ef5b5be493", "value": 513536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652298628, "uuid": "859a5467-afd5-4647-9fe5-73d9acd86553", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652298628, "uuid": "c070f880-d221-4cd4-b755-13a0ac2f4c0d", "value": "4b04725291980b03b3564f50a09cb4a709db51e86dbd69a8f94f8266480f0a6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9bf184e-d141-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652284076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652284076, "uuid": "468b0d2f-f1b2-444c-a410-8c54e310be0c", "comment": "Malware payload (Mirai)", "value": "d1504be284c3a30ecc1c4f1eb9db7328", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652284076, "uuid": "1013b266-ff54-43b3-a114-375b1d7180f0", "comment": "Malware payload (Mirai)", "value": "4c888539b64d57835cdda695b791e2956788453536425f6e49e57f837cfa7ae3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652284076, "uuid": "27232f75-64f4-4561-bb13-26bbba72e131", "comment": "Malware payload (Mirai)", "value": "eee9fea787da50c9f70d94b69bdf7eff240d05b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652284076, "uuid": "7cacfb3f-1bd8-4c43-9a4f-9c771a0deb17", "comment": "Malware payload (Mirai)", "value": "542eb6c8d2810014520e1177688cd5b823e1dd051225cd08e47b2bdb51d87349a331103eb1212ec609a446464be9f9c4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652284076, "uuid": "adb2538b-9434-430b-9d4c-86301df7f2a5", "value": "T17E634925A9791E22C1D4B17B62F7D321F2F6220E31B49A5D3CB60F4EBB14640A8573B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652284076, "uuid": "5c5eb590-80f5-4530-a6e0-fae313276bb8", "value": "1536:hQWROwESZDSciIQ1+RVBvKL+MX16vkKAmyM8CF0:1rxSIQ1+RbvWXcvkdj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652284076, "uuid": "019d91bb-cbb0-46d6-9f0f-0e950d15f726", "value": 67740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652284076, "uuid": "539eb029-bed7-4627-beb1-77d136c27708", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652284076, "uuid": "1a368402-a1de-4b98-9fa0-c2e0f58f4214", "value": "d1504be284c3a30ecc1c4f1eb9db7328", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c111145a-d14e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652289671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289671, "uuid": "07f4944c-81c0-4ff6-8b2d-34f99a58cf35", "comment": "Malware payload (Heodo)", "value": "a4b32dba40a85f6550f701ddf8ce9de0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289671, "uuid": "1c85a14d-88f7-41b6-8e94-794b2f5e5f94", "comment": "Malware payload (Heodo)", "value": "4cb0a0ca8e9f05172ccd56cda2ab748395d89d72b195cea9fcdf07e198b70f2d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289671, "uuid": "0712a1d4-714d-488d-a969-1ef339c1b951", "comment": "Malware payload (Heodo)", "value": "1a77af4e622afa4dac0204d6b253f66d324e70f7", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289671, "uuid": "51045f9b-a6fb-4b59-8ee3-4eb6894c4901", "comment": "Malware payload (Heodo)", "value": "59420a7a1a556c0a85a2e569063f84a969827d5fb6a0a44c03869f9bbd5e41c44c83ced81f75a8bc8403909b376e166a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289671, "uuid": "7c03cc82-59a0-4107-bf12-d9b60f2ad2f1", "value": "T165B4BF0673A504B9E4678174C9735952E672BC121761AAFF33A0436A2F37FE06A3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289671, "uuid": "f73a00e6-ef09-4116-91ce-d834a13dde41", "value": "6196af15ce9ababd9a592319b3043ede", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289671, "uuid": "506d1d0a-9a76-4e03-8a7d-396dfd8c109b", "value": "6144:iuD3jumQgXW2jLi1QPy+hSVL+ymiohaWdtUPM1UlTIqNtF1FMytrf:ZDLVXW2j21QC1+yZoptUPMg9Z1FMyB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652289671, "uuid": "636a8ed6-4650-436a-af3c-89b60444afe8", "value": 513536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652289671, "uuid": "a08a5a7b-bf86-48e6-9da3-ad9ca0281b23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289671, "uuid": "54ce36b6-03ba-47f7-b8db-820a40cd0305", "value": "a4b32dba40a85f6550f701ddf8ce9de0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e63e7c14-d121-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652270406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652270406, "uuid": "66c41e6a-bb9c-49b2-9b43-8d8790adf872", "comment": "Malware payload (Mirai)", "value": "5eb5fae40f0a252cadb7bc6c28c9ad15", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652270406, "uuid": "9004333f-3c60-44c3-a78d-9990cfd43ad6", "comment": "Malware payload (Mirai)", "value": "4df8e42528dea42c0c8da6ba80f69e2cce50f841fc3b51e27f99031b1a821543", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652270406, "uuid": "df0fa6ac-8b61-4c40-85e5-c0c745912f5b", "comment": "Malware payload (Mirai)", "value": "f27f263a69b386d633ac8a4dc037b460942acb05", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652270406, "uuid": "ffbe6a29-99fc-4cf3-b3cc-78b0e787e070", "comment": "Malware payload (Mirai)", "value": "7aa38cc66421cf92f4f010c0c8656f742e4d345af4601d6f3c50ce1507a3134ea099f9535d8b7f6a05f125c4d2ffe3f7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652270406, "uuid": "1a960e46-1af1-4c11-9806-a08d325f3d5c", "value": "T115C33B42EA409B17C5D61777FE9F414A3322DB54A3DB330689285FF43F86A9E0E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652270406, "uuid": "d2652fa4-3c6d-44eb-bf24-32d4a9544f8a", "value": "3072:tc/BCltnde5hLckPBrPDVpN+Gt49mxoWM/9xM/:O/BCltnAcErPDVpgGemxjM/9xM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652270406, "uuid": "b64606e0-4524-4ac8-9c7b-96348185d21e", "value": 126644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652270406, "uuid": "fd6848d6-0483-48ed-8bab-201e85b8f6e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652270406, "uuid": "ee520c98-8033-44ee-8eda-17102d389886", "value": "Owari.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "477dde79-d0e9-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652246088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652246088, "uuid": "14b16bfa-8195-4338-b554-71518b4c41b6", "comment": "Malware payload (AgentTesla)", "value": "d1f0427af81218f5ec55bce19c797b25", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652246088, "uuid": "2d4ed827-ef07-4cde-90d3-e64d27defdc2", "comment": "Malware payload (AgentTesla)", "value": "4f0c88afd74d2b32aaced97e4dc024c5e10d5a6fb4cf929adf8bc654d98407d5", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652246088, "uuid": "8d032cfd-eb25-4384-92a3-3ba43a7ba627", "comment": "Malware payload (AgentTesla)", "value": "15d33f3b1eba51aef435d90f91fa68f298e9e7c5", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652246088, "uuid": "884ee730-5935-49db-b03a-bc72381b48c1", "comment": "Malware payload (AgentTesla)", "value": "019c7cef536c135b37c27511a5a72fa8606b8cd7e98ddfb9925086278e4efcbdb35b013bebccf9458180195e8d746306", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652246088, "uuid": "32254d00-3a31-4d1e-b57f-31874f82fa95", "value": "T16E62D0AD105C6C5CE3122FE9B710A9D10129283D237D35C951BBF8C2E661E65D70627E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652246088, "uuid": "9c73bf80-d386-4dfb-bd4b-6100aa411043", "value": "384:li649FMzV9GGncfkJFxQwtUusD2dfkEq/0pn85dRo:UniTncMNnGuHdM0Kzq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652246088, "uuid": "c32f4a42-6634-4f6b-9abe-abccd60db8c9", "value": 15069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652246088, "uuid": "01499aba-8ddd-4284-83fe-8ef07b3a9937", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652246088, "uuid": "cdcf51ca-0e87-49df-bf04-f3ac37c91b96", "value": "Inv,Delivery note.jpg.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a54105f2-d139-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652280605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652280605, "uuid": "081afb77-7967-4d8a-b4f4-5343dc3a3e64", "comment": "Malware payload", "value": "8c5f3f1f4f05eca554396fe34d6e3da2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652280605, "uuid": "9f583599-c155-4ce1-94d9-69075be7ef5c", "comment": "Malware payload", "value": "4f859ed832347e0f0e8a11b897d1c67d247290f93fbb5e0f356e654c16f5bd6b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652280605, "uuid": "308de375-023a-443f-93d7-d991b8b5849a", "comment": "Malware payload", "value": "e268c582b7d10502af8443c6a8a9b8ac3177b5fe", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652280605, "uuid": "90ba499f-c5df-4724-a289-b9e7c8f26fd2", "comment": "Malware payload", "value": "c5d12cd354f23e60e73c1d2bc05fa3a938095b2c45ae3786e24d07157356184c3a2797406b057fd55abae3d35a4c7fe5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652280605, "uuid": "2f73fc51-9604-4e37-8096-e5a6a06223b7", "value": "T1414302C2DA081231C7950EB6FB4E8B41E6B87C5264FB027A754289BC1DEF85B2DA704D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652280605, "uuid": "1cbe7f12-0acf-4760-aab3-28128cbd72d1", "value": "768:YkzxbWtSiRabI198M33v8wKXxSzrtPMVmA3ltcDBrmDbSG3MW3YPOSISn3U4j:YkzxbwNqheRPMVzQnGxSIS7j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652280605, "uuid": "064b0a8c-ed6b-4c0c-a944-9fdb7de221da", "value": 56720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652280605, "uuid": "6abda5af-d479-42e5-89e8-acd429739580", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652280605, "uuid": "3e37725e-a9a3-4e5e-aefe-0588d5607883", "value": "arm-20220511-1450", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77161925-d0d6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652238008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652238008, "uuid": "cb07c3ee-160b-4c8f-8eca-5f393e990958", "comment": "Malware payload (Mirai)", "value": "27796486771be2a4d560247e29bb299c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652238008, "uuid": "2320df28-e7a5-43f4-9237-10039ede49ad", "comment": "Malware payload (Mirai)", "value": "4f9ed981f101c020ff8d6c839a12bb601813883078fa1c8a78fd51b93494eb58", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652238008, "uuid": "4229826d-f169-4534-a539-b829b73714cc", "comment": "Malware payload (Mirai)", "value": "7c9d8a2028bba61ed07100fc9fe7722e8b477108", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652238008, "uuid": "0c810edb-aff5-48e9-bfec-5241bbaa0da6", "comment": "Malware payload (Mirai)", "value": "c5dce584263d85860369a55e13a196058ad63ed3fe6e5fa852165b3b29b73670b9533c923bc21c20c266b2f1a01f0c8d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652238008, "uuid": "1887a7fc-1e5b-4b97-9e5c-176e08fc3ab7", "value": "T10EB2E001BA5E6166D3B0E932DB3FC9892B5A4BB0D2F122137528173D74C645B36F42CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652238008, "uuid": "a60b4954-abc7-48c6-b084-1c0d82ee7728", "value": "384:wzBnIeQZGVY842W1zwDtr9Q8hToVxACm38K5Kh6wUZOhymdGUop5hW:OBnnrnezwDtBmVDm38K4h0Es3Uoz4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652238008, "uuid": "4ff02f4c-9151-4641-aab7-8b6f9402de1d", "value": 24072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652238008, "uuid": "df6682f4-fa00-4557-9f7a-041662749c7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652238008, "uuid": "6fb39f41-175d-4692-b5ff-e1e310327783", "value": "sora.arm-20220511-0300", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6280fd4-d105-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1652258407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652258407, "uuid": "6e15e326-a4e9-48a6-876b-dac593a0b72a", "comment": "Malware payload (AveMariaRAT)", "value": "9856cead20fb0c57a8f338af1504a1aa", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652258407, "uuid": "cb2173d9-eea2-4433-9cdd-b4840e656928", "comment": "Malware payload (AveMariaRAT)", "value": "5004dccfea55cb7c7338390ef12adf835341473d9e850e9232aee6e7c7b6f1f6", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652258407, "uuid": "b9baa1fe-83d6-45bd-b88e-da4c0fcf5d4b", "comment": "Malware payload (AveMariaRAT)", "value": "b7a46f5caa9e2d87d1abb9b44c89439907d317b9", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652258407, "uuid": "907c7f6f-986f-463d-aeb6-f9b4c1caf957", "comment": "Malware payload (AveMariaRAT)", "value": "ce8388ff842e39eb6618fefd3b895e7d2e3a4eeea0fb07824370a4a114423c2eee6810b01ed7089c8b9ff9005652b121", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652258407, "uuid": "1b3b093f-2a6b-4208-a50f-e17a56be998a", "value": "T1B3E4D0C37734CB57F4783BF4652A843447B56C27A661D74B1F8EB9EB18B27001A82A63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652258407, "uuid": "a3d59f27-c4d6-46e2-8d91-e9c79cff7da6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652258407, "uuid": "cebb43a4-3f59-4a47-a9e8-42550949366a", "value": "12288:i9u9WQhQkLnwUPxq1A/qvDYqZv3C9Za6ML:cu9WQhQksUh/hqZaZOL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652258407, "uuid": "2f4b31ff-d400-4e74-be3b-bf3c97d4d077", "value": 706048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652258407, "uuid": "3221cca6-7ade-42b6-a49d-27643153f1fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652258407, "uuid": "6556035a-12b4-4e7e-8044-b9814f551524", "value": "SecuriteInfo.com.Trojan.PackedNET.331.26146.16975", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5501b33e-d14e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652289490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289490, "uuid": "12b3d18d-376e-464d-bdc8-0ccefd145240", "comment": "Malware payload", "value": "8c0d399aede8ff4fd40b4b77a83d3633", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289490, "uuid": "7cb4f7f5-43c3-4b1b-bbef-7bb8010f9575", "comment": "Malware payload", "value": "50dd7a0c5a5b172ac486f6cbfa06eb5145d3df1ff2b28725a26b11118e16d23e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289490, "uuid": "660fe574-a5a2-4e28-844a-79910c0e5a10", "comment": "Malware payload", "value": "9d63c4889f0420d173622febf9462f25bd8f2e2d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289490, "uuid": "2549f1a8-67e8-4910-b741-967c10d9ffbc", "comment": "Malware payload", "value": "f18c101e6b3cd8eac2cdac17eeb0fdc5deeebe2a09d510731d3ad6d2edf656fe58bf62370104f245c79547412a3c648f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289490, "uuid": "60ec3865-df37-4b0d-bac5-6de8e42286db", "value": "T125B4BF06B3A504B9E467C174C9735952E672BC121761AAFF33A0436A2F37FE06A3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289490, "uuid": "8b60f81c-d94b-4e87-bd8d-b8a9c0215e9b", "value": "6196af15ce9ababd9a592319b3043ede", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289490, "uuid": "4ed1c311-7f9d-43e6-9025-847cbb836781", "value": "6144:iuD3jumQgXW2jLi1QPy+hSVL+ymiohavdtUPM1UlTIqNtF1FMytrf:ZDLVXW2j21QC1+yZo2tUPMg9Z1FMyB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652289490, "uuid": "10ff1467-03d8-44b9-a2ea-1ce42cf47756", "value": 513536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652289490, "uuid": "8b09f3c0-10e2-436f-bdb4-a9e43b474c83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289490, "uuid": "d460bfa8-f5cc-4952-8a5f-f48e94e00224", "value": "swAt9lYOQNaoLJrRYloEpou5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b9b9feb-d15f-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652296668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652296668, "uuid": "890c8e63-1d2c-4ebc-8005-9602fe639a2a", "comment": "Malware payload (AgentTesla)", "value": "61b6cda2a63fa62b9573ca4738046455", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652296668, "uuid": "cbc97b8e-7efe-4083-bbd5-fe113b0ade98", "comment": "Malware payload (AgentTesla)", "value": "50f1063e3a3eaf597bcc73dabd2e6823f56ce1731f1bbf89ca77a5a02e604216", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652296668, "uuid": "73c86e5b-e234-446b-a345-93adbbfd8636", "comment": "Malware payload (AgentTesla)", "value": "40a419c678f87fa433d362cfc28780fd06410096", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652296668, "uuid": "f3c51ff7-ad7c-4d72-b78c-89892e53598c", "comment": "Malware payload (AgentTesla)", "value": "cb42d7007016fe8170f28d508da17ca141eac8f3097ca379120ac00cf9d5dea207fabfa73fee5a3dd81219b56d3260cf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652296668, "uuid": "d7be87c6-abb7-438b-ac98-0c2cee4fa623", "value": "T19105CF22AB4CBFA5E63BD3798150841043F0A31EF72BC55A3DB764CE5572F8593A2D22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652296668, "uuid": "dede9fcf-4973-449b-9b16-f6002cfc575d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652296668, "uuid": "151c53ee-5f83-4d34-af48-f30d18638aa7", "value": "12288:kejf51EqW79zrTYbsAdUCUSXbzFujVbTZnMhj+R5wuqNKmYiQsHrB9QzTf:kOf5M71r8gjQ8xb1VRqugGiQsrB9ef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652296668, "uuid": "734fe26c-8f23-47b3-a549-01d9eb9ffea8", "value": 868352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652296668, "uuid": "6faec4a3-e33a-4707-ac41-7a456a0176f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652296668, "uuid": "916efa9f-2bd8-4719-a070-802aaa37ed19", "value": "PAYMENT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e90dfc4-d15e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652296324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652296324, "uuid": "5d5453c4-0c5e-4f2d-8367-cd3fbd856738", "comment": "Malware payload (Heodo)", "value": "06ace03c3ae0485db76e31cb9ec14e05", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652296324, "uuid": "ecae7c9f-103a-4ef2-a26d-e59903a2b743", "comment": "Malware payload (Heodo)", "value": "525b0ac5acc1d4211b1d3845e890bf8b510c4c0c58c1593764757f3c185528f9", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652296324, "uuid": "2fb76e8f-736a-40ea-8618-ed7680c6a686", "comment": "Malware payload (Heodo)", "value": "e6bab0a78fdb59456261a7d85a140f110081a163", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652296324, "uuid": "71262138-1a67-4336-8de7-8efccf7b9a85", "comment": "Malware payload (Heodo)", "value": "ace9f094033e6c5abf85952c8805b581e36bc9b0faaf2e75537222af8ba1cf1baca933248b40c6c8cdc93b631997394e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652296324, "uuid": "d1966782-2f54-47e4-a09f-4ba509b1672b", "value": "T16AB4BF06B3A504B9E467C174C9735952E672BC121761AAFF33A0436A2F37FE06A3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652296324, "uuid": "3edc3c88-9596-473d-897b-09aa032cdd4a", "value": "6196af15ce9ababd9a592319b3043ede", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652296324, "uuid": "2d2a5cab-1dd2-49e2-b837-7d724d8c4549", "value": "6144:iuD3jumQgXW2jLi1QPy+hSVL+ymiohaRdtUPM1UlTIqNtF1FMytrf:ZDLVXW2j21QC1+yZostUPMg9Z1FMyB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652296324, "uuid": "0345f9d0-d614-4815-bcc5-490746b1e1fc", "value": 513536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652296324, "uuid": "6ebc568b-4ab4-4cf8-aee0-63e5ba7faf7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652296324, "uuid": "b4afe23d-9a39-4405-a958-4abb89842d20", "value": "06ace03c3ae0485db76e31cb9ec14e05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d39fdfc-d130-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652276673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652276673, "uuid": "dc2f0053-bfbc-49ae-b493-9e6fbfb67310", "comment": "Malware payload (AgentTesla)", "value": "427677a63ce7eb55195c330aecfcc139", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652276673, "uuid": "d2bd8fc7-9d0d-4df8-89a4-9697b533c824", "comment": "Malware payload (AgentTesla)", "value": "52b735ad78f481b5cf50e737fad29bfbf75037b5a56ee4c9d1183fad58fd39cf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652276673, "uuid": "fb5b79b1-24c8-4abf-9294-898cf4da716c", "comment": "Malware payload (AgentTesla)", "value": "0a7bba3b85b4e54188e9f0056f91c01b4b56ae7c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652276673, "uuid": "b015c822-f91c-4d15-b466-28d6383f720d", "comment": "Malware payload (AgentTesla)", "value": "2291d52ff78d7f3c925672ee77e29f40e6c3a4543e032962ae903f3a4b806d2c4260aaf7e80797a4a3a444fe44965387", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652276673, "uuid": "722813bb-58f3-42a5-b739-1c8dfba840c6", "value": "T18AC307943B8BD662CAC9793DC7EAE6F42333DD4249519ADB57607E1B3E32B03C949240", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652276673, "uuid": "64fc2052-883b-4078-916a-4453d14da032", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652276673, "uuid": "d18ed436-8e51-4086-952d-2a5c356c1d49", "value": "768:R8s7qwDq3A7eYUrhpCr1TT5Ydf9QuDdwzXik7RNi3CVm:+s7uACtY1qUFDTlNpA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652276673, "uuid": "9339cdb9-e54a-4234-9c1c-dc31d4507f8c", "value": 126976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652276673, "uuid": "eb30a4ff-9c0e-4d37-81f2-b403a01cbc83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652276673, "uuid": "0f62be77-d027-43d0-ad2b-9cadb94936aa", "value": "427677a63ce7eb55195c330aecfcc139", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bace926b-d0db-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652240269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652240269, "uuid": "24b87365-08c7-4d1f-9646-f0bf8edf4e9f", "comment": "Malware payload (AgentTesla)", "value": "ef3ef296f0fe3a57183d97d43215776b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652240269, "uuid": "831650c7-7d63-4269-8f69-f07fd1626976", "comment": "Malware payload (AgentTesla)", "value": "53276d0a0acc73fb550b5b29cc686c0e646ee69333e803496cac726b337b5515", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652240269, "uuid": "8101db4b-eabf-4a4e-9b1c-783679423669", "comment": "Malware payload (AgentTesla)", "value": "0bfc1d251214f1d9b19b06cf1b30c86825f158e5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652240269, "uuid": "d5acd91f-958a-42f3-8fe2-e08888755eaf", "comment": "Malware payload (AgentTesla)", "value": "627a8aab77ad1f111c9698e0e731e4c4164debff91264c101f97053daf1256b74ddb1818ffa53f921e94a5ffe66100a7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652240269, "uuid": "ddf8e079-8705-4cdd-946c-9d89de13ce3c", "value": "T1BEE4120126ECA774CABF2F35A47B31105EB5B856B436D71D4F84288E2A633934A647B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652240269, "uuid": "4af09213-e4c8-4362-aaf9-b99727bf7778", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652240269, "uuid": "419ffacc-d76e-4309-9ca2-2de1156d9957", "value": "12288:zrpIpV+tNNtDosfgthE+xUtGf0UrOJZ5F83bDQduOC3O/uKp:Pmj+tNNtMsfChE+agJrMLFeDQdut3O/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652240269, "uuid": "1c9d10e2-7304-492b-b58e-9e58a7e776aa", "value": 686080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652240269, "uuid": "f16a266e-7adc-4d39-ba74-ede98ba00ad4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652240269, "uuid": "7aaf004b-cf22-47ea-afd9-960b3f55bb42", "value": "SecuriteInfo.com.W32.AIDetectNet.01.18640.6804", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55082009-d13f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652283048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283048, "uuid": "7cdfef57-9df3-4ba0-8ad1-b5ba430c17be", "comment": "Malware payload (Mirai)", "value": "e7de474681dad3db51936be02ec7383d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283048, "uuid": "73d09ae6-69f0-4fdf-bfaf-f570e763a233", "comment": "Malware payload (Mirai)", "value": "545d93f7b8c2cc6252675340607653181e1fa29cb023ae0b50882f2066f18e0e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283048, "uuid": "897920c6-5b26-4e09-9480-43e91c51c686", "comment": "Malware payload (Mirai)", "value": "62697448be163661edf11655a09e267157b98e69", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283048, "uuid": "e1f856e5-d8a1-4b87-aab9-a5c34332e60c", "comment": "Malware payload (Mirai)", "value": "c0421c171a47e93cd79ee641061bc2361b16efc9807b387ae3420d4137dbf6ba55e11e32dd00882d5a4d7ecd954f3a6f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283048, "uuid": "37795329-1c03-4210-99a6-671b448b3a99", "value": "T1E9732A96F8915B2BC5C023BAF66E628C332163E8D3DB3113DD6017646ACA11F5E37E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283048, "uuid": "e10cf695-23cb-4767-9e20-2e9a0f51ed56", "value": "1536:b/PbHFs3G6leUHYjFqYz1WAAY05ozRkaXp4yxn/l4YkM5bEImH8jH6OA6a10WtT:b/PePleUHKBRNma546/uMNI8jg9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652283048, "uuid": "71c9d6fb-3f47-4618-a1f6-ef5c2bbad971", "value": 76640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652283048, "uuid": "2c63fe7e-1cd9-41ff-a561-133c8f72ce8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283048, "uuid": "40280077-971e-425d-b361-e9962e8b6fe0", "value": "e7de474681dad3db51936be02ec7383d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "875ca7e9-d179-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652308043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652308043, "uuid": "1dff74e9-0a17-4aec-8ef7-b9fa7118ec13", "comment": "Malware payload (Mirai)", "value": "4ee14402f6b44d17e2d998e6ac79f896", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652308043, "uuid": "f3fdc1a6-aaf4-4ff9-bf09-fbf2190aefbd", "comment": "Malware payload (Mirai)", "value": "54c22c862444e075d827f63ae3a64ac7e4e14317260e5e3db634d1314a40a7c6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652308043, "uuid": "014d1b5a-3a13-4f58-882a-5e8c595932c8", "comment": "Malware payload (Mirai)", "value": "13072b2f8f4913aba0c17e2be335dda29469e4ff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652308043, "uuid": "0a89efa5-9173-4b6d-83c2-d1f0fb58f1b4", "comment": "Malware payload (Mirai)", "value": "0f63f0fe2a0ce3a2a7d3fb45404d893ec4ff0660aea172b2a335bc3632c8b2020ca466bafae2f8b12e15cf817cf7886f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652308043, "uuid": "7c064880-f475-47dd-a091-5aa0dae53c7d", "value": "T1B8B2E1B6B7DF09B4C3F111738A28C3C7FE57457871973D32A66A4B4CA616A029F34445", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652308043, "uuid": "2238c477-51f2-473e-a80a-5283cb607b19", "value": "384:H/riEtvEw70+1N+brT2N3pArAyA/saMSCiXhdqkuhk7RRMq9hvV7dshymdGUop5f:H/rBcw7B/qTYgp/SvdHoqZBss3UozJh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652308043, "uuid": "142a205c-c3f3-441d-80c3-5ab2e2aa3fc9", "value": 24236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652308043, "uuid": "285768e3-cc77-4e5e-a05d-d42fdd5c9d53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652308043, "uuid": "b7189fa4-e08f-428d-84d4-e85c08f8d77a", "value": "4ee14402f6b44d17e2d998e6ac79f896", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36e904c5-d12d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1652275266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652275266, "uuid": "e2ae7c57-51e6-4bf1-9233-2a35eee79afc", "comment": "Malware payload (Quakbot)", "value": "6e9e2076a950b7bf6820a61cae864a5b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama183", "colour": "#352CA9", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652275266, "uuid": "79a9aed0-26ce-4335-b16d-421f959c0c60", "comment": "Malware payload (Quakbot)", "value": "55dff05b8bd54a21267a8320f44230b217188ad1134128f8a33c488937c0c407", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama183", "colour": "#352CA9", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652275266, "uuid": "d87df3e1-3064-41a2-8bc5-5668b5cf5bc8", "comment": "Malware payload (Quakbot)", "value": "7f94ea7bcf8796987bad0042566d77289e8a6b10", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama183", "colour": "#352CA9", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652275266, "uuid": "41d7fb81-794c-4058-9df8-22c7c2778bb0", "comment": "Malware payload (Quakbot)", "value": "26ac5af8e8a0c0a44732f232adc931ad9c6fdd51a3b640d91be77c949843ffc96a895cdbcd74d38e66af1195268e7401", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama183", "colour": "#352CA9", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652275266, "uuid": "76f3aff1-bd5f-4a23-8976-330b24ca54f5", "value": "T17005AFB875147CD6E66F567BDADABCDC03B6272299CBA4CD80647BC30563372EE02805", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652275266, "uuid": "3e6d4576-39b5-4e44-bc9e-3ba27d6fb59f", "value": "99335be05eea85d920eaf8f6f5246fc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652275266, "uuid": "883bb5c1-b2ae-4add-9646-61b580c5b873", "value": "12288:pg2boKKRrRYEr991kYgwHXdBRPBPSjpho0vqLks2n2BpJBJC8QEydhIjtkI90N+m:pgD1P96YlbGjwks22B/QBhCfG+6F3ll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652275266, "uuid": "e61c4b4d-a6fd-4709-9d4c-9fa2fa47b09d", "value": 819712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652275266, "uuid": "ec33d588-e2f8-4ab1-9279-2153305cf396", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652275266, "uuid": "6a210948-e090-48b4-818c-7820f8d3cb68", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "311c8b51-d119-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652266666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652266666, "uuid": "4625af04-61ce-4ebe-8780-b8df21819bc1", "comment": "Malware payload (AgentTesla)", "value": "28313ae3d080d4bddf1d022aac96c8d4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652266666, "uuid": "b5fc812e-7d51-4d3f-a529-a16c4f89d257", "comment": "Malware payload (AgentTesla)", "value": "55e046ae70a02fbc220998dea85ec6363f6f0279985e24960701690422e0f91b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652266666, "uuid": "d6336a32-1e68-4e8b-b17e-906bcb84a64d", "comment": "Malware payload (AgentTesla)", "value": "e483a366fe7c30fb56e6621014444969e3a0b0e4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652266666, "uuid": "b041bb0c-7b7b-4776-949f-a00a06aafcc4", "comment": "Malware payload (AgentTesla)", "value": "d3c8a40bd7ce78049ccf1c692506df7df37976459518b66d60c0fe5abb09ceee4c0d0a23d1b7e4d3532f7eb6b4daa2d7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652266666, "uuid": "8c4aa939-cdde-4227-8fc6-a8846c2354e8", "value": "T17974230663A5D477FE53BA361B2DDB269EB6029A1C7043C743501B867AF27C1832F792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652266666, "uuid": "f3c278b0-f16b-4d44-8fdd-6540bd295df6", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652266666, "uuid": "7b684342-9fa9-4ac9-bc0f-86201391a75d", "value": "6144:LOtIOWqBmsImXC5HsH66zbX5J6q6OimIMyfA1ROhbkRscZuCqxJvTiKIfRXQlUM:LOLWOlHSKH66X5gq65AyfWROhY2cZkZd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652266666, "uuid": "426d3fec-b717-48fc-b35b-7fc035e13c16", "value": 358991, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652266666, "uuid": "e2dc731e-7e3f-456d-a0c6-235e8aea5194", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652266666, "uuid": "be60deb2-49c5-4c02-b0eb-2e15cfc848d9", "value": "endalll999.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f10a49d-d0d3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652236679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652236679, "uuid": "dd282330-6b36-428a-9572-cf79060dd7e6", "comment": "Malware payload (Formbook)", "value": "9b69704005a2db422555325f8d20ff56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652236679, "uuid": "6b28cfc5-9341-436d-b1d7-fbeef00cbdc7", "comment": "Malware payload (Formbook)", "value": "56d2b04636f78507452be23298beaa972eb1146667d250b40b90eb72ca074f98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652236679, "uuid": "bb221c37-393a-406f-ab9f-6690ececef3b", "comment": "Malware payload (Formbook)", "value": "2725b1b6fd655cf8fd8649be2df75c6ff4a5a54f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652236679, "uuid": "8dcda2f6-dc6a-419f-972c-d37ed395add0", "comment": "Malware payload (Formbook)", "value": "51ebf7a42e9eb3eb1ba51c4c6ba2135c1ed7b4167a331227841d02c38af0091a90c77e49e774e9ccf176270791266e6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652236679, "uuid": "475847df-0f2a-47fe-8eee-bc52f70498c8", "value": "T1DB341240B3A6D117D0A317311E3F776BDDB6A57162F4C00F1BE03789BA10691AE1E76A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652236679, "uuid": "1a85e2d5-fc44-427b-adb8-58f20bcad8ea", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652236679, "uuid": "77e57ee1-cc70-4baf-aa0f-41785cff6b5b", "value": "3072:LODZGPEounbU4QrWvgSMAAd6HdDDMFC3J+uqly4LhjkP1eFiwsX0DuGuGeFv4ry8:LOtIOUOPd+3Jldhg2vsGruGQbWTEUX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652236679, "uuid": "aa300974-d320-4813-ac2f-ec563f8976ee", "value": 251146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652236679, "uuid": "80ad39e9-1183-4ede-9566-a9beca555d81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652236679, "uuid": "ec44ffb0-e5f5-493d-a50d-61ea88598ff5", "value": "SecuriteInfo.com.Trojan.NSISX.Spy.Gen.2.738.14252", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9337ae0b-d142-11ec-8e58-42010a9c0032", "comment": "Malware payload (Sodinokibi)", "timestamp": 1652284440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652284440, "uuid": "e6033861-85a2-4be2-bab2-776330e3f182", "comment": "Malware payload (Sodinokibi)", "value": "c9a6b174730bac5143b303ffa35e25d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652284440, "uuid": "40312047-15cf-43ce-aaaa-5e851dcfde80", "comment": "Malware payload (Sodinokibi)", "value": "56e7073e0f7b2cacaa30f77eaee4b036b480b1992ade5e55bfa2ff062eda4d8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652284440, "uuid": "a5d9238a-c5e3-4e03-ab29-7d37d612622f", "comment": "Malware payload (Sodinokibi)", "value": "cf893248c06f8a6215e749bc792e4299d9222517", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652284440, "uuid": "140bd404-c04a-47f0-a998-fcdcb4000669", "comment": "Malware payload (Sodinokibi)", "value": "fc176c73a9a49b230a4e8762881334e27ad4bb8e4a6cacd46d327d2587d7a1cb3f33e1378822a7f76847adaf25a29cc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652284440, "uuid": "c8e570b3-30c9-4741-8e78-c816e90c907d", "value": "T140F3F123EC6282B3C4A781F3133E3F1BD6BEF9740016A467D7618D047AA90A2E717597", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652284440, "uuid": "38e1ad6f-9566-4cf0-bcac-1d0ade6a3601", "value": "7ecacfc6f1d64067e0047425ad885408", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652284440, "uuid": "b4f21f2f-c494-4ecf-98e6-1a2d0f652c86", "value": "3072:1LFrb30BRtBZZg+i2ayy2RjLTuVyu7CJDgoMT3QKGSTdoZkS4aIq:ZJ0BXScFy2RsQJ8zgue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652284440, "uuid": "db35f94e-bdb8-47d0-a478-4df10a4d3224", "value": 170496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652284440, "uuid": "347e73a9-61c8-4846-92e3-b812ca73eaf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652284440, "uuid": "bf7c5914-a054-41c5-be57-70deda30e924", "value": "56e7073e0f7b2cacaa30f77eaee4b036b480b1992ade5e55bfa2ff062eda4d8a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9715e27-d0d4-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652237233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652237233, "uuid": "f3b420dc-20c8-4a75-968a-bdf5667c0c4c", "comment": "Malware payload", "value": "1eaae14d48de71d8fccac6d36bf7414a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tasktool", "colour": "#61BD71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652237233, "uuid": "cdb3452d-65df-4069-a2c2-d5a2a0f4e4f2", "comment": "Malware payload", "value": "577b7bc4f60cc9711ebe0736b722c3f536908ea00ef1808f59bd94924b44f19b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tasktool", "colour": "#61BD71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652237233, "uuid": "5d79428e-abf8-498f-a3d3-193f05146da6", "comment": "Malware payload", "value": "53e687a36cf8ba259823df7da04f9763247a1134", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tasktool", "colour": "#61BD71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652237233, "uuid": "f132f21b-92fe-4f26-8b6f-86f387549c61", "comment": "Malware payload", "value": "b210ff881fe49371463debe5b14aae6968cd9a26a78871c53718b563ade4c3b537e79ca09c62bb0b440022a54989e56a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tasktool", "colour": "#61BD71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652237233, "uuid": "d0a58fc2-6308-4aca-820c-51cabcb0347a", "value": "T128B4CF2EB3A954F9E863C17CC8524942E6B278525374DBFF079046572F2B6D06E3EB20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652237233, "uuid": "0eeaff57-1fa9-4d01-ac8a-4a6fa14467e0", "value": "a85307dc1503c1ed326599b6f8ca7297", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652237233, "uuid": "ea7111ba-3c79-48ac-b1bc-380728960124", "value": "6144:1kHp1CT5DWqc15RdiTTCBAyeoaohHrdeBBoG/s29c+EX0IiC4fDXBg5h967YY8SO:1kH34D14TiHCBQ7o9cddc+Evy0967", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652237233, "uuid": "bc94ab00-a807-41f3-b1fa-d8ac687662a8", "value": 521728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652237233, "uuid": "913257ee-8798-4cc3-8dd2-bf515d699e5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652237233, "uuid": "1068a218-aa35-46e7-acb3-3e41d66882b0", "value": "tasktoy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be72ba81-d0ec-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652247576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652247576, "uuid": "768f8c21-da73-4b40-a2bf-2eaea2d6a6fc", "comment": "Malware payload (Formbook)", "value": "a0fd0dcfb5af60c3e834b2d61e7b9b6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652247576, "uuid": "a2a2528c-acd2-419c-8dd9-065160cbe6ef", "comment": "Malware payload (Formbook)", "value": "57a3559c6affb5200be54b3c0021bb049dd3306ab0e326815b555c55b39fe591", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652247576, "uuid": "b4138fe9-5341-42ce-be17-0efbebf90351", "comment": "Malware payload (Formbook)", "value": "b0476399175e653a8afdd590927dea5e92d0c760", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652247576, "uuid": "686eea98-3ea4-4c5f-9815-02d5e12948fe", "comment": "Malware payload (Formbook)", "value": "53d17253ee74734993f2b4e36c4799ac50cf93a02152ef0c91ffd97ed3198e3011bbc8ee42f3dcdaaeeb909afc668148", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652247576, "uuid": "aaa57724-e80d-47b6-9415-e13ad541a029", "value": "T19FD4010177B49F6AC83C07F86925895247B17C26DA22EB4F5ECAB2FF0873B414A11E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652247576, "uuid": "c26c1d7a-6bad-4a9f-a03d-f37a772db5a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652247576, "uuid": "c95e94cc-d474-4e78-bdec-c9c4a11788c4", "value": "12288:04u9WxhTdhhTMmoSG8V7wqzlNrcVSD15QazZDs7:Xu9W3T9TVoSxmqsVy1RZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652247576, "uuid": "e8412fd3-a2be-42de-9eb4-607e2f36bd64", "value": 648704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652247576, "uuid": "abc70d79-8732-4741-9ece-ce87d4d285e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652247576, "uuid": "6f83841d-c77f-4561-abc0-701c0accccc4", "value": "Enquiry 1331 SO 26929.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4055e1d2-d13f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652283013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283013, "uuid": "64c6b472-739d-4e21-a389-5042fc209ee3", "comment": "Malware payload (Mirai)", "value": "240a8e2b418cf570885f4861cd7fdd44", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283013, "uuid": "7633450f-92ab-4c79-820e-c16f70fe8741", "comment": "Malware payload (Mirai)", "value": "57c9d1dfd26ad0ff67395062a08872e9c8a74c253895e9b26692d8b7fe23a9e3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283013, "uuid": "e1d8143d-ed76-4ba1-9842-3aa275043f0d", "comment": "Malware payload (Mirai)", "value": "63d1765aa929e7b94ac66a57cf49e2b7c8f3035a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283013, "uuid": "bc5410cd-c901-4902-b6ed-7a7d3617131f", "comment": "Malware payload (Mirai)", "value": "a2ebed0bfa32eb53ed5f46f413ab0ee26273dec2c4637550cf79e75b3baf61f6c6c909013f9f59274ea2abef712234f1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283013, "uuid": "5dcd538a-8385-47d5-a1c2-04b824433ce7", "value": "T15EF35D46FA404B13C4D62776BAAF42463332A794D3DB730399285FB43F86A6F4E27905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283013, "uuid": "0836d945-aa4f-424e-bac0-7da22083bfb7", "value": "3072:DrDVMAMe/OnLktpw5zDVU47dHcPGG/zQnZg/DFm6M/9O35m8wxQ35x:fDqA3WLA2r7dHcPGwzkEDFjM/9E5m8wI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652283013, "uuid": "19b4e55e-9909-4ec7-b5ce-d0c10ade5ec3", "value": 163530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652283013, "uuid": "1cd6d118-dbeb-412f-837c-c03f3799dd37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283013, "uuid": "e59b4b2e-760f-423b-8d85-77270fdfd875", "value": "240a8e2b418cf570885f4861cd7fdd44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c702b64-d15e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652296321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652296321, "uuid": "b2225116-4c57-4451-86db-a6a0d86fd155", "comment": "Malware payload (Heodo)", "value": "25165f0801f18a3ff7481548b453a7fa", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652296321, "uuid": "68e6c33a-234f-4ac4-ad1d-7f9605276ed1", "comment": "Malware payload (Heodo)", "value": "57cf38e83dd7d657bb3c03a72167847274e4ca36021511941db2ae5d6e20ac6d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652296321, "uuid": "b1263926-10b7-480a-8229-c2d03f669035", "comment": "Malware payload (Heodo)", "value": "124b86e59cdf61432bbd8f0344560fa62c3a770c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652296321, "uuid": "58c6832c-e537-427c-87a2-a9598cd6b23b", "comment": "Malware payload (Heodo)", "value": "ed0bf4354c83ef6bdc7e22e6d2d0bec3c0b509b7fb5f1513561811266d8c67678ad757a5cc66f384af0e908bdd12cd3a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652296321, "uuid": "ee1bc200-8b8c-43cc-98b1-580506c03829", "value": "T1AEB4BF06B3A504B9E467C174C9735952E672BC121761AAFF33A0436A2F37FE06A3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652296321, "uuid": "896a4f30-d884-451f-ad6b-30dc33a18f7d", "value": "6196af15ce9ababd9a592319b3043ede", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652296321, "uuid": "13a7379e-6c6d-439a-a12b-dfc5af5f5dae", "value": "6144:iuD3jumQgXW2jLi1QPy+hSVL+ymioha7dtUPM1UlTIqNtF1FMytrf:ZDLVXW2j21QC1+yZoutUPMg9Z1FMyB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652296321, "uuid": "325f34b1-ee16-41ba-aa7c-33b54ce01a0b", "value": 513536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652296321, "uuid": "cf0e32fb-d9e6-4cef-afb5-ab4cf97c5945", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652296321, "uuid": "202c7d44-39fa-4a15-85fa-0738f8b9d59b", "value": "25165f0801f18a3ff7481548b453a7fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f33f17a9-d164-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652299204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652299204, "uuid": "a109717b-717f-4702-9e2a-0cbe87c67901", "comment": "Malware payload (Mirai)", "value": "28ef21e64378c1725065f01869efd6f0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652299204, "uuid": "75974212-2f6b-4203-82c7-fd814df9d9af", "comment": "Malware payload (Mirai)", "value": "582428c30c3b0dff2195d667e7d2c0dcd31e96250070108109c4e67f5a44c15a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652299204, "uuid": "304b56dd-56e2-4966-91cb-882ec56b800e", "comment": "Malware payload (Mirai)", "value": "828e7cb038d4fc93134d93fba2f687d756ea020d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652299204, "uuid": "724e6c7b-c76e-420c-9d89-7817ea0c6276", "comment": "Malware payload (Mirai)", "value": "2df34d08c51628cd9960ff2b32066c50b7241f372e3dd64a8e4533bd1bca1fc55888d59b8ab3905cfdaf5c90ce7b4ad3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652299204, "uuid": "6f655710-3191-4a80-b1ea-43b57e735a89", "value": "T19E2302B1E31EE0C3C237D9BAC8BF8781652E185AE1FB741E49DA3558A35188F5B38153", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652299204, "uuid": "9414f6ee-c563-4784-adf1-ecb2b53e4df3", "value": "768:95lpPa7beMGLDtWFuCLImiVKb0rmekqlE2A9q3UELuyTQPvfaYvCinHpo:9JPa7bQ8BWr9+2JLNQPvDvCiJo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652299204, "uuid": "c12b637a-0389-4e2a-b790-f7c620b22859", "value": 49000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652299204, "uuid": "47a11fba-d031-444a-bf8b-cdc7e54f1ac4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652299204, "uuid": "b44d73d2-a1db-49ac-aff1-3fc8a069ad36", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4df5ee71-d0e1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652242663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652242663, "uuid": "a6fe62c0-53f6-4840-b033-baf4f2b6d610", "comment": "Malware payload (Formbook)", "value": "ce80f11188752ec28c7e75986d83d396", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652242663, "uuid": "7b7d4384-c774-4553-a2cb-186c151aabcd", "comment": "Malware payload (Formbook)", "value": "58d325351b79f84d68ef5586de43ec3708fc0e142a83007fddbd7a05c20021ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652242663, "uuid": "1c829849-6293-459d-9fd3-15e71c3207ed", "comment": "Malware payload (Formbook)", "value": "e6c1fd6591a64ad27300a21feed4d2f041fe8cd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652242663, "uuid": "3a907a94-7457-48bc-9ae1-30b534bf4352", "comment": "Malware payload (Formbook)", "value": "a8afcf7d35cb807df26147e903a820e0103c021a0732f67f1f7a9330be27d6140487556acc352b4db5f0ba1167cf0461", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652242663, "uuid": "2384d9a6-fea2-4dbb-bd50-b1525c83bcdf", "value": "T12AE4120823E8AB35E2BF2B7951B924096FF9BD16D532E31C5FC4148E29A7BD149047B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652242663, "uuid": "503a0c68-ad84-43ea-8c57-162debfaa419", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652242663, "uuid": "4f42209a-3f47-4666-8f7f-92e08b9acef4", "value": "12288:npepFsnFTpwmuVahL+sqo5mD89jX9NFWdCJ6kXtx46JgsSUkZmHTSp:noMnp7uVa9+YQDoX9SxaL4DPUkZt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652242663, "uuid": "a10b0794-31f1-4654-a1e2-59e59a02f93d", "value": 667648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652242663, "uuid": "b5dd2f70-4351-44ee-ae0b-3d39cdca21a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652242663, "uuid": "57edf698-dd51-48c2-87e0-c3b808730d5b", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff153846-d111-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1652263576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652263576, "uuid": "36783bb1-7eef-4271-a07b-f991154b6843", "comment": "Malware payload (RemcosRAT)", "value": "dede005333f56291d50850db1da59a41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652263576, "uuid": "a0886b2e-9b83-4eb3-8bcb-c74fa0465956", "comment": "Malware payload (RemcosRAT)", "value": "5903a9c71f93974bc25d0acbd5c8502aecb1197af5bacdf20eef07c5a0f4b57c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652263576, "uuid": "753ed828-8e46-4c41-911c-23275d5fe498", "comment": "Malware payload (RemcosRAT)", "value": "59097a24d921dee4bdce5c71224cc2e5ea1d265c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652263576, "uuid": "24cc9a30-105e-4216-951f-7cc1dbe9b467", "comment": "Malware payload (RemcosRAT)", "value": "51f43fdddcd367913f036bd36ba554556b305567405271b9e83216dd84315993b2b4a08fd416e212c65afb97e26bf108", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652263576, "uuid": "aa6988f3-1daf-42c9-9359-98f7fc16ebf1", "value": "T13FC42380B749FCA6F9AD8A714D27CA2658F4A873447062532788F25B7F337019E0E75A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652263576, "uuid": "1c329724-e509-4188-b933-c64e6b902786", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652263576, "uuid": "54fea147-f9dd-472f-b98f-c5cae6638261", "value": "12288:mOAw6M7zLx9ud6TG48wtpvD+P3tBYlMBjGNs7nvQUlfnmUa:mOAW7PxO4rDtxeHYCJyscUtmj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652263576, "uuid": "a5a350dc-f4de-4c40-b389-f815e0018f3d", "value": 567835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652263576, "uuid": "91689421-83e4-455e-9115-5a9c06c20dbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652263576, "uuid": "cfd81713-00f5-42ea-bdd6-4537486cbc24", "value": "PRE-ALERT SKLZ2112352 SHANGHAI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "507b8b36-d13f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652283040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283040, "uuid": "59500fe3-d824-4d03-8936-0308387307c0", "comment": "Malware payload (Mirai)", "value": "c5c0f4086008a6909ba517a6b12b6dc4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283040, "uuid": "709ff735-3913-4c5c-a29b-fa24bd7df1f0", "comment": "Malware payload (Mirai)", "value": "591f3bfd1e7a321ee5b7ba379f24c0be2dbd4f0e79427b1da2fe508f78315a00", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283040, "uuid": "80eaf6ad-3f4c-4edf-a635-759365522bfd", "comment": "Malware payload (Mirai)", "value": "d713197d482118641a02acc5f1374f4f978aa5cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283040, "uuid": "192a435c-3975-4354-b1f9-2b9881f8af29", "comment": "Malware payload (Mirai)", "value": "2bfc21bcdc0e3f4427fb203000223dda47c0b1e10c265b0a37a333611edc072acd8602fbaf9c0970650d1f780f60116f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283040, "uuid": "6c385059-bd22-427c-a551-c729010216de", "value": "T128932A55B8918B11C5D522BAFA2D158D331317E8E3DFB2139E205F743B8A92B0E3BD45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283040, "uuid": "01e7bb61-3943-4154-b74d-9f12897b2859", "value": "1536:tcn0e/8AvnliGwL3ZwV7uoZAMFLMWJace+NdBgOdw2WM0z5Hc55AcOFQnMCig5iy:8jvliSAMOWacjN/gEHz0zNwTt5ixZak0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652283040, "uuid": "26108de8-2c53-4544-993d-e80ce6483329", "value": 95424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652283040, "uuid": "1758747f-e565-40c0-bffe-c7f87ef8617c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283040, "uuid": "bce196bd-f844-473f-88b9-6149cb3c9fa4", "value": "c5c0f4086008a6909ba517a6b12b6dc4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "255385b1-d0c2-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652229281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652229281, "uuid": "baeca6b8-6645-4f40-83f4-185decbb2e60", "comment": "Malware payload (AgentTesla)", "value": "3d35e613aed9cf25c3d063d98296547e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652229281, "uuid": "2c290c9d-7b4b-4269-aee3-a49c4aa793d3", "comment": "Malware payload (AgentTesla)", "value": "59cb024dac79e0a360f7feab234c5dfe59881d1934a42a9d4ffec1862682e78d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652229281, "uuid": "a444e04c-175d-4b59-b5eb-bd4ec4068561", "comment": "Malware payload (AgentTesla)", "value": "bb725971696939c88f726af7be09575bcc560fce", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652229281, "uuid": "ff1cc9e3-4a25-4966-bddc-5677be758882", "comment": "Malware payload (AgentTesla)", "value": "040a85fedab6e77d820e59f251635a084226e705e2ca810391126bb817cc8244a7f4409c119eee05b2b51e3d7647ca0c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652229281, "uuid": "ffda2565-775f-4a20-a3c1-e6a6de3d5e15", "value": "T1A05467F9D7E357D3F8326A36CB91523460323EC9A4E46DF556C8B72C49301DEA21A92C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652229281, "uuid": "ad4a53a1-f5ad-4e85-8e56-2a23be06bbf1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652229281, "uuid": "d8d999f5-d572-4022-bf3d-72a6aa80bb11", "value": "1536:VqE1VAB3Zfcpn+1MVoyJPkbu1OK1OvR6EPOsmHfEXXknCYQWB1Z2SO1BkQ2y14BL:Vqf5GfqPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652229281, "uuid": "2298a6cb-888b-4869-9556-942ff63d44af", "value": 293888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652229281, "uuid": "4b2b46b0-47ff-4b0f-8413-5a8656934f95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652229281, "uuid": "e05421bb-6cf4-414d-87f3-9125dd268c1e", "value": "SecuriteInfo.com.IL.Trojan.MSILZilla.19174.30106.30345", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38ab7855-d15e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652296314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652296314, "uuid": "b82fa1cc-228b-4f91-8fe1-0d00abad7a4d", "comment": "Malware payload (Heodo)", "value": "4eac2c03ab0d2c50f3e963859d985ed5", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652296314, "uuid": "e6d71b00-15d0-4294-bb91-d1f1b4b0a582", "comment": "Malware payload (Heodo)", "value": "5acb940e58c09f268a266f5d7339a8c1fe8c9173f275303858ce1747a3d35171", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652296314, "uuid": "96291fe3-11b5-4d70-a304-ca1eef095ef8", "comment": "Malware payload (Heodo)", "value": "21e15e62e21bfe4922ec54dd7f0c8f60b7943a03", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652296314, "uuid": "d27ceb81-1a09-4be3-9fbd-9a1c401ad0de", "comment": "Malware payload (Heodo)", "value": "0ce73ea82d370d4a09d2d99bc0998ec24a8a4ebcb41303c6fb1d3ea78eb27901cf047b0e5d22a7cc7c988699626cf5e2", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652296314, "uuid": "68ad3427-b5c2-4367-a252-c0b0a0de7673", "value": "T116B4BF0673A504B9E467C174C9735952E672BC121761AAFF33A0436A2F37FE06A3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652296314, "uuid": "838bc79d-48ce-450e-adff-5ec1a9b6c928", "value": "6196af15ce9ababd9a592319b3043ede", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652296314, "uuid": "073d20cf-9a4a-4946-a908-9ada098202d7", "value": "6144:iuD3jumQgXW2jLi1QPy+hSVL+ymiohaPdtUPM1UlTIqNtF1FMytrf:ZDLVXW2j21QC1+yZo+tUPMg9Z1FMyB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652296314, "uuid": "07502deb-3aea-4313-8d3d-6eaa4cd3c15a", "value": 513536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652296314, "uuid": "f7360081-8128-4c69-a977-9a3ad74183f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652296314, "uuid": "3f44654d-47c7-46cb-903d-6343244d4128", "value": "4eac2c03ab0d2c50f3e963859d985ed5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6a4756d-d12d-11ec-8e58-42010a9c0032", "comment": "Malware payload (AZORult)", "timestamp": 1652275480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652275480, "uuid": "d9376baa-fb8b-4f8b-898e-0914b1e0a40d", "comment": "Malware payload (AZORult)", "value": "5e748489c4bb54ebb67e3d4a3779ea03", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652275480, "uuid": "86db94eb-8f4d-4ab5-a4d2-9165db0ceb77", "comment": "Malware payload (AZORult)", "value": "5b33b53607c8a74d787cf1303bbdb20196577023bf9f68e13788f7f06cb723f6", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652275480, "uuid": "bbe51115-712e-4dfb-8e90-2361164ff69c", "comment": "Malware payload (AZORult)", "value": "58644cb35c8f184c347c77f73ceab6c61201e692", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652275480, "uuid": "5f310158-d5ad-4dca-a3b5-51654c4f0ee5", "comment": "Malware payload (AZORult)", "value": "9d2c0301d281d6b13b80d81ce7b51f12a5969c1813bd446eb3be0d12b729ec473ac3e99ae06b479897dd5e6d83f92fa6", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652275480, "uuid": "f6c480ab-426a-4512-adb2-807ee5b3e8b0", "value": "T153E66C22B284A03EC46B0A3A4837D794A93F7B712E26CD5B2BF41D4C4F357416A3E657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652275480, "uuid": "e08bac1c-5f07-4954-b354-b2ed74fbae9c", "value": "fa1f033b599312363f9b5e4c24b2c6f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652275480, "uuid": "8ed9b906-264b-4270-90a3-3b631aec1c2d", "value": "196608:Oq23W2REB3LZzvFPONdFAxRFIpitxNLjDCjF833rER7n:OquFk31zv1OWIpgxNXDCjF83bEdn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652275480, "uuid": "26e0d51d-4366-483d-bf2a-5c3d74cfa222", "value": 14066688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652275480, "uuid": "7f9716cc-5e2e-4073-9da4-8848fb2cfa84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652275480, "uuid": "68c348d7-341c-4e6f-9415-f6af2a6a7f4c", "value": "folio_clssdbhtktyt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "364cdf9a-d0ee-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652248207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652248207, "uuid": "964508b2-9d7f-48c6-b3b9-29e76413809b", "comment": "Malware payload (Mirai)", "value": "5c8e3b645855b7d644b86e15b9633ab4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652248207, "uuid": "8a3e5554-78ad-41d0-bf78-2940886764d2", "comment": "Malware payload (Mirai)", "value": "5c28ed86371c5848bd5c31c23c471de088d08f5de16776ea878978f8120df49e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652248207, "uuid": "fae88a75-e4c4-40f3-95fd-01ece1ab91d5", "comment": "Malware payload (Mirai)", "value": "bbe8059594a71b11d25c3cbb7b3a83ed43c8aa65", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652248207, "uuid": "3e167b08-5a1b-4449-8bb8-c0b35569f776", "comment": "Malware payload (Mirai)", "value": "6db6f1bc0cadcb0cc03bc2e5e0b3c4406257be22f6c9f0575050372c4a7e3522b756ffd671b7f80c5cdb3ec5305a493c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652248207, "uuid": "8f1e28cf-ecef-4ebe-ae8d-0a7f2cce2197", "value": "T149933B857D40A622C2C9127BFA1F028D376513E8D2EA7307CE255F70778B92B0EA7756", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652248207, "uuid": "2be21f2d-1c6f-453e-91dd-afd6d6275637", "value": "1536:3joSzqgh9kb/1vOVyRMc8nfYlvANuwnKOdcjsnsWwLvNW:3joSzqghGNgyywlvABEOwI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652248207, "uuid": "02c51398-6d84-4598-80c1-939cb6971749", "value": 92308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652248207, "uuid": "cc2d4a95-b4f9-4946-ac6f-d655e0bd2b70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652248207, "uuid": "cf71a2cb-418c-4db7-9c36-40d6fdd06bcc", "value": "garm-20220511-0550", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb39e427-d10c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1652261315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261315, "uuid": "8afb8a8e-b4ea-4915-8e00-a25c976f419d", "comment": "Malware payload (Gafgyt)", "value": "6ee4cd44bf7c64447e9f2c4c62ed1071", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261315, "uuid": "3e985086-446a-4a93-b397-cc4cadb11d9d", "comment": "Malware payload (Gafgyt)", "value": "5d56feca91076aa6a38ff111bcdeeb811c95b12dc61b4c140828ebf3f210aac5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261315, "uuid": "82464e90-4f8b-4d2f-84bf-5b6315d9eab0", "comment": "Malware payload (Gafgyt)", "value": "2ea9ae981f429e5f7b6d2f2d254fe708056afcea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261315, "uuid": "afde7444-4b03-4db8-83fe-bf1e1b56aac6", "comment": "Malware payload (Gafgyt)", "value": "7993c97fdbaae1136b8f6df8d3d7311c282aaef51f3d13f3cf0dcad8359d9bc517c2218ef38243553f7368399de552a5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652261315, "uuid": "b85ec2da-48a0-4f04-bf4b-161bceb5f433", "value": "T1B2C31844FD04475BC3D227FAF79E429D37366E28979B33216A347DB42BE17982E29120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652261315, "uuid": "6a3b3a7d-91f3-4cc5-8515-6eaacc60cbe1", "value": "3072:tRb4JKEe3karl+qg4oX+kH1APuIFH78z8QTKtEDsdNi:tCKEVarlVsOkH+GUH78z8QTKtEDsdNi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652261315, "uuid": "8bbad76f-b67a-405c-818c-5522e93f7369", "value": 127046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652261315, "uuid": "019ebfe4-c041-4a9b-b20e-37e98997d92f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652261315, "uuid": "34884866-3a4c-40dc-a9c2-7f8d86d12022", "value": "6ee4cd44bf7c64447e9f2c4c62ed1071", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f4f67c1-d0d9-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652239149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652239149, "uuid": "c0fef3c1-be49-4d81-8c44-2c57dbbd6f3f", "comment": "Malware payload (SnakeKeylogger)", "value": "ac94b0e54b9334f25c1ee1aa29834b26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652239149, "uuid": "54fcbe99-293c-48a3-9d51-632b0cc9e449", "comment": "Malware payload (SnakeKeylogger)", "value": "5e78cf499e73d06b346f84de0a36188587cb0789a9a02899d3e5d0dcd4a15520", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652239149, "uuid": "ae4a0d53-9ac6-48cc-ad70-910ab4e8f2e8", "comment": "Malware payload (SnakeKeylogger)", "value": "2051c396be3542324b0c2b06dcc7f8651cc5d5e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652239149, "uuid": "17c2d36e-c15a-48d3-848b-fbedde4e35f7", "comment": "Malware payload (SnakeKeylogger)", "value": "9955e36c9ffe307375e220cdfafba97435a93054170f2e522c49563ff754d2c9de6488e18120e070c6c2630859ec7359", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652239149, "uuid": "99dafa08-340f-4495-b83b-b3f3ac5c54ad", "value": "T17BC4120962F8DB24E6FE1FB8217960045BB4F85B6933E35D4FC4A94D36A67814E207E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652239149, "uuid": "c78a809e-0ada-4df6-a59c-0ba420eb609c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652239149, "uuid": "9b7d0848-4233-4704-965c-397889130fcf", "value": "12288:+YpipWz4LpUJ7uShHT3c26jMUxzWJPSrg6C9/HXrWfqp:3QyJ3hz3c26wUxKJogZ7j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652239149, "uuid": "066ff83b-a987-4291-8c32-5727081b721a", "value": 593920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652239149, "uuid": "87767ede-e1f8-4b9a-8ca2-b4f605e5a220", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652239149, "uuid": "a8eddbde-4557-44a6-a924-8584ae68c31a", "value": "PR NO 132.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fd86423-d12b-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652274395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652274395, "uuid": "6d015893-9d5c-4a0c-a7e8-856f5799324a", "comment": "Malware payload (AgentTesla)", "value": "c911f611eb621c4f825b0b5620c88b7f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652274395, "uuid": "91f65d7d-e58c-489c-abba-ee8650728659", "comment": "Malware payload (AgentTesla)", "value": "5e8540ee75fe4107c4691ed38721559b01564c85185188087cb9f48738254cd1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652274395, "uuid": "80d4fc66-0bfc-4be0-b8c1-eb003bb7999b", "comment": "Malware payload (AgentTesla)", "value": "316d2584fc8eabf9d37b3ccb6ac52c2042950b45", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652274395, "uuid": "ac984bee-1926-4353-b479-92dc6f40d356", "comment": "Malware payload (AgentTesla)", "value": "99088af6560c392f4450c97b458dbda43a9b8878115f892b5972274739e3915f6c5a236d4f31ea23b886590bbd26889d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652274395, "uuid": "efcf4a4d-d307-40ca-8ef0-ba29c4e8c777", "value": "T116B2301B778C8624D9B70AB1FCA391441626FF0598D1A72EA4E8BE2F3F336444B73521", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652274395, "uuid": "475726c0-0219-4b07-a640-66d09290bd80", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652274395, "uuid": "d4a1a0f3-5775-4df5-8ed7-9c3fb6cef25c", "value": "192:ixoTOTEy/Q0k3QbTgW53a81URxRs96bvH:pTOTEy43Qbnpa81UiEbv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652274395, "uuid": "94b999f5-54fe-445c-b216-5d827d2d3bb6", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652274395, "uuid": "c9117730-cc11-4669-8055-841ca8eeadc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652274395, "uuid": "a38bed24-7e43-42fe-bd5d-fe7e0f7701e9", "value": "QRP74031000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a1d08b0-d13f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652283110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283110, "uuid": "e4a04dee-bd9b-421e-879e-50d142cad1f7", "comment": "Malware payload (Mirai)", "value": "c4a1ecece300e3df17754c61c821e8d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283110, "uuid": "3875023a-4800-4967-b36b-cdd0f0d64667", "comment": "Malware payload (Mirai)", "value": "5e9c0a523f305195e709f35fdea61edd2c2c16d9f1f50c95a98c6244c868b33c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283110, "uuid": "169d82cc-ed3e-47b0-bc2d-faf3c5084c45", "comment": "Malware payload (Mirai)", "value": "1a9a9707a032d42aca674e077419c62f05eab51c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283110, "uuid": "a4921965-d0c8-43d8-9368-7a56a4673667", "comment": "Malware payload (Mirai)", "value": "c2a4cd2a4c2db9309619b4b33299a96bada3f26356481cce8dbc79285794f028e4a239d1451c890997cc9f17bcaec5e3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283110, "uuid": "11a62588-23b6-4f85-a85c-e5fbcdad8c39", "value": "T130A3D70E7E259F7CF7AD823547B78E25965833C626E0D640D2ACDA101EB024E641FFAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283110, "uuid": "9f5257d3-a76d-41f1-b547-e1eaaa3be3df", "value": "3072:OOyHOi02MjE9KFHC+n3kgQ3H3tH7WZhckMx:OOyHtcrdCItA3N7X3x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652283110, "uuid": "7c2f49cb-fc43-4565-b69a-f22bbbd25d19", "value": 106676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652283110, "uuid": "f67e40b0-0424-471b-9504-e4089ebeb846", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283110, "uuid": "c8730481-1a49-4ccf-bd99-cc2b4950fe40", "value": "c4a1ecece300e3df17754c61c821e8d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ef8a115-d13d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652282259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282259, "uuid": "4320163d-8f67-44eb-b8b1-a781032b2656", "comment": "Malware payload (Mirai)", "value": "de9c909768426fc464d7137c3b3ac933", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282259, "uuid": "c0e9193e-c093-4d9c-ba5c-4be66f68f629", "comment": "Malware payload (Mirai)", "value": "5f5c9d455d3f7ebd2480ff21551acc43ee04206bb32f453b57ac7063d601e1cd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282259, "uuid": "c13e774d-2a5a-4c5b-8b45-045eba6da146", "comment": "Malware payload (Mirai)", "value": "32b4052b48ff061a6df0c90d979e59669ca4f044", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282259, "uuid": "01d3c702-d8e2-466e-876b-e7f714b22140", "comment": "Malware payload (Mirai)", "value": "a785fda16acbb7d6d9660fd8f3857aba96f461edf6584ff95934463d9fd5d6f36e869cb14189dfe16faa3c47025b8264", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652282259, "uuid": "4f7e2c5f-d94c-4235-a437-2e29c5e81120", "value": "T106539EA5C4ACAD9CC6264678F6148835AB23A00C62A33DF6DA57C656845FDFCF01C7F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652282259, "uuid": "c38c7fcf-9424-463f-9903-8e33dd909e44", "value": "1536:sal/He90IlrkHkAPf+2JCs2F/S9/Sfs3zO/QSwtPlCXLi:sY/ejJkHkAPfyF/Swf+iYdtPlz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652282259, "uuid": "8db2ec8f-247c-4800-a57d-8f1e7c2b8f69", "value": 66368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652282259, "uuid": "93194a93-48e0-4a57-a0b7-bcc904fb8230", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652282259, "uuid": "2d2d8785-8a62-44e8-b463-dadb491436cc", "value": "de9c909768426fc464d7137c3b3ac933", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "510ab9e7-d174-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652305804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652305804, "uuid": "bd1cfa45-f173-4e9c-8bb4-f41559766057", "comment": "Malware payload (Mirai)", "value": "36d0a638f813a08b79eb91a97ecb9bf6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652305804, "uuid": "4e516e5b-ede6-4025-aba4-60656c1d4702", "comment": "Malware payload (Mirai)", "value": "5fef2e5ca21745cf28b52803de4ae5bcbf15d75dba2b1cad84c0bd05ce9bd4ad", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652305804, "uuid": "4ab1c719-b91a-4f9e-844e-5747660321d1", "comment": "Malware payload (Mirai)", "value": "f30b8c423d118338c4cf8c1e9bdba0c43cf23a81", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652305804, "uuid": "8be641fd-9e44-4946-acfd-de765e736fc3", "comment": "Malware payload (Mirai)", "value": "832d05f4170e3222e5c1426fc8cb2359be39d33b368f2bca87c7de4c02a6bfc3064dc23c740d24baa9b30ccb5da4f8b7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652305804, "uuid": "7bd29952-98b2-47fc-9014-290f640484d6", "value": "T1A3B2E886A9D24D1EC5D4137AB67E42AD33106B97D1DFB70BCC048B543A8A90F1D6BBC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652305804, "uuid": "cd736978-80fc-47ad-a447-716abbfe0d9f", "value": "384:v/Ceot75BJRZhpx5BJRZhpx5BJRZhpx5BJRZhpxmO2eG0uX2G/a8xr8Cr3qPDllL:v6eA5BJRZhpx5BJRZhpx5BJRZhpx5BJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652305804, "uuid": "44d58b4c-3a34-46ba-b9fe-13b1a2f12ba4", "value": 23536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652305804, "uuid": "4d4c4fdd-a732-4e5f-86de-f6e1f3c18fda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652305804, "uuid": "9181978c-8575-487f-ada1-96fc37b56577", "value": "botnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "998c353a-d125-11ec-8e58-42010a9c0032", "comment": "Malware payload (AsyncRAT)", "timestamp": 1652271996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652271996, "uuid": "fa1eac3b-0152-42a9-af62-25c1f3654f42", "comment": "Malware payload (AsyncRAT)", "value": "337405cd0e3e50cb1549d9f8f287bb8b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "latamhotel", "colour": "#4B0DE7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652271996, "uuid": "3fead217-f777-4556-9380-0b17ac4950fa", "comment": "Malware payload (AsyncRAT)", "value": "62e33e6670b07bb55f79d13f512d9dbdb2ee0550905053525a9aa914ed7f3ef7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "latamhotel", "colour": "#4B0DE7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652271996, "uuid": "da49406c-38d6-4377-a723-d7108c0e42ed", "comment": "Malware payload (AsyncRAT)", "value": "09224d63ebb3940a1d82bf326ee81b02d61e169c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "latamhotel", "colour": "#4B0DE7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652271996, "uuid": "cb563d2c-bc06-4a4a-9248-f7f62ccb0213", "comment": "Malware payload (AsyncRAT)", "value": "874da58c072a8b177a73cc17df049b5d874651a99a4886f5f0431de8abd046fe3b547ed6b7a94b5f75179d267469dd98", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "latamhotel", "colour": "#4B0DE7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652271996, "uuid": "ed2bc75c-f704-4540-894c-418cd90d4457", "value": "T1DA92717EBA50C34A6D42886616FBB3C5BC41A0AE105BE0AD4663F7B795243077F392D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652271996, "uuid": "85dd6017-90ca-4727-a331-829e89ca55dc", "value": "96:Bpjpjpjpjpjpjp8jpWpjpjpB2rtylsAsGLrnskvisGl4sARDlsA5MvMtGv+nA5uu:/FFFFFFKIFFz7A+g5FFFFFFFFFFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652271996, "uuid": "d7d3fb3e-ac2b-43c8-b03f-8589f4ae83f0", "value": 20416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652271996, "uuid": "ed9e37f1-4e69-4ce4-a613-4062658ef9a1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652271996, "uuid": "33c075d9-d92b-43d7-9002-08c98db8dfbf", "value": "hihi.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5216abc3-d129-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652273594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652273594, "uuid": "23f42502-1750-49a1-a68e-e735f4c4a3ba", "comment": "Malware payload (Formbook)", "value": "baac441488f918ba66f95cad56cd228f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652273594, "uuid": "e932c1f5-fa7b-4a05-8575-b59417ad0141", "comment": "Malware payload (Formbook)", "value": "631ac6c362a98070ff6afbfb5d35b9e87d02d67d4303e6311a37ac22b6806fb1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652273594, "uuid": "ebdbee79-072e-4855-aaf4-fd6dd5d0eeda", "comment": "Malware payload (Formbook)", "value": "79b70875a9240a8eb9510152ce649c147cbf3b5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652273594, "uuid": "eea5e306-0ff1-45e3-a24d-91c315e62525", "comment": "Malware payload (Formbook)", "value": "b73919116121de2ef99e4a8a712cf2cc80401633e2e1f51e2fff3f8a0197f65b5f141aa498420c4b1b4964eeee7d5d35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652273594, "uuid": "6e7c8081-5629-4cb3-850f-716a34340e0a", "value": "T1BE4412A07754E877DD838B328AFB06667ED98C1644E4570B8F207E587E6A30167BF603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652273594, "uuid": "1b46b6f5-0b68-4576-a490-432a97bf327b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652273594, "uuid": "0f0a68e2-12a8-42b5-96d2-5510677faa5f", "value": "6144:LOtIORGuWjon8fJIRPThSh/oU9guBiwZOWY6c20O/o:LOL4jo8fSRwh/oeg2iwYB6c20V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652273594, "uuid": "fdd6880c-3a08-4c0c-9d1d-87afb594e183", "value": 275174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652273594, "uuid": "3eb57da1-b248-4d2e-82c8-b8943d2a2b1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652273594, "uuid": "4fd8a362-bcea-4cc0-90db-53d0d2238294", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1969855d-d112-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652263620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652263620, "uuid": "4c19210d-1a77-4b77-a24e-e7b70db6a80e", "comment": "Malware payload (RedLineStealer)", "value": "0ee6c0c3125b0fa3de7485ba25ce5f83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652263620, "uuid": "c33318bc-ccae-4e19-8dc5-95c670157957", "comment": "Malware payload (RedLineStealer)", "value": "63581ae3a6484a00bb415bdc2105a1256fb9929a7cb3ef9bcce1b141bb99bf7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652263620, "uuid": "d8659b06-9a9a-4058-8b9c-8ce817c1fdd4", "comment": "Malware payload (RedLineStealer)", "value": "5bfd848feabd6cb1fe1fd068d2ff98aca16412a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652263620, "uuid": "05162be6-95a0-4fc9-a8ed-da46c05c4add", "comment": "Malware payload (RedLineStealer)", "value": "1d4177e016a6e5221c6bfd67d44e9bd968eedbe19e611c09c7566b4a31f73f7aeea63f08d96b52b89ef46e4b2e22dd76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652263620, "uuid": "8a3ba48b-dbb9-4fdf-8352-df1e3a4e2e86", "value": "T16CF4F003E646902FDC119B33D852BD71DEEEEE32DB255027268F3A4A1E321C1915F6B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652263620, "uuid": "f40fed90-d9fd-449b-97fd-f74202821d11", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652263620, "uuid": "3ed25efc-f727-477b-a981-5d833524297c", "value": "12288:VQi3IG+zy2yc6m6UR0IWp1hf39Wkv8xwJ:VQiYG+zy2yzHIWpdUM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652263620, "uuid": "c3aab31d-bcd4-448a-b44b-29021f03af2e", "value": 774144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652263620, "uuid": "d32fa62a-4376-4458-9c11-60ad1d8b72ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652263620, "uuid": "7609b673-6178-44a3-9f4f-1d96e786cb13", "value": "0ee6c0c3125b0fa3de7485ba25ce5f83.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbc92f84-d0ed-11ec-8e58-42010a9c0032", "comment": "Malware payload (IcedID)", "timestamp": 1652248109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652248109, "uuid": "e186df68-e1b4-4f4f-9da4-e9769b5bbc34", "comment": "Malware payload (IcedID)", "value": "f425f1defd562e22a3a62fb5bc141cb1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "photoloader", "colour": "#6BE8C6", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652248109, "uuid": "28f6d6e7-aa2d-4d07-b272-b5edd9633923", "comment": "Malware payload (IcedID)", "value": "63770070208c532df8a7d41a391faff7c5280814bebd13b0b935f0fa80fc8e27", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "photoloader", "colour": "#6BE8C6", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652248109, "uuid": "723a5ae4-885b-4a77-9322-47cc623b1da4", "comment": "Malware payload (IcedID)", "value": "d7bfce77cad7d605e35538c2501a522015e3e3c2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "photoloader", "colour": "#6BE8C6", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652248109, "uuid": "ac012084-6318-40c7-8991-ffe280b6c2c0", "comment": "Malware payload (IcedID)", "value": "318908b6b046509a2003a008cf69e96cc9244a2441e42ee0231dd7e7b25704098182a6f036c235b263357bc2a54d97bb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "photoloader", "colour": "#6BE8C6", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652248109, "uuid": "52dddd53-db27-4975-98cf-2337efd0f21c", "value": "T1C152079E272105CCD1BBD2BAC6112E13D2F238A40726875E04F0DDAF9F233126A6EF05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652248109, "uuid": "c5ecbdbf-886c-49eb-9379-95998f286f13", "value": "b8b6216613b83b9374da0ac1163e6c23", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652248109, "uuid": "e3db6337-96f1-4a4f-a878-e02efbc983b8", "value": "192:sHVMfa7TTCjJSixzPSAA56RCK7Yu/VPgw4oXBAQYfPq/3Kb:s1Mf0gJSix2AA56RCiZVqKGQYnq/6b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652248109, "uuid": "9090f043-3d16-40d8-b30b-db5f2a72d489", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652248109, "uuid": "0c25059b-c740-491f-9225-4564a4e74d9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652248109, "uuid": "f8db1274-6214-4260-9151-8e5fda6c12d1", "value": "3cbc08dc4f11379f6e080a7b6dad3e2f7c53202e08f461100f4ce4f5b869811a_unpacked", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d561ba7a-d10e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652262218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652262218, "uuid": "0c004928-f34b-4afb-87ab-a7503a0801a5", "comment": "Malware payload (Formbook)", "value": "db4313dc01ba0b9dd2e9cf34fb7f8343", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652262218, "uuid": "37e02eaf-a7a6-49d3-b0aa-42d483db3aa9", "comment": "Malware payload (Formbook)", "value": "63997f07918cc69341e64c6bed789aaa16851243d9f578dd98679524d6aa5751", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652262218, "uuid": "e2674840-e9e3-43a6-9975-02414964c75a", "comment": "Malware payload (Formbook)", "value": "72e5668fc6a86ed66a12bdf30b663b8f4d3cd312", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652262218, "uuid": "586eafd6-fcbc-4f99-b1f2-856df643733f", "comment": "Malware payload (Formbook)", "value": "7a17e329e74a38b0ab1c5cbf07655caa7d609350f1264abaae44827def1d870c3eb24fa89462e6c1e1f9dd2554bfafb5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652262218, "uuid": "1584288e-6028-4c6f-9838-61062a025d0f", "value": "T119E4F10073A45BA9C57C07F83A26895147B17C3BDA21E75F1DCAB1EE18B3F414A52E8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652262218, "uuid": "e17bcfc2-6098-41c5-a52a-858e9f5d3beb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652262218, "uuid": "2c1d8fa2-3640-43d7-a4ea-adf89faf764a", "value": "12288:lTLu9W8+S7zZqS1UDfZ9JoQ1cMqyXANusoHhe8VRXMI8fC:Ru9W89zeDfZ9R7ZX6WHr+NfC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652262218, "uuid": "0aaa39b5-b77e-4f34-95b3-6449639e88f8", "value": 670208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652262218, "uuid": "d1fc88c3-ed78-430c-9fb0-d0e7c53d5f3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652262218, "uuid": "564eb599-89d5-41ed-a289-95abf4b97afa", "value": "Swift Copies 103 -05-09-022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "554d116a-d118-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1652266298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652266298, "uuid": "c4a93a21-d6fd-4288-b196-5fc4113961ff", "comment": "Malware payload (DCRat)", "value": "15aab4c1603b00c7f820ce86decbdf03", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652266298, "uuid": "966c2751-dfe8-4d50-918a-f2dad2877407", "comment": "Malware payload (DCRat)", "value": "63dd0a2a872fe7368088cd4916ed199f6ead9c5f5843facdcaa578bb68dedd57", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652266298, "uuid": "d3941078-ca79-44e8-b635-b71c68c178c4", "comment": "Malware payload (DCRat)", "value": "78f32cca891fb58e6f9445b28c9d2eda84c348d4", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652266298, "uuid": "2d0490af-2444-4849-8995-e0d32b10c80c", "comment": "Malware payload (DCRat)", "value": "41368459600b855731407c9ed84352b2ab5509b1510012949c16471171cc1f92146d2ae49352f4001f42f005f2236d8b", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652266298, "uuid": "5abd4df8-833d-4f98-b795-b86f03aa4236", "value": "T13635EF12D6A747A6D9A3F7F8B0ADF27226292DBF136001DB3738FDD418E0E55046127A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652266298, "uuid": "1874ff53-2fb2-4555-9476-6b58b18e959b", "value": "bc70c4fa605f17c85050b7c7b6d42e44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652266298, "uuid": "363d81df-c5a0-47cc-8ebf-361676f95693", "value": "24576:eQ663wN5YU89Y5p6/4/p46msE4nbz7DFEBLQYekPLfOZX0w1zLVvi:eQ66GYD9YPcGYOmKV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652266298, "uuid": "b82f6fb1-3dd5-4ebe-8e01-6f17c0a817f0", "value": 1136640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652266298, "uuid": "4746cf9d-28f3-4e97-86e9-c11172d96e22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652266298, "uuid": "f49a183a-a0ab-43ac-9430-75fa4ec59fe0", "value": "15aab4c1603b00c7f820ce86decbdf03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e3f9aa3-d163-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652298606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652298606, "uuid": "196c18d6-a8c3-4a6f-8db4-eddd0641dd8c", "comment": "Malware payload", "value": "e9ecbe9f9bc260bc582fab327d06abe1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652298606, "uuid": "9983da0d-db68-42b5-b5be-cab4ba20e692", "comment": "Malware payload", "value": "64317307935c3a00724ba448545de7c74385254f7dab22d7f8305ffca05464d2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652298606, "uuid": "a5ec4c1a-d783-420f-b873-5105736d8996", "comment": "Malware payload", "value": "da175985a326ba85c2fd3d58c0e89e7813d4b0c7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652298606, "uuid": "3124b40b-0ca7-4e9c-89da-78d63a27b674", "comment": "Malware payload", "value": "fa9c005e65dff115711045dd9abc816058962c2723a2e21e74c8884f271be4f0da9ff788163f17bd628ef7b3da987ddb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652298606, "uuid": "6979a16f-15ff-43cb-9774-824869e76348", "value": "T12F53021CD5438572A7365C39FD1616D2E32073FDC4AA3A155B6E87BAA7B8089D730223", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652298606, "uuid": "fe7482a7-e8e0-45b2-b1c6-b12bffee5a12", "value": "1536:yZw2JG2+6aX+lDM5+rNQUZTcPwJMMdxtc8DTIX:yK2JGH6KAYMNsgtdDTq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652298606, "uuid": "5a05e0bd-c525-4253-8c39-792c4f5183b1", "value": 63144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652298606, "uuid": "cc4a897e-a736-433a-8f85-e8cd42ab6511", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652298606, "uuid": "6c008cac-899d-4741-bccf-8801426123b3", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "994e76c7-d119-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652266841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652266841, "uuid": "f452ae53-a383-403a-b126-4c4f6fe79bcb", "comment": "Malware payload (Formbook)", "value": "a4fce543204701289e529a5143a417dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652266841, "uuid": "8b27b2a0-9053-4662-bfda-e40f44bf9787", "comment": "Malware payload (Formbook)", "value": "67df0a89b663af659b5f00979d5ecb52592f81ab32d55ab197963b5cfed28e8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652266841, "uuid": "a2d2ae98-513c-465f-8672-e7aadeadc3b2", "comment": "Malware payload (Formbook)", "value": "e3b2091b4efaf71e5a9ea48c4c0c5764bef0e04c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652266841, "uuid": "f235523f-57f1-4737-96d3-ac0bddb85513", "comment": "Malware payload (Formbook)", "value": "ee89cb3671688585190293a6a1b966fd1683428ee3a67e6137b7e5fba5bf8db64562ae38540d99d57c2e7614872a7686", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652266841, "uuid": "11e52e27-9d83-4fe5-9a49-18b3ccd73545", "value": "T1D94412012BE5853FD6F1EB320EB62B634B4B967620D573475F10294ABC73342EA2F294", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652266841, "uuid": "87dee39e-6122-42ce-bc9c-0206c22f838e", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652266841, "uuid": "d12814be-9182-4006-8865-352be46927f1", "value": "6144:LOtIOzj5gg6uKoHaS1Gsltf738BVTqNvBS/+BoTLqlxZJl:LOLCg6ufhtfT0TEI/+mLUZJl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652266841, "uuid": "083f239d-f8f5-49da-8f42-4a624a693af0", "value": 274757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652266841, "uuid": "db7d0dca-4b37-4955-aabf-a466dba9efcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652266841, "uuid": "c4eba2fc-3694-4ed3-bd02-d709359d4212", "value": "DHL_AWB_NO#907853880911.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c067ee09-d13e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652282798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282798, "uuid": "74396e0a-3dbf-4734-a565-76d1201743bc", "comment": "Malware payload (Formbook)", "value": "7e385285d0252b889917271bd1cf6858", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282798, "uuid": "7b5f8ef2-266a-47ba-9377-feb0219099b5", "comment": "Malware payload (Formbook)", "value": "697dd6f02783c344512edcd4bbab5eb97b6f06a29d1f1ee75177abdccbd280d9", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282798, "uuid": "a096ece3-9663-4f31-8bca-e59920796f97", "comment": "Malware payload (Formbook)", "value": "ea1fea66ab510cb6c524047a41bea8c77f4e1c2b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282798, "uuid": "67c65ca0-50ac-45f6-a89b-899cecfc0b48", "comment": "Malware payload (Formbook)", "value": "43832222d7b922a04da48074cb74bd88cc5561013cafd62b1dbc0a96a3e414c9f1fd33cafcbcc771aecc8781b441e644", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652282798, "uuid": "8494c23f-5ce1-42b9-973e-b86c02f2d2b4", "value": "T1C10401AE3A184D61CD396F70AE682D9BCB7CBC8848DBF0D06CD7B51493B12550C25AF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652282798, "uuid": "6897cd86-315c-4b7c-a8c6-ff0d67eb3e6f", "value": "3072:T3WBjR2g8PFLMC2hO7UF9pT/Xqsrve+qkI+aCB/4HrN061ZotKNvLTPrWntREDv:bWBjn8PFco7UFHb6srvW+aCUrN06sYdT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652282798, "uuid": "a6af728a-87bd-4337-b4c8-421ef9371531", "value": 188264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652282798, "uuid": "ebad9e9c-d0e7-493d-b5f2-daa5aa047fad", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652282798, "uuid": "366feca6-c550-489b-bc62-2b285f64c5da", "value": "Order Sheet.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5277a744-d174-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652305807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652305807, "uuid": "6ccdd70e-da6c-4aaa-b414-1c1a67f52f22", "comment": "Malware payload (Mirai)", "value": "c7cae654e195cdf102746bc0f51176f4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652305807, "uuid": "7219044a-9b8a-408b-bf57-ca28420d1177", "comment": "Malware payload (Mirai)", "value": "69a3200145f8c27937fdb89b21aa2fd8bdfe8a48503e2de8db59b4c71008c847", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652305807, "uuid": "84330538-c7ab-46ee-990c-a1ee2d72d830", "comment": "Malware payload (Mirai)", "value": "1b2e594814bc9f9467b18ee163a29fc334f3b252", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652305807, "uuid": "5488d146-901c-437d-aaf9-3b224bf6f0ca", "comment": "Malware payload (Mirai)", "value": "a6b407178727e4a9a69d8bb620a5072d95e0757aa2f8e79832884f2a286a903f92090c277dbd4507eea5a9a92a130f08", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652305807, "uuid": "f01441d5-a046-4056-a993-c9394a1cdc48", "value": "T19BC2E78179C15A2BC6E0637AF9AF45AC3350A3D8C2CFBA178D555F00378BA1F1D67A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652305807, "uuid": "49756b3d-4378-4a45-b583-efd8d28a1d51", "value": "768:VRnUJfrRBAxEliU7AHP7vaU+HH5Q/EtC:VoTRkU7Av7vj+HZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652305807, "uuid": "ec4d9b43-8598-4ee3-8860-650e0c50f75b", "value": 25780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652305807, "uuid": "fc671869-4553-4c9e-8279-d3166df3d771", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652305807, "uuid": "9190e009-3f3b-41c0-ac33-f3316f8cb196", "value": "botnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce8c417f-d118-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652266501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652266501, "uuid": "09f58402-b980-4d97-bd33-146f7bb5f42f", "comment": "Malware payload (AgentTesla)", "value": "9c78fad40b0cf8d19a6ffbd02f5a0c15", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652266501, "uuid": "cc2eea3f-cb26-4daa-8eb5-dea73be7a4d5", "comment": "Malware payload (AgentTesla)", "value": "69a85ed9d62cb41bc05f09b4791a565e4b5b320ff650b5225c8ccf8fe0afb90b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652266501, "uuid": "f26ba6ca-1c0c-4231-98f7-f7babc89637f", "comment": "Malware payload (AgentTesla)", "value": "665932759b20d3f339a93a07af0cb491c43667e8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652266501, "uuid": "d66cbadc-c6e4-4df0-8a83-71b3530e7351", "comment": "Malware payload (AgentTesla)", "value": "14eac4fd1cfb67996a7463ee5c27c893feb8c4ce2995bf54768d266460151874c5016a942a9bbf5b607d7411af2f7335", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652266501, "uuid": "959c7ea8-8ebd-4d63-8a2a-2d18d1bfad8f", "value": "T181B2211BB75D8225D5B31975BC6391880266BF02A4D2B71FE4E8BD2F3F3324847B2561", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652266501, "uuid": "cf57db7f-9f36-4fd5-a9be-5353118ea74f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652266501, "uuid": "d37530dd-3dd3-4599-ad9d-a561ee5e12ba", "value": "192:aT+oH08VOb96HQbTsym1OAupDaSs9ljb6oh:mH08VDHQbnm15QavHPj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652266501, "uuid": "60a80ae7-ee66-4519-afe7-b68415a6e1ea", "value": 24576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652266501, "uuid": "479ee3ab-f618-44ff-8970-ccc03c4f79f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652266501, "uuid": "27fb7d45-882b-4954-8266-bf8871a8f16f", "value": "SecuriteInfo.com.IL.Trojan.MSILZilla.16797.2146.20456", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a03aa466-d159-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652294341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652294341, "uuid": "fb85eaca-c147-4e96-a7d1-fceb1bf6af7c", "comment": "Malware payload", "value": "158e0a90182b96d6b2e4d039562a645f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652294341, "uuid": "11ffeed5-ac18-4c1e-8643-e22aac5549ac", "comment": "Malware payload", "value": "6a6cc6f90add70c714c159eb5f0aad3e6e822d17b21090542a9bd0b996379f9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652294341, "uuid": "30bc7cee-f785-4f77-8db0-a7e919d714a8", "comment": "Malware payload", "value": "2dd13d59edb9f74091da2a480940d35a5d0a06a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652294341, "uuid": "63f0464b-841b-47dd-91af-29d204f95a32", "comment": "Malware payload", "value": "014b5471ffbf94a7ce5df969c3bceb57f36c5725398d4c5e027c810788f7eb062f6bfd4ce2667c68081a192b7badbe80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652294341, "uuid": "109da2d3-acac-490d-a590-1dcc272986d1", "value": "T1A1D422512ABC5A7AEEBA57F4C4A1350003B57BDA0632E79D0F95E4C264F3F04E602E67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652294341, "uuid": "3059bac3-ff67-4d00-ba2e-c3235ec48750", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652294341, "uuid": "9cc610c9-41dd-43c6-a375-1960254f1207", "value": "12288:z4esnYBFCdZTEcWg0gNqtE9xEq/OLDl9uud9iJn9eONfdOmbMiyoivJ:ynYkTEc10vu9X2LDlJd9i/ImwVv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652294341, "uuid": "28b3ee2d-8ec5-4db8-b9fd-7ddd89c78efa", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652294341, "uuid": "59ae7a8b-c136-41cf-8033-752e2a6e79d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652294341, "uuid": "e903ce5a-9dd6-420c-8651-b90cc543a91a", "value": "SecuriteInfo.com.Variant.MSILHeracles.37963.17269.5672", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b06249f-d12d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652275434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652275434, "uuid": "0082e288-781e-477f-bc8b-03c32d009897", "comment": "Malware payload (Heodo)", "value": "02ac07df0fa4e54a7156be35f408b939", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652275434, "uuid": "fc16e356-b534-4c4a-9b3e-b46500b0f051", "comment": "Malware payload (Heodo)", "value": "6d3d61fa2f6254dffb8fd40384cd0396ee5e9af84d96b2ee45711270d2bb670c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652275434, "uuid": "17a778a2-134e-47d2-aa27-5f17c5662b64", "comment": "Malware payload (Heodo)", "value": "2bc58d529e9d6251b28e1ca0b58a44916d54c140", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652275434, "uuid": "955cd6a5-5aa7-44c6-929f-c45097ee7579", "comment": "Malware payload (Heodo)", "value": "93a82b2c2a84dd7facd793cd41dac1763b7a772923a4e40d3cd219471a310ba2681adcc3ecaa724884eb10ef706c0fc5", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652275434, "uuid": "013d0de4-91ef-452c-ac14-0a092904908d", "value": "T163B4BF06B3A504B9E467C174C9735952E672BC121761AAFF33A0436A2F37FE06A3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652275434, "uuid": "ad57f719-165a-4fba-95a8-b35728b29a3b", "value": "6196af15ce9ababd9a592319b3043ede", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652275434, "uuid": "fb204cd6-ab3a-4f98-96f4-cbf6af5dcf39", "value": "6144:iuD3jumQgXW2jLi1QPy+hSVL+ymiohaOdtUPM1UlTIqNtF1FMytrf:ZDLVXW2j21QC1+yZohtUPMg9Z1FMyB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652275434, "uuid": "a461e84e-4cd7-46ae-b869-0a8ecf818142", "value": 513536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652275434, "uuid": "c053d64e-e653-4fb7-8af2-bdb9655ab8e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652275434, "uuid": "6e5214f1-9fae-4c35-9b87-1d6a0380d687", "value": "emotet_epoch4.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84c70313-d140-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1652283557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283557, "uuid": "04e25ab7-b021-4d78-beae-b631d473a0be", "comment": "Malware payload (Smoke Loader)", "value": "1ea47e6fec42ebc481f281b00e18ff8a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283557, "uuid": "6cf969fc-ab58-43d9-94ae-4b61518f6b13", "comment": "Malware payload (Smoke Loader)", "value": "6df1711427805cf33f297bd481fb8fdf3f04e92d25553b15060161bf972b334a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283557, "uuid": "e913191d-1be2-460d-81b8-d12182e3ed71", "comment": "Malware payload (Smoke Loader)", "value": "849e23bbee26cc81707b36b747e8add1d61a4ea4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283557, "uuid": "f15f87d1-48aa-4809-b6d5-8d0f5c0aed33", "comment": "Malware payload (Smoke Loader)", "value": "7caaf821e142996403ba24b41e5847a3e9155dc5f8239030ec5b760e24fbeda8e9fd2d4a9c9ed26da15adbf85a231ead", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283557, "uuid": "d76ce37a-9341-4a70-8174-465396d62344", "value": "T1AB4412C0EA1A1552C9920C3256F466921BF8E282EC76507B5D04E392EE5DFEC3F4367E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283557, "uuid": "b5809659-b82a-44e3-a13b-c4b8fb42a9a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283557, "uuid": "666bcaca-bdd4-4871-b4d5-3aa8e9c81e38", "value": "6144:D01aSaFi5zkc4ubjnWhck9rIG5P89m9imU3PbfBCDs:DN/Ywc4ubjWhN+G5kc9in3rBV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652283557, "uuid": "efe7c043-c9ee-47e3-8e8b-c691eb8bd2e0", "value": 256848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652283557, "uuid": "7556a180-f3d7-49d2-80f7-7041e45e7df2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283557, "uuid": "dfe84dc2-42dd-4267-b237-3a3cf012243b", "value": "1ea47e6fec42ebc481f281b00e18ff8a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1740627-d167-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652300409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652300409, "uuid": "bda8ee4a-b4db-4086-a781-98640b407a54", "comment": "Malware payload", "value": "b297f5ff7bcbe06183d677170f187cc1", "object_relation": "md5", "Tag": [ { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652300409, "uuid": "ba154d80-1dc9-4885-9838-f7c154c3be00", "comment": "Malware payload", "value": "6e722280229d52b86a53de526c2c1812dc27344c32f296f4d96447c3cd46d847", "object_relation": "sha256", "Tag": [ { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652300409, "uuid": "4ec6f7a6-63a8-44f3-9ef8-2a92bc851f27", "comment": "Malware payload", "value": "4cbabcf722ac465397bcb7413c59d538c1b2c082", "object_relation": "sha1", "Tag": [ { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652300409, "uuid": "54ade469-6c8b-4d81-a6c6-9e6857ef44de", "comment": "Malware payload", "value": "d3523f5a85a14e187522683cef9f484be44acd562e38037dfcb12572c26122a381ff72110102a4b275f9aa03b47e3a8d", "object_relation": "sha3-384", "Tag": [ { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652300409, "uuid": "d028f42e-8985-4c6a-bc1e-a7509d611311", "value": "T11A9423F50295D0726AC187E82CD2DB2B0469B12F0F0E42BF7E544617B9475F38B3AA5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652300409, "uuid": "504439cd-d5e3-4397-bb10-6e33872379b1", "value": "12288:jytQ0bZAQDgY8qg1HeCedF9159t2OhO6dU/9YB7lkM:jQbRDguUTsFx90Og6dUyBF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652300409, "uuid": "62ceed3a-ba73-4360-9a0d-fa8c11758bf8", "value": 435894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652300409, "uuid": "28af9f76-d137-468b-bd3b-daf30b8a77bb", "value": "application/x-lzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652300409, "uuid": "b9f11ebf-355f-4e09-bae5-4933ffdf74b8", "value": "Invoice.tar.lz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46e26133-d129-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652273575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652273575, "uuid": "fdc6dc79-5ce7-4dfb-b5a4-d29674c2ad88", "comment": "Malware payload (AgentTesla)", "value": "81e2dec2ca39d728c008cb0a6a7cadd8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652273575, "uuid": "3bdcc3fe-59b9-4791-9784-ae32f9f8b939", "comment": "Malware payload (AgentTesla)", "value": "6fbe616d3cc61c5e09ffc5a072f1f45cc081b2f4c545d06383065e3199069249", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652273575, "uuid": "7c007131-ecfa-4370-9c03-e6357a2fd322", "comment": "Malware payload (AgentTesla)", "value": "5dc9871dfb8858188ad3311c615459feecb84920", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652273575, "uuid": "ce6a2f7b-1c97-40ac-a68b-a5b96463eb69", "comment": "Malware payload (AgentTesla)", "value": "dce1e31558bf295326df791c4f0efc4e0fe1a6308d004847128039aea470e4c290e61e8ef58ca3b382f298f1b49e9fc6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652273575, "uuid": "1cf56791-4943-4558-9d66-821ba285ac0c", "value": "T1339423C4F223A63192A4E2BCA6C4C2A56175FC930713B4591BD9BBC9FFFC2D58A41709", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652273575, "uuid": "acfce5dd-5572-4b7c-ab08-bb55fe4ad81b", "value": "6144:gY+GQc+C0EgZicdeqm3XLj8Hz/KRSd2rnNzZSBXg4k36+wmrlG+3ej+rAMlO:gY9EptYqOLj8Huc0pNSx9k36Eo6BY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652273575, "uuid": "60058a6b-223a-4102-b762-13934368776c", "value": 420025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652273575, "uuid": "9fb19111-4297-4e6a-911c-4ebd5ffb6a1d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652273575, "uuid": "6f35dd9b-512e-4762-b3c6-6791ecab6a1a", "value": "NEW PO.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04773505-d10e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652261867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261867, "uuid": "4f2349c7-cd1f-4787-84b2-a7cce8bdb85f", "comment": "Malware payload (Mirai)", "value": "db5eeaf0c84c26939de57013159e00b8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261867, "uuid": "54a3eabe-7e6d-4ac8-a22a-ade164b57cb9", "comment": "Malware payload (Mirai)", "value": "704c54559485decf18f50d32a4cf98f0392b791c9f34076c79c48bd2c4db330e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261867, "uuid": "4b8e45a9-ffdd-4f65-a00f-3ea987ea05f9", "comment": "Malware payload (Mirai)", "value": "3291369cb05c0477b119b32072d3e57086904b0f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261867, "uuid": "323e64cd-a498-4544-a420-b7c1159c8f49", "comment": "Malware payload (Mirai)", "value": "71008a5910554508c596bd0ca2b89e183dc655f09a923a5dfcde5f5551f780942e4a08359bedea9e8fbec378430f525f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652261867, "uuid": "e5cd0ce2-40db-4dc8-b48e-ac77e401f36c", "value": "T165734A0276284E4BEAD60AF1253F5BE483BEED8025E4B584680FD7464635E37498EF8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652261867, "uuid": "53b81bd2-28b9-4972-bc03-f4a77b519683", "value": "768:x0zlipKQt/M9Kr902YECVNoIdgxI+B5vTemF6m3PpT5v99/sllk5MCs7/nLDJQ00:6iYQtO6VCbWFdT1ik5kvm04/V5yDOcub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652261867, "uuid": "cfbb1301-d4e2-4272-b6bc-a2bf75daeb43", "value": 74660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652261867, "uuid": "41f73ab0-3716-491b-a9a8-d2d832db6180", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652261867, "uuid": "9385c5e2-1995-47ed-8689-42e04e9d2a3c", "value": "db5eeaf0c84c26939de57013159e00b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93766c46-d0f1-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652249652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652249652, "uuid": "e5e65dd4-08e7-4366-9cb4-8be6cdb0df4d", "comment": "Malware payload", "value": "ada33798f77b66543cf8f8c6f8aa56cc", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652249652, "uuid": "25082bba-c542-42d2-8d23-273326a3adfa", "comment": "Malware payload", "value": "705c383f36a1eed343028c0aca057da33c9ee3a8243aa282e5f45177009ddd35", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652249652, "uuid": "b8547bbc-7097-41ed-b6da-6f85fa70062c", "comment": "Malware payload", "value": "30ff66bb0550b649ee95bce454feb2d19e85cd21", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652249652, "uuid": "df8d0d4c-6273-498b-b8e7-bbf2523f150a", "comment": "Malware payload", "value": "77b07910f09a5c102fa2cdd669cfc139ce7a8824bcae74dc55628a66330f4e0c075ebd590bb0a84804ed82cc74b29173", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652249652, "uuid": "adbf6fb3-7858-41ba-9db3-9aa275800c01", "value": "T1CC14232E5F41D054F004D7B2FA5B9698B858AB33865720F9A11E27CF0FFA4D13A62693", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652249652, "uuid": "a7bbb709-501d-4b59-b11f-6127f6bd22cd", "value": "6144:RrazMSQZiuq1R+cvQ86C79OQee1W4sUUfLdmRr0Lt2J:RmzMViz1MdZC7MkQPjdIrCEJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652249652, "uuid": "16661f27-743d-4b7b-878a-49ce984cd916", "value": 199628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652249652, "uuid": "a669ca08-1176-4cf1-b1e2-b81663436c48", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652249652, "uuid": "2fbf0525-c6fa-4e9b-9509-e43c1426a614", "value": "Order list #4098721#.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b60059c4-d14e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652289653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289653, "uuid": "175f4868-b970-446d-add0-4287a5728d00", "comment": "Malware payload", "value": "6ec0a7c621841a312a5e7d7d273f0566", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289653, "uuid": "5e3d7ceb-5a48-441a-b61d-df49189ef5c1", "comment": "Malware payload", "value": "70fa9807b6cc09b603e467db60bbaaf2132bba676e863d89eb47e3e1d68059f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289653, "uuid": "38423e4b-45b7-4b43-aaf9-bf9991ea4684", "comment": "Malware payload", "value": "e15d38218cfc5fa3b560f3ca9fc77e17566838e0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289653, "uuid": "6fbfe960-bb1f-49c4-a166-2cfdff9169a4", "comment": "Malware payload", "value": "3b462ad7874962b43490f75aeb874daac86fdacf0cefb03ad67ddc8fcebcd94419a0514059d4b08d1f13752074f820be", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289653, "uuid": "27ce10dd-597f-4a79-b7f4-49e78a5dd6ea", "value": "T15503E11DE0B00DC1CD7C9A32916D2B35EF646498728BC3DED351EA9D90AEE07B54E066", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289653, "uuid": "e09c72ba-3a32-4e16-9012-1b6fa77f5f91", "value": "768:2u+dhF07mTlV27W63RxxMB7PNXU/d4ZrGMhVchbAjiz007LWRo:21jZlV2lBAd9KurDchsjig0j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652289653, "uuid": "c3f4d26c-0783-4b26-a3bd-7d26173844d2", "value": 39588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652289653, "uuid": "05bc6e7f-eaa1-4efc-a50c-1d78bddc40e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289653, "uuid": "5e1e7d56-73af-4035-a8b0-cd58276f78f2", "value": "6ec0a7c621841a312a5e7d7d273f0566", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3d5b88e-d108-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652259584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652259584, "uuid": "d2791652-038c-4d48-97d4-fcad51c6796b", "comment": "Malware payload (Formbook)", "value": "95b1b15c87f5d6daba1c72e6514a9fc1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652259584, "uuid": "7eb6d467-4e51-4e40-8ab4-09baea6423f3", "comment": "Malware payload (Formbook)", "value": "719ac8462a554ec46d13e7c3b33c39248d546da6e9618edec381656472814352", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652259584, "uuid": "92dce2fd-1e2f-4152-9edf-3f930dc159c9", "comment": "Malware payload (Formbook)", "value": "4f05f44baf5d8d3e31dc050c79f1d8703c82e0be", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652259584, "uuid": "8067275b-549b-4010-a7b0-379cc31d798f", "comment": "Malware payload (Formbook)", "value": "2727f076158f2e99bde3c196deacbf35056b1b9622d60c3582b62da68d00d72c610d5b6f64cce5f5e6ecd465c9db5523", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652259584, "uuid": "9a8a3dc1-5451-4ee2-b0ce-3428b67b0c85", "value": "T1F5D3F11DC5C41659EAAF133693868017BD12AEB8FD10670B3D7A335C7B732D804D2B6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652259584, "uuid": "56b9f45b-7384-40e8-8ecc-febc3e4f782f", "value": "3072:UNnld8hK+szIGhNuX5z5c6hSogcUvAfx3nYWWSA:ib80rUGhNuJzFqoWj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652259584, "uuid": "0ec0efa9-a156-453d-95da-27ff38e8a79a", "value": 134488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652259584, "uuid": "c5391160-7cf3-42e9-a96a-a816443b9cf8", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652259584, "uuid": "fe6f6be3-7cf5-408b-bc1a-d4e5cf4bbeb3", "value": "Berthing.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9c894ee-d0e6-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652245099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652245099, "uuid": "96d9c9e6-24cc-48db-888c-8371fe2ac55d", "comment": "Malware payload (AgentTesla)", "value": "a554844c8416718f2f8743f3b8be2479", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652245099, "uuid": "311bb27c-7519-4255-8ea4-8db6a381f199", "comment": "Malware payload (AgentTesla)", "value": "71fb081a54ae28eee92c61bc2c09aa76c155ead346ad5f2b4959250bc24d01c4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652245099, "uuid": "5652b3e6-f351-4df0-b6c2-3d1fa1b48a1a", "comment": "Malware payload (AgentTesla)", "value": "ee519188f39d9f6954c57797369ee0765b1e05c0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652245099, "uuid": "8eed7173-e875-453b-82e0-afc9068ee134", "comment": "Malware payload (AgentTesla)", "value": "0a79e33e1bd0d6d1bb61718ca7e12f47bbb68f903925dc3f4f1da582b5550737cc806ebe23a35624ff0c8251cc0626aa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652245099, "uuid": "b9c38971-211b-4f04-8bb3-a9be0d7d28e8", "value": "T104E407AC312471DEE46BC575C9595C78EBA2346B830B42139063E7BDAE0D9B7DF120B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652245099, "uuid": "b82ade3d-44a7-41d7-bf70-7ae4edcd00cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652245099, "uuid": "b7e6b17f-e27b-4ca6-8352-33e61735e23f", "value": "12288:5kOhzGURP2bQ4GO51GaKbEHyLkBcaMWaOXKm46DHris7K6onnMbfTJO6Flcj0t6U:0UV4B51GaYEH8ScO6B6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652245099, "uuid": "410023b5-f2ea-49be-ad50-b51affdc41d8", "value": 668672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652245099, "uuid": "0d4adf54-f7d7-4c0f-a7be-2fb68e1a217c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652245099, "uuid": "33537b6f-4f2d-4c0b-a4d3-74733d3d1b56", "value": "BL draft.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0be8497c-d128-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652273047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652273047, "uuid": "70127814-f2f0-4754-a7ff-3a875c93a39b", "comment": "Malware payload (AgentTesla)", "value": "3bb5d7aabc6db82a051be066252d5128", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652273047, "uuid": "f6d0bf91-8c1e-40e3-8f3a-a346527d09cb", "comment": "Malware payload (AgentTesla)", "value": "731d797a01e8942d8083396e7e27eb18f84728cd08b977134ff80c72d3b70a1d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652273047, "uuid": "ff35fcb8-5d97-47a0-ae6b-b03e336c1e28", "comment": "Malware payload (AgentTesla)", "value": "3fb8884dc3c36a2b2463c6c4c5d3f464a7a12244", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652273047, "uuid": "31a58c87-135a-48fe-b68d-5c09f165a14a", "comment": "Malware payload (AgentTesla)", "value": "84089fb3af91f39e7dec231b02e49fc2a930a9e5446703c06511940362c48318b33aec9b5055064cbe7bcdef24257aae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652273047, "uuid": "e587aa40-4338-4a56-a02f-fcbcc77505bb", "value": "T186E40219FAFADA22D16D6B3AE4FA50144778BE09A033D30E14C8174E9E937A749413F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652273047, "uuid": "39bbb04e-0013-4a53-9f88-a9a05327a6ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652273047, "uuid": "b8e9645e-b52d-4d5f-870d-870bd4796534", "value": "12288:ZzypqpjZwEqWUNCJ0oIZ9PtrW2EhLyQzyneoFv1pfi4SBnGCCq9t6jkuvcEfRp:ZzyMLwPHN80uWQEeq1kMg9kkUJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652273047, "uuid": "7d279cfa-fde3-4012-980a-6aaa2b8421e5", "value": 717312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652273047, "uuid": "ee73657b-5adc-4c4e-b57a-240509ef7963", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652273047, "uuid": "1000c640-6338-4719-8f39-fcf9c9714db4", "value": "SecuriteInfo.com.W32.AIDetectNet.01.9820.31653", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "285c26df-d0d1-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652235728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652235728, "uuid": "d0772a8f-6915-40f7-89fb-77606899cbe7", "comment": "Malware payload (RedLineStealer)", "value": "2d93d7e059933c90a2bd320414329ad5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652235728, "uuid": "cc9ad988-6b46-44e8-aaaa-4e3b7ac06639", "comment": "Malware payload (RedLineStealer)", "value": "78d864c773019641060c5df933ab36ac6bb84e2015e91bc434025396b6deef92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652235728, "uuid": "13ca3270-0730-4845-bde5-9e22f7936279", "comment": "Malware payload (RedLineStealer)", "value": "2129e21fd72b555f47b8819fc7a1e4e8e7c3713a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652235728, "uuid": "6e391433-7554-4714-b324-9770a79769f3", "comment": "Malware payload (RedLineStealer)", "value": "432d18dc5bc66d51067e0147f4cbd354f753c2a787664643b3d11b1e38750b6b223d30d9e1fd76194439f42b97fb1c0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652235728, "uuid": "b8706850-7777-40dc-88f4-160df0870695", "value": "T142A35D3067AC9F19EAFD1B74B4B2012043F0E48A9091FB4B4DC154E61FA7B866957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652235728, "uuid": "c694f786-9ad3-4f82-99c2-8575da77c816", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652235728, "uuid": "80dfccfa-bf47-4fc6-bbdf-50f7c5b65adf", "value": "1536:9qsIXqrzWBlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed2gtmulgS6pY:rWgzWHY3+zi0ZbYe1g0ujyzdkY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652235728, "uuid": "4620e3f8-a1e6-4813-9d74-01e8514a2a76", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652235728, "uuid": "df081e5b-4297-4142-8fe4-3d08f455d312", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652235728, "uuid": "922c31ee-5901-4337-ab9d-9195ff10a43d", "value": "2d93d7e059933c90a2bd320414329ad5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28b5235b-d154-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652291993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652291993, "uuid": "a6e99260-f59d-44ed-bfa3-e856ef8b7763", "comment": "Malware payload (AgentTesla)", "value": "a0f036baaf9746f735f4b256c985515c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652291993, "uuid": "558e28dd-1326-4046-a6f8-9bd8dd5ab5fe", "comment": "Malware payload (AgentTesla)", "value": "79582515fd2e56f9bc2600763d27b91c3cab551bb411f3a77b3957a50f359975", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652291993, "uuid": "3ab8cc09-7525-4597-a891-5fee3a3f1de5", "comment": "Malware payload (AgentTesla)", "value": "27fae3d3a304b5332067e0f58c4583069b613a6b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652291993, "uuid": "aebbf063-a073-4c44-a34f-668acb296ff0", "comment": "Malware payload (AgentTesla)", "value": "61492044ddb7c667e1cf5a490468fa1122b33bcdc238cd9a03ee4275de1809cf26de246f834bab73fc7783872e169ad3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652291993, "uuid": "a35596be-723c-4b41-9b2d-64bcbc8dac2f", "value": "T1EFA423803BF0F077E74355339E6A93139CAAE95411228F9B4340290E7D363806B9F7EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652291993, "uuid": "aea21432-2857-4c38-bbeb-82da7459e13c", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652291993, "uuid": "77e010a6-a6a6-449e-a349-9cfd23a7ab8f", "value": "12288:LOL/YxhEaf7hZz1Gj2c7g65dX67CrOF1fCn:LOLQYazhZ2dMpzCn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652291993, "uuid": "0ea7a59a-fb3d-464c-beb1-79e536d5c259", "value": 449628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652291993, "uuid": "09133b47-7aa1-4af5-b473-0b95ede57444", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652291993, "uuid": "7285e3d5-e01c-407e-a230-ca1661404149", "value": "SecuriteInfo.com.Trojan.NSISX.Spy.Gen.4.6174.26464", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "886935ae-d119-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1652266813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652266813, "uuid": "4b8aeb17-6f66-479b-afc2-38897e943a7d", "comment": "Malware payload (AveMariaRAT)", "value": "9feea968d31b5f7c82bff510b295593b", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652266813, "uuid": "47a55e5b-635a-4ad9-8c8f-a465479a1476", "comment": "Malware payload (AveMariaRAT)", "value": "7be4dca46f71873d42dc26d38efb796fff2c4d1bf295f99e0aadddc52527e537", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652266813, "uuid": "8e0ddb65-c251-42cf-b9ff-555ec79a6495", "comment": "Malware payload (AveMariaRAT)", "value": "10bec0c8a9361faa8e41aff9e34464fa59b5ce46", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652266813, "uuid": "364e6e7f-c4df-4752-829a-e77652fe7d90", "comment": "Malware payload (AveMariaRAT)", "value": "567d470060ce705d5b23a6d89a4bf9024ed56befd9227475202a7ea7270a987f4cce3b82aecd0cf925dc37924edcebc0", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652266813, "uuid": "ea219481-b8a9-4dbd-9113-d2d7397062d8", "value": "T102741301DB900082EC56BA33E955FB32477B0DF1992F5D5A42F275466A724C0EABEF32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652266813, "uuid": "1b2142be-5372-423b-91a0-420d46c05726", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652266813, "uuid": "dd03fb24-8f6b-4a0c-ac64-7674c43b0bf7", "value": "3072:qODZGPEouA9FFFFFFFlYYYYYuPPPPPPguuFIbWxOO0QVgiKX4ey8YPNsB36memES:qOtIDBWVQXTvYPe6ZmEssow+Q2YA5W0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652266813, "uuid": "0f468ec1-0648-4a7b-9286-d87cb0ddaa67", "value": 362334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652266813, "uuid": "a8ce02cb-9b8a-4f80-bc92-a74d12a736ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652266813, "uuid": "8257c6c2-2303-406d-9707-8c02c32e01c8", "value": "MV-JXGR NOVDEC,PDF .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a44c83d7-d139-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652280604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652280604, "uuid": "511e1559-1235-4c25-be4f-9bc0c394801b", "comment": "Malware payload (Mirai)", "value": "ee9bd14ba9d17d0f7644b042f9eb7eb8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652280604, "uuid": "1cb682e9-3a87-4b2a-950d-c1510ec21e33", "comment": "Malware payload (Mirai)", "value": "7be7ea360ffbc62ac0f305ebee76e277435ea264983ea1c91048427f62eb2de2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652280604, "uuid": "183b2aea-9e8f-4a83-a6ac-89541514a677", "comment": "Malware payload (Mirai)", "value": "4fe2a22bbdf836d5c9d9e67c7e2a4c4e4a01bdca", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652280604, "uuid": "795e4013-9995-4cd5-9551-bbb7dca0b840", "comment": "Malware payload (Mirai)", "value": "72653c921249a79e4943d826171ec25066178d03bd6ae6ddc71eb614af63078e4e5305f240745f4e90143d45991e934b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652280604, "uuid": "7c8cf6ac-71a7-4d7d-bc9c-aa3cbd9318bc", "value": "T18B430228C0E8975CF075C03BACF6FE9B586FE659AE0811A98E61273E9014F8B0D5805B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652280604, "uuid": "dadc2670-d5e2-4a8d-bd21-b51999e3c773", "value": "1536:TnrbB2L1TULCMcg+sc8/n+XHGD7yFbCS5R3Gb/oWOiunouy8Nq/:Tx2LV++scyn+XHpuSauoutg/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652280604, "uuid": "81cb5ef1-7912-46d7-af0e-ea43bfc2c5e4", "value": 56568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652280604, "uuid": "536d3f56-0f8e-4011-afb5-0d5d3c3ff538", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652280604, "uuid": "e198a769-4fd6-43d0-ba31-f9059072a72f", "value": "x86-20220511-1450", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "687975ea-d14a-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652287805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652287805, "uuid": "881e6018-ca81-4296-a8cc-acbc0d21a7a3", "comment": "Malware payload", "value": "54def1468c0bb6da5a12d6265e53e78f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652287805, "uuid": "1fedf08e-0baf-48b4-8633-30c875f46d72", "comment": "Malware payload", "value": "7bf39f1db4af0092308522bdecf5f349a1cd95f476dbedf99a967e97dd51bc70", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652287805, "uuid": "d4f433cb-8e80-45b5-aa37-d574419f4e03", "comment": "Malware payload", "value": "b7d32de1b0314423d5f275a7a0357cefced18aa0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652287805, "uuid": "d28820ee-ca04-40f5-a631-6f9f13a91ce4", "comment": "Malware payload", "value": "50d5f934e317749b5cbdbb9b4e6e1e0fb77ab7d501d0401586f8de40acae5f882f067925ba62d7f382bff6e3a65bc0e5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652287805, "uuid": "968674d0-cc85-41e4-9b8d-6855ebbdcfaf", "value": "T11EF2D0739688B072DA641835A0E906C7337D1EBCF4D3721507CC9768B6660A7AABF50B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652287805, "uuid": "158ddce3-63d9-4866-9e8e-202cce09f22e", "value": "768:inhWYMpSp93FZKG0E0hdyS2SNXcp9+5fh/JXWU6CK3Uz:inhWYMopoG0E0h92S6p9+dh/JXWUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652287805, "uuid": "42aed8d6-4871-4cc4-846a-9597321ee7ec", "value": 36940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652287805, "uuid": "92a2e743-05f5-41bd-9e0a-23c1693f980d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652287805, "uuid": "b3fdf162-0130-4b88-bd33-ef0bc57dfedd", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30fe0fb3-d0e2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Nitol)", "timestamp": 1652243044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652243044, "uuid": "2063ea94-bc90-465a-88f9-4398553fd7bf", "comment": "Malware payload (Nitol)", "value": "f5a7f8dc01f23a6e1acf50ba97834116", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652243044, "uuid": "de631f35-9bba-45b2-8b58-9e4763bcaf1b", "comment": "Malware payload (Nitol)", "value": "7c3642c12a6b550058c554c47278704471042257f62b6a677a78f387e74e91e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652243044, "uuid": "0884a3e0-abf5-4292-a728-86671fe6a149", "comment": "Malware payload (Nitol)", "value": "f884a0e9646780d7487f30906e4fb9347b18e438", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652243044, "uuid": "63083228-8dd6-454d-9fab-fa9b2ad064b5", "comment": "Malware payload (Nitol)", "value": "7bc19b6af548c2dace71b08064973be32d059c43fc9e6c815b6c6973b17bdf3b0224a79ad628d6275c1e743f39493a77", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652243044, "uuid": "28c5c7f5-dc6b-4df1-a2bf-ed29b281e98b", "value": "T1BB648C1137E1C837D4B311734E528799B2B6BE219D36864B67D03B0EEE70582CF29B69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652243044, "uuid": "77787fcf-920d-4e1c-9413-78ab38995db3", "value": "a6aa6d0c6db875d549751d0089b30222", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652243044, "uuid": "7f8ac9b3-481b-439d-b57f-3f72e7e17036", "value": "6144:QavG/2iKnG8stuZ57bYAb7B7bW2YLQofXOPC8EPl:nHstuT7UAPB7S1pfXODEPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652243044, "uuid": "10e8bf76-f33e-420c-bf8c-44e66439937d", "value": 315392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652243044, "uuid": "86eb06fc-9e6f-41ec-a93d-bf67840c05bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652243044, "uuid": "92dd2e33-464d-4b10-9395-87463c648512", "value": "f5a7f8dc01f23a6e1acf50ba97834116", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cfd3bfd-d13d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652282283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282283, "uuid": "d7cb9f40-a867-43d9-8507-72d49bc5ac94", "comment": "Malware payload (Mirai)", "value": "ac4406cf093b71c485e4af67976a2a62", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282283, "uuid": "b3163ff9-d9b8-4b82-9543-96f4a615e7a7", "comment": "Malware payload (Mirai)", "value": "7d1a662aa656c1bc11a6d4579eea5a57db4c51c8008827cb6cc117da2ab50e6d", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282283, "uuid": "8f19ab7e-349b-4113-ab31-32607b80ff0a", "comment": "Malware payload (Mirai)", "value": "b43edb189cb6230f39158d446059f5b3238c9dcd", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282283, "uuid": "f2468191-72c9-441e-99d4-ee101de67b81", "comment": "Malware payload (Mirai)", "value": "a8bd452a287464d75e9ae92f043a203c92df72327b21a10f8b87309c94f2c6a60f447cf23a7b058451ef8d121cb8ffbe", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652282283, "uuid": "fa29f29b-7fea-4fbc-a383-6e1c13195dc8", "value": "T188833C47B5C189FDC059C27426AEBD3ADC22F4BD033AB1AB27C0BB253C5DD611A1EA05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652282283, "uuid": "a61b9439-f176-451a-9a91-887169bf432d", "value": "1536:b3PBJjWA+QIk4dcEuUiCErAHuT8aw6PJ4G0/6isj6eASLm+h:rPBJKhQIk4EUwTj42isjN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652282283, "uuid": "e4465e11-fba0-4e11-91ae-def986a12a2f", "value": 82544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652282283, "uuid": "33ea564a-89c0-4e15-92bf-f3cdbf5e7c40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652282283, "uuid": "e2f685d7-4a0f-4ebf-80e9-f92c213104c0", "value": "ac4406cf093b71c485e4af67976a2a62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "932e75c2-d0ec-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652247504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652247504, "uuid": "9151ad47-5df0-4628-984c-75687abc31b6", "comment": "Malware payload (Formbook)", "value": "aaac98c968fad65f254cf1462892222d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652247504, "uuid": "d133d6f7-d03b-415b-8d99-6e4faaf81373", "comment": "Malware payload (Formbook)", "value": "7d7e33c7e57e155dd8a8f84d467104c69c9d7fb34d16059a33de603aa502c78e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652247504, "uuid": "6fcec786-eb81-411d-a28a-1980517274ca", "comment": "Malware payload (Formbook)", "value": "6bf6477346572023cc4dbecb898ba59d9c112a56", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652247504, "uuid": "71b7118a-3222-4b1f-9174-5831ea4cb2ac", "comment": "Malware payload (Formbook)", "value": "48ff642342c1bcbd0d27548f68e581b2880d3e3ddfdbd11edb4a53ba33d1c8025b4826cd43719c57ca0cf59fb6148866", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652247504, "uuid": "2a0150ad-7402-4b61-9c34-c89bd5d860ef", "value": "T1560402772765821DE65522FF003C86562526DEA227CBC10CAE4FB72518BCF16E62292F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652247504, "uuid": "2444fd15-6a33-440b-886d-1693e9dd772c", "value": "3072:sqtjwTS7Jbut8Kcy8ppvzGKY/TDbJNHXMK4YQMLyzBdH/xP102T96T1A2EHy21bC:3jb9but8KAppvzGKEnbJiPYyzHHVOAv2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652247504, "uuid": "6fcaa941-8161-421f-a563-91c3c4388866", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652247504, "uuid": "dd5ddbf7-b833-47e7-8df5-b2bdfba2956c", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652247504, "uuid": "39230bf8-cd7b-4758-9067-ea6cafd9fc62", "value": "50%Downpayment.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87957f59-d13d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652282273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282273, "uuid": "819fb2cb-a60f-45bc-b96c-52854ea712d2", "comment": "Malware payload (Mirai)", "value": "d8778a2a42b93d3a586b63c8bba708ea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282273, "uuid": "71a6c94c-9f0d-44ee-9a59-b54087bba08d", "comment": "Malware payload (Mirai)", "value": "7f43c425cb3d9b5b5b147e0363608307c9768caca800d5ba125fa8437bf8052c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282273, "uuid": "ceb17138-6e3a-43ef-9503-e9dcb7858bfe", "comment": "Malware payload (Mirai)", "value": "36b8044536cbf61694e92cbc16d41981aad87320", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282273, "uuid": "45f5b291-8c3a-4f26-8a1f-8193d46d5dba", "comment": "Malware payload (Mirai)", "value": "1ffc973dfb3ca727e808c7f6960689033ff79578ffd23843a00aa517cd9491816b6a3692f391bc6abc2ef6481516cc2e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652282273, "uuid": "5401408d-f202-4617-a6d5-4e87214b7057", "value": "T15F532AC8A5D3F8F5DC140978307ABB66AEB3F13B7135E99BC3D86923A841702D10669D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652282273, "uuid": "b89e1266-530e-4b6a-919b-64c61d48c291", "value": "1536:IEj9G7O9vwitb/XZz+aXtEgTTra8SW7V/DjObeFt6PuQ43:19G7O1witb/XZz+aXqCrrSWZ/XObeb6k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652282273, "uuid": "96df6e67-45c2-41ff-b989-3b564eced7ac", "value": 66136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652282273, "uuid": "ae128da9-a17d-4fe4-9e1a-d0325f1237b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652282273, "uuid": "14be661b-138a-457c-86c1-f118914dcdc6", "value": "d8778a2a42b93d3a586b63c8bba708ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc0eacbb-d12c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652275087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652275087, "uuid": "90c01f99-a185-4e49-ab6f-02bacfe42e55", "comment": "Malware payload (Formbook)", "value": "6910a49255a1f31d78d79a260413fed1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652275087, "uuid": "9a9c1c75-807a-4268-8f2f-c332adff239e", "comment": "Malware payload (Formbook)", "value": "84b0888a5a6938795c26a681435c52a25c16fe2d1e6230112df171024c8767df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652275087, "uuid": "0b0b9c5b-4f85-4195-8734-e8a61b0116d4", "comment": "Malware payload (Formbook)", "value": "29d4640623dead9e78b3cb65c249a5c562d1a2a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652275087, "uuid": "0cbff686-cae4-408a-a412-0ef7b4602fbf", "comment": "Malware payload (Formbook)", "value": "2dd3b806d28b2b91a32a3622d634eb59ce5f5273fa7e26645883d750c86030e61d9b874ff3385283cf9badb544a6da90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652275087, "uuid": "ebc6fb56-98ad-4fda-8d74-05224c823b87", "value": "T11F4422858695D0B7EDA1B6334F6D973F8EDFC85104A04B2703906A997D26B823E0B727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652275087, "uuid": "8ea43a90-b62e-4bc4-b08f-b4bdf26f56f2", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652275087, "uuid": "2b571991-aa9f-47ce-a988-aaa4fe532c1b", "value": "6144:LOtIOyMfAegUusuTL9oyLfA3fbkG2CCafq0OMe/Kdz:LOLyMN6TL+zkG2raC0Eg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652275087, "uuid": "33513588-cc18-4017-ae5b-81e48d6a65f3", "value": 274325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652275087, "uuid": "ead09cc7-b2b4-4552-aa63-58e6fcfd2118", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652275087, "uuid": "adb7b46e-433f-4d8e-b919-3ec87a1846aa", "value": "PAIEMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b977a9e8-d123-11ec-8e58-42010a9c0032", "comment": "Malware payload (Sodinokibi)", "timestamp": 1652271190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652271190, "uuid": "03342ba7-211a-408a-b5e5-06787d4d9f4f", "comment": "Malware payload (Sodinokibi)", "value": "db2401798c8b41b0d5728e5b6bbb94cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652271190, "uuid": "6e76d501-e36a-4334-9d08-86cb0358d6ac", "comment": "Malware payload (Sodinokibi)", "value": "861e2544ddb9739d79b265aab1e327d11617bc9d9c94bc5b35282c33fcb419bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652271190, "uuid": "d991359a-5dcd-4ab2-8ce4-3d4880278cc5", "comment": "Malware payload (Sodinokibi)", "value": "6620f5647a14e543d14d447ee2bd7fecc03be882", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652271190, "uuid": "cdca03cc-6a74-4698-bd5e-c7803b2a1688", "comment": "Malware payload (Sodinokibi)", "value": "5b9356cafb9764fdb7cb8dc9c5b18b63a294d6316f737a26f4a8c81b1ba16baf02c49a04b2faa52354185a6a66f0b3c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652271190, "uuid": "de02d707-fe12-4d60-a4b9-1fc91f433a31", "value": "T18A839E92EE128AF2E89221B3075F3E066CBDFEBD46052477E3F1C5858E910A1F12B557", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652271190, "uuid": "4c3d8028-9ffd-4188-87ef-977987c470bf", "value": "1536:KQm2abTNclxvHza5681GJNOU1H+v4GHI2hhD/Flpd6g0ICS4A3Y3GjTJZ1q:Nm2airHzaB8JNOU1ev4Go2hhD/FHvcEU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652271190, "uuid": "e16a6ee2-b12e-448f-973d-4070928a276e", "value": 87040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652271190, "uuid": "7410b47f-3893-4f9c-a18a-ed10d75a09c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652271190, "uuid": "6da1ac8d-20f3-47db-abe0-ab1022309bc1", "value": "861e2544ddb9739d79b265aab1e327d11617bc9d9c94bc5b35282c33fcb419bc.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1407abfc-d14e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652289381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289381, "uuid": "8d4ad728-ac9a-4a35-b4eb-686d7433cf15", "comment": "Malware payload (Heodo)", "value": "187f3f465b7bbb178af8293e7b2d9a9c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289381, "uuid": "5166f350-409d-43fc-820b-d6e31c29fd37", "comment": "Malware payload (Heodo)", "value": "87f76fbe04e43c5e1aec357c751b9488369a1967ca55172e7d45a2c6288b6017", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289381, "uuid": "49a00c5e-ef2f-40ed-952d-dde85693cc16", "comment": "Malware payload (Heodo)", "value": "11903d4554d2d51f133654491eb8a0c1d1cc83ff", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289381, "uuid": "0deb0280-f8dd-48ec-a2f5-495e30d08a5d", "comment": "Malware payload (Heodo)", "value": "08383950095154b8a2c10a0301514ecbaab6d5f3383abb7e4bd8ea347ac22749d50c37de832f3f4776bce5d3fa009245", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289381, "uuid": "0c14d9c2-9714-4d97-9431-834a11076682", "value": "T1B2B4BF06B3A504B9E467C174C9735952E672BC121761AAFF33A0436A2F37FE06A3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289381, "uuid": "698e710b-7266-45fe-b484-a62fb8cc686b", "value": "6196af15ce9ababd9a592319b3043ede", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289381, "uuid": "d025f694-fa08-4a43-976a-1a2a5178139d", "value": "6144:iuD3jumQgXW2jLi1QPy+hSVL+ymiohavdtUPM1UlTIqNtF1FMytrf:ZDLVXW2j21QC1+yZoGtUPMg9Z1FMyB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652289381, "uuid": "79f74f19-5e3b-4bdd-acee-d4d944a2b1d5", "value": 513536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652289381, "uuid": "4b1aacc9-84ad-4f2a-963b-a0165c84d0d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289381, "uuid": "d05fa81c-e800-4cb4-8b34-d12e9693baad", "value": "UcOixQ.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "358cfa4f-d0ee-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652248206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652248206, "uuid": "09ff0ff1-c3b1-447b-b527-419b360f4241", "comment": "Malware payload (Mirai)", "value": "79b5152e07ac9f67f337553afd8fdf49", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652248206, "uuid": "9b5bc42e-bdf1-4e63-b367-78a6d5fa9cd3", "comment": "Malware payload (Mirai)", "value": "887584f6ac90a19a51341d46de78a6980007a505755752a8a2a37cedc3e1ec7a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652248206, "uuid": "827623c0-f88a-456b-b16e-974d1dca3e57", "comment": "Malware payload (Mirai)", "value": "17e1afeffdfe348f39b93bb93f232aa4aff92a9b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652248206, "uuid": "101f29ab-e2d6-40e2-a216-04b5d5fea4d7", "comment": "Malware payload (Mirai)", "value": "bc4677e5fee2efa2ad55b7a1b86d81a29ce87131b2007271d5718f91c549a997b9eb8a371c83543aaf7512aefea04565", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652248206, "uuid": "6f16367f-de54-4992-9db7-9c7a2c30224b", "value": "T17B735CC4E583E8F5EC124578203BBB768E37F63A9536EE97D798A9239C11611C20339D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652248206, "uuid": "7a9f49a9-0f43-4fe8-992d-6268bed04ca5", "value": "1536:OEmxp99gAkAe0kFWECg+vMPwi5ATJOrQDaObNAJwewrU6BmCSf8:/mxp99gA1e0gWECgUMPwi5AFraXJfwo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652248206, "uuid": "78d5b6ce-3dcc-494b-b224-0efaca01a718", "value": 79796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652248206, "uuid": "4da33f22-c70e-41f8-b473-c687088ec8e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652248206, "uuid": "879ad274-45fe-4121-8030-247e89d8e4b6", "value": "gx86-20220511-0550", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3d483ca-d13c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652281891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652281891, "uuid": "3af0d6bc-4a2e-4b06-bb11-f28ea478f7c2", "comment": "Malware payload (Mirai)", "value": "7181eee7d74f3fa41702707310d880c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652281891, "uuid": "51b4f54f-afb0-4341-976f-c71349010cd8", "comment": "Malware payload (Mirai)", "value": "88e1954b71e1f0b8d1eea683025f065d23ed3f3898a39ba069dc5eb81f8cba77", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652281891, "uuid": "5feb0103-10b3-4dc2-832a-a7e90bbb711d", "comment": "Malware payload (Mirai)", "value": "67faa29a439e600d86c7a075e9be0e4ad80a1441", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652281891, "uuid": "3c6017b8-cd0d-44a3-af80-0f465f2c00fe", "comment": "Malware payload (Mirai)", "value": "f23d8d7347e9cbfd527a6fa4a254ae788a40d9d7a3aa8d4f686cce6e07b61ff95bfdcd1e1e08a02d45075f8ee52b860e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652281891, "uuid": "8d314c86-4e09-44fc-867f-86bbc31109d6", "value": "T17673724D3E219FBEFBAD823947B35B119209239626F1D984E15CED020E7034E745FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652281891, "uuid": "a1705e3e-2697-47de-8b79-6dfb4530078a", "value": "1536:26OHayEW+YOtZtNvXXb6D0vRp+2Db+32EHi4a1BcXbf7oyvOr:kHUJYIVq0Z02QNHi4lXL7oKE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652281891, "uuid": "8c922c31-175d-4eb3-8f98-be1d0432a5e2", "value": 79712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652281891, "uuid": "142c12a5-0207-42cd-8142-58a7fd341747", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652281891, "uuid": "33103c64-d163-4bb2-84b2-4e2699612e5f", "value": "7181eee7d74f3fa41702707310d880c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0b5e04a-d126-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1652272571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652272571, "uuid": "65024de3-f7e6-4b40-8cf0-ca488fe3536a", "comment": "Malware payload (Quakbot)", "value": "949e33f4201dd566d3f0231f48367de9", "object_relation": "md5", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652272571, "uuid": "1ca462de-1c81-4623-89a9-e6741c9e3a87", "comment": "Malware payload (Quakbot)", "value": "894dad8d458beefec849665e63f6747b7e8f9428636fbacb7e33e8bf23da28d6", "object_relation": "sha256", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652272571, "uuid": "252b47c1-6b64-4bf4-b8cd-0a055034d40d", "comment": "Malware payload (Quakbot)", "value": "b0a9dcd71563975143d573c70f30f4dd40d99974", "object_relation": "sha1", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652272571, "uuid": "9cfca6b1-d510-4b42-8dff-56182491daf1", "comment": "Malware payload (Quakbot)", "value": "0d2f1a59c9c36cd5344b6a5c2e89209c9506ec7b612191e531688fc31d99404ea83fcac4be3f72d672c30525f800991e", "object_relation": "sha3-384", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652272571, "uuid": "a15346da-b815-40b4-9493-79799e9b64fa", "value": "T1D935AE7BE2397C3BD2360B7805514370D6B62DEE103D768A16D1BEA49B3E1CF75226A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652272571, "uuid": "17f802ab-5d1b-4f1f-b206-7625db2e7589", "value": "24576:fVLFUM0yA0yK0yA0yu0yQ0yi0yg0ys0y80yg0yQ0y00y00yg0yw0yc0yc0y40y8j:fNFcytyrytyfydyjyNypyZyNydyRyRy/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652272571, "uuid": "af2ed35d-009a-4d62-a900-1c3d44515d28", "value": 1067406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652272571, "uuid": "9d3b53e3-c7f4-41fb-bb1a-31fc9c3ce2b6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652272571, "uuid": "ef9fb808-4783-4d1f-9ac1-da5aa2c81d46", "value": "z397139224.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45615f46-d0c6-11ec-8e58-42010a9c0032", "comment": "Malware payload (NetWire)", "timestamp": 1652231052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652231052, "uuid": "1dba62c7-0b55-47ae-aa7c-591a6244c571", "comment": "Malware payload (NetWire)", "value": "173ecae1209e548d0df71d631494b30d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652231052, "uuid": "181388d8-31b6-4e6b-935f-b609013f5436", "comment": "Malware payload (NetWire)", "value": "8a54db382066229c50cc8e6feab1bc532431ee7804e54efceeffd696422e64d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652231052, "uuid": "186fb55b-64d8-4024-98a6-3335a63b81c1", "comment": "Malware payload (NetWire)", "value": "34fbce321e992e5bf88bd1a3c0502dc5679e71a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652231052, "uuid": "6092a239-e59a-4928-a07e-e1c6392a5af6", "comment": "Malware payload (NetWire)", "value": "7b7ace367f8dbbe483c69015592f2358873550ff38d92291c1983ec05901171a456d9f7ebc276726497fcdd00ff7bf13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652231052, "uuid": "c46d8e7c-2bfe-4bd3-9fac-d05caea80024", "value": "T15865296D77198905DC80C775EDB33B6327E2C7B578E5730AA3F63A29D26B3AC1502602", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652231052, "uuid": "2b77169a-fdad-4824-bac7-16a34b5601d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652231052, "uuid": "420c7c07-4e0a-45f3-bded-ee6fcfd7931b", "value": "24576:/1IW4YMbH4013sd8WLp9Nq2YZYDJiftDX46es6:/1iJLnMrVXwVDTr6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652231052, "uuid": "fe70e9af-383a-4deb-a730-a3b456fb51a9", "value": 1526784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652231052, "uuid": "d9b1d840-6e6d-4dde-be95-cc621821fef4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652231052, "uuid": "c0aab5d6-ebe8-479a-b919-ee674e7e82dd", "value": "Payment Advice.doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6ab87b6-d10d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652261844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261844, "uuid": "16f0838e-e1c2-4c08-bb45-af7e406ad613", "comment": "Malware payload (Mirai)", "value": "defb244767e03e7dabc20052db1d51a5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261844, "uuid": "7865d6c4-9977-432d-8881-5e14fd86c33d", "comment": "Malware payload (Mirai)", "value": "8b3cea7b646a12669fdcc187d15f6266e023378beef1d21ab690e36c143efda1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261844, "uuid": "666ef9c5-522c-4ef9-a5b1-109f6ed43f9f", "comment": "Malware payload (Mirai)", "value": "252eb26aaa6368c84f7adf9aa31996b45d2445bc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261844, "uuid": "82d965fb-9332-4cb4-a67e-6ccf9a682610", "comment": "Malware payload (Mirai)", "value": "23e6a41a83747731101d2c43304c2cb6fa451dbf7edd2fc71d6187081072b22b8f4569ef96828803cbd77da16f0b884c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652261844, "uuid": "d802b645-5b21-41ea-a403-9ce3ebc32e96", "value": "T18CA3840E2E619F7DFFAC823887B79B219249339A36E1C585D15CEA011E7034E741FB99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652261844, "uuid": "488fa4a2-bdd2-468e-8850-98aef85ee78c", "value": "3072:XDIkiGgcsQoeJP0r01ed6WP0qNuCd4adP9:iU2Rd6WP0qNuCuAP9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652261844, "uuid": "d32997b4-6fb1-4ef8-ab47-5976b7c83d67", "value": 100332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652261844, "uuid": "406e117f-8c87-42f0-9e21-7fd60b2cde1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652261844, "uuid": "847ec135-f81a-4ade-b2c9-ed86b1f1c08c", "value": "defb244767e03e7dabc20052db1d51a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "252e5db7-d110-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652262781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652262781, "uuid": "2411f5bd-6ce0-483a-8fd9-6056a7185894", "comment": "Malware payload (AgentTesla)", "value": "7b878b63cdaf023063dc4818a573bc2b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652262781, "uuid": "52105633-234a-48fb-937a-967b733c6baa", "comment": "Malware payload (AgentTesla)", "value": "8b8d980e86da3a981db6d8ae71191a6eeeb41687092e1b65cc9374408462e100", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652262781, "uuid": "db79caaa-3014-4143-a529-429349434f4d", "comment": "Malware payload (AgentTesla)", "value": "23d981b153b75c225f4a92628116308ae7ee2251", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652262781, "uuid": "b4c58c19-f809-4638-a3d6-fe0e83df67f9", "comment": "Malware payload (AgentTesla)", "value": "99a82bed5e0ab302dc0e47ef5f250aaed6536b26cb1887dc1987a131a7f69c1c9a5b21c0d38575fab6ddc0bab503917f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652262781, "uuid": "3a449232-aa45-4827-8041-c0f155b82ea2", "value": "T1A4D4050063FD6605F6FBFF2169B421514ABABD9EBE39D10D1A52018E4EB1F44DA60B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652262781, "uuid": "321888c2-5969-41a9-a424-4c2a1d81c45c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652262781, "uuid": "cd712d88-7ec3-4e91-acb8-5dbca9f90da6", "value": "6144:dxnjdJ2no2WPgDg/ZyTGDX0cd6rFOe9ZJSyyeCDFjlUxi+MmE1hkG15SMzK/BqN:zR9gKcGDk7FOWWeCpleJeBzK/B+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652262781, "uuid": "924a1056-f141-420b-bcd2-9d5cf8fc03fd", "value": 604672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652262781, "uuid": "261fcc3f-bbb4-41eb-8244-7fe93f2e4f6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652262781, "uuid": "32f1011f-75b4-4c4b-9792-90d65baf3708", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03fde80e-d129-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652273463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652273463, "uuid": "2d070a21-0b8f-46af-9374-990179f9274f", "comment": "Malware payload", "value": "9bf404c9930e419402c315f35109f85e", "object_relation": "md5", "Tag": [ { "name": "bpfdoor", "colour": "#7C9817", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652273463, "uuid": "2bf3dce7-fcb5-4611-b83f-02476d9d61b8", "comment": "Malware payload", "value": "8b9db0bc9152628bdacc32dab01590211bee9f27d58e0f66f6a1e26aea7552a6", "object_relation": "sha256", "Tag": [ { "name": "bpfdoor", "colour": "#7C9817", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652273463, "uuid": "6cb017bd-f603-4161-b359-3d9c4863bf19", "comment": "Malware payload", "value": "024ee38c4a451620e5044e99dea89f99e38b0eef", "object_relation": "sha1", "Tag": [ { "name": "bpfdoor", "colour": "#7C9817", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652273463, "uuid": "a7dc7326-3198-4d1c-995f-6a2fa4e4949e", "comment": "Malware payload", "value": "92089829b5cb83b552c9881e379e12cc0f09fd931c7bddedb56a114d5b09e5518db4209da34c4274104e76a24999ebbe", "object_relation": "sha3-384", "Tag": [ { "name": "bpfdoor", "colour": "#7C9817", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652273463, "uuid": "a1258c00-1155-46a7-b1e9-dcf0f1a35fd5", "value": "T11DD282CA977A245F46B38B2DD7835809E34A311312D1650EBDBCC159DFBA460E2F0DAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652273463, "uuid": "cf4b8515-07be-4787-8f5f-d66a49616bbf", "value": "192:irPTi1BpVgz8i61HJORQ8Q/GbQSZgTeESMW+Jna7nBN0V/cbzH/40fh8M6I2p3Ht:irQCCpIwO0SZgK/oVKV8M6XWz5ADp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652273463, "uuid": "e2d447ec-7412-4e3e-807e-e3e15cf29a1b", "value": 29758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652273463, "uuid": "8b99326b-6f33-425f-bff3-b69f5a27a00c", "value": "text/x-c", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652273463, "uuid": "8aac9188-03e6-4f75-b676-55feda05dbb4", "value": "8b9db0bc9152628bdacc32dab01590211bee9f27d58e0f66f6a1e26aea7552a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e0a5946-d11c-11ec-8e58-42010a9c0032", "comment": "Malware payload (MassLogger)", "timestamp": 1652267977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652267977, "uuid": "7dc1612d-a9f3-40b8-a9b3-cf4e02eb1dcb", "comment": "Malware payload (MassLogger)", "value": "d24003b39fc0bc5ce0588ba1648bc173", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652267977, "uuid": "e3d6280b-93de-48b4-8c7c-feffc7ed3af1", "comment": "Malware payload (MassLogger)", "value": "8bb3f4c901a0bca7547f367794fbbfb568233ec8ce85c14a17a1e33a40389be5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652267977, "uuid": "537c938e-0213-4aa1-843c-730e92e2006e", "comment": "Malware payload (MassLogger)", "value": "8be09bc7d3256785e608e1d696ada53fb288149e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652267977, "uuid": "15650abc-ffbb-4d21-931c-2a45d88f5a7c", "comment": "Malware payload (MassLogger)", "value": "3c7be1bf0ad364a83218012ffcd9bc840eae46d494f918aea407ee0091ad6e1b81370f4a49bb9841afa3ba3a60ec4039", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652267977, "uuid": "d432de12-1d2d-4cca-973c-b29b7dd2e637", "value": "T18E4412905B22F0ABC9F32EBB153756B28EDD653564EA571F530836DD3E26202921BF03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652267977, "uuid": "095ecb06-0d3f-4555-8e83-e5d71ab89be9", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652267977, "uuid": "0e64781b-d134-438b-bc7b-def3b1dde913", "value": "6144:pOtInXU3Xg0Uiuh5CLuGDNL2NU/Um0sIZ1QygQLF+AJx0s4KQcUOZ:pOEU3XgyDt2qPkQ0Bx0skcUOZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652267977, "uuid": "d30d6651-14fd-42ca-9990-d56082256766", "value": 277401, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652267977, "uuid": "32641bf3-f324-49da-99f1-82dec541311a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652267977, "uuid": "5f61b648-dc88-471e-8cea-2a7442eb2b8a", "value": "INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e35af18-d118-11ec-8e58-42010a9c0032", "comment": "Malware payload (Nitol)", "timestamp": 1652266393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652266393, "uuid": "fb3f57d1-70fc-4b22-97ea-0a7623c1b90c", "comment": "Malware payload (Nitol)", "value": "cf9497101e8575b995b5787ca065e243", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652266393, "uuid": "e8ad0dc7-ae9c-4647-9263-0b5b32424a91", "comment": "Malware payload (Nitol)", "value": "8c0c470b43553c0b6ecd3a4d1a792368b109835cc976452776718e1cca3f5b59", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652266393, "uuid": "f8a4cb8c-d08e-4757-99e7-f735c57695bd", "comment": "Malware payload (Nitol)", "value": "03325c4ac07ae5debddf058a40b7241e37b8ef5d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652266393, "uuid": "97077f37-4e30-4a1d-aed5-cb432d9512d4", "comment": "Malware payload (Nitol)", "value": "2f147b41545aa3ad853a656e73697d0a2f8a9d6bd74655ad07c202a67e29f5fc92b6f335420b7024ea3b2bb418ae1e10", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652266393, "uuid": "614a1560-fc3a-4633-b175-a55c49b968c8", "value": "T1B6647C1233E1C877D5A601334A92C359B2F6BE51AD3686477BD03B0EEE70252CF25B69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652266393, "uuid": "f80c626c-6204-4622-9425-2ccf077c4e9a", "value": "4660d4f55970ca074db150bc25297558", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652266393, "uuid": "655e5f2c-2017-406a-8c8e-5b6deff96b00", "value": "6144:ULwpEFWtfJqN4ACGWkDQoYshnGMApM9LXYCEPf:NqN4ACGWCQmGMApM9TjEPf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652266393, "uuid": "5c5edba9-d894-4105-8a5a-a0f0b1623882", "value": 315392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652266393, "uuid": "056a9f07-bb69-43c6-95f2-93f76a47aa0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652266393, "uuid": "2b1a5f9d-9086-47c2-a226-54445b6d16ec", "value": "cf9497101e8575b995b5787ca065e243", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d090bd84-d13e-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652282825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282825, "uuid": "00965563-c4c2-49ec-b22c-ab3cbf5bb40b", "comment": "Malware payload (AgentTesla)", "value": "e0d0a7474b9ac76798a93324a709198f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282825, "uuid": "b810dcd8-7df1-45bf-b9ed-3efcf4f81478", "comment": "Malware payload (AgentTesla)", "value": "8cab0e983a4a64cedcc1bd30b47bc7c2ec1d681bce6dd4eec285a076b9eacb83", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282825, "uuid": "22aef472-852b-4ec8-9140-b11afd236f5d", "comment": "Malware payload (AgentTesla)", "value": "5e4121df57fd4c142a470cf7750985b9f4b8ad3d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282825, "uuid": "ba9da016-656c-47b7-b399-34eeb86f5b61", "comment": "Malware payload (AgentTesla)", "value": "d9101c7acaa1155e133014a3acb90276a87a5bbf45c1a1a193fe88682f1c2b71739f2895a8ecbe3c2b4809f171e0a4f9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652282825, "uuid": "45cba829-0fbb-4734-a0e1-4f49c4cb173e", "value": "T156D4811C3F415A72ED5DC13869030A19BB660F332B4AE9C617CB2ECA87DF1E91D45D8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652282825, "uuid": "9e9582f7-d691-437a-8a53-d6f69bacd219", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652282825, "uuid": "6bf5b759-ae71-4643-83c2-1c8136253b43", "value": "12288:dltPr3/LTp2ZCRKm8RiWa86l7cHFkumi8CX5xfMN:BRKm8RjWlgCun8CX52", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652282825, "uuid": "4ec57541-a7b1-4f52-9a9e-5511f3a2c0e9", "value": 607232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652282825, "uuid": "4abdc4e4-c83a-438c-89db-0e05fc1b53f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652282825, "uuid": "f969b599-ec1d-4009-a888-fafda46c25af", "value": "MV NEW VICTORY_VESSEL DETAILS.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3d40d1b-d139-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652280603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652280603, "uuid": "a88260a8-d9e5-4b62-8aef-d32624fed2d3", "comment": "Malware payload (Mirai)", "value": "3d3a719fef757bf84c6e92d872a99106", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652280603, "uuid": "efecab1e-c7d0-48cf-968b-998eb279c50b", "comment": "Malware payload (Mirai)", "value": "8d6e3434a48837acee248b939a334046bee989c8a45b98eb7b12f73a5a9d34eb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652280603, "uuid": "646c6567-9e96-4a61-824b-86936b14542c", "comment": "Malware payload (Mirai)", "value": "28d6debf7fff515906213bf0d22e7632309e4ecd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652280603, "uuid": "2d8a2ccc-fd00-4353-be99-7eed73553628", "comment": "Malware payload (Mirai)", "value": "342afca519f41757916c0101ddf401bb053b5c4224e72d9bb0e27fb924a22bedc6425117b6286d018c93ede8e06e26ba", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652280603, "uuid": "c82e4d40-db06-4d6d-a147-b8242a915da7", "value": "T146D33A46FA408A13C4C61776FAAF41493322DB55E3DB73068D185FF43F86A9E4E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652280603, "uuid": "b719fe97-f20c-4486-bd2b-43bdc725b19d", "value": "3072:OAfRuiVUkjSv4d+TfJvWaFdCAnhsJhL+HeBg4xKql2TVvYbhj6b5M/9FLW3:df0iVUkjSv4d+TfJvHFdCAnhc+sg4xKT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652280603, "uuid": "fb22c67d-0549-449a-a950-634e06ae2326", "value": 136657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652280603, "uuid": "7f83584d-6716-4d59-9b88-1b5c72b32b8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652280603, "uuid": "3f3ff12e-ddaf-4522-9655-14c37df076d6", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e59ea6d4-d121-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652270405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652270405, "uuid": "64aef93a-6b9e-4c18-a89e-cc2d0e950409", "comment": "Malware payload (Mirai)", "value": "5da00664ffe806502c883fb473d62a4d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652270405, "uuid": "9aeebdd1-7edf-4aaf-b9e8-2f1ab0055ef0", "comment": "Malware payload (Mirai)", "value": "8e21d6b2a394a2318354aa98cd2bc3e3a6efc132397fdacb37ab4241348df011", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652270405, "uuid": "1fd5f552-04df-4023-8e6f-197df114e4fb", "comment": "Malware payload (Mirai)", "value": "eefca5065fd44ce95bc713a759225ec18341a94a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652270405, "uuid": "09b3ed0b-d116-4ae8-8289-69b071123f00", "comment": "Malware payload (Mirai)", "value": "fc6408986cc51b89dbbccf1df4d08dbb28f562e8095b478f8f31aab4f4a37523721f728819a83cb6139cddd342618d2b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652270405, "uuid": "1af372cb-7fa1-4a26-af48-68f79a2a1d62", "value": "T1832329C47482F9F8EC15057C317AE7729EB7F43A713ADDABC39994239815601AA032ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652270405, "uuid": "c8a9c03d-cc4d-4553-ade1-4a8bdb26cf88", "value": "1536:SZ4pyHAH8TgbrnOIjua0yqBNcUvkm92kdrkEU:qHAH6arnOIju3yqv7vkmAkZrU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652270405, "uuid": "0fdfb853-2f57-4669-ac27-d76f3c5abaff", "value": 49752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652270405, "uuid": "66315d99-993e-4703-b91f-697c4358b815", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652270405, "uuid": "cc51cd4e-0d1d-44e8-aca9-1becbe04df66", "value": "Owari.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec396a8b-d104-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652257961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652257961, "uuid": "96539d62-0ade-4b4d-958a-289002be1082", "comment": "Malware payload", "value": "e179a1ef8f5e4ac45ed955b157391207", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652257961, "uuid": "5ee9ea4c-7497-425d-8b80-3702579d994d", "comment": "Malware payload", "value": "8e5db2a8bd23da8ccf2728e94d82249453e565aca7b8c6acf6063ef30cc09423", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652257961, "uuid": "8a6f4910-0ed1-451b-8cf0-2314f6678339", "comment": "Malware payload", "value": "613a20cf91f7d382a2257a6627993fa66ad974bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652257961, "uuid": "6b55938e-8daf-48aa-ac90-5eec4982adb9", "comment": "Malware payload", "value": "d009ab62118f64bb767cd03d16f329c5f011c3e04736335b2757f3ed9d5bba60052ed87ed389f0ff4d868893387eeb14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652257961, "uuid": "1bbdc802-4b2f-4c83-9619-a46a499fa759", "value": "T1EEB3FA4D631447DBE42A7738C96ABF29061096BC78CBEBF9F4763643B8917D6106303A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652257961, "uuid": "7c12a067-6cde-4b56-a09b-98b2e5e9eec2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652257961, "uuid": "88bcdbda-1d12-4ff4-b136-9132f6e347c9", "value": "768:GnRfPLspM9AibgwvIuYX6qOyZZB2/YPMtkOOOOOOOOOOOOOOOOOOOOOOOOOOOOOg:Q+pM9/bHIa8Cy6QF0LKNUw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652257961, "uuid": "ddadbf21-f7e7-4332-80a2-6a5a9eacff04", "value": 111104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652257961, "uuid": "b6c9ecf9-d185-4963-a386-3c34ceb09dec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652257961, "uuid": "1274fed7-f9fd-458c-b875-3e239a59bb22", "value": "854F1E97-5DBB-4A87-A566-33D9012B05E2.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2d41995-d10a-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652260495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652260495, "uuid": "d5f18076-e304-4716-8fb4-0b048285d772", "comment": "Malware payload (AgentTesla)", "value": "7304d738bc86a005b5caa7561da8fb93", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652260495, "uuid": "4036171b-002b-4bc1-94a7-25c9e4f23b4c", "comment": "Malware payload (AgentTesla)", "value": "8e5ed115b7473306fd41dc1862d463a22e1918369e83a8c2d97bc3498af5f93e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652260495, "uuid": "78eb33e0-9d0e-4726-880a-1872327900b4", "comment": "Malware payload (AgentTesla)", "value": "537ac634820fc28cb189116066f28c6a4b54a006", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652260495, "uuid": "d4d34813-359e-4159-aa6c-e6a194b8f16c", "comment": "Malware payload (AgentTesla)", "value": "fb583a6a44c50037f6748c7b11ba161932c41abd54fcbb807caaccef2e61fa04fb27b27e54cf7beeccef692d01747870", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652260495, "uuid": "28cac7a5-a9a8-45bb-ab8d-e96ce75c07c9", "value": "T14EE40218BBB6C606D1BE2F3AD4F5A41407B9BD069033D31E3AC81A4D6D533970A91BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652260495, "uuid": "6f4e4416-e5bf-4838-8d10-4b7060b17dc2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652260495, "uuid": "a3f29479-3a8c-4baa-abf9-3ad3bc89795e", "value": "12288:km9pgpfXwIpOIeGXmg1QjSt9iX2IBoj3nI/EwukvNnG+QOsPRdn0Gp:99mo4L8SOGIajYMDCN+9Pbn0G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652260495, "uuid": "8c6e00b9-c988-48ea-87ca-380f198463af", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652260495, "uuid": "5421ab77-d1fc-4f4b-86f0-6127ab8f22d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652260495, "uuid": "bd5206a9-1f5a-4646-b4df-1f8f2627707d", "value": "Office Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bde445bd-d0c8-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652232113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652232113, "uuid": "1546a4e0-cdc7-43b2-af9d-63f11dda4645", "comment": "Malware payload (RedLineStealer)", "value": "38299ac520e112d4d31ca74b5b9a7f89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652232113, "uuid": "f63e70e8-34bb-4d83-ac78-87748e2cc533", "comment": "Malware payload (RedLineStealer)", "value": "8e69124eef60e3fd34df9b53b91c526e8c4b120d0e56bf8565080362f767284f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652232113, "uuid": "102aab81-2c5d-47fd-adc5-88cd9e9375de", "comment": "Malware payload (RedLineStealer)", "value": "e5817ba0b2165839370d295db866ac1a35187634", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652232113, "uuid": "6796b583-480f-4c7b-a7d7-ae32ef7f1173", "comment": "Malware payload (RedLineStealer)", "value": "982d8090a46b5a522c51a450ff2de2209eda24c814f82df011b47b521880bd2c096b15eda434cfbc0e22174c343f2418", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652232113, "uuid": "67925dd9-928d-41b1-b0b7-5ed677c95bdc", "value": "T1C295BEE38302120BF262F439801E9D6DB9B20B3157CFB87767899EE9931B2D0556DB53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652232113, "uuid": "1b55eaa2-6391-46cc-a6bc-18d925125a7f", "value": "5a498eee87e4d89512a84502f500181f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652232113, "uuid": "cc25e2e1-4e98-4aff-a13f-a3844828e98b", "value": "49152:eO52SeihkR7GGm/3Fk0L2G3V/Xmjwu3nJYp0PP:eOESeihkR7GZfF/Lx/FyJYuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652232113, "uuid": "fc63c76e-cfc4-47aa-aedf-60e4b8c18a35", "value": 1884672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652232113, "uuid": "e8a9fd4f-abe8-45eb-ac43-75ab207f1d75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652232113, "uuid": "1d361c83-a23b-419e-adcf-0c469c88f0d6", "value": "38299ac520e112d4d31ca74b5b9a7f89.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cae6eac4-d171-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652304720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652304720, "uuid": "7db76c03-2e0d-4507-bca6-5e96d3a169c1", "comment": "Malware payload", "value": "9f9d7829308fd4193fd44920ef6fa439", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652304720, "uuid": "7ac70716-11a6-41a9-a9d9-dfc23e6f837c", "comment": "Malware payload", "value": "8f1871aa11fb9d1ad29888bca69668b1ee085c4d58973c0fc366a4165a4978e4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652304720, "uuid": "8ddf8dc3-a348-49ba-bf52-4758c5a08880", "comment": "Malware payload", "value": "f546764d02cc8c409b365733a32fc1a56d3dca1a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652304720, "uuid": "eb1f3c29-2a12-488e-94dc-c8e6b3fc8203", "comment": "Malware payload", "value": "013f67e62a12d67cb6c70a2ecbd238b57cf0755c01fffb8f5e53bc2b4c24077f9ff7d38eb5bcf4da3d7e8515d050daa4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652304720, "uuid": "4924b42a-eb01-4f9e-a7b3-357bda73415f", "value": "T123C4CF8D366072DFC86BC476CEA82C64EAA07077931BD243A45316ED9E0D5ABDF144F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652304720, "uuid": "e2c1c7d4-19af-49d4-842e-09558db7e2f0", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652304720, "uuid": "3bc713a2-1482-4dfa-848c-5606332e238d", "value": "12288:ZOdTTZGKcQVNy4C2NaaiqSIwlIAEz3q0r6oYzLEMC07Y6coPPjCL5yJ3keIX1Wy:Z6TTTcQVNbCLaiGoGhOB3EM17", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652304720, "uuid": "6a46b0b9-b721-480c-bebc-82cb1109f7b7", "value": 588800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652304720, "uuid": "a97407ff-8ac9-4cd6-b9ca-9bb8488bfaa8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652304720, "uuid": "14b7acb1-8b3c-450c-9010-33c02ca63865", "value": "ExtractedHexStr.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99b8647b-d13c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652281874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652281874, "uuid": "766c7e2e-958c-4e75-b83a-653290d919b1", "comment": "Malware payload (Mirai)", "value": "cd708be157fd4be3dc5b2f82f87c43fd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652281874, "uuid": "04433811-5b74-47ce-bde8-c708e7adda27", "comment": "Malware payload (Mirai)", "value": "8fa3f429b26fbf514b9cf2dcd26286c59a76eb9ebed3f282c6dc02f4a005a81b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652281874, "uuid": "3097e91a-4f6c-442b-ba74-7960d97569f0", "comment": "Malware payload (Mirai)", "value": "73851c3250c20b6cb1df2bd060bd1f5ad7c2e885", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652281874, "uuid": "72556914-ab7a-4e47-86c2-07c991648853", "comment": "Malware payload (Mirai)", "value": "1e3829192bcb2f1a685b9182939f99682ec1b45382339b524dc9ef6c9a8c92645a5264bc9dfb267fdf8f13129e772f41", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652281874, "uuid": "38d559b1-8b0f-45d2-a81e-b92cb1894f9c", "value": "T13A732A86B8819A21C6C516B7FE2F104E330297A8E2DE7353CD145F6477CB85F0E2B95A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652281874, "uuid": "c1bf2f89-763a-4c59-a646-51f7b994f969", "value": "1536:C9nQlxuJzfBcgq+FZY0JrcdkSv4d+TfJvWa5dCAnhYXWHuzVL+13Ljn/LdCIhidb:jrKflLYgcSSv4d+TfJvWa5dCAnhzOhLk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652281874, "uuid": "91ea8515-4c8f-4e59-b549-942e6e6ff79c", "value": 74880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652281874, "uuid": "abe7db36-2f34-4fbb-b9e0-40510932924d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652281874, "uuid": "1a403082-734b-4287-9356-32f54d1abfbb", "value": "cd708be157fd4be3dc5b2f82f87c43fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8bff03a-d132-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652277685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652277685, "uuid": "8b623d21-77f8-4881-a6f1-a0d8016834ec", "comment": "Malware payload (Loki)", "value": "e310499d46f5ec0029eebafdd266599e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652277685, "uuid": "54175715-2812-483d-8f23-19126d60bdff", "comment": "Malware payload (Loki)", "value": "900412d2feaf6d59fb84d51f31945d6a0d78d9155d9d12d11687152d2bb2b6b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652277685, "uuid": "9ed8c480-b4e4-4c4a-9f1b-6eb89fbf4fa9", "comment": "Malware payload (Loki)", "value": "d3f5de03a9d12707486dbc195fe84bb7633d1e26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652277685, "uuid": "1551d499-b626-4b29-8eea-dca25729ec1a", "comment": "Malware payload (Loki)", "value": "a13f165978195c79a92d075ad92f1dfdd06b4b96905173c3c8a03497069c57546cbe25bb301c22b14c446f5e971bb495", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652277685, "uuid": "920b3076-b17f-4da6-b3cf-31b7f36bece0", "value": "T1282517987254F5DEC817D071CA685CF4AA207C66C32B820B90173D9EB97E783DF219B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652277685, "uuid": "8c6b0e79-7241-4042-aff0-318104c611de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652277685, "uuid": "d6eeca87-dcea-460d-a856-bf7d4715e8ae", "value": "12288:iDu1fxt7J0AgGlB2KCtKPuyfwmL5I+rhEiNtQT6lRoSueVgT2EYKAFlySUXEREi8:s62N6TaKPuydL++reiNql", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652277685, "uuid": "dd18d847-3ba7-49a9-9b91-7c5a63a0dd99", "value": 1050624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652277685, "uuid": "ae02bc2c-6f6c-497d-9ffa-9e6bb08db292", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652277685, "uuid": "8889f61c-ea31-4f55-92cc-09d2a419e5a2", "value": "RQjebeYZlehv73w.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "173d9df8-d0fc-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652254168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652254168, "uuid": "e992ae18-8242-4cc6-80b5-ab2fd882080d", "comment": "Malware payload", "value": "4fae07b21b2ce5aa949208dd0540b768", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652254168, "uuid": "23e491ea-8155-4c8d-bd2f-8385e9f6773a", "comment": "Malware payload", "value": "938c6ed84dd404ed8129ef773cc695ddecfb29203e34189760324caa569dfc97", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652254168, "uuid": "6bb09db0-58d5-4616-905b-4439fd706623", "comment": "Malware payload", "value": "98d1ceaf325f590999ce53677bf8bd47b2dbb0da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652254168, "uuid": "93cbd9fd-005b-477a-84f2-2eeef7bd5b44", "comment": "Malware payload", "value": "90b4f82abad8b5c7cf9dae7449f01f221365720a3ebcfac9e0a6c9c3060316b9a3b97dc777f8d496cbd30735f4707c87", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652254168, "uuid": "529db646-d0d9-4b71-8963-f4b60b28d38b", "value": "T169A52409A147E27BFCEC18E3055090D0D29C7FAA7B528CCDE93AC686551F482F7B6D86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652254168, "uuid": "0791d182-ca8c-4297-871b-1c851860a4d6", "value": "ab9ff6e4872ea2766a5f5c6af5649e9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652254168, "uuid": "4bfc1bea-6c78-423b-883f-45717f3b9674", "value": "24576:gJr8tE+gHqcgrTceagQEIYu4//aw0zQI029wYk+BoFJjuMXG8Iva4A4S:gJ4NiDtlmnawuZ029wYijuRI4S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652254168, "uuid": "50a31708-bb0a-4b75-9f98-1f367cc5b641", "value": 2130121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652254168, "uuid": "ace5848c-d391-4700-ba80-f274900ac882", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652254168, "uuid": "5a6e8ed9-7200-449b-8633-420ae54a623e", "value": "4fae07b21b2ce5aa949208dd0540b768", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66275fd8-d12c-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1652274916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652274916, "uuid": "7f71a020-0973-497d-8964-f4578439ba5c", "comment": "Malware payload (DCRat)", "value": "0e68c3f13c43fd4e5f8c26c10ddf2abd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652274916, "uuid": "d9827e10-7070-4c9f-a26b-915d4041a692", "comment": "Malware payload (DCRat)", "value": "9479cdcb83b7b22199031e3a0208ad62e85fbaf02f9d7e53c8adaa888bdc94d2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652274916, "uuid": "7717a801-a172-486d-86af-d994cd878ce5", "comment": "Malware payload (DCRat)", "value": "52ef24e8b2d5e86e33c08cd7d0ed64a07933ac0f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652274916, "uuid": "722ef92d-47ac-40c1-a70b-d766d849621f", "comment": "Malware payload (DCRat)", "value": "b96765b780ba61171217776bda08a0ec272c1405c8a14af6443e7a01714395eee79ade5304d872c6a37a4b349fc4bda2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652274916, "uuid": "5b8b4629-1f32-4034-96ee-64ac14886731", "value": "T1F0658C417E44CE11F0181A33C2FF55048BB4AD116AAAE71B7EBA376E65123937D0CADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652274916, "uuid": "3e1ff197-3b47-45cd-93ff-4903a10d8183", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652274916, "uuid": "f33d20e6-841a-40dd-ae49-911e972ff37f", "value": "24576:U2G/nvxW3Ww0tTqH2q+phwYXjP8ZVsN9MgqfLxP20CiZnqHvex/yXHhLn:UbA30GH2bphLPxIkSZqHGxQ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652274916, "uuid": "6e099de3-f2d7-4de8-9791-e272a98690e1", "value": 1516208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652274916, "uuid": "791bd481-c03d-4826-b69e-295e397a53c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652274916, "uuid": "aa2cd48e-6a8f-45e6-87ea-685b93920cf8", "value": "0e68c3f13c43fd4e5f8c26c10ddf2abd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb9fe4a9-d12d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652275596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652275596, "uuid": "c5a1cfac-7dfe-490b-b5c3-03d287b69c6e", "comment": "Malware payload (Formbook)", "value": "2b38356a2ffe12979669044ce1dd2fa2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652275596, "uuid": "ab89598e-3f88-4468-ae72-88dea2934e8c", "comment": "Malware payload (Formbook)", "value": "951337ef30b8c0940e630f56187954653fb03de3cbc9367e75d68d9432126fa4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652275596, "uuid": "069c161a-e4d0-44b7-b29f-6122b74ff380", "comment": "Malware payload (Formbook)", "value": "5a35c5deeec0d1ed7b4b91857539c0a802e68b91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652275596, "uuid": "ce4e4da6-fd34-45ad-b31c-e3f1948e88a7", "comment": "Malware payload (Formbook)", "value": "3ec45ccbf3de949280fd4f6807a5fc7ece2cb7321556aeb729e668696009967d39f409e30649861ba2d7d1a89f558a3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652275596, "uuid": "70b9c84c-d3c2-44b6-a5e5-bd1851c8cde0", "value": "T1E424F717BB9A11F8F3A69B3494A24502E3767C1A07B196CF8351727F0D623D19E73B28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652275596, "uuid": "8d8e6741-9c0b-4286-8904-845895be05a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652275596, "uuid": "7d626921-a287-4813-becf-4e4d4f939d3b", "value": "3072:YeQzh+3+VKzS/HlwpFq4PrSpBRAJvJ70jNRIa/YTa8tFmIDz1xIDc:LQk3kqriUxYj0QQu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652275596, "uuid": "da564c1a-47d6-4fdb-94bd-fcc07cf23863", "value": 218112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652275596, "uuid": "aab974f8-fd8c-411d-952f-67499258756f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652275596, "uuid": "c1dd1a97-df3d-4510-a44b-ef95371db3fb", "value": "2b38356a2ffe12979669044ce1dd2fa2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76869cf0-d0d6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652238007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652238007, "uuid": "62006f69-c529-42ce-83c4-6730b90ec294", "comment": "Malware payload (Mirai)", "value": "35f82851ad0a3d048ba754843a8c18fc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652238007, "uuid": "a8ec3b8e-ed21-472f-9ae1-c16bca223ed1", "comment": "Malware payload (Mirai)", "value": "95a36145053f968890554ddae4b86d206858657ae7281a40ae21ed74cfa9e2cf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652238007, "uuid": "ade3cb65-c7c1-4f1d-9135-ac5fa118cabb", "comment": "Malware payload (Mirai)", "value": "78f7e17d7c7ec116f73fa85a7b9e8c2a0d54894c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652238007, "uuid": "eac30c4c-6d24-47d4-9aef-933f6ca83eb2", "comment": "Malware payload (Mirai)", "value": "70b43c34810f29ceccbd44da41de002d00fe9df3b9e80357e261f0db660943ee52426779ac12e97995ae586793f0c78c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652238007, "uuid": "ab0e51e7-6060-49b6-bdd3-527ac4a55857", "value": "T1FFB2E17EF6A1CD79F968D33329A44D0EB165BA74E269C250B3852C6E41423CC33329E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652238007, "uuid": "369c0c30-f785-495a-b7fa-136d7ed15b29", "value": "384:MZcnZ4Dj8/hG1THBuZf8oNS7md46dqqgaEWocPeuamk1vaI41whJAgWGb83yY:/4j8/hGFHBAS7mdNhPejWyh91bPY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652238007, "uuid": "29e87167-8318-4573-a272-88a5af1ff682", "value": 23608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652238007, "uuid": "038bf736-9b7c-448b-844f-8cb90d7ad0bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652238007, "uuid": "29eb0a97-b1d5-4b75-a074-2de6ff2fa393", "value": "sora.x86-20220511-0300", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81c8ea44-d0ec-11ec-8e58-42010a9c0032", "comment": "Malware payload (CoinMiner)", "timestamp": 1652247474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652247474, "uuid": "b8592169-6082-40a6-9b1d-0f40a9fb542b", "comment": "Malware payload (CoinMiner)", "value": "e686ba357c4d356e51d66c1a90c2e533", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652247474, "uuid": "248c4155-9da0-4530-8355-689308b50069", "comment": "Malware payload (CoinMiner)", "value": "989d751b53b8c3d3d57111fe727904298f8723cab3b656db6da4bacfd9a2ed18", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652247474, "uuid": "f2b3d476-2f28-4a68-9511-92b42bd91deb", "comment": "Malware payload (CoinMiner)", "value": "7ee018fd210318bd1ee56a8f56c3be4a8a0fe027", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652247474, "uuid": "465a3b3b-20e7-4e45-8592-33f14f2d00f4", "comment": "Malware payload (CoinMiner)", "value": "882525c4f9130ab5881450a157e1bee226e82f75e46f11f56a6fb2005fa1beb1ba7309b4e57dee1fd7a9b15ac7534e1f", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652247474, "uuid": "ec894940-8ecf-48e3-b8af-e940a32eea15", "value": "T141251240BDC15872E6B2193259396B211ABAB9201F24DFDFE3D40D2C9E705D0AB35BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652247474, "uuid": "8f989518-c19c-4239-be0c-9efe3ea56e94", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652247474, "uuid": "05adc0ad-f3e2-45e0-816c-fe2a518378ae", "value": "24576:XhvJVJdMEIzPmADvPUL3RMUydMwoo6FeMA6M:n3dtAQN340lUMQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652247474, "uuid": "21f6e453-4c80-447e-b23c-b4bca6c1b055", "value": 1034083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652247474, "uuid": "e6626e04-a16e-4316-a051-6b46be3de8db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652247474, "uuid": "5cff591a-a906-4a90-baf6-dafabd11b0c9", "value": "PagoUSD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36afea41-d15d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652295882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652295882, "uuid": "0dbb9b44-93d2-4bdb-82b9-052b20827bc4", "comment": "Malware payload (Heodo)", "value": "6c3ae29b956db64df56670024be45386", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652295882, "uuid": "70c48727-3ab1-44e5-bf59-6f4739f3e6c9", "comment": "Malware payload (Heodo)", "value": "998e2a1a56195af809e8124f962e8534852868f44f4f7eaf1efa1f01f251b377", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652295882, "uuid": "cce227e2-82d0-4b72-95d8-debd0447a006", "comment": "Malware payload (Heodo)", "value": "60cd24db336248ab6d78b42dc1452003b3cecbe6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652295882, "uuid": "55e25cb3-d698-46a3-991c-7122f1c6b654", "comment": "Malware payload (Heodo)", "value": "052731f6527fed4e702cd01ba1391ddee1b194573ca278310293ab6d0d13d6d3a44499e15198717e1241b7405ab63309", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652295882, "uuid": "96a86242-b8c4-41a4-bdf8-5bc95a1b00af", "value": "T1B9B4BF06B3A504B9E467C174C9735952E672BC121761AAFF33A0436A2F37FE06A3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652295882, "uuid": "956af5c5-53b9-4ef9-afbd-47e5c9ed798c", "value": "6196af15ce9ababd9a592319b3043ede", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652295882, "uuid": "72801807-96a7-49da-8237-cbaad05ad4f7", "value": "6144:iuD3jumQgXW2jLi1QPy+hSVL+ymiohaydtUPM1UlTIqNtF1FMytrf:ZDLVXW2j21QC1+yZoxtUPMg9Z1FMyB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652295882, "uuid": "43f931a7-2e66-4630-8461-6bd25666e684", "value": 513536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652295882, "uuid": "d844f0b3-2b69-4c98-9a1b-ecbfc7e48c53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652295882, "uuid": "599106ea-8053-430a-bc39-d84549124200", "value": "6c3ae29b956db64df56670024be45386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5869a46-d105-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652258406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652258406, "uuid": "b1074e4d-81a1-419d-a0b4-f6f7b52e0a5c", "comment": "Malware payload (AgentTesla)", "value": "74d62a87de23dd775616ae32b73d1b0e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652258406, "uuid": "f5be4610-6a6b-4f91-9ac2-13e525bbf692", "comment": "Malware payload (AgentTesla)", "value": "9a328d6ae11ef0abc1ff8fcccf158c6b230294cc4d79fcdbc11093f8f917421d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652258406, "uuid": "75e94237-ab72-4557-b6d1-193dbf1d7b2d", "comment": "Malware payload (AgentTesla)", "value": "ef150eed7def100687ef0276f56a0150216dbe2a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652258406, "uuid": "b357e254-da9e-45e6-b1cf-b25e1e26c5e5", "comment": "Malware payload (AgentTesla)", "value": "151bc2a435006631c7898eb79f2862f2e07db64aacdac9b1159b346cfcb695ea9a22064bb33ee2a7ff2d9444765f0aee", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652258406, "uuid": "19c5b1e7-f4cd-4b72-be61-de7fb39718bf", "value": "T1FE742315B7F0C42BFD721B320ABC9123DFBF681A61E6B51743103B942FA878565BC616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652258406, "uuid": "24a27d7b-768b-4fc3-b183-df08b10da524", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652258406, "uuid": "211d752d-8655-44de-b2e7-2f6e0ae6c3b8", "value": "6144:LOtIOnVlseIy9XUy0X0VuNEUxy7raWYT2wx0WOklCRGy/s8T4wWzvzMd4D38L:LOLVlPY8eUraCwxVOkYREE4Zz8I8L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652258406, "uuid": "34629717-91fc-4f65-a614-e35051b775b1", "value": 359397, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652258406, "uuid": "361c9404-de28-4d4d-95c1-eb99191f1557", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652258406, "uuid": "b5873245-cdbd-47c9-8b63-b4312cec16e2", "value": "SecuriteInfo.com.Variant.Jaik.72878.4607.29036", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64c9f0fd-d133-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652277920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652277920, "uuid": "52904ea2-8289-4d2a-ae25-9a195bd9e0a1", "comment": "Malware payload", "value": "14c930526be331cbb9deac54423329df", "object_relation": "md5", "Tag": [ { "name": "G0nnac0pe-Kekware", "colour": "#D9A267", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652277920, "uuid": "530e2179-b096-49bb-917f-695237e543f4", "comment": "Malware payload", "value": "9b087a352fcb0a61545dbd68f7dfa32e0e15f98ca1547207d9ff918881ff5c75", "object_relation": "sha256", "Tag": [ { "name": "G0nnac0pe-Kekware", "colour": "#D9A267", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652277920, "uuid": "3c8d70d9-17f4-4482-a804-6c7ef336989d", "comment": "Malware payload", "value": "c4f0052a757f87a426101c6e187f70fb341f54e7", "object_relation": "sha1", "Tag": [ { "name": "G0nnac0pe-Kekware", "colour": "#D9A267", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652277920, "uuid": "9c773708-5cba-44db-b582-8697234109c6", "comment": "Malware payload", "value": "5915d5bb6d3712afe8b9e0dbce45bf678f6d8d1d18b67a9bcf5bfb78cd0aac19dfbb9b573052e5ec857b273b71adda68", "object_relation": "sha3-384", "Tag": [ { "name": "G0nnac0pe-Kekware", "colour": "#D9A267", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652277920, "uuid": "a084f248-5cdc-4a02-b9a2-251b22f20c38", "value": "T170C20A3849C7D77BB155931FA29BC05D2246B03E9CA924FBC8DCBE782F9824DE0B6055", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652277920, "uuid": "d894a200-1803-4150-a18a-f0462743a345", "value": "96:iDLIXvPURWQZsQPURUPPU3U8edIPPUoiPmnR/j05gGuqWRRKF5omdTUIDAKHomdd:igPF7d4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652277920, "uuid": "deccdced-d884-4cb8-9338-aa86536db24f", "value": 26115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652277920, "uuid": "c29efd2a-3982-4461-a421-390012c66ce0", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652277920, "uuid": "4f027fd7-8c75-49ba-9d38-b26386db72d8", "value": "4BDAd47i.txt.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03027dc5-d10a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652260147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652260147, "uuid": "38160928-b54f-4b14-b56b-d236a3dcbdb1", "comment": "Malware payload (Formbook)", "value": "f4107079aba88ff0b058e8d827126625", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652260147, "uuid": "60cbb328-9fec-454b-a234-094bb9e3998e", "comment": "Malware payload (Formbook)", "value": "9b0a4dba4956bc341c94844a39cabed66757532bcdbc38de6fe0c2fc9a366482", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652260147, "uuid": "dfe81b38-174a-4b9d-980b-787dc3c1963f", "comment": "Malware payload (Formbook)", "value": "3b567f4a93b1f3f225dcce4366d5eafe8908eee4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652260147, "uuid": "67ce906f-a5db-4d84-8035-6c2f22ba3815", "comment": "Malware payload (Formbook)", "value": "2bafb1e286703922f510e792ad7e09461e4cd915dc6787121e6bf3dafee905df658c0e392605d24fb3802d8e2a2a55f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652260147, "uuid": "9867fa22-4b65-48e6-8a38-000f78f451c9", "value": "T194F48E9B7F846D64C1BD6A70966C31B4C3F050DF5BA9935F0882B1E86B363C97B806D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652260147, "uuid": "e84208a7-83f8-4b5f-8581-06fd3da66cc6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652260147, "uuid": "a160f2f3-ad52-4ca0-9b55-4b9eb49fa33b", "value": "6144:wMjdR7RRWXKiIHHmzTqyrei4ZC7rY1Znck9sesTzOI9za2X23y7WtxykKMOgvTRQ:9KaiyHIGAe7ZO87t9MO0tXs5TRkOn92", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652260147, "uuid": "c2ff74e7-9fdd-4412-b0cf-58d24010395a", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652260147, "uuid": "bd310202-4385-408e-93b1-fdc121677623", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652260147, "uuid": "b42b6131-f990-4411-8937-cf5aab3a633e", "value": "Se ataseaza factura proforma.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "065c55b9-d123-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652270890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652270890, "uuid": "478cd3d2-f46c-4f94-8c70-59e63d2720dd", "comment": "Malware payload (AgentTesla)", "value": "a77c9b16d6e742433f8a486eaa4765a9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652270890, "uuid": "f9bc9194-a8af-4be1-b40e-20806379d962", "comment": "Malware payload (AgentTesla)", "value": "9b21279d670a2a913f21102ad527f94a180f6569f773e5328513899d9ec366a6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652270890, "uuid": "1e0b6fae-7cef-4e69-a36a-b00809ec495a", "comment": "Malware payload (AgentTesla)", "value": "d67e5c69d594858bad85a1292953d4eff9a037ae", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652270890, "uuid": "4f0d4725-953f-453b-b3f6-ecdec44602ef", "comment": "Malware payload (AgentTesla)", "value": "08589d74a04c907252087303c8146c8e55f7d5e3c77367f74b2e1f6b14bb13b56d8a1ce0b5094004e86601e6bb4ff5e1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652270890, "uuid": "fe06536d-53cd-4f79-9245-1a215c38250c", "value": "T1B1E4121523F89A21D9BF1FB9607A31066FB9BD49B436D70D5FC4288D1A673920B113B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652270890, "uuid": "d24cd679-1ace-4774-b0fc-0769b5957de9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652270890, "uuid": "e3456145-c564-4e6c-aadc-0cd56ee3e811", "value": "12288:cpip6Zc+3xC5LHdhZXLVVRlICFWSPA8iqa3bS+LjrYd4OOp:ckehC1dhfAPnLjr7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652270890, "uuid": "b5c1f8cc-ecc4-40f8-be43-e3836f38e0d8", "value": 686080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652270890, "uuid": "04442246-1127-4f83-b732-dbf01dc0682c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652270890, "uuid": "0e5d8f5b-4818-4e81-b701-295a16398bda", "value": "Swift Transfer Copy_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1351317-d14d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652289188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289188, "uuid": "d3ff91a9-56cf-4594-9f4b-5d5b8a36bf7b", "comment": "Malware payload (Heodo)", "value": "ddb55f3f8e7d9a0f6ba20a161dbbb5e5", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289188, "uuid": "f77b1aa3-8af5-4e2c-b455-588915819832", "comment": "Malware payload (Heodo)", "value": "9b29c669060dd03fb01ae96b0d6f1738c6a6f4c4c0380499aac5dd5d14cff0a8", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289188, "uuid": "88fb544d-871b-44f9-a85d-503846427883", "comment": "Malware payload (Heodo)", "value": "7e6ff17eef0628ab9d947f7437617db59cdd2593", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289188, "uuid": "ca0a7132-ce0b-46f1-9709-56915599716a", "comment": "Malware payload (Heodo)", "value": "927c22542a14a08dfd3f6056b8968d2d1c026e4924d00313c9931310f6d9b032c29223d85fb98c10ab4c291571c39116", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289188, "uuid": "52dbf9f2-5f78-4b3f-81e9-cd7244b3c1d9", "value": "T11DB4BF06B3A504B9E467C174C9735952E672BC121761AAFF33A0436A2F37FE06A3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289188, "uuid": "05bf3e6e-7bbc-45b7-bfb1-3109ae42826d", "value": "6196af15ce9ababd9a592319b3043ede", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289188, "uuid": "09b3bd78-1f4a-417f-b21d-e86045e6ef34", "value": "6144:iuD3jumQgXW2jLi1QPy+hSVL+ymiohakdtUPM1UlTIqNtF1FMytrf:ZDLVXW2j21QC1+yZoXtUPMg9Z1FMyB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652289188, "uuid": "56998067-ec62-4f17-ae6b-211e3ee2c959", "value": 513536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652289188, "uuid": "e8f92faa-b401-45aa-ab90-f0b880a06269", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289188, "uuid": "0f897904-5575-462c-9867-90ba2081965e", "value": "ddb55f3f8e7d9a0f6ba20a161dbbb5e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6c85780-d16b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652302163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652302163, "uuid": "4464c03f-ed00-4b2e-a7b5-029e2112ccb0", "comment": "Malware payload", "value": "d287f8f4fb316adc5651644196c77d35", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652302163, "uuid": "f03e3697-fb83-416e-b732-93742c933375", "comment": "Malware payload", "value": "9bc3ffc1b17bfc9e8a955160529467c83634fc0de5f2712070ee7255758ef000", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652302163, "uuid": "41250305-3384-4d01-b7df-ad637420acb1", "comment": "Malware payload", "value": "65a5ed58f5c102060a77ad81d15bf49b0a31c4a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652302163, "uuid": "4a624d7d-2834-47b6-bee7-e80222e8ebbf", "comment": "Malware payload", "value": "4f016ac8923ce3fe64ce593fff3e4cd62d2ed2bcae61b65a04241864f9cd4b611c08d8c596d38bd8ed30e9cf8631e1b3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652302163, "uuid": "ab6ca14c-2fd5-4806-a334-52d98b8720f1", "value": "T19B03F1EDDF982D8DF99D5C7CD5095512C9ACB2DAB0994F0C33208EC2876524F9C8A438", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652302163, "uuid": "76902a8d-000c-40f5-af23-09201bfef8eb", "value": "768:yjN0WIBompY+GJoHfNVBrr5Lrbexlk9/wD9vqifnmFB+GgEqWRPl:yjN0dBy+iiflJb79UCieuGRVl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652302163, "uuid": "c1b70ded-24c8-44d9-9ae4-72b7dce9e755", "value": 39704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652302163, "uuid": "cf43df5d-4166-4777-8271-2ae8f62541f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652302163, "uuid": "5309a8ea-c539-4606-933c-00cf78b0d00f", "value": "d287f8f4fb316adc5651644196c77d35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18d606bc-d0fb-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652253741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652253741, "uuid": "cf19e84c-8ba4-4125-8f8c-4096c3d6bf3b", "comment": "Malware payload (AgentTesla)", "value": "f8a3aff75d063652e4fe43b2408cb2d6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652253741, "uuid": "ea0ae888-b1b7-444c-b245-7a5e0abab6c2", "comment": "Malware payload (AgentTesla)", "value": "9c071afc054e8a65329317a6b449e9f4119a5546c2b3a5c2ce9bf2cb1a04a46e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652253741, "uuid": "8c144983-a425-45f0-9588-0b39d5d12654", "comment": "Malware payload (AgentTesla)", "value": "02ce76e7fcedabd270b8bb58def53a1801fc25f2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652253741, "uuid": "156808c4-c2ca-4b12-8450-dba32845a24c", "comment": "Malware payload (AgentTesla)", "value": "3c3ba0bdd5ad6fb4114285e24f538804996bd90b0f3ad690b465d04433165d2588e3546c837f6fcc5252f2a111d2dd40", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652253741, "uuid": "4763ffad-6851-4735-baff-c016f5ba73ff", "value": "T175E41204A2E8D965D5AF2F70607D60186F75B95BB936E31E4FC4988E2C53BD20C60BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652253741, "uuid": "81754877-d74b-4ed9-8187-b53d473b10cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652253741, "uuid": "ee0a0c10-524f-4ac8-b955-7e9567d9998f", "value": "12288:cpCpe2ZT5/TNH0do3hdF0LCCh+Sp2QJYksLd4zc2Y9QUzudRYFp:cYZZT5/Bwo3hd2lh+rWYksLS4p4TYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652253741, "uuid": "df6aee39-2266-4cec-b7d6-db9ef421ff0a", "value": 686080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652253741, "uuid": "264bdb30-852e-4879-aaf4-d41b95572029", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652253741, "uuid": "6d42b40e-b4c6-4bd1-8c18-59588510c0b1", "value": "doc2022051101001.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9df9a5b1-d130-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652276728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652276728, "uuid": "e0be07b8-feb7-428e-88f3-6e2d7baaf7c9", "comment": "Malware payload", "value": "80e86c1c3774adc16f412380fc085290", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652276728, "uuid": "0b5ce0a0-b659-45ca-b4f2-64555816fc51", "comment": "Malware payload", "value": "9d2ffccc41cbeaa6ab739e2efb6a71d63400eb50b44eb1984bb64a510c49ea9f", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652276728, "uuid": "63c91bc3-3f5b-4529-af49-5d232da8fccd", "comment": "Malware payload", "value": "1dbb1d27920be72d2b8ed30351e98715dd57d230", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652276728, "uuid": "27a18a87-dcb4-4216-aab7-218d2cd27a6b", "comment": "Malware payload", "value": "005df8f618a27489d1be5f9f1c17d63eb412aae8a2d6a3b88d8153d97dc8d4affff02fa8acc544319b5ec308c92534cf", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652276728, "uuid": "acd57eb0-8f10-496f-a40d-d0ead3c1b330", "value": "T13595330A575E62D4EAE17033880B0355A5BBEF610DD30E26774CB6183B737D8EF6A425", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652276728, "uuid": "90c91cbb-7e8e-451b-a821-93e550ff1e63", "value": "49152:IRramNLH04MXjEWwe5POPyA90ck2rC5L4OuGr8OgmQBOow3Q15tPSwcE:MramNLH0Vzz5PwkECbbDgXSwH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652276728, "uuid": "68fe2382-f9a7-4092-9393-33dbbe9ca078", "value": 1968930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652276728, "uuid": "555846b5-0248-46c0-acc6-dd413ea3fa03", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652276728, "uuid": "87ff20cf-328b-4528-9c9b-5c376952285e", "value": "BNLBancaSicura.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f953242-d13e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652282663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282663, "uuid": "e2484ce7-dd67-435e-a225-ccd7b7583346", "comment": "Malware payload", "value": "1a6844f277d8e75451c5fbdf17b7d422", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282663, "uuid": "bae67a5b-3101-4835-9b45-bb39869f7162", "comment": "Malware payload", "value": "9ddffabe86591524e53fa9b6e70a33dd9730bcaed415fac35f98d05772624cc4", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282663, "uuid": "614c0418-9461-4928-bbf5-6f7651b57012", "comment": "Malware payload", "value": "d00e81d7765b3b81e9538532fff49c2071427b63", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282663, "uuid": "130e90f2-d4f6-440a-a7a2-dc0b699c28b5", "comment": "Malware payload", "value": "9c6d26e85d4509f30d8a154bb10145d70596393d23b983c30f4ed783c3a1d8cb2d5ed2d9a018de695a88724418e38e98", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652282663, "uuid": "9ed0bcc1-9905-48e6-94f4-cbd32c5c6c8c", "value": "T169940019CA1D9E77DA42C13868BDE711AF051801313A4F4726BC7DEAFBE2D84B89478D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652282663, "uuid": "684051c3-784d-4064-a6c3-24ecdc9c9226", "value": "12288:OuBBljJG1SFFwXxvdya7fp+sCDtnUQB9BvQMvSduK/x02FoQVBDu+RYAH0:ZljJG1Nxoup+sC1dvQGSdRx0a2A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652282663, "uuid": "c3586d93-98b5-4b39-a9f0-b8acefa1424b", "value": 428544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652282663, "uuid": "823f7d5e-3f48-4b87-8f1a-cbce595b00e3", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652282663, "uuid": "a8c8f3c9-3960-471b-9007-47fdf30396f3", "value": "Park Edge_RR Detail_5.10.2022.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68414f29-d13f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652283080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283080, "uuid": "69e6b169-d33c-44c3-a7cd-d282b2f3a4fc", "comment": "Malware payload (Mirai)", "value": "4a6ab681b9d633a13f4900e17731925d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283080, "uuid": "bbd39709-3c8e-484b-98e4-695f72483788", "comment": "Malware payload (Mirai)", "value": "9e08e613e2caba001e3d71b3ecd239ada726ea4c1e87940dd615463e6f90e3d8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283080, "uuid": "50764f65-6882-4c02-a417-b8e981a8b8c3", "comment": "Malware payload (Mirai)", "value": "f9d77e7c17224e3a0cc8324d8b1cef6e7465f659", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283080, "uuid": "34fb54f5-30bf-49d5-9af1-1b4fa5bc1224", "comment": "Malware payload (Mirai)", "value": "0ed92adbefba7b3bfbcacc9a150428c1905cbd663a300f3a3ccba84f81e853a74fc5668ab023b59ef8eb839033362dc6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283080, "uuid": "04b03348-67ae-4138-9c9d-2ed276caa521", "value": "T1F9530A817C91AA29C7D057BBFAAF108E3354A7D9D0DBB347CC040B917AC694B0D67B86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283080, "uuid": "b43f9d3a-0b50-4e18-bc68-101a622a4a1f", "value": "1536:dOxGlZ2yn3chsbacWiXW6M9l/yTBplu4Egjp8h9y20Yv6k6YceZWGzDhMH:dOxWZb3WzXX0Q6kVcwLaH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652283080, "uuid": "f488c471-fb71-40ad-873e-a6f2b229e7ba", "value": 62680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652283080, "uuid": "41362bdd-51ea-4215-868b-0de1c4caaabc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283080, "uuid": "1ffe0cbc-d326-4065-a67e-0ffdcdf8dbaa", "value": "4a6ab681b9d633a13f4900e17731925d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5229a4f9-d17e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Vjw0rm)", "timestamp": 1652310101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652310101, "uuid": "28fb079c-43b3-4245-8e84-d6745103834e", "comment": "Malware payload (Vjw0rm)", "value": "40ab4af039be9b1c4e650ce7f9d7ddea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652310101, "uuid": "a84dcda0-ef5b-4eca-a457-52a0c743bef8", "comment": "Malware payload (Vjw0rm)", "value": "9e3d8b92dd0a7f6d79d37a99d0a03f6349f64d2ce0f480b96f0b5d8c21517f78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652310101, "uuid": "1ee0f3c7-c277-4fed-99ae-80afdc3eeb5d", "comment": "Malware payload (Vjw0rm)", "value": "6c2d4eee3b9804bc0dd9db61838f8e1aeefa55a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652310101, "uuid": "f5741ae0-bf2a-4401-8bcd-472fb46cee84", "comment": "Malware payload (Vjw0rm)", "value": "18a2ae685752298dca50935fa4a99be4bedca25eea122944d7ab3d46520036b213a1c314be7ad4e4e9b9b8c1648c5798", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652310101, "uuid": "7576d446-67d1-4d81-8a58-c9996cfa8091", "value": "T1A6960226B391C1B2DA6342B1C5A1C232A939BC21072BDDDB22D05D2FFFB26D15A3571D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652310101, "uuid": "f7553fe3-5f8a-4108-b851-3268ce77bfbe", "value": "46978de0f8944a65af1673d613222a98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652310101, "uuid": "496b1b7a-b024-4833-95b9-1b5853eb0280", "value": "196608:+8AaYcoawAou0tbuu2UrisN2IjZannQ51Z:+gAawq0Awrt2GgQ51Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652310101, "uuid": "6b83a510-a9b2-4ca5-8dd1-230f37d6e83e", "value": 9256960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652310101, "uuid": "1e980431-b714-46b0-abc3-1e362bc51af1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652310101, "uuid": "ef537c11-4c7c-4480-86e0-2bcf70ae677e", "value": "9E3D8B92DD0A7F6D79D37A99D0A03F6349F64D2CE0F48.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffe417ca-d138-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652280328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652280328, "uuid": "00cf49ff-d252-469a-89af-13990ce599c8", "comment": "Malware payload", "value": "eedab17b6560931f9a221796b16b8136", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652280328, "uuid": "1ede92b5-0f31-4c23-b91e-3ddbda991189", "comment": "Malware payload", "value": "9fb5d31aeaa01821051d16982d973aa40b6f0e6296e1ce0d1e34abf62e069275", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652280328, "uuid": "eff25442-e43f-4d14-9056-c91788eb6c1a", "comment": "Malware payload", "value": "f14889f75db6d419b071812a1c2497af2b8537b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652280328, "uuid": "279fa789-1fcc-4114-8035-151eead42f6b", "comment": "Malware payload", "value": "950736f4d673b8002c9885c0fc3644e3e249e91ca561fe1e67340865390d1bc1b3e934a7fd7246b6c4ed1dd6ee59a04c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652280328, "uuid": "ee9a7b1a-68c6-4f47-8418-85bd5c00d644", "value": "T160C50810B3A11108F9F7ABFE66F54660887E7CC15F2C96DF488546DACA296E47C307A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652280328, "uuid": "63583a6e-91e3-42a6-8819-d4d5eef18ec4", "value": "12288:DBNY9EHIC3YuSlBEk9PdX9mxkAzLfOfaa/iiRuuoksNR96g+xCJjCIi6sBTaFLl+:1iL7M96g+xCJjCImB9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652280328, "uuid": "beac8dc3-f70b-46df-ae43-cfef0cf7b385", "value": 2613248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652280328, "uuid": "da529924-4e62-4283-97c8-e5eaba7a8afa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652280328, "uuid": "a5fc25d5-d38e-4b15-a473-f0777eb76f16", "value": "SecuriteInfo.com.Win32.Evo-genSusp.7384.12841", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c74b178c-d14e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652289682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289682, "uuid": "b0a3b45d-55b3-4efc-890a-447ac4cf2fe1", "comment": "Malware payload", "value": "e3aec59cfad2bd8901c9749476b77b64", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289682, "uuid": "ab0be8a0-dea3-4e11-97c5-b36ff56b0501", "comment": "Malware payload", "value": "a0607325843ae7fd929bf412a2e2fd5f55eb387eaf1ad309a57c4149aa5b0a90", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289682, "uuid": "5d81e5af-496d-406f-bb32-15d0e05f9a86", "comment": "Malware payload", "value": "24d1e0a09e7090fafd3efec418c58cdae711440e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289682, "uuid": "eb9b9aff-747d-4bbe-a889-d09531366a7e", "comment": "Malware payload", "value": "778bd0e2d22c513fb2246e9de28fd68989e4d65a0ec4de4f7d2b186534780409a5db3bc936d450222d00212b06338315", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289682, "uuid": "f1b29afb-f5a9-46fb-9b4d-489dac865f18", "value": "T17DF2E132F1C91DD1EAEB8AE05CB5DBC03FF4D69522D385E1D5C29F04E6225727504AC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289682, "uuid": "c74ad7dc-38d8-4c40-b7b4-65faf324d464", "value": "768:L5nGGh+LqlSQxpnzptaFDv2cQGzDTkEnUFHUEJsu54uVcqgw02NWXy:BGGeuSapzHGDv2+zDwGMUY4u+qgw06Wi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652289682, "uuid": "ee6a2422-9c09-4199-b114-a8b8f11ddd96", "value": 36512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652289682, "uuid": "c718a834-1f81-42db-9024-9b888331ce00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289682, "uuid": "68eac80c-210d-40d3-8779-f74b3a6494e4", "value": "e3aec59cfad2bd8901c9749476b77b64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dc81645-d126-11ec-8e58-42010a9c0032", "comment": "Malware payload (AsyncRAT)", "timestamp": 1652272244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652272244, "uuid": "c48a6b45-bb74-40ae-8fba-0929d850f58e", "comment": "Malware payload (AsyncRAT)", "value": "89bcb51ba7ebc4102c67b7046d2c642e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "latamhotel", "colour": "#4B0DE7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652272244, "uuid": "688c6970-9971-4ef1-a293-0e96570bcf59", "comment": "Malware payload (AsyncRAT)", "value": "a276dff534de2b72c38b63a7ef277fb0d5744b8bf7dce88a98631b4d6dc8813a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "latamhotel", "colour": "#4B0DE7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652272244, "uuid": "4fb68bbb-55d1-498e-ba8a-07161c05aab2", "comment": "Malware payload (AsyncRAT)", "value": "ec28c9df00a683bc6df238e0dc978f7b6b45e3e9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "latamhotel", "colour": "#4B0DE7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652272244, "uuid": "cd42d06a-7d60-444e-97c3-423b2abf01db", "comment": "Malware payload (AsyncRAT)", "value": "21c68a2a187a222342b33b28cff5979194c481583493f86a7c203e6bc727e2a1e63419ea798f250dfdd31168b0f23139", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "latamhotel", "colour": "#4B0DE7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652272244, "uuid": "ea267f2b-df81-4f0f-a912-32b77d348648", "value": "T1239484A6A066C88AFE4BDB41A2BCFFA525F1B1F355C41920233C6144CFE9F562E8C45D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652272244, "uuid": "4c722890-280d-48f9-a9e7-eabdec6ad5c3", "value": "6144:4Fn1FEsD92bMDsA4nxY3yraMcmzDNX3ApT92bMDsA4nxK:41D98MDv3yraR98MDX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652272244, "uuid": "a8e55756-8668-4353-bcaf-05397475b6a4", "value": 429096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652272244, "uuid": "ff9392a2-ac8a-403b-a417-82a6f3d16c41", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652272244, "uuid": "acb4c973-4630-433f-84eb-150d15553809", "value": "latam5.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8db0e12-d142-11ec-8e58-42010a9c0032", "comment": "Malware payload (Sodinokibi)", "timestamp": 1652284477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652284477, "uuid": "7734b22c-5870-4fab-a28d-54bfd6297ca2", "comment": "Malware payload (Sodinokibi)", "value": "a055246b0e804eb3a1dda52937f556ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652284477, "uuid": "62237f54-d800-4e83-905a-f24c8d326c34", "comment": "Malware payload (Sodinokibi)", "value": "a29f63484f53d2cf832b2bc70d6b66378b87b86221f885d0f43166503d631ef3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652284477, "uuid": "9eddd12c-ed4f-4c84-9185-31a5d98470a7", "comment": "Malware payload (Sodinokibi)", "value": "6807425e1252f1154664fc8072dde03558ed35fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652284477, "uuid": "b47febb6-bfd4-4b78-90bc-41041798b9f9", "comment": "Malware payload (Sodinokibi)", "value": "f5e15a6579ac11f0c1568a77b23e05a237d63afe4c71d2c5daa9dc0d78bbb689bbc39da2aef440502822da1cc94078ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652284477, "uuid": "c44217e1-0bfd-4c2a-8fea-5a48628c8ef9", "value": "T163F3F126E86182B3C8A781F3033B7F1BDB7DFE3485556866977149442F750A2E323693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652284477, "uuid": "ca894855-29a6-4af3-98c1-2694011efacd", "value": "7ecacfc6f1d64067e0047425ad885408", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652284477, "uuid": "ab8b3e6a-3eed-4ec8-84f3-726a326aaa20", "value": "3072:1LFrb30BRtBZZg+i2ayy2RjLTuVyu7CJDgoMT3Q/5iK9kPV/0:ZJ0BXScFy2RsQJ8zg/o9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652284477, "uuid": "66804375-d828-4953-b561-19a39f1b6c76", "value": 170496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652284477, "uuid": "6de8e46d-2f51-430b-b995-703c55fc9037", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652284477, "uuid": "5e0e71b4-f9c5-462f-a720-f416e1f9a609", "value": "a29f63484f53d2cf832b2bc70d6b66378b87b86221f885d0f43166503d631ef3.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbfefd73-d102-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652257075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652257075, "uuid": "ff9166c5-8cea-486b-b384-6a3e80607ac6", "comment": "Malware payload (Formbook)", "value": "c4b1f1cc91c61633e94a7952bfd4a925", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652257075, "uuid": "32527f93-0988-4f42-903a-5b371dd2f355", "comment": "Malware payload (Formbook)", "value": "a580ab61d55ab77a9c8cc5cf6b548b3c0c7a0a7ad1dc081ec5e90f37066d1445", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652257075, "uuid": "9b7a2030-2152-44a6-abfa-44d780a22d10", "comment": "Malware payload (Formbook)", "value": "e3d5973e19c416eb25e9b5520c906f957347bbaf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652257075, "uuid": "05a649c1-d9a4-497e-ad13-04510643e6c6", "comment": "Malware payload (Formbook)", "value": "d34d8bec1d438d88070957f221c60ce9fdde4675dc0b18ca705f320f14ac0ba49dab7b5e22a33adfe62575878cdd2889", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652257075, "uuid": "56bdf98b-cdd4-4538-a160-c8990d4b19a0", "value": "T1C4D4120522E8EB71D1BF3F74647930185FB8BD6AB43BE32D4EC0688D29567A149247B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652257075, "uuid": "580b38fb-d29f-441f-ad2d-1d3de4d34c19", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652257075, "uuid": "3c8846d2-fd01-4f72-af63-6eb07281d69e", "value": "12288:Dp9pzJd100USIS3IQNyvYp7O7ydKgtPUwWIya402jwTKVZ4p:DTz483IQ0oKyUgNU502jVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652257075, "uuid": "e31f5f6d-5e31-4189-8ea6-38887304afe3", "value": 655360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652257075, "uuid": "5c69da57-3bfc-423e-a9f2-02030d71a35b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652257075, "uuid": "83cec9ad-62fc-43ea-bd7f-bbecbb358012", "value": "Proforma invoice 416484 Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f746cd9-d10f-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652262557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652262557, "uuid": "0c36c33f-8e75-45b0-9816-b60bc03974a4", "comment": "Malware payload", "value": "0103d36de2702e7249ee2bf5a7e3bd52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652262557, "uuid": "848b3242-e7d9-4527-ab64-5f32cedf854a", "comment": "Malware payload", "value": "a62827d89a7c64c0a93f419fc55a00f70c95759bbf39edeb9a5e7ab60b524914", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652262557, "uuid": "90ecabb3-ed2c-4e3a-9a6b-0ad579140a2f", "comment": "Malware payload", "value": "1b5e3d19495e46ae92169398d01176cd3b59b894", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652262557, "uuid": "227509aa-6ddb-40dc-b986-e90b9ae23871", "comment": "Malware payload", "value": "9f1d93ebbafd98e3171296b4d519b8f660b85ede7fb8cb379bba879913c6e6367650155062058260fc5c133ee852e955", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652262557, "uuid": "d4597d77-0a47-45e8-b258-c16e831815db", "value": "T1C8759C057E70416BC91E36B38D12CF927CBD6C98EE2D6D86F26A1507C77C360A91AE43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652262557, "uuid": "fd7c27ff-a746-44bb-b795-aededf402507", "value": "b4070734502a100c8f90bbd445995533", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652262557, "uuid": "e5c14844-b9bd-4b27-8bda-7ef16841a284", "value": "49152:4u4miow9L9XSbO72ZQki+EWOK5GHile0kd:4u4HL4Za+x5GHiIxd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652262557, "uuid": "fbaed188-ee52-4362-bb06-353be020056b", "value": 1672249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652262557, "uuid": "3f5a56da-8b2c-4838-8d22-7faa415c3e90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652262557, "uuid": "83578514-9869-40a9-8273-4a621c1bb0da", "value": "SecuriteInfo.com.Trojan.Ciusky.Gen.6.28782.16819", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0ef521d-d113-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652264277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652264277, "uuid": "faf5f7ff-1a65-42a2-8b07-4609661e2357", "comment": "Malware payload (AgentTesla)", "value": "967fa2410f808f191f1747accd027d09", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652264277, "uuid": "50d073e8-bd72-4ddc-9f93-083303500b16", "comment": "Malware payload (AgentTesla)", "value": "a69f86945f7f8ef58c13736fe00c632a0bbb38807b9e3f5722e3de01b7ab0464", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652264277, "uuid": "cba1994d-633d-4b3c-a562-b601963ba6d7", "comment": "Malware payload (AgentTesla)", "value": "7afb8bd9e26f2b1a6c3ea47245a028391d32fd36", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652264277, "uuid": "8874d03b-6907-487f-bcda-b13d90df0ccb", "comment": "Malware payload (AgentTesla)", "value": "20d346c5d2242566c2138eb3397edf42c7abafbc9a1aa22d4f607770219e51c57c66d22b7ff27efa09b9fdb8a7f1dfc5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652264277, "uuid": "7bcf9f02-6ced-403d-8d4e-67ba1ae4d5ca", "value": "T199E4120DB6EBD911E27E2F36C4F551240775BE099573D30E3A88130E9E4378A4A91BEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652264277, "uuid": "3fd17c1f-dd28-4c56-b75f-eb57a459670f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652264277, "uuid": "2fd3b888-14e9-4f09-80dc-5f945d737fbf", "value": "12288:ICdygpSp15SsHmq/fmCo/yMzWwWhDty3BSPkCofLCArCPmNm2Sn8tizap:ICdyg4xRHlquwGtkMPeLCA2ON2a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652264277, "uuid": "dd851a50-8152-49e7-9ef3-6e85f4b5567f", "value": 710144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652264277, "uuid": "b58d6286-bb82-4704-b8ab-102b4764589a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652264277, "uuid": "c2574d3f-e768-41a8-b0ba-31ecfa624e69", "value": "Bank Details & Civil ID.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d054d2c5-d16b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652302152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652302152, "uuid": "2513406c-cacd-4713-a0c1-4a7c393ba45f", "comment": "Malware payload", "value": "59144144cb595d73aac48c1bfaacd4df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652302152, "uuid": "312f94c5-f15a-4a56-8c19-bef916bab08b", "comment": "Malware payload", "value": "a6a5af6c43cf2ca9d8f09ce7549daeb38d7359e93906d411da399251598a4cf1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652302152, "uuid": "9afc04ce-2895-4730-95a0-8b67abd8221a", "comment": "Malware payload", "value": "deab92a419c5e3bd4f66043cec2b0e36182ca443", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652302152, "uuid": "72414a0a-70fb-4679-a97b-0fc928f6f86e", "comment": "Malware payload", "value": "c45b7a6e1de8e7fa82c693d3d71161071b7c096b97c824bdf60aad8030f3437da044a94f1c9a879fd40ddbcede546909", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652302152, "uuid": "0c4a6f88-b650-47e0-a127-8cbb7abf8671", "value": "T161F2E030F2E58D70F7BB17B199966AE8B2E00B9E6B72432161411DDC7013922B759DCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652302152, "uuid": "87af3f59-a6f8-458b-a6cf-9ccdfc3baef2", "value": "768:tW45WD6JjGlwKSAA7cCa3L3AKOsZFFjRa8vRzB/v4uVcqgw02NWX1:1VgHSD7cZ7QKXJjRai/v4u+qgw06WX1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652302152, "uuid": "598a85a2-2ed2-4854-a797-9553fde64098", "value": 36712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652302152, "uuid": "96ab4c60-9299-4b04-8f92-54a3565c9def", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652302152, "uuid": "55c69d22-8525-4ba5-b22a-ad0df5c83fbd", "value": "59144144cb595d73aac48c1bfaacd4df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73a3126d-d156-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652292977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652292977, "uuid": "476fdc9c-14fa-4383-9ce4-d6ac8fd81506", "comment": "Malware payload (Heodo)", "value": "e90ea3420ce31d55831a5156bd948ea4", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652292977, "uuid": "2a375bf9-47ec-464e-846c-920d2da07e5d", "comment": "Malware payload (Heodo)", "value": "a6ebb13cb88d225021a2e7fde73743f61d8f9180005d03c462aa8b411998b1d5", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652292977, "uuid": "1e1e4e81-45a8-494d-8e6c-b6a6cbbd2189", "comment": "Malware payload (Heodo)", "value": "7fedf9b5143168d53dfeab8ab5627007e8f1ebf8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652292977, "uuid": "859dddaf-96d3-4677-b08c-f856be3257d7", "comment": "Malware payload (Heodo)", "value": "9222238b459111763fb225e3930782b02df6c6adcbdfb61ae4f46930841c541270b4598ab199483f9e7813a456a6a3f5", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652292977, "uuid": "d7c9f09c-b4e4-4555-9a63-d28e3041d5a9", "value": "T1B1B4BF06B3A504B9E467C174C9735952E672BC121761AAFF33A0436A2F37FE06A3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652292977, "uuid": "223e1323-f784-4b2e-a499-af954476d05f", "value": "6196af15ce9ababd9a592319b3043ede", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652292977, "uuid": "05a62ee4-1066-46bf-a48f-88f25da99cf4", "value": "6144:iuD3jumQgXW2jLi1QPy+hSVL+ymiohaGdtUPM1UlTIqNtF1FMytrf:ZDLVXW2j21QC1+yZoBtUPMg9Z1FMyB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652292977, "uuid": "c0ab1d90-5736-44c3-9a59-7dd37af278d1", "value": 513536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652292977, "uuid": "f449b380-20db-498f-a2a5-94b64718105c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652292977, "uuid": "0eb4dd33-6271-4d30-8255-8c11fcbb161c", "value": "e90ea3420ce31d55831a5156bd948ea4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f957639b-d105-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1652258412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652258412, "uuid": "8315179f-6196-4c96-beb0-4501962b3861", "comment": "Malware payload (RemcosRAT)", "value": "c066db4cc73fe84f8464de992655009a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652258412, "uuid": "86515223-e9f7-400b-bf7c-39b838572714", "comment": "Malware payload (RemcosRAT)", "value": "a9cd42a2017d8f8c79cff1d088c9a54e9dfa5c5ac4c55d300e37f485b5a6217c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652258412, "uuid": "e106dcda-0968-4cf8-a121-8ce796d06269", "comment": "Malware payload (RemcosRAT)", "value": "45884d4325bd73956d33db23f8112558ff1aca60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652258412, "uuid": "180b1089-ea2e-47d2-bb09-351bbf079f86", "comment": "Malware payload (RemcosRAT)", "value": "9c2aff388e852d4d1b1009e991c688ae98a2f50e4c0c01d0faeeb759b451f03a4d33699aec327335138dd0a7e5da75dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652258412, "uuid": "2e8dbcb1-920c-4b35-9cb7-b90f6bb9af93", "value": "T1E7356B62B2E1D436C43256784C067EB55BB6BD10ED74A846AAECECCC5B34ED13B26343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652258412, "uuid": "13a387ca-1e0d-44ae-a6aa-56e9f1ced1c7", "value": "a394cc215dbb58f1799a34551bb75374", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652258412, "uuid": "9d8ba911-85f7-4518-8599-d8b4979bbe89", "value": "24576:pECA5PKKupbJhqEIZzymVDJvwJGlllllllllllllllllllllllllllllllllllld:p7/KFv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652258412, "uuid": "18d2d58b-1b6d-44a1-b7d0-e2fe6dcbfaae", "value": 1146368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652258412, "uuid": "629a8dba-6178-4a6f-9a70-b0b114826bb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652258412, "uuid": "1b4f48aa-52b7-4032-aca6-946e5d1fdff8", "value": "SecuriteInfo.com.Variant.Zusy.423667.18777.4688", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac22e27e-d113-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652264296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652264296, "uuid": "6da01620-386a-439f-8de8-6219031c75fe", "comment": "Malware payload", "value": "d9f480ea34558b8aec75d5672f943f16", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652264296, "uuid": "ca7f79e5-ae27-45d4-804a-9b7b9b5d9705", "comment": "Malware payload", "value": "aa0aca6a8e2ed81c16579e51c08af59d2eafe8fefce1734f9c9200e4d3d78d39", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652264296, "uuid": "57478f15-2654-4666-be93-96e9fc58bb69", "comment": "Malware payload", "value": "e440e849c13a3f2d03f19a736a40839b174b681c", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652264296, "uuid": "49c3bf1a-df86-48d3-9f4b-29898bddbecd", "comment": "Malware payload", "value": "cfad146016ae904240b201b8224d7073b5ab3d19e3b784f01f934892db4fefed320226187387db7ac82a5ddd25f9cb14", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652264296, "uuid": "0474502f-93a4-4193-b40f-00d1e039e903", "value": "T1C204172733584009C4D8B1385D9F87A14390FDEA4E25B31E6392A61B6FF5EF67F05A0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652264296, "uuid": "6b0d09fe-2ad1-43d6-8601-1af5646bbdbb", "value": "3072:bz7oQFZzjleSZSSE1bVSWjkaCkDA0zoGs8Wci/Ntq/O7XhCKe:1D3lesW4SCNDUohCKe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652264296, "uuid": "27ee0e18-dcc2-4896-bbcf-d222c1e41380", "value": 180572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652264296, "uuid": "40b5ca2e-ddba-4770-b541-eb53fe610d0a", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652264296, "uuid": "128f7d2c-373e-4f25-829b-1f8faa7966ab", "value": "updater_mcy", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de16bce9-d132-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652277694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652277694, "uuid": "024865c2-24d1-44b9-a237-04d27a44a6ed", "comment": "Malware payload", "value": "5a8ce36df466fd2af834f8f46f528301", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652277694, "uuid": "9c303a65-e8ea-4bdb-8fca-714595d3e01d", "comment": "Malware payload", "value": "aa1923df4763a68e45d0b277c7524755354d83d4c6c228eee92a1ac1de76438a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652277694, "uuid": "bd503bbe-874a-4f7a-af3f-77abf363ffee", "comment": "Malware payload", "value": "55eb7cde3ae2ff2f99cb86f0f73236eca4420322", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652277694, "uuid": "03b9b318-9714-4350-9a3d-df593ba87223", "comment": "Malware payload", "value": "60180e33df6b0f60533d3c7dfb3bf5ceeb34323b2f3200480f8d01d23fc7565b785a4143bf88493e1823c8ef50cb4168", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652277694, "uuid": "25b868a8-cf8e-4002-bbdb-c0b2a348e473", "value": "T14E810B69AA0C2DA5E532403AA5DBFD200191B25162DB19C576BFEB32073B2056FA5E44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652277694, "uuid": "64460b3b-1974-4c8b-8ed4-68e280b8a97b", "value": "96:NAsXUvNiR+gqwBEUpf7YjYL1kg1wP9Jpafy4SrugjL2OHZ:esXUgR7/fEjYI1SB05", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652277694, "uuid": "8554326c-951c-42c0-be3c-da6de1348eef", "value": 3971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652277694, "uuid": "1e1ed877-a5b6-4eb4-9bf6-41af0959d776", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652277694, "uuid": "d97ca1e5-4797-4343-8424-af17b8f95c39", "value": "PNOMEK_Fiyat Listesi_2022.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "932ee115-d118-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652266402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652266402, "uuid": "145220df-7c2e-4706-bbe4-f67d81727c18", "comment": "Malware payload", "value": "4aa04c5b3c7fa6ac458e4de51ae99bad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652266402, "uuid": "8177f4e4-b394-4400-9a9d-84cfee03824a", "comment": "Malware payload", "value": "aacb32e6d8717a1aa7836996f0b6388bffba81978d0d4753cc69c0c56d9beb47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652266402, "uuid": "a87c14ed-deb3-43e2-b97f-50fac29f8657", "comment": "Malware payload", "value": "f2b8ca2ccdd1d44cc41ce276a805ad83309a36ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652266402, "uuid": "ab6ccc3e-e9fc-4ca5-8679-157f8683334d", "comment": "Malware payload", "value": "726f775c0a9b7f40db6d4ffb65fd331cba4197a5e4d316d88d034c576e1f7c6d47f31f5ded32a12b712d041e395a112b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652266402, "uuid": "d997e233-f34c-4e02-95c1-c08f2a162f4e", "value": "T10E251202F9C299B2D6721E31953A6761557AB9300F20DFEFD3C04A9D9A316C0EB35B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652266402, "uuid": "98c9a337-de95-4617-9128-93f5d38f99d5", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652266402, "uuid": "e712e5c3-66c1-40e0-b085-a5609f1c99d5", "value": "24576:XhvJVJdMEc+0g55Tx7x+wK7OMrhfWwNj4nmFvNnu:n3dFrTx7xxKiCxWhnWvNnu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652266402, "uuid": "83aeb985-5ca4-4ac1-be38-c63de4810696", "value": 1033788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652266402, "uuid": "bba368ae-8d5b-4b14-ba18-2221ad4b4ad5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652266402, "uuid": "42e4f6e0-dfb6-4c15-9f1b-24e5ad99edb7", "value": "OdemeEuros.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b669ed1-d13f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652283058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283058, "uuid": "230c9bd4-e14b-420d-b3a9-b9540faad280", "comment": "Malware payload (Mirai)", "value": "2d338c7cf4480fd8e6207bf29176fcfb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283058, "uuid": "b771d0b9-5430-4799-82f7-998abf0ce985", "comment": "Malware payload (Mirai)", "value": "ab19596889c0d35cc7e9ace93515cd2a0edf6c20271bc82181e63b6d5694857a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283058, "uuid": "004adeca-224f-4285-8310-31a6bedee59c", "comment": "Malware payload (Mirai)", "value": "5d40f117b70cd28a1bd2b06e67bd4be822378f23", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283058, "uuid": "2c2eeeff-88dc-4fa4-87f5-df8f76fd7e78", "comment": "Malware payload (Mirai)", "value": "a63b67e1f8f7c5893135cdd379fa7aebfbae9b147618143cbef37b46fa0baa8d07ad60146e1773fd28c4de16200b95f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283058, "uuid": "ab62ce19-c122-4cf9-abc0-af0cf384722b", "value": "T143833A56BD918A27C6C422FBF62E528C372153E8D2DB3103AE351F6127CA52F1E37A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283058, "uuid": "d210b903-1b46-4e26-b351-514f8ee61d21", "value": "1536:1vf3R5KwmytrNhEv3x1jsy+y5B1CZpCwI5FzxnN7u19pECj15OLa6OA6a10Wh:1vfFmypNhEv3UZpoX1Nubiag", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652283058, "uuid": "abf7afca-6b2e-488b-a28b-38975f800740", "value": 88672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652283058, "uuid": "c7de6d61-b038-4a7f-b032-c362f6d94a8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283058, "uuid": "93da19d8-4401-42ca-ae72-253160ad185d", "value": "2d338c7cf4480fd8e6207bf29176fcfb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3498bb9-d17c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652309405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652309405, "uuid": "363290fb-a8c5-423a-b0f5-efe70f4c1ed9", "comment": "Malware payload (Mirai)", "value": "a0cd248d400862f11429ca059367a679", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652309405, "uuid": "d23c230f-abff-45fd-8204-1f5c6e004dc5", "comment": "Malware payload (Mirai)", "value": "abbfbd7e81de6a136dbc88a3f3f42dfac0ff7d9d8cb6bcc74130469e285cce97", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652309405, "uuid": "612adc1c-cf6f-4a86-a839-6733baf4a531", "comment": "Malware payload (Mirai)", "value": "86b95c4c710b5781e3eb4da2cb731f59afcad60f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652309405, "uuid": "f66cfc21-40e6-46fd-8fd2-3c38d0762b86", "comment": "Malware payload (Mirai)", "value": "4d76142ec837a48c4d726a0400bb88918572631128a6271414a16e227d593e8b07322228db785480f63086201132071a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652309405, "uuid": "18b85772-4ba4-4f45-a7fe-40c22a25554f", "value": "T1A9D34B46EB418B03C4D5177ABAAF42893323A754E3DB73068D186FB43F86B9E4E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652309405, "uuid": "dd362252-5710-448f-a9e3-b136fee414a0", "value": "3072:99RP//oBNo6gj7WYauPT+wvIkXMBXqNUJCNSGGr3rgM/9JeovH1Eyh:9bPHoBNohjCYvHDXMBXqNYCNSr3MM/9f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652309405, "uuid": "74d8e4c1-3427-48e8-a515-3766aaf560c8", "value": 142574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652309405, "uuid": "5f9aad85-cd0b-422e-be6f-c059699355bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652309405, "uuid": "e074edbc-5577-4ca9-82db-20512ec60c40", "value": "arm7-20220511-2250", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6e2e55e-d121-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652270407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652270407, "uuid": "614c19e5-1acc-44af-a551-ae4e86b4efa1", "comment": "Malware payload (Mirai)", "value": "c35add0719804a8bfda8eab3786d2fe1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652270407, "uuid": "6413fc06-754f-4f1c-910a-a6ea2702aa39", "comment": "Malware payload (Mirai)", "value": "acca60d4fc134996a3e429984e1a410fa2d4470f0c497454d663766e5c57431e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652270407, "uuid": "14d03b4f-36f0-4ade-ae8b-540222845c4f", "comment": "Malware payload (Mirai)", "value": "187b83156b63e043128e9056179e5d071c510012", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652270407, "uuid": "b5fa392d-11bd-40a6-9a4d-a81ed16ee1f2", "comment": "Malware payload (Mirai)", "value": "23357864f59e919b775763b27840b91699e0992ffeef117015aaadd4f350b1b116b38e30702c4f0b0f17632ba8194259", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652270407, "uuid": "43f9685d-8001-4f31-94c2-b5be7ef01ac3", "value": "T12123F8C27892AA39C3D0577BEEAF418D331497D8D1DB3357C8281B947A8A90F0D67B46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652270407, "uuid": "74e4e4e7-fd17-465f-9b5d-35a6c07b2196", "value": "768:HR7nhgvz7/a6M1yyj69CFLUEZmY89ntf2OfFGv3kNmekTtk7wCVy/rCxHghW1/K7:VhgHLM1oBY89zGv3kNmekpfhWE5kS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652270407, "uuid": "f542cc3b-c250-4c0f-b11a-9e9d6f5bb5a9", "value": 48792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652270407, "uuid": "54a2882a-a71a-4119-b56f-2ca0b1b13cf0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652270407, "uuid": "48c12bc5-8bc5-4912-b221-4848bf1d62b7", "value": "Owari.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e1ffb8a-d0f5-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652251361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652251361, "uuid": "ded42d43-e406-4c06-9b62-bfb71e5b5c21", "comment": "Malware payload", "value": "7f7d3c22b039e4b8471701d346821103", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652251361, "uuid": "fb03a7ae-5a31-4478-a675-fff132f03653", "comment": "Malware payload", "value": "ad547ada764c79f4ff452365224261afdec9b5f8acc4d3428025c47270030191", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652251361, "uuid": "2a0c913a-6e41-4fe6-82e6-c47b91de4bb9", "comment": "Malware payload", "value": "6403ef9022e67e0e387a5bd5b290bace35dbe094", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652251361, "uuid": "90db4165-74f9-4c11-9f1d-733b48c879f3", "comment": "Malware payload", "value": "704f1ba58f32d95f9a80cf73ac0b763a27693a902b6206d449b8f19765306160fa8fe06cc47403f8c9ea32b25f3ed9f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652251361, "uuid": "efd23b8f-2fdf-4646-aa7f-a47686e5effc", "value": "T13382D0C5BA40EEA5F54058B36C2C82BC899BF75E07A72031CCD5BD4DC74A4A6149F3C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652251361, "uuid": "9b386f90-2594-471f-b60e-259e4955d06e", "value": "384:flzEBkDOvTCZuQEkymy/Gf+3pK9pGr39KKD6sq+GJ4kjNB2:pwkyTc9pHiGJ7C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652251361, "uuid": "70e9af81-130b-4b73-b527-587b9d863ba7", "value": 18564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652251361, "uuid": "801e89cb-eb0b-4dd9-af53-c66948372185", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652251361, "uuid": "011e239d-880c-4284-acd4-90c8adb4753c", "value": "SecuriteInfo.com.Linux.Siggen.4218.23867.10367", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f162a96e-d0be-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652227905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652227905, "uuid": "a9227601-17f8-4a8b-9a4d-7d3dc477b8d3", "comment": "Malware payload", "value": "0f33ba327a6674b6e2103d0f1989a2b4", "object_relation": "md5", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Webshells", "colour": "#85492B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652227905, "uuid": "e4128451-4c9c-4196-a59b-a7a4d28e6804", "comment": "Malware payload", "value": "ad6d44c70f83431bedf890967f2da0607c9b1f79591fb1b2697160f5b1c1a75c", "object_relation": "sha256", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Webshells", "colour": "#85492B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652227905, "uuid": "d6a7471c-8e09-4926-95fe-53f158b7c216", "comment": "Malware payload", "value": "eb9e5466833c3a5e771e917491fea0bea2f3af2d", "object_relation": "sha1", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Webshells", "colour": "#85492B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652227905, "uuid": "6c1dda1e-4e06-4427-877d-a17c277dab9a", "comment": "Malware payload", "value": "1ecbc0a325ab8140482e18bf4c64d926e3d3684753cec053ef7989a7ddd8426d9658f3587f3a00f2481e1bfdd7688c60", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Webshells", "colour": "#85492B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652227905, "uuid": "a3caaa40-f20e-41d8-ad0a-1fb36f1bdc90", "value": "T1CB115080741F69E2D5424DB85CDBB528E0C717F090D6ED0C146EB0E882CDE5E287EB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652227905, "uuid": "05173500-0fe8-4e69-8a26-42b5728f758f", "value": "12:+ZBkI8/C0p8/CBJJ8/CW+LC0MVu8bVCoNoAO8bVCBJINoAO8bVCuNoA3WC0MVINC:jI8/5p8/e8/OL6Vu8bV28bVa8bVS6V7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652227905, "uuid": "fe71338f-f11c-471e-8757-3e7349c95b13", "value": 910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652227905, "uuid": "4d90357a-3576-49eb-a5e5-573d28d4994f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652227905, "uuid": "788bcc4b-defd-4466-bda6-ae83a9a85145", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc15787a-d11c-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1652268242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652268242, "uuid": "43ca4ac4-82f3-4a22-8d2b-3589da546d9f", "comment": "Malware payload (RemcosRAT)", "value": "08e9247eb0fe99e7234bef53b9b3d7e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652268242, "uuid": "e82baa57-cd60-465b-b4c3-e9bbdf77c09d", "comment": "Malware payload (RemcosRAT)", "value": "af29d510ddce0ac43c2eafa794d8ff147b4da2917c7f2fad0a770e376d6ce4cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652268242, "uuid": "9eafe2c0-9668-4be3-91ae-c8541066d1a2", "comment": "Malware payload (RemcosRAT)", "value": "d55cb02313727444569c213fa0d8b173c9b35d2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652268242, "uuid": "2587c09c-0fcc-491e-b806-3c46f630d91e", "comment": "Malware payload (RemcosRAT)", "value": "59b7cf86d53b5fb50789e7593241ec1fbd5bf6337c8fd90585679bbfe4701d55845794abb52e70ed13fab04ad025e5bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652268242, "uuid": "66e4d79a-b9e3-4c76-aac2-ccae798606d7", "value": "T1F0D4120035E8F4A3D5961576DEBA87FA47EAFD52E8211E132340BF69BD32D10F81B246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652268242, "uuid": "4e5a46dc-dbe8-4b02-8913-61a1b0e9b37f", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652268242, "uuid": "72e70c36-de39-4869-b598-56578fc5fa30", "value": "12288:POdJmd2dntOCa0rCT193uAYUZAy84ph4W1YsMXms2WQLS1A:PODhdwCieV9CXigLS1A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652268242, "uuid": "4f303361-9e3b-47c7-b900-8f5fd012afc1", "value": 618564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652268242, "uuid": "22e46382-297c-4838-8b1f-3fe259a6637a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652268242, "uuid": "2795b61a-087e-4815-be91-056400caf00d", "value": "Quote order#098799.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a68175a-d14e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652289445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289445, "uuid": "6512bc51-4ea7-493b-a842-ae857825f756", "comment": "Malware payload (Heodo)", "value": "424eb6e1075b31fa83932e636d2c3d40", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289445, "uuid": "942085d7-7746-42c7-8784-c4a855d24af7", "comment": "Malware payload (Heodo)", "value": "b0b1b98aed9282d972e9b072a76f3d8fa5e6d51626595b7b1a1b7694737e19a4", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289445, "uuid": "46f252bd-9e06-489e-95fd-a106ad80592c", "comment": "Malware payload (Heodo)", "value": "a818afee9c652a7548c8221518f371a8efda4f43", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289445, "uuid": "7a7d92b9-d4b7-44f9-b661-dc0feb88e95b", "comment": "Malware payload (Heodo)", "value": "9b0d92cb3ee5c15a1c9483c9f53c2560136997af3b75861b45a70ba5cfda89bbe8f569c9d25a450adb2af85bb32d80ef", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289445, "uuid": "a09fdc4d-0bbd-427e-8a98-ce8a0d6b9a66", "value": "T145B4BF06B3A504B9E467C174C9735952E672BC121761AAFF33A0436A2F37FE06A3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289445, "uuid": "af8c0a52-b9b3-4a7b-90e7-4d6e15bcdf3a", "value": "6196af15ce9ababd9a592319b3043ede", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289445, "uuid": "821cf18b-e0fd-4714-98de-d52d6eb02a73", "value": "6144:iuD3jumQgXW2jLi1QPy+hSVL+ymiohandtUPM1UlTIqNtF1FMytrf:ZDLVXW2j21QC1+yZoqtUPMg9Z1FMyB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652289445, "uuid": "8852adf6-c522-4576-a1d0-f6a2ce4992e2", "value": 513536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652289445, "uuid": "59788841-b90a-4254-a808-bd86a934c42e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289445, "uuid": "b20b3896-05e4-4d91-95f8-b2ef4c229296", "value": "HnvIiEKASPBblkaOfJ3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2591722-d120-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1652269997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652269997, "uuid": "067b4753-5ff2-46f7-bcdc-e639b2001dbf", "comment": "Malware payload (AveMariaRAT)", "value": "7cb79ded5e239498e64b11d67e6a101e", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652269997, "uuid": "f01477ad-2be8-47d3-949a-8e3c2c15bfe4", "comment": "Malware payload (AveMariaRAT)", "value": "b1c236871d9406e3ef46672fde2b0f50f4af9f9c870b4404c7c5512410b15f9c", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652269997, "uuid": "c9e4cd34-16cd-4117-9980-0f8869f5fe04", "comment": "Malware payload (AveMariaRAT)", "value": "ceb392d178db3948797a1cc420e09c64460331ab", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652269997, "uuid": "24e01e95-12a8-4222-920f-286f0ec68df0", "comment": "Malware payload (AveMariaRAT)", "value": "b2f4b334685945ebc31c51e81959ff6ca344f3c4ee54c2d5cb8b2d4211c9224dc755f4ac9912a9f99bbc3ec7f7fe2d65", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652269997, "uuid": "f8c30975-832a-4b1a-9562-f6df2d816863", "value": "T1FE843B417188ECDAE4132AB25CBFD5301069AE9D9179C50E3797BB2B55F331220AFB4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652269997, "uuid": "d9d66fb0-2d63-4f09-9176-ddfa66c95cc7", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652269997, "uuid": "33cdf773-752c-4c72-ab14-8c6687571b55", "value": "6144:yOtI5z9u8Lr5SFCREOYSTajl6SOp/tYIc/Tk/ODGbn/FDb809muC2:yOubSFLOYSTMOp/tAbHKC0UN2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652269997, "uuid": "69bcf9d3-645e-48e2-905d-6cec6a3e26ed", "value": 387603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652269997, "uuid": "112038af-f128-49fd-a76a-673ba906cfa4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652269997, "uuid": "b393258c-31fb-4230-b25f-6c5a72d44cc9", "value": "INB232222,PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a4d3a7b-d0f7-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1652252240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652252240, "uuid": "f0c43dec-663d-479a-bda9-ed752fa8d9da", "comment": "Malware payload (AveMariaRAT)", "value": "2b48cb44f2dbb19a431f45db0cc23d26", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652252240, "uuid": "5938fa98-099a-4785-ae8b-ae5ec8be7fbd", "comment": "Malware payload (AveMariaRAT)", "value": "b1d6a4b94c5508ac4948d91498b574710dcc2bae3ab4eff42ffb889eca5a97a2", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652252240, "uuid": "d751790c-1f30-4906-a6d8-899d8ee30ca4", "comment": "Malware payload (AveMariaRAT)", "value": "b05d8aac1eac210e03f44f7ba78704385bdffc72", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652252240, "uuid": "ef0512e8-133d-4070-9cf2-1aea74e527f3", "comment": "Malware payload (AveMariaRAT)", "value": "b6219b0383357960df9e5ef727aba0f7359ed31fcc006ae682d151f449b69d5a650202fb5fff3964eee7909e4b286e34", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652252240, "uuid": "f8e80414-afcc-47b4-a771-40ef3e45e1d8", "value": "T120C4020926DCEB65D9FF2F78907920680EB6BD56B832D31D1F80298D2A937914E147F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652252240, "uuid": "766b648f-3a28-4054-a3ea-58099cdf5e68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652252240, "uuid": "4d81ca98-5ddf-4b66-8010-9fa1ab865cfe", "value": "12288:5pypou9e+x2Onlw511NWqSLAu4VedCWx4p:5ESI2On81NFSF4MXO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652252240, "uuid": "e15bbd94-fea9-40c7-8533-b124ab911bd8", "value": 577536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652252240, "uuid": "20fbeeaf-b74d-45ff-bb14-da77edd4986e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652252240, "uuid": "b8e83a94-3d8c-4306-ae22-83fbc8977690", "value": "CW059 FCVN Request for Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5feecc2a-d0ff-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652255578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652255578, "uuid": "d4220c37-f878-48da-931e-301e6a8f818f", "comment": "Malware payload (Formbook)", "value": "168a695dbcc82610ddf4c8be25216c05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652255578, "uuid": "13e81ecc-6437-4ab4-9fa7-d428c08e46be", "comment": "Malware payload (Formbook)", "value": "b1fe85520c015f8f7344de2923392bfbf216bfa02f9db21c8aa4bb20e7e9f192", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652255578, "uuid": "b0a1af00-b413-4794-88c7-a335e624fae7", "comment": "Malware payload (Formbook)", "value": "ef6ab4aebe8a8c803bc4a4f2f0fb91695133a3a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652255578, "uuid": "d316709c-7f1c-493b-a265-787f7e74028d", "comment": "Malware payload (Formbook)", "value": "aa57eb3e3eba5fdef5a80ffc9e8c8301f15814e488b0ab42b3dcaf5f5f5fefb24ad2d7cb3b0663afcbf38795a396f989", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652255578, "uuid": "f6fbaf86-45d5-4692-a22f-17ecd3348ceb", "value": "T17DD47E9B5F846A21C1BE6A74966C71B0C3F100DF67BD835F0842B1E46B36799BAC06D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652255578, "uuid": "6bd3d2e2-58f9-45ba-bbd3-9a33b292449b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652255578, "uuid": "fb3b3c14-7297-457a-b3ad-f0d71ebe3bdc", "value": "12288:1aiyHIGAe7ZO87TqUQCdYVfXHmyXEQ4Zmd1f9o:1aiyHF7FiUQCdivmyXEUd99o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652255578, "uuid": "560b5c30-c43e-4a1b-b740-f0e12e01e27c", "value": 609792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652255578, "uuid": "c5a907ea-7722-410f-8c00-4b94a7344079", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652255578, "uuid": "be2652ee-bd60-44a5-957c-0c9ca3db8679", "value": "Potvrda ponude.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5714040e-d126-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1652272314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652272314, "uuid": "e5a6b67e-6ab1-4cee-9773-a03bea162272", "comment": "Malware payload (Quakbot)", "value": "e414af3f3e46f6a293f8d971ffb4e6bb", "object_relation": "md5", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652272314, "uuid": "f1f25964-eb45-436d-950e-236d14a6437f", "comment": "Malware payload (Quakbot)", "value": "b27cdf8db38f91a7af314654023d412ac2044148ebdffcdaccd31cfbff9a4bd8", "object_relation": "sha256", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652272314, "uuid": "477560ad-ae75-47a7-96cf-0762401f4c78", "comment": "Malware payload (Quakbot)", "value": "92141c459c9f7abf36c144bc4155a0d114becf54", "object_relation": "sha1", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652272314, "uuid": "cb9b3898-4fb2-4b83-b8d1-6e8b2242e162", "comment": "Malware payload (Quakbot)", "value": "d08aa71d73049ddee60c10a0c05babbb29dc21b7d5bd105b0459303e12c9dab3562a8006573c9bdee5279bbb80e195c1", "object_relation": "sha3-384", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652272314, "uuid": "bf86fa98-f024-4db6-8b04-e1672216c5e1", "value": "T162E48E27A3D0487BD2771B3C8D1BB7A894397D112D78988A3FE41E8C4F3968076652E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652272314, "uuid": "883a7abf-cb26-4906-b695-d8f3b51a8261", "value": "f7eb3e856a00ee4120cd9bbdbac23f92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652272314, "uuid": "9221bded-9113-4535-be79-63a36f172c02", "value": "12288:lJam0AsChqCGBO6pMbrr+r894ovZRzYB:HnWChi7mber0zZRkB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652272314, "uuid": "aa22f177-02c6-412e-afd3-92881cd6d804", "value": 701840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652272314, "uuid": "e60f6bd3-e135-4352-aea0-445303fa5208", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652272314, "uuid": "c5369661-ef85-406e-993c-98be739d474a", "value": "b27cdf8db38f91a7af314654023d412ac2044148ebdffcdaccd31cfbff9a4bd8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe990259-d149-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652287627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652287627, "uuid": "af94bded-1e06-4f9f-9b99-0017418ce690", "comment": "Malware payload (AgentTesla)", "value": "59ef0d447a86033d13d92a685cee5221", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652287627, "uuid": "7c8bacf0-f8f7-4e5c-ac20-80127cfe0651", "comment": "Malware payload (AgentTesla)", "value": "b32bcc5d676e1a13c052aa35f456563dd6c5bd8c5d7284c17547d102da3ef949", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652287627, "uuid": "2ca66b4f-724d-4244-a6ff-286ea6c0f026", "comment": "Malware payload (AgentTesla)", "value": "a654c39297f3f503dc8a0f92ddbb9e4ebe484b8a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652287627, "uuid": "fa2fa036-961b-4f91-947d-df359df941d2", "comment": "Malware payload (AgentTesla)", "value": "c2e618c95daf5b88d13ea32025827aa74e1bd00df72020bd2a4929d9f3fbfb5ca499ff7ed6afb59f46f5bffb9cd641f2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652287627, "uuid": "397c923f-b530-40d1-9c96-84d3c4af7793", "value": "T11A742320A6E6E573E6F21B364D37DF626EE9810364D046A343001DBE78F3B52DA4F54A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652287627, "uuid": "78916ecb-f498-474a-80a7-22524d9960c1", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652287627, "uuid": "3f4a7e7b-6656-46e2-b9b2-8af7ce19f669", "value": "6144:LOtIOQHueuLAl+fz64OM/yUS+cYXao2XEI1ANokUHy7HlpkgpRi:LOLQHueuLP/c+1f2XEIpy7H/PpY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652287627, "uuid": "7bdcb2e0-7aab-46c9-84be-0e64726972a4", "value": 353644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652287627, "uuid": "c3dd798f-a487-484c-a6bf-4f81b60c93ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652287627, "uuid": "e186ea07-99de-4ec7-a0d7-d78264fbf21c", "value": "squimax.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d7a9132-d147-11ec-8e58-42010a9c0032", "comment": "Malware payload (IcedID)", "timestamp": 1652286498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652286498, "uuid": "728703fa-c614-4920-b388-a641e70f2f2a", "comment": "Malware payload (IcedID)", "value": "308e57f8fc4d90212f0c7a034a310de6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652286498, "uuid": "9d3e30e3-3a04-47a3-a991-10a10f816ee9", "comment": "Malware payload (IcedID)", "value": "b4737db536f4d237537b65f73a622146a89a6d2787b66f9ed6922d697160b83d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652286498, "uuid": "5374420f-d171-4621-879f-2a45970af6c4", "comment": "Malware payload (IcedID)", "value": "aa48e1c3d0c1b4396b8e020cce641e12b1dbab7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652286498, "uuid": "d72f6717-1893-45aa-ab1d-58eeb6cb5323", "comment": "Malware payload (IcedID)", "value": "4125d27e0c698687be45aaa8f7fce5763fd9b53de42cda39e8a189f141a812a292f39f55a0d1b730f88f6a985e4962d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652286498, "uuid": "c5030ae8-37d4-463e-8fdc-c125ce139c99", "value": "T1E2C4AFB8B5047CE2E66E167BD9D6BCED13B627239A8BA4CD806477C30563375FE02805", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652286498, "uuid": "a2474395-1b13-423a-a437-9074f451e35d", "value": "82052f886058ccda0d4627c7b027f0dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652286498, "uuid": "6c505966-d3b7-4b52-8b11-127af139e352", "value": "12288:dYpkiA6+R/kpuT/tMDPf3azzH95xohltGuviksKUV:dYpkiP+1ksTVMW3vK5ik3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652286498, "uuid": "302fbb43-e79e-4868-8f29-7e18ae7b793f", "value": 587776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652286498, "uuid": "6339d602-7c3d-4873-a2fd-f48b3fda501c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652286498, "uuid": "929b8e2e-4a94-4cc4-adb0-5aa7168c64b6", "value": "olasius.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49b5706b-d0e9-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652246092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652246092, "uuid": "15306ea7-dcb7-46bc-b9f4-c0a226832e2c", "comment": "Malware payload (AgentTesla)", "value": "e6a3425c04f036dcd5d5dfbf4d343eca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652246092, "uuid": "029fabec-5325-4815-a9a6-d9b9de945a5b", "comment": "Malware payload (AgentTesla)", "value": "b5cf6e34c00c5f0909467f20d071c313c26d8e8849dc920908d3df27d7256506", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652246092, "uuid": "f4e50262-cc8e-40a3-923c-6e3ebe9d53fb", "comment": "Malware payload (AgentTesla)", "value": "10f00e63044b9cd54244505c7189aa1c29f735b7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652246092, "uuid": "676daa22-f14b-4ed9-9813-15921d350de5", "comment": "Malware payload (AgentTesla)", "value": "9775e6ce7876faa44e630424994d4b2ca3ddb30ef598e67f0a3f1ed9c05a342d4f812a97944851b6711dc87b32d9d0c3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652246092, "uuid": "5515830c-bcb2-4ede-9464-9da8f5b6a056", "value": "T1ABE2F81037A8E964ECA548308C13F3742A30FD96B9525B7763C4A6CFEC33585EE725A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652246092, "uuid": "b489d311-8f03-42d2-b8fc-d05b4bd02afa", "value": "384:T3Am0DLALa8XViZ6wIs6TT9h83OGXzfKDVFKti/xynLk39Q3AM:muZS6Rs69h83OGXzk3WLS9Sx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652246092, "uuid": "47979ff5-2b2a-4943-949b-7c03d81bd6b7", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652246092, "uuid": "3696b86a-c957-4011-a4e6-5726541f4eb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652246092, "uuid": "41797a17-1d16-4b4b-9ff9-f58809e541bc", "value": "Inv,Delivery note.jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e4364a8-d140-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652283546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283546, "uuid": "ba2336e0-bcc4-4cc5-b765-1b69b8ac5dc5", "comment": "Malware payload (RedLineStealer)", "value": "8c7c35ed2979d7b828c34aa1682b93b6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283546, "uuid": "c7d8c352-8e80-43e5-8ad9-2c3fa4066c25", "comment": "Malware payload (RedLineStealer)", "value": "b67e281a3801005976e93ac7b8d5857403ce330a7b5f8fa6394596433c48a2aa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283546, "uuid": "d5b49c50-c900-439e-bcd3-d1b809978e48", "comment": "Malware payload (RedLineStealer)", "value": "9fc8af89d8d1c70be01af6ab49fcf3f3b1eced52", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283546, "uuid": "b154b0ac-795a-4c64-919e-8e9eac5d6e42", "comment": "Malware payload (RedLineStealer)", "value": "ea44d0e2b954c8099c5c6d15691a166fb92f65cd89f00571d22dd04ca4679eda0a575faffce75ef32bb765c2903e749f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283546, "uuid": "b318e078-2cbe-42e2-9235-114fd33db9e2", "value": "T17754AED4B6D1E432C093393088719BBD5A7ABC62E630694F37743B2E2E743D06976396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283546, "uuid": "eb59f02b-32fc-4052-a6ea-e04f0f2de034", "value": "8b318cf55c5e05444f521cf810458a29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283546, "uuid": "761f78fc-e5b4-48a7-84db-0a470fb93a27", "value": "3072:lo3SYRr64aCBxBtPG60zWzKuJ0KIVggjcGkNIVqIjmN:fOr64acXtPGXzWzK60p7ITsqV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652283546, "uuid": "03b1225d-03df-4062-9118-63e16b35d6d5", "value": 295936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652283546, "uuid": "746532e2-fba8-4c50-8cdd-68c0beafb582", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283546, "uuid": "5f28e685-5aa6-4a08-8d0b-b8d0d751bf98", "value": "8c7c35ed2979d7b828c34aa1682b93b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b12bc48b-d142-11ec-8e58-42010a9c0032", "comment": "Malware payload (Sodinokibi)", "timestamp": 1652284491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652284491, "uuid": "b91f8731-3b16-471f-83c5-2f84a890ebb1", "comment": "Malware payload (Sodinokibi)", "value": "8203a583c5eef23e5fa7fa9d1506d430", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652284491, "uuid": "0e0bd3ba-b2af-4876-ad6a-9c8512267cd7", "comment": "Malware payload (Sodinokibi)", "value": "b78469fb8eff53d82081bdcb0dbb3436f239b8ca6ef7fd800ce5ba7e098c256f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652284491, "uuid": "cce5d712-d04e-431d-b1e5-aed9f10b931a", "comment": "Malware payload (Sodinokibi)", "value": "a03db11124592b36137f3603afdba5e3c999aae9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652284491, "uuid": "480bc9db-83e0-4283-a52e-004916daa832", "comment": "Malware payload (Sodinokibi)", "value": "76af2fce2a7c5773e2bb95da9637310ba4e1eb90c2385c9907234707abe1c3fdeab8c355cff1300c2213d651da8a2f12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652284491, "uuid": "e95d252a-db71-49df-bc8a-f3cf81a581de", "value": "T16404D023A9D28D72D0E341F35237AFC6A67EBE705056102797607CC61A7D0A2A72F357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652284491, "uuid": "cd3f13e1-86b3-4ad4-b16a-af2066ba3e49", "value": "5d1b05200eee34f0b6cb3c904e11102d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652284491, "uuid": "aee3be64-231b-46b1-a92c-e2bce28a883e", "value": "3072:4LFrb30BRtBZZg+i22yyTsnAdu5tjgn/RRKwkwvMT3QQmJQOZt7UaN:qJ0BXSchyTsnXToKJw4gQeQutFN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652284491, "uuid": "1095913a-e57f-4939-bc69-02123d35ddcc", "value": 186368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652284491, "uuid": "ea90c78f-96ec-4438-8111-a63946a6d818", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652284491, "uuid": "c2cced43-abda-4da0-9161-7ec5554dda31", "value": "b78469fb8eff53d82081bdcb0dbb3436f239b8ca6ef7fd800ce5ba7e098c256f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4d61a96-d17f-11ec-8e58-42010a9c0032", "comment": "Malware payload (njrat)", "timestamp": 1652310696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652310696, "uuid": "dc78f029-8572-40ec-a47d-93f9ec8defb4", "comment": "Malware payload (njrat)", "value": "5151e3e84f00af4cb66f9ee2626d65d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652310696, "uuid": "2798bf62-b963-48fb-94ec-72f17b405c27", "comment": "Malware payload (njrat)", "value": "b89355f0e2573bdf04120e42f004e7ecc2339c0539a65b8329e0f02e1291b0a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652310696, "uuid": "9ae97a6a-136b-4a94-a530-e7b1373fd0ca", "comment": "Malware payload (njrat)", "value": "9edde8e240996473b3ade12ba11c80857adc29c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652310696, "uuid": "7630279e-d490-471a-940e-b6bdff6ffa69", "comment": "Malware payload (njrat)", "value": "6b20658dc26e3f67da565875242f688ae962e64087e383a9b883d6016a5509d0f382343e70f2bf15f25692146b25b308", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652310696, "uuid": "1f6d7c49-507c-484a-9c6b-0800321c2ed6", "value": "T157449D4A3F98D85BC2C83E7D46A4C3BC537199812E36CB036AF2EE4EE975D892D44194", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652310696, "uuid": "9533a854-2ed6-4265-97a3-f42b42129178", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652310696, "uuid": "79612f5d-e30f-4183-93d5-34d75fd8779f", "value": "3072:LglF0qwOfgVlwrq6xh8vn7vvxEKXfmempqNNNs/ANFg+1Wb:IElwOsha7vvilpqLiINFg+1s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652310696, "uuid": "6f2d7b79-15db-44ff-aed1-1caa5c77903c", "value": 254464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652310696, "uuid": "622f9f3a-bc9a-4fb4-b88a-71d1d503ad63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652310696, "uuid": "6dbc2a1f-1aae-4c82-b59e-ec0b899112c2", "value": "B89355F0E2573BDF04120E42F004E7ECC2339C0539A65.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6645fc5-d10d-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1652261790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261790, "uuid": "d2bb2ef4-722b-4563-ae88-5227657a4db6", "comment": "Malware payload (DCRat)", "value": "000d72f9d59f5e12c4b1a669f74ac98d", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261790, "uuid": "6df7febc-2592-4394-b1a5-b5d871227d5a", "comment": "Malware payload (DCRat)", "value": "b9581b11b9ed55b72517712e7147450f5411775b2b325568679ae05b12b3451c", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261790, "uuid": "77c19ee9-dfae-4a0e-8c60-1ae67865858d", "comment": "Malware payload (DCRat)", "value": "3a292e5235f318e4c7ee8cdef7e3582390b2b391", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261790, "uuid": "a8db1749-7738-46fd-9785-f23c7fbd7995", "comment": "Malware payload (DCRat)", "value": "ec748d97587b79a164b6636380f4e2eb8bd92968a1a2ccad40f529ef85c281f8f101fa60a8cb6afef39b24d513bff105", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652261790, "uuid": "77b8f81a-e283-49c8-960d-af80c081a804", "value": "T1FFC533ED64B3B32DCB2F0976F0094E763EB1B96DD404D69BF46B1644F89B223499E804", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652261790, "uuid": "8e34a624-f6d0-455b-b6a6-3416b701914f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652261790, "uuid": "3500803e-1cf0-49a1-8728-49830687dd9b", "value": "49152:/TsvgV9Ew2ZBBu7EP0MsiDvCl6wqWQyz57dI2KSOIS4TAiscAbf9VaP2ZtFP+jMV:/TagFquI3siulEWQy1BK0oRbS+BPb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652261790, "uuid": "3f6cd4db-687d-4fb2-8aa1-bd5ae1875eb9", "value": 2704896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652261790, "uuid": "ce6e52d8-7a7e-4784-ba56-246a3a885127", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652261790, "uuid": "fe442f23-15ea-4447-bef9-1c25b8b5ae81", "value": "000d72f9d59f5e12c4b1a669f74ac98d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4dd20e7-d105-11ec-8e58-42010a9c0032", "comment": "Malware payload (NetWire)", "timestamp": 1652258405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652258405, "uuid": "140e4801-80d9-4d7d-8feb-b04b1e7797ad", "comment": "Malware payload (NetWire)", "value": "8089af065a046dbad8e7d94abd1d8f19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652258405, "uuid": "f795255c-b3f6-4bd1-ba5a-674da462b7c5", "comment": "Malware payload (NetWire)", "value": "b9ae250f46ca4265b6b0ac9707b2684cc0c52d375734fa96826df03d1ca3f6f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652258405, "uuid": "170c10eb-9e5f-4119-a114-067c49277bf9", "comment": "Malware payload (NetWire)", "value": "21cae633ae2fd48a890482e7820cca6e8444e953", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652258405, "uuid": "638b7453-565e-44d6-9ed0-4706d28a7e08", "comment": "Malware payload (NetWire)", "value": "7d0e3359c241abd76a3da48a91e7630bb139c5ac8dacd58187705037f3ff790f780943288767e6938faa2611a51aaccd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652258405, "uuid": "637d138b-dfca-4df9-985c-78464b15bdc9", "value": "T119355A62B2E2D53AC43216384D177EB557B6BD10ED34A846AAECECC84B34ED13B21357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652258405, "uuid": "5e40c14e-aaa8-4713-9d3e-f144ed333473", "value": "a394cc215dbb58f1799a34551bb75374", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652258405, "uuid": "a96552a6-e210-4493-aaea-43321291229a", "value": "12288:vxx+UPkKD0b5PK/Chm9pbJh8k4LYIZzUzs1WHmVDIF5+RgML9r4FKI4/8:pECA5PKKupbJhqEIZzymVDJvwJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652258405, "uuid": "1052450e-2f41-4cb2-998c-2fc1b065859d", "value": 1146368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652258405, "uuid": "10704ca2-fed3-4f3c-b2c3-27cd4fcf4f88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652258405, "uuid": "c96f7f47-d3fc-4e8d-a26d-cec84266f50e", "value": "SecuriteInfo.com.Variant.Zusy.423667.20128.28808", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "779ba361-d13f-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1652283106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283106, "uuid": "e8b6340e-98c4-41fe-8240-47c537c37143", "comment": "Malware payload (RemcosRAT)", "value": "fad1ac6ade348bdb407a80644f2360cf", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283106, "uuid": "5db4007c-f8b4-47ad-96c5-685055c17072", "comment": "Malware payload (RemcosRAT)", "value": "b9feccd2e106384a5517c0ac4d43b5d2fb70ea224e43ba5b8ff65726fdb0fb1d", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283106, "uuid": "e605de52-aa61-4fa5-9094-e94870ee540d", "comment": "Malware payload (RemcosRAT)", "value": "9d9d73ebf02c6ac1772559a3cd064ba99d02a6a4", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283106, "uuid": "3dbd61e8-1d18-4925-acf8-02d5f9ef1de4", "comment": "Malware payload (RemcosRAT)", "value": "b48926d74013882644b15ea19afe1055a9609e5c62fe4f353aa816c8f69fc7ce2e251989db9b96942006892d530b7155", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283106, "uuid": "54363952-2121-4c2c-9b7e-f154a4169721", "value": "T16A4101EF350B642569064CF2FC1F54AEA9316217D23948C0B200EBC50D78278A7E69BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283106, "uuid": "f96206c6-0576-43bf-a5c6-94700d456990", "value": "48:I+o4NQaECkwqrnneVHgbh4VJRfo0TE7eve5sGu:I+o4NQ7rnneXVJYae5sT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652283106, "uuid": "c0736741-1752-43b3-9bb3-62463503446f", "value": 2114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652283106, "uuid": "9bfed565-90d2-421f-b67d-5b8e708cef92", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283106, "uuid": "ec10f588-2dcc-4243-ae4b-a4cadf80a835", "value": "Protected Client.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7830f081-d10e-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652262061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652262061, "uuid": "f6d3881c-607d-4808-bd4c-729f340dceb7", "comment": "Malware payload (AgentTesla)", "value": "05ffda638040515ce702f8cb5260ef0f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652262061, "uuid": "4759a9ce-27cc-4e60-8e11-6dcce307fbc7", "comment": "Malware payload (AgentTesla)", "value": "bc69363fcef0e7f595585f876b41915ccd50ee5e2efcc27b23f18a905b03f0e5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652262061, "uuid": "487f38d6-732c-431c-ace9-9ef5784c847d", "comment": "Malware payload (AgentTesla)", "value": "314c4d49cff97648af4ddd6bc9c901482abfc90d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652262061, "uuid": "6c85e4df-a1bd-40e2-8b53-2d8666826c19", "comment": "Malware payload (AgentTesla)", "value": "9db1c6a2161f66d97956ee9f4b0151d14ddfc678de0573f41a7c96b75d294e48bc764a292b5bbb0d4d56506777e4d725", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652262061, "uuid": "4a328380-27fc-4783-b1ad-d4ca7f43e46c", "value": "T10DE4022CB7ABCE12D0AE2B3AD4F654245BB6B90AA133C70F14CC274D4E067974E55793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652262061, "uuid": "e2892a85-ea31-44b1-84c5-d42acecebc7b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652262061, "uuid": "bc54bb44-7135-44ad-9f38-f8bc88c4a4c0", "value": "12288:r/HkCpSpfNZd9vp+ja7EQekTY2BQM6YqyE+5p9xvvc7EyZpCp:r/dEX1YjWvTJQM63ydrLvc73ZpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652262061, "uuid": "3001602d-cd7f-46d3-b6fd-cdb985c54018", "value": 706048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652262061, "uuid": "0470f35e-1961-4ca5-86a6-dfc2e7e7dff0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652262061, "uuid": "c526810a-db91-4b40-a21a-810b03ab1122", "value": "PLACI-MIE SRL 11 MAY 22 - BML PAYMENT_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a2017bb-d160-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652297230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652297230, "uuid": "db16e191-5c63-4d9a-aeea-d795eb3f9b09", "comment": "Malware payload", "value": "1c0a3c9dd856e32bf9d891c0ba279020", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652297230, "uuid": "519c7b3f-89f6-4135-ac5c-6b6b3e6712c9", "comment": "Malware payload", "value": "bed86d5531615a9300efd26520395a5abfcf4c7fb6ce55086b4ad0dba0239171", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652297230, "uuid": "d88c10fe-34b4-4622-a214-257bdfbe01e6", "comment": "Malware payload", "value": "54b09cb4428aa95310f097cb54c411f0948701b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652297230, "uuid": "4b5105ff-b4f8-4db0-8474-2611e052fc3b", "comment": "Malware payload", "value": "6faf08f0df073640e297bd152d965da05b3097b34ca579e3f0dec6a127e9ab5b8b6f267704fbd7750c8b600463c082bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652297230, "uuid": "f1f94b80-b0ea-4e28-ae7b-0dd603497f2d", "value": "T13A356A62B1E2D536C03259785C077E765BB6BD00ED74A84A6AECECC84B34EE13B25353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652297230, "uuid": "e124f907-ab21-4c3c-9d8a-d76ffa8e09ad", "value": "a394cc215dbb58f1799a34551bb75374", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652297230, "uuid": "7f8fd0df-17bf-46cc-b2bb-1910f12e3b62", "value": "12288:vxx+UPkKD0b5PK/Chm9pbJh8k4LYIZzUzs1WHmVDIF5+RgML9r4FKI4/8:pECA5PKKupbJhqEIZzymVDJvwJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652297230, "uuid": "f2db2675-3ba7-490e-8843-da405b81c12b", "value": 1146368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652297230, "uuid": "1ffe7b49-6c2f-4f1a-8e0d-d40da43a1d33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652297230, "uuid": "261070be-6757-48b1-bb2e-294776c2234b", "value": "Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70a1b238-d0ec-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652247446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652247446, "uuid": "2046144f-1ba0-4ace-842c-040ba98d0b94", "comment": "Malware payload (Formbook)", "value": "46806b374dd368d6ca62cd8fea5a9623", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652247446, "uuid": "e8cf6094-5f4d-4b9b-98f4-f61f0747d620", "comment": "Malware payload (Formbook)", "value": "c1aa2253f99e2f3a49731b245dc62b2497af38392910174f1534608e105936f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652247446, "uuid": "dbb1e99e-f984-4a2d-a07e-f601bead5e4c", "comment": "Malware payload (Formbook)", "value": "7833c87c9749b1c5d7c23da0ecee6237b076d2aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652247446, "uuid": "ced19188-e272-4bdd-b588-dba0bd12bf5b", "comment": "Malware payload (Formbook)", "value": "554c2b39ea7b4d0912f2037e80d6a04c221695f1142236d4c4ec791bb21cda37977ccba0ea69286a73a63bb8ebf62af2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652247446, "uuid": "4c4c441a-0f30-4116-9a61-c3ffc64c26a1", "value": "T18C5412412357D9A7F46C3F321C24363EBE9DFD1ACCA9560B77807995797230CA6D9220", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652247446, "uuid": "e1f50b7a-2871-4425-a663-a1aad280e8d1", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652247446, "uuid": "40aafed9-0f9b-4571-9f8f-ee51ea0c254e", "value": "6144:TOtIoed9HQ6tFGzk6MKDe4md+pEiVIevBFUT4d+wYJ:TOdgRQ2Gzk6b+0Ff+wY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652247446, "uuid": "e5126204-596f-4aed-840d-24c37af1c249", "value": 289398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652247446, "uuid": "d8ba921f-fd47-4adf-a150-b5e9213a4c91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652247446, "uuid": "025dc10c-d51c-4eb6-b284-7d2546fbd80e", "value": "Proforma Invoice 2796_xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f7ac8aa-d180-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652311063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652311063, "uuid": "c8e49cc2-dd7b-4644-8259-9326efb685e8", "comment": "Malware payload (AgentTesla)", "value": "0f28584329cb62372609d9cdbeae266f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652311063, "uuid": "cb7e5463-bc18-426c-a7f7-ecbaecd7d19f", "comment": "Malware payload (AgentTesla)", "value": "c1de96ec01ad1b90fc5e57da74d794825340df26cdd61b6f96a0df006e3a3877", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652311063, "uuid": "3c2cbf70-1cb9-4141-8a6d-3245b48de0f4", "comment": "Malware payload (AgentTesla)", "value": "b22f1d9ec176d8b9a9bf9bfbe60046f4bb14d3aa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652311063, "uuid": "e91605ed-e5a0-458e-a4d7-40787c0b0469", "comment": "Malware payload (AgentTesla)", "value": "f691984ac0a1aee165809af57ed68226fc1fcd99de27732eba921b592d8b826aa8b2874b6a452fd8a757aa409806fad6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652311063, "uuid": "f0f8fd62-7651-461d-b1ee-7c89fab4947c", "value": "T19315CE22B70CBF61E63AD3798050851043F0A71FFB2AC55A3DB664CE5672FC5A262D27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652311063, "uuid": "50bf93d9-e39c-4cf4-9398-69e9cf28ef8e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652311063, "uuid": "e7856927-c71e-41c2-9479-f2d88b2c4da4", "value": "24576:rMBr/LeMIClIx8ANw/uSZT9fWuUPMtN+qpd:+SslIx8Cw3PfWTMtNr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652311063, "uuid": "f3eaf525-dcad-4667-a670-b3e1668fdec2", "value": 923136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652311063, "uuid": "972c6f62-21a8-4659-b2ce-feadbb2ac1ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652311063, "uuid": "5a7aba8e-5ccc-4c6f-a1ea-2adc45fa3a87", "value": "Proof of Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2e87795-d10d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652261811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261811, "uuid": "1ea7224e-daee-4ab2-9436-77b2fc805561", "comment": "Malware payload (Formbook)", "value": "b5a1d0a95975840fccbf74da2ee0d251", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261811, "uuid": "92bebad9-dbf8-418a-b8ac-4ced84eefaef", "comment": "Malware payload (Formbook)", "value": "c289d98eaa7fed6ed8265b7654f593e597a6ea403118379de2e101a00e9d87a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261811, "uuid": "e49b2b30-958a-4981-8e97-dbd2dde63542", "comment": "Malware payload (Formbook)", "value": "1a2cd789151b459c80a0ebc8049e444233a59d03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261811, "uuid": "63eaa770-df92-405f-b943-457b0766d119", "comment": "Malware payload (Formbook)", "value": "ee6da2150948d4ea8806f470724eef9bf61f79c8e240ba1a08a371a86502573fdcce530a0643f3b9a0ddf6e63db48c4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652261811, "uuid": "c1186ea0-f795-4206-a2b4-93e13ca3540c", "value": "T1CA441205BB91E5B7C3A29F321FBFFB215DFAD912009472474B4029793D21BC1E61A7A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652261811, "uuid": "4896fd28-3b48-441b-a292-5d6c48cab242", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652261811, "uuid": "77f09cba-f549-4de0-8441-3a4f85b9f79b", "value": "6144:LOtION2sXDuuSI+CI6iRrB6sgxZQ6NGMup/MRWd+Wy:LOLN2s6HIlINpBgxTSp/MR++Wy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652261811, "uuid": "5bc245e4-3566-4dfc-aca3-c6c506a4d899", "value": 259065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652261811, "uuid": "8eb234cf-aad1-4390-9ef1-072cb14f5fd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652261811, "uuid": "4357c111-ff5b-48d4-b878-876a61bff267", "value": "doc#011010022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "674cb96c-d14a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652287803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652287803, "uuid": "16653322-d6dc-4791-bbb6-be9b7138c7d3", "comment": "Malware payload (Mirai)", "value": "2ddf4de90093c6fd620ddd73e447d5bb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652287803, "uuid": "e34746da-9a3c-4575-9936-d7ea46914531", "comment": "Malware payload (Mirai)", "value": "c2ed668060af2f186c0d869680035934f9a044c6d2fda0d1f26fef7199dd55f9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652287803, "uuid": "49ccc253-7f33-4f05-a702-136190399a28", "comment": "Malware payload (Mirai)", "value": "61051aa1502f8c140c400c2e4c41c74d92c05927", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652287803, "uuid": "4f04286d-ee98-4a8c-a7e8-d8c60ee3e2a4", "comment": "Malware payload (Mirai)", "value": "291a056593955936a1fbfe36973ff3b0fa0cc742dca1f9639d0e01629802d358fb7094c05b535c4ec21dea2006dd476f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652287803, "uuid": "a7cbeaaa-50cf-4d2a-af54-e73755011ecf", "value": "T1B2D2D063C1960A94C7EA0832E82F3C0C6978BB0995BD06B8AFEDF1058D75F2557DCB61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652287803, "uuid": "90e77f04-236f-4767-89ed-c0ec13b0fe64", "value": "768:iYicrAqMzfOwAHnMZvPFInoL1FKQTCEno7nbcuyD7Uryqq:1zAVfgHMZvPWovnTe7nouy8mqq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652287803, "uuid": "9037c243-b023-4ec6-a2bc-6842f2b553f9", "value": 29508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652287803, "uuid": "24f16d3e-3fcf-4312-a9a0-c1abc5467c69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652287803, "uuid": "7e3d6ead-a3ba-4095-8124-55977683e653", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbdb6fa8-d119-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1652266899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652266899, "uuid": "082d4e62-b75d-427d-81e7-63a38096ac01", "comment": "Malware payload (NanoCore)", "value": "339c2a623cb5e745856b3fa600896bd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652266899, "uuid": "3394d59a-53f2-466d-94f7-d963c6197a82", "comment": "Malware payload (NanoCore)", "value": "c34f73a880d41a1a74e636bb2e6f9dd91b9c9fe050870400c4bedb2128b63588", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652266899, "uuid": "b119182f-b439-4ac6-8881-b71a614f6734", "comment": "Malware payload (NanoCore)", "value": "3f9254e4158a8aa0daffb16914be26a96a4b7e44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652266899, "uuid": "d750ed93-609e-498a-9d53-6e8925fc5a8f", "comment": "Malware payload (NanoCore)", "value": "8fa9cbdae2fe58262b9181bbbd1486025867e520dd7af972472c80731c9c1c1f301e3fcdac9bcc2f140c0be6c9e21e5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652266899, "uuid": "61389f8d-b20a-44a0-a3cf-cb5bf6d47aac", "value": "T1F905F6A83ED171CEC4E7C832CEA89C74AA5474EB431B921BB057469DAE4C887DF141F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652266899, "uuid": "28ef84e9-3ea1-4863-b56b-3e633d9af2a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652266899, "uuid": "93386c1e-11bd-4c1f-bb6b-e37da530a6b1", "value": "12288:xWvZ9voNAsOvZDM0WluH0dcBYKfY3665D4eXyvLkW6CfKjUJJf4r9ap4wWzPSZEm:xWvPTtw0W3dcLGvoLk4L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652266899, "uuid": "dfa8def0-c91e-48c7-ba50-bf95adcb40cf", "value": 823808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652266899, "uuid": "324b3895-d75b-45f0-9ed3-11b3562a7537", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652266899, "uuid": "999f7fdb-3fa1-43d8-b0b9-2dffba9952a3", "value": "339c2a623cb5e745856b3fa600896bd7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a74ddeb-d0fb-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652253770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652253770, "uuid": "d2e536a6-d89e-4d36-abb8-2b50979d1d96", "comment": "Malware payload", "value": "97dabee425c12565cd44b86213052c7d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652253770, "uuid": "336a9712-7e71-4bad-8bdd-caff361d4db3", "comment": "Malware payload", "value": "c37390714be434f709d26b4ab21e21b85e7c055d991234c321be27756f38e597", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652253770, "uuid": "ead24d0a-7692-4043-9f68-50836d6bbb19", "comment": "Malware payload", "value": "305db305a7149707b46a8b79fa87e833c487a127", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652253770, "uuid": "dce88008-f48d-46f1-b1f0-144d8283ff72", "comment": "Malware payload", "value": "5833790240f9a4390dcca0511e74366536ead6536ddb4b4020b4c201d3f872badec58ea8a62d62414123f1b0cf7a33aa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652253770, "uuid": "6ed1f621-b5fa-4dd6-87b6-b16119fc71a4", "value": "T1DA13401766CFBDA1C0782A32B7B313C5C36CDF415217DA1E65C832198A3A3973A927D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652253770, "uuid": "e1616143-6d8e-4f6a-a78c-be2c86279405", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652253770, "uuid": "5fde7819-83a9-444a-a03f-b408608dcbfc", "value": "384:NX2kVzUP7mG6bvoRHRKdCdHYvwZliqaJA93M3w7myU3D+6MwaL/pJ1+dff9vwEG/:522AhVxKAdHCuh9XwDiLxJ/2GLb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652253770, "uuid": "d65f1657-4ea5-4cb6-afbc-12eeea33fa8f", "value": 43520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652253770, "uuid": "f86ba1bc-60e3-4661-8229-7fdc35eb79ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652253770, "uuid": "6d6076be-a0c3-4d39-b731-2f6df698d231", "value": "97dabee425c12565cd44b86213052c7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76a035c5-d14f-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1652289976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289976, "uuid": "229e06e6-7ed1-46e1-b223-bd411237712a", "comment": "Malware payload (SilentBuilder)", "value": "27ac38fb2f897eb61e56d9c448ea0fc0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289976, "uuid": "47bca5eb-dc31-4f75-9059-8c8df7a8fee9", "comment": "Malware payload (SilentBuilder)", "value": "c41e8de18571125db4a50a2180f528d5b78aaeeabbb1506d9aa57ec53a484890", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289976, "uuid": "4d1b62d3-3698-42a3-acea-27e219c399e9", "comment": "Malware payload (SilentBuilder)", "value": "3c27e31125dfc808f66c5ab2937b9b0d3f599c76", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289976, "uuid": "3ad92d73-4cf5-4ee4-ac78-cd188e9f78cd", "comment": "Malware payload (SilentBuilder)", "value": "a534dec873b12c42b655a274f7c39042ea0af0ce1799b6fa80a01571c82e73493f6af5c2916e158e6807f32fb951b9f1", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289976, "uuid": "e671a138-a558-49e3-ae2a-4154211227f3", "value": "T1F503844ABA5AC95CFA25C73548E743E9B362FC101F6B0B873645B3657FF49A04A0360B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289976, "uuid": "3c3f0978-7c3a-489e-8e26-0cf5dbfb53aa", "value": "768:pkZKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgACCBn9kC+xbwcZfqG9tMvcVi1lw:p+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/dY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652289976, "uuid": "3ae65c00-13e6-421a-b45e-d17bbad70e56", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652289976, "uuid": "13ede8e2-80e7-4fc7-a7dd-60320199bfd6", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289976, "uuid": "014d015f-6c6e-4638-b0f7-f22b4b035061", "value": "Jamaica Inn, Ocho Rios.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "282e8c35-d14e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652289415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289415, "uuid": "742b4a10-a021-4b37-ab75-a347d776d9db", "comment": "Malware payload (Heodo)", "value": "e7a4aea4311437239fde365c8af823dc", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289415, "uuid": "8cf0745b-1c38-4844-8f84-90e14643b975", "comment": "Malware payload (Heodo)", "value": "c48434ffb34b744c6adead80b5d5fe947950ab67044a86d9f166cde99a66f387", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289415, "uuid": "faeb340b-0c3e-4260-ba1c-c4b889f64d47", "comment": "Malware payload (Heodo)", "value": "b798468d4edfca0059f1677cd6ceefeb1f325194", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289415, "uuid": "50eda31e-4c2b-47bb-9819-a5144c1ee78c", "comment": "Malware payload (Heodo)", "value": "a55d938fc81ebcc15899c7cec90e8869d4a3ecf2fa066630bcfe99ad9b01966e2a47edf875b89190b927d77964028669", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289415, "uuid": "a5fbf322-286a-4336-9b99-6713d8901403", "value": "T1F2B4BF06B3A504B9E467C174C9735952E672BC121761AAFF33A0436A2F37FE06A3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289415, "uuid": "8136994d-4b04-496a-81a2-cab5f1aa1e59", "value": "6196af15ce9ababd9a592319b3043ede", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289415, "uuid": "75706f4b-6221-43ce-9b26-37c6a4fc19b8", "value": "6144:iuD3jumQgXW2jLi1QPy+hSVL+ymiohaBdtUPM1UlTIqNtF1FMytrf:ZDLVXW2j21QC1+yZoYtUPMg9Z1FMyB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652289415, "uuid": "cd0a4ec7-0e38-4406-a11b-fdd4736020ad", "value": 513536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652289415, "uuid": "dc99846c-832f-4fd5-82f0-2b3ddd44d5b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289415, "uuid": "2c40bbc8-070a-4c13-82e4-fc8253da72a1", "value": "oGgkH9AoZ4PM5yDqABW6Gsf8luYH.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1143d13a-d0fc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652254158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652254158, "uuid": "27a218e7-7d33-4feb-b4d8-6181a2e10931", "comment": "Malware payload (Mirai)", "value": "5de430f42c1cf7e12ffa4aabde0cb1f3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652254158, "uuid": "627215a2-f821-4dcb-8874-2cd085535540", "comment": "Malware payload (Mirai)", "value": "c56e166acbcff80eb7c2c969a056a41e1502de5f021a158793ac22d7b7f650d7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652254158, "uuid": "43a565bc-8ba3-4441-a6e1-928a341cf3e7", "comment": "Malware payload (Mirai)", "value": "80016678307ea505d5fb0c27a7114780f0e6e425", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652254158, "uuid": "832965ec-68d3-4885-8d66-d18078a95275", "comment": "Malware payload (Mirai)", "value": "38031826a3243ecb111119e2f3b726a45053b579031cff7fa865d8c2639a4ddd45c49ea76448b53e55922920023cc25a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652254158, "uuid": "3550b0d8-3789-4ed6-960c-e82619b7f2cf", "value": "T124E2E11190929E48FA1FA7318DE1B3EC6908F04D60D9C69A77D0797E254FBB63F28361", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652254158, "uuid": "800d95a8-b9af-452f-8787-91dda59df7f3", "value": "768:4ayIsw/Po3+/FRC8pOtD9aadRYTv4uM61e2zwDL1LnbcuyD7UHQRjSD:4akw/Po3SC8pOtZlYT4uLe2+RLnouy8D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652254158, "uuid": "4d882fd8-7bfa-43c5-96a6-995a20e795d8", "value": 32800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652254158, "uuid": "fadb73f4-befd-4c18-b30c-084c67aa2f2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652254158, "uuid": "22ea2a7a-215c-4510-b9ca-9a52b6e76fb8", "value": "5de430f42c1cf7e12ffa4aabde0cb1f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6ee5a13-d10c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1652261334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261334, "uuid": "17708f0d-be5a-44a8-8be2-95e9add85b1f", "comment": "Malware payload (Gafgyt)", "value": "5b0c25a84e4d5d8891ec4e3f204c81e1", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261334, "uuid": "b4880f02-b304-4bea-b94a-0ff806572df8", "comment": "Malware payload (Gafgyt)", "value": "c581d46940f9ebf1a5475da262d052e04b4c7bf9460f2119de5c84321935b8a1", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261334, "uuid": "a7b3dcf7-22e8-455e-9347-357bfb406602", "comment": "Malware payload (Gafgyt)", "value": "bc441ffc061752380028bac564abc33f27336048", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261334, "uuid": "98bba959-9328-46b5-81fb-3b6c78640782", "comment": "Malware payload (Gafgyt)", "value": "7a2c6b293058bf6b54abba37c1e4665952d297c6fce30959cbbc8a885db8c8c38895741c6dbbc3548b6facee3634e3af", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652261334, "uuid": "a4905f92-2f74-4bd3-8b43-20607e8ee0c7", "value": "T1F8B33A1766A1C6BAC08762F42ADF96A29413FC3C0B32612733D0BDA92F759C52D5E317", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652261334, "uuid": "5e7ddf78-5671-47e0-bcf1-05dd875371eb", "value": "3072:3XCyLp782w+pdsEvjIvaFiw2UHDE78JSxG4KbCHNX:3XJpzsKsynjE78JSxG4KbCHNX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652261334, "uuid": "8cc03a61-1399-469e-a1b1-8129843c828d", "value": 115684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652261334, "uuid": "13dd2fdf-f599-4bc9-8372-9121a902e8d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652261334, "uuid": "2e4dadd5-50e7-4095-a4c0-5fca0f6162e3", "value": "5b0c25a84e4d5d8891ec4e3f204c81e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9b9183d-d16b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652302168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652302168, "uuid": "6b25aed9-6a58-4813-a6bd-fd63d393abb5", "comment": "Malware payload", "value": "4935b95c2799f534df601647a678ebe0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652302168, "uuid": "9ee4b4e5-7045-4b2d-acc8-e2d94c74d98e", "comment": "Malware payload", "value": "c6f824f3bb1433913d013491d7e4d71f767c8eea50d24b0f343c3d7263f9ba3a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652302168, "uuid": "d1d2e29a-7b08-4855-b4ee-57d2ea881f5e", "comment": "Malware payload", "value": "27dff9c898294069b412bb5ed145f746fb0f0208", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652302168, "uuid": "46e8a293-26c8-48f7-be8a-5aa2ce5a6c14", "comment": "Malware payload", "value": "0f065a0bcbd8c317976c6d9841b0311dd740080b98b08cf50c383349a7cd2efc07ae04a65caff6a4cdc963e60556e5f6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652302168, "uuid": "7fab9d73-603e-4519-85e6-fb3931018d71", "value": "T1FCF2E190994218F5C27C0C31DDACC8D89B5D2FAEB993B1162A2B917DC9D13936CF9B05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652302168, "uuid": "77e7d042-4f5e-43e7-b812-5969d317ee5e", "value": "768:drVNiiekR/46kASyzDMsbGOI8JVoY9m5yz9q3U7:dTekR/467SGDM+fJVP9mszZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652302168, "uuid": "da3f2fb8-381a-48c0-b1f2-902ed760cdc5", "value": 35668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652302168, "uuid": "c53c174e-1b13-4c57-baad-9a6e33446296", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652302168, "uuid": "8a0d9afa-8df2-47d4-9b55-78e318cd0d44", "value": "4935b95c2799f534df601647a678ebe0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1efe628-d13e-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1652282828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282828, "uuid": "e7765fa7-99dc-4394-bf8f-793a014e21d7", "comment": "Malware payload (NanoCore)", "value": "da45ae0d96c1f435eba5c3126f51dcdc", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282828, "uuid": "d2de3fd3-27a4-47ca-9055-309d1e0d94d1", "comment": "Malware payload (NanoCore)", "value": "c7c69808d91c1b72143c1fd9c56a53c8bac6be4a19c1bf4e337fd1be830a9bf9", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282828, "uuid": "a7fb3216-25e7-4a48-8cfa-e45534a53ec0", "comment": "Malware payload (NanoCore)", "value": "488b76140c9071b4c4b82edb27565b31a3307d1a", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282828, "uuid": "f1218c07-d916-4e57-97e6-a3c413b0822d", "comment": "Malware payload (NanoCore)", "value": "1e78b8a84f10a456ec12006471bcba1e7552394d2b91b21ea58307afff96186e29e80b44c62e806e28bcb03c73002e60", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652282828, "uuid": "49f195c5-3bb2-4f3d-980b-063ebfa58139", "value": "T1C0D42359AF631B732245933C5BC38EF9AB32ABF48361456D06DBB1C3CA648E0550A58F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652282828, "uuid": "df309216-5615-45e3-a4bb-b0cde75eb1a2", "value": "12288:DAg0MQNbjgV5JXkQXIqbCQOsZBxWzMseXQhHKn+hj4dIHtNvC8cnDfR:D30fjgyQvbWsZBxWzMskQhqnySQve9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652282828, "uuid": "c769b026-d4ed-49f7-92ae-204bdb126099", "value": 629420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652282828, "uuid": "55931503-a074-45c7-a0f0-efb7df46dfd6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652282828, "uuid": "084f787f-d68e-48ea-8256-c15f51d68194", "value": "QUOTATION.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8620b4a6-d0f1-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652249629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652249629, "uuid": "36190188-ec05-4f2a-af44-11055ddadd30", "comment": "Malware payload (SnakeKeylogger)", "value": "dbfc62b408019ad0c20c0a6854ff444c", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652249629, "uuid": "6cff8f3c-b18a-42a7-851a-d93c7b217068", "comment": "Malware payload (SnakeKeylogger)", "value": "c9990d23eec99dc91c06b5b078ceba889c75848a2ba5b46aaba0c448a198f2d2", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652249629, "uuid": "d8e82524-fc2b-4a1b-afc0-9d6808692155", "comment": "Malware payload (SnakeKeylogger)", "value": "b7c07c77f990ecfb0c85de1e1adaaf0eff8d75cc", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652249629, "uuid": "71ab6770-febe-41bd-832a-efa4ae51975c", "comment": "Malware payload (SnakeKeylogger)", "value": "52802c449c314fed4d02e638bf43bbd3840fa2644966edff6cd5c4b351f9e5c0bcbd978390f24b348d568affb0b2342c", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652249629, "uuid": "edc44d60-3c3d-4fde-bf43-39987f686a3a", "value": "T1FCB4235BBE69828B11C2AF6EAD136EDB983703D49E3740B73B804C181E054B9A3D1DD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652249629, "uuid": "f16719c0-f77c-4a9e-a78d-2454a3fb86e5", "value": "12288:F0WxhAT6sk6iN+dcLf7JU/9/dW1EuQ+J+5g:F0or6iN+mxQxdYQ+Jkg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652249629, "uuid": "0fed8b22-3ec2-4a98-b704-83f2a75e4197", "value": 501094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652249629, "uuid": "ac784388-9e8b-44c8-8ad6-581965de9bb9", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652249629, "uuid": "6b7e17c5-5e26-49cc-ba6a-b64a2e4b7471", "value": "PR NO 132.pdf.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "909854b8-d179-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652308058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652308058, "uuid": "7bbb5c34-450b-4965-b2d6-5127fd5b7147", "comment": "Malware payload (Mirai)", "value": "2e32f688d9fdbda476891fd50d93ee31", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652308058, "uuid": "ac188692-0bbb-49e6-8122-2708d798b319", "comment": "Malware payload (Mirai)", "value": "ca01731994881c2259cd183052087848117ad27c5db5029e80ab9492fa4897ad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652308058, "uuid": "6af18a37-9504-49da-8a26-138c946a7173", "comment": "Malware payload (Mirai)", "value": "85b01c0aaab70ebba4d686e8916fd533b760135d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652308058, "uuid": "d7d5f303-1b7e-438b-8a43-3d02907edc19", "comment": "Malware payload (Mirai)", "value": "af7614c83efabca249518aad1cd79d0260e85b5428cd88a750d8a334d518658b7bd1279e3915ec267ec044a0160bf47a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652308058, "uuid": "9d123711-2685-4e00-9c45-998407f1644c", "value": "T191D2D13CB6015563DC7394B942DB07A736720FB26603CC83B861CDE2BF82966B597AC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652308058, "uuid": "fc0922d7-49b7-4804-994e-db14e404ba3c", "value": "768:HZNSbj8XYa3x4/piOHoDWjEtuV+FjJgGlzDpbuR1JQ:5NSbCW/IOHvR0FZVJu6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652308058, "uuid": "ce8f74eb-5230-4224-b1b8-4a264e89d23a", "value": 29444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652308058, "uuid": "baeba0a1-ec25-4d7a-8e7d-3f72b957faa7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652308058, "uuid": "bd790aac-0bbe-4a5e-a81a-91102293a72d", "value": "2e32f688d9fdbda476891fd50d93ee31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca9ef79d-d167-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1652300425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652300425, "uuid": "93418da7-8840-4a13-9714-08e954105d5c", "comment": "Malware payload (SilentBuilder)", "value": "8fb6dc44d3a5b1dbf6ce4ee0d166eb24", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652300425, "uuid": "cd6a0041-455b-474d-a826-2f38f57c8a9d", "comment": "Malware payload (SilentBuilder)", "value": "cb1e2bebe4a60f5fc9f44cce7962ed1ade2a297faadf66d1e59a7d0062d1ebfd", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652300425, "uuid": "2f9348ff-5d75-4c52-8ee6-06803d4b9512", "comment": "Malware payload (SilentBuilder)", "value": "4d04a0205d336a984a126f5082cfd6b0576cc85e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652300425, "uuid": "18235df5-1a4e-4399-bc30-2d8383c11cd3", "comment": "Malware payload (SilentBuilder)", "value": "9d48d459a88bfc6f6d0abadc80ff33cc659ec5ab7b50d62289295d2e58808cac27e3c417f00a32dd606595ec1778626c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652300425, "uuid": "a1e89035-f614-4aa1-bafb-91b1502331e2", "value": "T1E303844ABA5AC95CFA25C73548E743E9B362FC101F6B0B873645B3657FF49A04A0360B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652300425, "uuid": "bf589728-7c74-46ba-82d3-04da9498a924", "value": "768:pkZKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgACCBn9kC+xbwcZfqG9tMvcVi1l8:p+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/dE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652300425, "uuid": "9e34e8ab-9a50-4c0a-aff0-f63fb217e8f1", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652300425, "uuid": "b9b78be1-7f59-4ec2-84fc-e2b1c9eadb57", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652300425, "uuid": "3064a466-ed0e-4f00-9476-74087d3ab9dd", "value": "Ace-mexico.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c29aca37-d119-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1652266911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652266911, "uuid": "5b9be108-a9bc-4b1a-befd-c91b16c7bced", "comment": "Malware payload (Quakbot)", "value": "59264478b1f47c3c5ae623e2432ac0e5", "object_relation": "md5", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652266911, "uuid": "7adb9bd6-8f72-4d27-989c-a26dafd7c416", "comment": "Malware payload (Quakbot)", "value": "cbd9a472f9588a205390a6ee56722f15aaefe8364bccfeccf7a8ca04b2ec07d1", "object_relation": "sha256", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652266911, "uuid": "478323a9-585a-4edb-811c-e25ea3a80d31", "comment": "Malware payload (Quakbot)", "value": "22365a8553f3772a6a9ca890f182626b9c596c65", "object_relation": "sha1", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652266911, "uuid": "ac427931-989f-4e15-9741-c530ff5c3812", "comment": "Malware payload (Quakbot)", "value": "e53cfbfdc06c9399d8da460ee363135acf52367549a598a3d900731e84afa2895728b977f0d2fa97e0771fb756874522", "object_relation": "sha3-384", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652266911, "uuid": "550638dc-491e-46cd-bdcc-6f226d1df229", "value": "T1B3158E32F3E18437D1732A3C9D7B7759982A7D102D78A88A6BE50D4C0F396427D292E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652266911, "uuid": "745a11d1-c71f-47af-8a37-3f3526569019", "value": "2ef056f13cabaad369bfc8142f741822", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652266911, "uuid": "44ad4844-8cfc-4fe3-b116-8337442dc0cc", "value": "12288:SQiqrqqTZ4nAQxe/k4XZdAxz6s8I1rm9JDGQkk3CDv+3wMLDUTVScZvHsvZRzIBj:HT+Hn3Ezc6NIUXHCDv+3woAJ3+ZRMBj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652266911, "uuid": "b21255d6-90a4-4c8a-9fd9-7c2b206f3a05", "value": 954272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652266911, "uuid": "3c95f962-3bac-4ef4-b904-8475f5faf07b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652266911, "uuid": "2e9d05ff-02e7-4a43-bb27-f73120fed2a2", "value": "cbd9a472f9588a205390a6ee56722f15aaefe8364bccfeccf7a8ca04b2ec07d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65896caa-d14d-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652289088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289088, "uuid": "6b2dc047-9dbc-481d-bf66-e99d30046282", "comment": "Malware payload (RedLineStealer)", "value": "545661a600cd2804b64cf5bbd82ea450", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289088, "uuid": "0c4b97f2-c074-450e-bd53-b53ec4191f73", "comment": "Malware payload (RedLineStealer)", "value": "cbdd52594dd1f8dad5f83113f09f2a1c086a59dfe67a2b44c159ad1b6794230c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289088, "uuid": "2df5f45d-15bb-43ff-b6a0-5e882bf88122", "comment": "Malware payload (RedLineStealer)", "value": "72e814be4f36921aade07ee881784b64da475518", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289088, "uuid": "3b1f0190-ed53-4bb5-817e-475946e0ecf9", "comment": "Malware payload (RedLineStealer)", "value": "46ee6ef7c15ed31f3d1d1b2fa67c61364e93f9d0d6fd0cf89d4b624ee74274e10ceb04dd51218c037a53a2e88c7d8266", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289088, "uuid": "0999a50a-a9b4-4fb6-b5c9-a751b291d362", "value": "T1F0653341A6E8FF44D73AC43AD96445F1010C5E1D6EB4D7AF126F7E0FC42E16CA2286EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289088, "uuid": "f796cd83-85b3-4bb9-bc8d-e497e1952f4c", "value": "069407361307fa34b23ade96ab2d8363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289088, "uuid": "7581b97b-984c-4bb5-9287-bcebfc137cfc", "value": "24576:MSPxr2ELOSUP+tflBCKzPRfgGWsXeynQ7lWT3Tv5651ZXxhwLQ3/gdKY:JJaHQ3zpgGWMZnOK3j5GZXwLQ3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652289088, "uuid": "3de6c8b7-0f00-4b36-9260-ba12f2da4df6", "value": 1486945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652289088, "uuid": "8956be73-0ee8-4651-802e-591c5cb0a413", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289088, "uuid": "ddcf1854-6684-4ac9-b30c-734ff5387ed0", "value": "545661a600cd2804b64cf5bbd82ea450.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e76a152-d0ee-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652248301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652248301, "uuid": "dea0742d-a896-4e41-80a6-ef4322bc66a3", "comment": "Malware payload (AgentTesla)", "value": "0cc11778e4e93dfd854c2b0348ac1832", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652248301, "uuid": "55276323-376a-46e1-b5b1-9ebe10b096a8", "comment": "Malware payload (AgentTesla)", "value": "cc7dc23ac39ca2ac2def8b58a37dc8cc7b689c2d69da88cff10b8a9fa9b30174", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652248301, "uuid": "4e418a74-5324-49e9-a320-243dc0f48ff7", "comment": "Malware payload (AgentTesla)", "value": "0e2e1c65b7fb59b4dbcf1ddfd8538d5fa5ccdea3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652248301, "uuid": "c12b0f69-51e4-446f-898c-2939b2ddc8ba", "comment": "Malware payload (AgentTesla)", "value": "8b7449dd271293599096a838b7e720d34353abb1332207dd68842946272a4c10ac660d8edadd7c75d32a6a9ab305dbd2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652248301, "uuid": "439fb299-5e5e-47f8-9810-baaf44020cb4", "value": "T173C42315908D48682C189A078E1D4CB6F09C72808FD78AAA55CDD67B7ADF33EDCB6193", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652248301, "uuid": "98cf891c-0ebd-406e-9e63-0d306080f659", "value": "12288:6GRLCva2CFVGbrOkn5eWbBUz1ATg/B69Bf1GEl7mN6adbTU:LLCy2CFwb6k5eMUzqg49fGY7mttTU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652248301, "uuid": "25fe1e66-e3ce-42cb-bbe4-d20cf9d8d2f9", "value": 563904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652248301, "uuid": "96b07180-67a3-47aa-bfe4-e065b03cd6f6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652248301, "uuid": "94cf0d52-1e76-47ac-a437-2e7be2efed9a", "value": "Payment Advice.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67eb53b4-d14a-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652287804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652287804, "uuid": "bc540e2b-e194-4fe7-983a-849dee39755a", "comment": "Malware payload", "value": "1716450f178e5db8bea1bd1c3fb328f5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652287804, "uuid": "3fe4d0e5-ea52-4b69-b974-32722b18c64e", "comment": "Malware payload", "value": "cca8734833c6bc8e1667f09333c198a8ca64a99fbd7ee6cd42f06de680d7025c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652287804, "uuid": "08a5804a-7bc1-4bb6-9811-3ce67e24c7b3", "comment": "Malware payload", "value": "fe6f45384392abc9c72d2857a47b16303db15287", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652287804, "uuid": "3812a8d1-2941-4abf-8870-82e43d42ac60", "comment": "Malware payload", "value": "7b40277b060a5b0b0ee2d70f16e78679a9a633754d024f70356c0d8a6cb04ffa5a7c7ea950257cdcdf657d7ffbfe8382", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652287804, "uuid": "cd468af9-213a-447c-98ee-414bb7c5f63d", "value": "T1135302C99605BCA0E2328E3BE66E562EB6A94E7171DE37E25F109368F0C119F6F0100D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652287804, "uuid": "e3afef9d-df26-4581-a4f6-d720d57b43b4", "value": "1536:xbkdML2gpfq1emDrtZQ8oHuxmlhASc3k6q:xPigvp72Xk6q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652287804, "uuid": "26edec21-1cf2-4841-9ddc-4ac2359978aa", "value": 62992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652287804, "uuid": "6b0217ed-a224-4586-98a8-ee70fd914e46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652287804, "uuid": "6de1b6ca-e8ae-463b-a16a-a12b59fd7a34", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e6b00b3-d13f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652283117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283117, "uuid": "86eca268-329f-4df9-8519-f242fc4f28e8", "comment": "Malware payload (Mirai)", "value": "466e18de45377e4976c588138d545b3d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283117, "uuid": "85d2d44d-17ea-4332-9133-fde702f16af6", "comment": "Malware payload (Mirai)", "value": "cd8bf32a1c9fad9f55350398ff15fbbcd230423dfe4dcab59dcc650d00b5e69b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283117, "uuid": "95fcf8fa-2383-40a4-b8c8-49d8bc418c25", "comment": "Malware payload (Mirai)", "value": "9bf51e1c09f5b56652aafe6c009a594670507fa6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283117, "uuid": "87c20b1b-ddd1-4d09-a1a1-7358de5e7a68", "comment": "Malware payload (Mirai)", "value": "05323c57885f33dd5c300430e600d19971aa4a014cda39cf671dd1f912133eb98234372f2a562140b324df201bf90005", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283117, "uuid": "988e28fa-1cc0-4771-b4f1-f6d5f069ea69", "value": "T150831881BD809E11C6C517BBFA6F118D331247A9E2DEB353CD145B6477CA82B0E37A4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283117, "uuid": "58d1ebaf-6ea0-4c64-97cd-bbf7aab382c3", "value": "1536:29nh7t24E7yFVk20ytEC+1Z4YTjaJuBBPYO9mrsplDKZUlQBKXAVan1X+F8Jyvum:qteyrknytb+v4ejSuHd9mrsplDKZUlQv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652283117, "uuid": "3704ab0e-6cfb-42ac-bdd0-8948e39080e7", "value": 83072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652283117, "uuid": "8862e09b-7cc2-4aff-ae61-5f2e7141e460", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283117, "uuid": "f0010bc0-ae12-49d9-855d-dcbf5dc07671", "value": "466e18de45377e4976c588138d545b3d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c864470-d151-11ec-8e58-42010a9c0032", "comment": "Malware payload (Nitol)", "timestamp": 1652290684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652290684, "uuid": "0730356d-2e90-4897-b83f-52f3bfe908ab", "comment": "Malware payload (Nitol)", "value": "43cdba67516e86a53370b057d0b0de68", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652290684, "uuid": "51952dac-c729-4ad0-b73e-7d6c01ddfe0a", "comment": "Malware payload (Nitol)", "value": "d083094f008a2e68de555a67105f3d6d82605f4af5d52700e171c833f6da10a1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652290684, "uuid": "ed58dfe7-84cf-4251-b5db-a3319960535d", "comment": "Malware payload (Nitol)", "value": "03b05acf4e356ec1c2c28ccf1db75358c8d6a29a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652290684, "uuid": "38cf3bef-8ed9-4ec2-a0bd-7ebad335221b", "comment": "Malware payload (Nitol)", "value": "6b7939b9a848a44c43896bde433a25ca0c2fce2c63d0448dd3b0e84c033ce809c4399f9c10aab95b1dd0d136e7f973a8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652290684, "uuid": "7cd7aba9-dd25-40c1-8a43-ae1cd963c191", "value": "T13B647C1233E1C877D5A601334A92C359B2F6BE51AD3686477BD03B0EEE70252CF25B69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652290684, "uuid": "e713bbe1-050c-41b6-82cf-35025ef3e17d", "value": "4660d4f55970ca074db150bc25297558", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652290684, "uuid": "06e88ca5-978c-49fd-ad5d-4b0f2040b7dd", "value": "6144:ULwpEFWtfJqN4ACGWkDQoYshnGMApM9LXYuEPf:NqN4ACGWCQmGMApM9THEPf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652290684, "uuid": "8548194d-d25c-41b1-9c47-649c6e1ec936", "value": 315392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652290684, "uuid": "a1c28e70-231c-42d1-84c6-6712f13f27f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652290684, "uuid": "f34b55b8-efec-4574-9ec6-71f1f620e052", "value": "43cdba67516e86a53370b057d0b0de68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b338bdd-d13f-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1652283139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283139, "uuid": "8909e618-fd7d-4ace-bffe-8fed1f66edbd", "comment": "Malware payload (RemcosRAT)", "value": "4563c1ba4e3759d5881228727fce684e", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283139, "uuid": "70aea88c-c82d-4548-93a6-3ad613ba826b", "comment": "Malware payload (RemcosRAT)", "value": "d227f2c01b74856507e845738a6177dc8f2b5da7c56b8677fef9b11c7452bf22", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283139, "uuid": "b7381c5d-f4da-4a0e-9736-b9324c30fee5", "comment": "Malware payload (RemcosRAT)", "value": "a50675602689c48ad05010aea094c724d8821944", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283139, "uuid": "1e3e4b04-7c79-4831-a2a3-dce037426839", "comment": "Malware payload (RemcosRAT)", "value": "cbc21957cc0b7faf3ee8bb5aad8cc10a4112401d820b8cb49913d730ba09362e90ced6fc437c0bf3cae6a093fe552787", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283139, "uuid": "b7276aeb-6554-431f-b80c-16bec6902f4f", "value": "T1CFA112BAF684C5B0C61FE6398248BC1C0520BAC3C2D02DC467BC6C2A9C95FCF6D656C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283139, "uuid": "0dd6f7cb-4ff0-409e-b2cf-96bc9e5d7d17", "value": "48:CBn6zALDCn/r4vGXKQuT4vGX1ebB7xxg8PzUPeSy3n5ZWibrE7xxpsGyN5nVJA7w:CB6zVnUujruYlxbnExLAexfqP1nPnx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652283139, "uuid": "51134fca-853c-4e2c-afaf-88211b3cdebe", "value": 5019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652283139, "uuid": "19686f0b-e0a9-457d-a045-eb7b49b8e4c1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283139, "uuid": "88913980-8b48-4d72-a705-3c403d6cabb4", "value": "attack.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7062ab19-d155-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652292542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652292542, "uuid": "ca5a585f-627a-4bff-b7f1-acec388354b1", "comment": "Malware payload", "value": "4089c9acec1125d87f77f0abb10fb378", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652292542, "uuid": "7f933ae1-7c57-47ae-8c51-e814c914e5ee", "comment": "Malware payload", "value": "d2b4dd50a2397e49ae83d7935413e05d5f01c54ec1682f5c23fec5ab5e11a234", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652292542, "uuid": "47491e3a-2686-41e5-a3b7-e6d842c082b0", "comment": "Malware payload", "value": "2cda34ec96bda9f9e0dfc2a38b91ec9d01c16764", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652292542, "uuid": "a1ad6c91-410e-4afd-a746-1f29fb2acae5", "comment": "Malware payload", "value": "d933ce82645ade089829ffc3d1a309a5e496e15112035057a50e05039763538457834e189bf5751a46d5d81346107a45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652292542, "uuid": "cee7d347-bc71-406f-b0b4-7727026a608e", "value": "T170D41254F6A4D762DC7D8BB5983649650335BC3A6920D72F6EE8F3CE2D76B000412B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652292542, "uuid": "18870ba0-7b0a-4826-a67a-8a93b425f977", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652292542, "uuid": "7d1a0a33-dc7b-4442-9605-119fe516272b", "value": "12288:MtqBWkZZES142NhGkpV6hIWDTwLlVhmiaeHNeFbbo9sIHu9:eEZZEc42NhGkpV6hPDTONBa5FbjWu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652292542, "uuid": "8ad6acbb-4bc9-418d-b56e-ec458248f2ca", "value": 619008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652292542, "uuid": "5c5dac81-4542-4b93-80cf-54cdcd1498c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652292542, "uuid": "be662f82-c005-488f-8db8-dcd766142d76", "value": "rdp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02787677-d171-11ec-8e58-42010a9c0032", "comment": "Malware payload (njrat)", "timestamp": 1652304384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652304384, "uuid": "04fad362-962d-44f2-82f9-882930d2afcd", "comment": "Malware payload (njrat)", "value": "19032a2236dab8cba5e224fee5d70212", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652304384, "uuid": "606e1cd5-b858-4e23-887d-c62e98f1ec8e", "comment": "Malware payload (njrat)", "value": "d31dd64e3df970a07d7a59d0f2d65d12dfeb09fb48605daedcb2863f6bc7c77e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652304384, "uuid": "83074f3a-e85c-4fd7-9c12-22e15266d4a8", "comment": "Malware payload (njrat)", "value": "4e569d6be1e2c874e14dc2a72a7b2d36ab916fd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652304384, "uuid": "395bd967-9dd2-4d0f-a376-db775af620c7", "comment": "Malware payload (njrat)", "value": "ef8d24a0a2a954045a90d8fbaa648e9e5f818424d91a047054cdc7aec855c31f85aeeed35de61f75edacdc9103019820", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652304384, "uuid": "f6a65b54-5244-470f-baf4-763a50ae4d40", "value": "T1683533C29365632FEBF63371771A0A303A86A23C26AC1FC67586B141E6DD5DE49C5833", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652304384, "uuid": "6454c154-5710-4438-8afb-42bd6b775f21", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652304384, "uuid": "010cd623-55e6-4b2f-8569-42c7702accea", "value": "24576:DAKCdETSh5JpEqy+z5M4W3GqIXFVXDN2F0dIKvTxQco:DADdEkJpEz+z5M4KQPXDNVXFQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652304384, "uuid": "0560a22d-59a1-46a8-b6b5-208c560b0e80", "value": 1129472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652304384, "uuid": "edc5c61f-3462-41dc-9d9d-65b1990c8fcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652304384, "uuid": "91dfa46b-951e-4780-8c2d-e9ecb4b6d392", "value": "19032a2236dab8cba5e224fee5d70212.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83cc2a4a-d11d-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1652268523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652268523, "uuid": "2676d754-68f3-4cd9-8524-b11ff26ee88e", "comment": "Malware payload (AveMariaRAT)", "value": "f745f14ec7b92747f5561e01f38f9850", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652268523, "uuid": "99378a5f-0826-4e23-98ea-6b618855a381", "comment": "Malware payload (AveMariaRAT)", "value": "d3b47647c4910a938229bdc38abeb3e5b7a5a0bab20913438bc3937be5c47f0c", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652268523, "uuid": "71e4d4bc-5401-4d7d-9f5e-8bda9fb58a45", "comment": "Malware payload (AveMariaRAT)", "value": "ff46ed3e1df0d17bc05e65410c312260962ea4b2", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652268523, "uuid": "6d7fe063-2345-4777-b64f-c8d3393d1c32", "comment": "Malware payload (AveMariaRAT)", "value": "65f66d8020d8912f2c2b6dfbfe615c552af82972ed8b2aa16db0852f052e47f5968dee8a7e3d2ef2be4dd08da3ace98d", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652268523, "uuid": "e6648098-ebf5-41e4-956c-09a736c3d228", "value": "T147C4010CF7EBCA11D0BE2B36D4F5212947B4BA4AA0B3D30E368C164D6E0379749517AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652268523, "uuid": "29e6d530-2dd0-4f46-acac-ae830760a7a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652268523, "uuid": "f7186a24-fe00-451e-a3c9-aaf2145af4e0", "value": "12288:typHp+lUuEz99m1yIlaaaRVgUPv3kvmlKpKm/WwJHMp:gN8Gr21Llaae7PpAoWWwJs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652268523, "uuid": "d5d3ed99-c985-439a-a9ce-3dcd0fb23596", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652268523, "uuid": "6628a83a-1ccc-44fb-9364-37143eff41b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652268523, "uuid": "5b606d48-af3f-4152-bf7a-5e7b48b57207", "value": "PROJEXT FE-KA-00020 Order 00013433.jpeg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51c02dff-d174-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652305805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652305805, "uuid": "783139a1-f2df-4c7a-87c4-2e486d437158", "comment": "Malware payload (Mirai)", "value": "53e6fe14b3cdd1ff8a29ec3d10852952", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652305805, "uuid": "2e6d636a-389a-4853-adf9-2b6cdbe109dd", "comment": "Malware payload (Mirai)", "value": "d3cb1b14eb4a1d4d862af2ad760aa4402ae3da98400a769449e7aaaeeade6d32", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652305805, "uuid": "596c2fa1-8f67-4408-abc2-52a287132674", "comment": "Malware payload (Mirai)", "value": "0f72dbcd27ee59256318b9ce80c2c3e6d67c12eb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652305805, "uuid": "96907731-5d1c-465e-b2c7-6658d3d7eaaa", "comment": "Malware payload (Mirai)", "value": "084d30a6b5fcb2872d524eba1aadb061ae07dba7cb3e15a0ad43869386e6741ca68d7882a2c537aa71d965cbbfe1ee84", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652305805, "uuid": "f25717bf-bdae-454d-898a-7f17a207784d", "value": "T15DD218C6D4A3D4FEED2506B1A173EF329AB3F92E3919DD43C39C98623892540D20768D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652305805, "uuid": "14d6cf35-aa44-45ad-9980-ca6e4264f1c4", "value": "768:gDeXq6m9Vd8fuQcEcFsxi29k9/yE7qTxE70d:giXTm9Vd8fFcEcFsxi2K6E+Txq0d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652305805, "uuid": "0639e3da-0edc-48ec-a9df-e75601f1e5fb", "value": 29456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652305805, "uuid": "fb6e4d33-6b4c-4f65-8e98-aad6afe3b2ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652305805, "uuid": "7c9c5e04-b8d0-4d65-9486-beec75db833b", "value": "botnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff188574-d17f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1652310821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652310821, "uuid": "2401af60-85ab-4cf4-9922-e1cfcdfda449", "comment": "Malware payload (Quakbot)", "value": "5c74a198e84a5041d849ed8aa52da3f4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652310821, "uuid": "d9c8ecf4-cfe8-47e2-a27b-b6d765c30901", "comment": "Malware payload (Quakbot)", "value": "d521d0bac4c3686c76cb620df77379d0061b190704d9ac05ce34d32e8f5cdcc9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652310821, "uuid": "feb92f4d-e8f5-40ac-95ea-a4b6be5ee307", "comment": "Malware payload (Quakbot)", "value": "5d6fe322541c686ae63196d1f2bbe541480ed72c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652310821, "uuid": "7eecfdab-8525-4688-accd-fabb2b62715e", "comment": "Malware payload (Quakbot)", "value": "8b3f74e4e96b00aac42fb34de29e07aa5ec90baeaa5afc4c4c6d8b09a69c3666fe9b088756bfaef479c667c10610a689", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652310821, "uuid": "b12ecc91-9aaf-4d3c-8c03-aea060fcb8e9", "value": "T1EB05AFB875147CD6E66F567BDADABCDC03B6272299CBA4CD80647BC30563372EE02805", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652310821, "uuid": "cc3a8bbe-56c6-440c-839a-f75a96676a48", "value": "99335be05eea85d920eaf8f6f5246fc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652310821, "uuid": "dfa5ed70-726e-4868-b8b1-6fee37205fb8", "value": "12288:pg2boKKRrRYEr991kYgwHXdBRPBPSjpho0vqLks2n2BpJBJC8QEydhIjtkI90N+a:pgD1P96YlbGjwks22B/QBhCfG+6F3ld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652310821, "uuid": "5a8fdb7d-845e-4376-80a6-4eb224fb058c", "value": 819712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652310821, "uuid": "3d303603-1701-4254-a180-c75ae2ba1eff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652310821, "uuid": "cda97404-308c-4545-9352-f8bae8938290", "value": "Astop.OOCCXX", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e81b7110-d10d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652261820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261820, "uuid": "faf74cff-8eb5-486b-8620-8fd2892dd8b2", "comment": "Malware payload (Mirai)", "value": "a1fb9bda727f94566e69e30823d51ed6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261820, "uuid": "2cf0f448-b7ea-465b-b170-20af6bf2c1a2", "comment": "Malware payload (Mirai)", "value": "d634bd707b04a1e7e63b71e060c542716377e987d9ae44f501d7d1e633d5983c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261820, "uuid": "1ea613b0-9f2d-4ed9-a945-4e095e1846c2", "comment": "Malware payload (Mirai)", "value": "bc5a5ddbee5a789e457b65fe23cc15b5e1011af2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261820, "uuid": "ba9880e8-5dab-4c19-8a66-d6866919e90a", "comment": "Malware payload (Mirai)", "value": "bb7603fa27f3fdb98f0ccb931f1721d0f6fdd59a44a00fb506f146fc0a8463ba789be8cb2fa28f91ffd847a080653833", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652261820, "uuid": "22273815-c8c9-47a2-89f3-61adab75944d", "value": "T132A3944ABF215FB7E89FEC3745E92706288D611720A93B79B934D904F21B31F19E7860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652261820, "uuid": "620b90d0-f847-4bd1-b98d-20fa68460088", "value": "1536:a2fsCDpMtQagM6PkH406j5Tb06wnDQhPqf/Jc+n7bdEgvch9p/:a2UCDpMtQagM6PHj5P0tfJEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652261820, "uuid": "152eb1e9-34bc-42ba-9ab6-3ff4caf28156", "value": 101676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652261820, "uuid": "91626182-ab87-4e26-a12e-3214c05acd5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652261820, "uuid": "21778805-fd4f-4583-9940-b13fdd4fd70d", "value": "a1fb9bda727f94566e69e30823d51ed6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "673f13ca-d179-11ec-8e58-42010a9c0032", "comment": "Malware payload (FFDroider)", "timestamp": 1652307989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652307989, "uuid": "de02eb6c-5798-48e9-8391-8240af8d3e3c", "comment": "Malware payload (FFDroider)", "value": "dfb6e366186969c7265e5602a4b85335", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FFDroider", "colour": "#C1C037", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652307989, "uuid": "4318930f-e06f-4fc9-9d41-d58fa3aa9105", "comment": "Malware payload (FFDroider)", "value": "d77bea86bd4c36acae410d6dec8e012439e36d6226d99f1fd7de29827fca3835", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FFDroider", "colour": "#C1C037", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652307989, "uuid": "b4982952-99a5-4458-921d-4ced402a3a41", "comment": "Malware payload (FFDroider)", "value": "f20c75e427ef43b853b4a053e98cd301cae331c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FFDroider", "colour": "#C1C037", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652307989, "uuid": "1ac14719-3bd6-42f0-b146-576cf2d6b3fa", "comment": "Malware payload (FFDroider)", "value": "26b69dab1d110586959d7b06a6122919ee29e96c3d4b07350d11e36bbe98ae0b7d5bedf7d7ae0493c318cb37f2461cda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FFDroider", "colour": "#C1C037", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652307989, "uuid": "b5be7f2c-9386-4130-aeb1-20f771e7b7b5", "value": "T1EDF50221BB93D879F47254F08EA6C2C89567B991AC3AC2BF75C1132F1D30AD0AD36572", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652307989, "uuid": "7e6a8341-ef57-40d0-b4d6-ef38f181cc5a", "value": "a71b735d20c1b17c39530e3975651687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652307989, "uuid": "86faf48b-c34b-4f4f-9b3c-a7eb5bf1a6e0", "value": "49152:ZyV3P4uIjAcmZMTmcZ+6TBp1Zf0J/E+g9H+rEK+/085bR5WUd1H8KcTqUyp+SPdn:ZyV3AuZMRVg/qHIE/SW1Tc38+SPJr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652307989, "uuid": "54d19401-8d6a-43da-8e3c-49f41a147acb", "value": 3462656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652307989, "uuid": "427625e1-c73a-4a6f-a379-cd4d9d41f578", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652307989, "uuid": "6f80b0bb-84d8-41ea-93ba-49165775eb1a", "value": "d77bea86bd4c36acae410d6dec8e012439e36d6226d99.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61cc7de0-d13f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652283069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283069, "uuid": "87812649-9b7e-46d0-8531-6a74d149dc03", "comment": "Malware payload (Mirai)", "value": "3584d40fb87523f1bb8c0aff8a1a2162", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283069, "uuid": "f2d82f93-2e52-468c-bd7d-3af08d05c5bc", "comment": "Malware payload (Mirai)", "value": "d83f9a6903872b04ae4bb7d2d82c07a9a26dc5ff100d9de0bbb571206c0a04cb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283069, "uuid": "1e6e739c-53db-4e7e-a27d-014c38afb150", "comment": "Malware payload (Mirai)", "value": "098f96fee4374173e5dfa601da1fd129c29b9ecc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283069, "uuid": "cbca5dc8-ef74-4beb-8745-a5d4aa1642b1", "comment": "Malware payload (Mirai)", "value": "da0099013f721ad0acb26f2c07a441de02d1e69fb040c1756d284817a8a0229951d8649a6c8a14b21bc23218733b5d9c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283069, "uuid": "aa1c4ba6-a28f-45fd-81ad-a43542f8e867", "value": "T10CE34B42EA408E13C4D51B76FAEF42493322D765E3DB73078D185BB43F86A9E0E63649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283069, "uuid": "0e20f067-06c8-4f9a-ab6e-19612b2859a0", "value": "3072:pO3gg6ZpK00mhTTIhdt9mrsplDKZUQQBKXAVanXX+F8JyvGPhLZ85iBMR6yoC1QG:pO3gg6ZpK00mhTTIvt9mrsplDKZUQQBr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652283069, "uuid": "93181f7d-2d14-42cd-80bb-409c499fa646", "value": 145189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652283069, "uuid": "18a62048-e1c7-4aec-8650-6aa5612bacf8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283069, "uuid": "e7031fdd-c1b0-444f-8e7a-200e502534ca", "value": "3584d40fb87523f1bb8c0aff8a1a2162", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4286089-d0f2-11ec-8e58-42010a9c0032", "comment": "Malware payload (AsyncRAT)", "timestamp": 1652250109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652250109, "uuid": "0b3632dd-619d-446c-80da-549560549c28", "comment": "Malware payload (AsyncRAT)", "value": "334749e376e6e909e779a83d59fad3bb", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652250109, "uuid": "5eff843f-852b-4590-b828-49e336bdd8dc", "comment": "Malware payload (AsyncRAT)", "value": "d91cd971207b49e38b00e74b2060bd2e52f02f8f036a028198d836a8c88ee501", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652250109, "uuid": "46e542a5-b56c-4a81-893a-d590bdf5a23d", "comment": "Malware payload (AsyncRAT)", "value": "498024151456fcc7bfe5627b733af39fa0a00c51", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652250109, "uuid": "0e1d7db6-a490-4463-b8e4-b1e0018e2bac", "comment": "Malware payload (AsyncRAT)", "value": "f4966a0bfdc7e30a129810c9b71fb5ac5e4adf864dc846b4c234da4b2afd393c92e716f86cc5e23254d1c03b1b9e7075", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652250109, "uuid": "4726f541-30fe-4c7b-ae70-1e8d5dc4c762", "value": "T14AE0F144FBD7B4C70F934E49838446104300D709213EF0E70C34D76841000C1F60511D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652250109, "uuid": "7c5545fd-4afe-42c3-8ce2-4aa8b986bb1e", "value": "6:nay6VGEIiq9NQKEMwoovgHNXzHzbvUTDl95CiXWX+jWNeEMMJV8v:n561IiqgKBwoovgtXzHfv09ciXWeBI+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652250109, "uuid": "ae6288d5-5928-4efd-85a6-4ceb7dbe46a6", "value": 388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652250109, "uuid": "250ad40e-c3bf-4f2f-8c5f-5c40433f83d9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652250109, "uuid": "fadc52eb-dab4-4d3a-b961-fcbd95682500", "value": "Bill-05102020-9S4N7A8B7X3L0A2H4J9D3T6C5M8B2.v.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eb0d7cf-d11f-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652269293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652269293, "uuid": "69be8971-fb59-40c6-a911-0fbd204efe54", "comment": "Malware payload (RedLineStealer)", "value": "34df02fccac9298e55d9499194326e72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652269293, "uuid": "7a12d2b6-ab89-4718-a6dc-abe04587017e", "comment": "Malware payload (RedLineStealer)", "value": "d9f760b8a816436eb15375d424137331c3753d48919822d1535ef71d0c600718", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652269293, "uuid": "4f9c178f-fb4c-4299-9aa4-b716f70b3b9e", "comment": "Malware payload (RedLineStealer)", "value": "ef879b95fdb59fc93af276b1084ab393e255ae83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652269293, "uuid": "decbb717-0a16-45c8-bd54-7c8e900e6395", "comment": "Malware payload (RedLineStealer)", "value": "5bae9eeb0a67294601c243f09b43a4f9b77d823e3ed2cfd0c40f87c9685e4bb21d5fe12e0a9b88da47b4921f70018db2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652269293, "uuid": "68037af4-982b-4ebf-baa1-b0cc07881a3a", "value": "T143B33B6C73DC5618E5FF8EB078B151D146F4F5A26C02D79F4EC4A49A0E22B80EA12BB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652269293, "uuid": "153d6842-e009-4bc6-838f-adb8be54cc54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652269293, "uuid": "428ec2c5-446a-4b6b-b010-01d740807d0e", "value": "1536:IRxqkCr3Q2IRA/cGB5USktl8xEi5EvfMHg3OZbuZNoxUr1AdG0wuei6DLI:ICr3Q49edi5qfMHsG6pAdGhZM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652269293, "uuid": "fc2b766a-64ba-46f9-a821-65babf5879f5", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652269293, "uuid": "3c9b9254-6278-4876-87aa-a1deb28ac76e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652269293, "uuid": "374c9ec9-4306-453d-9a41-8814bf511ad6", "value": "34df02fccac9298e55d9499194326e72.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0460191-d110-11ec-8e58-42010a9c0032", "comment": "Malware payload (SocGholish)", "timestamp": 1652262988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652262988, "uuid": "29028251-bc87-4b03-8e35-47a840afae5b", "comment": "Malware payload (SocGholish)", "value": "b0b442ba53656e1e7defe7a58fe0fb2d", "object_relation": "md5", "Tag": [ { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652262988, "uuid": "b9cc5902-7ebc-4e25-aa49-f1e2b6b9c9f5", "comment": "Malware payload (SocGholish)", "value": "daf92225b188c1c519f9c6f05d95e691538a43e0a1a26389d9fac7f29babeb46", "object_relation": "sha256", "Tag": [ { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652262988, "uuid": "aae052eb-745d-41c8-91f7-ae1d08f02119", "comment": "Malware payload (SocGholish)", "value": "9f4964ed7fe02e03ceccf1ffe17b3b25d6144a57", "object_relation": "sha1", "Tag": [ { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652262988, "uuid": "d18f1856-46f0-4ef7-8947-04135515c59b", "comment": "Malware payload (SocGholish)", "value": "fd1f0ced31449934c9f572bf79c57f27b5bf9c0749ff6652a550f0ca0b58dfc966980a717760c12313509ac16ea6bfc3", "object_relation": "sha3-384", "Tag": [ { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652262988, "uuid": "0962e5a5-c072-4e6c-95b3-92208754fa79", "value": "T15411C4C2A8BC03FAFC678F3802B04A0C4E1F6A984C530A4F46B516E310983B11AE87C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652262988, "uuid": "32ce52b4-6a65-4f1a-99e0-b88254f26d4a", "value": "24:9ulMHtbNOaNc+l6RpO7QB1mxXoX2ptkeCiAbVlDvv7blm1Gn:9u+HKaaAypg61PPAAZlDvv7bZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652262988, "uuid": "e4dd6af5-a5a7-48c0-ad78-cc62fc3c9536", "value": 996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652262988, "uuid": "cc7be4b4-5f83-441f-b07a-e6dd57acd949", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652262988, "uuid": "580f0e8f-6f19-47b5-afa1-670a3c9b5096", "value": "download.845d.8848.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "947d39a9-d123-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652271128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652271128, "uuid": "9c26916a-3870-422c-8811-2655b8ee5cf1", "comment": "Malware payload (Loki)", "value": "d03317300292297a16112f36a1e83bb8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652271128, "uuid": "f11cb79a-b59b-4c3c-a6f4-66b2364240d5", "comment": "Malware payload (Loki)", "value": "db634f40121feab576a36a525042fa80a16c79a5c34f566266fadf897487c2b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652271128, "uuid": "dcf7a993-8d15-42fb-b9b8-eea55b68706a", "comment": "Malware payload (Loki)", "value": "419d30382bf5ecc8b80c8d94a0e3f9921e72e13d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652271128, "uuid": "9307ff32-927e-4b60-a6d8-b26877c7437d", "comment": "Malware payload (Loki)", "value": "649a9122491bea1800402d6f03984b79776c34638b4499cebab8456dd773ce0f94f1581885c304baa38f3544c65ab5ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652271128, "uuid": "4d399358-8063-403c-b611-283673eae03a", "value": "T16E041206F3D2D763DAA31F314D779BAE4FE69B292474440B4391362D3DF2682972D206", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652271128, "uuid": "e81fcf4a-8290-451e-a52b-8d332fd418b7", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652271128, "uuid": "e240e6b9-0b99-453f-b6e6-3cb3c7d4d89e", "value": "3072:LODZGPEounbNrGg/yuVbs6ZhcchZ3OXdut+R7IgnKozO8EUVCRW+KtDm42eyzZNx:LOtIOkg/yQAYvhwd5RtO8tCRW+KtfSNx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652271128, "uuid": "aedc0b12-e330-4a91-a3a3-ab0c7be13125", "value": 183201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652271128, "uuid": "4ff36839-42aa-4042-b874-e20bbb057813", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652271128, "uuid": "dc77d95c-798c-40f7-af09-8b51b69984a7", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d865c72-d0f1-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652249561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652249561, "uuid": "7091af1c-d0c6-494a-a1eb-164b3157d957", "comment": "Malware payload (AgentTesla)", "value": "3137229e65d0e652f907ed2371aec681", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652249561, "uuid": "3db7ca7e-4c52-4540-93b0-f29b963d7c16", "comment": "Malware payload (AgentTesla)", "value": "dc3459d5398a6d86791654cd77f98a801bdf74fdb888707e6a65ec23a0cd9e7a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652249561, "uuid": "ce00c306-898a-4c7e-a94c-45ff73d6630d", "comment": "Malware payload (AgentTesla)", "value": "257e40f6f38269a2c002b2f7c1b1fcd2898519da", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652249561, "uuid": "4096365a-a319-482b-8a23-e59ac959c1f0", "comment": "Malware payload (AgentTesla)", "value": "885c13a4b7e1292eb6c8da4250da5012b769426a88000b5df6b890f11fdf3f642409edc39421802ef8f173cbe4f58ca2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652249561, "uuid": "4aa59f8f-13f4-491a-a0a5-0315e313597b", "value": "T16E74233EB24DB3A09991CC413B3FA1BDB2DC0455054FB83DADCD437A632EB4415A9E99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652249561, "uuid": "a8153ace-a89d-4539-8d1c-108f36f2f3f8", "value": "6144:H0gZZzd87Zd8Na8VgAxqr1KKFks/8jsaOsp7ELo/923j2/Ywdd:HDcddaa8VgAaZ/8jsMpQo9qwT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652249561, "uuid": "5bb34c72-9b3b-4261-9193-c2754f6c0823", "value": 339116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652249561, "uuid": "1a666028-9b99-43d4-ad19-874f544e89b8", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652249561, "uuid": "6aa163c1-afa2-4d70-aec6-61a724780639", "value": "14226INS0007573.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9235cb9c-d13d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652282291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282291, "uuid": "c4af1add-7611-4cf6-a011-34119236a9c4", "comment": "Malware payload (Mirai)", "value": "d1e295cbe8a385596711827b8f94b1da", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282291, "uuid": "d1de6873-75b6-4905-954e-6bd2b15a4d85", "comment": "Malware payload (Mirai)", "value": "dcd5907ff4aadc146747093fdb2419cbc512247b348b2c702e243413b8ec4bdb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282291, "uuid": "1fe2c4c9-4c9c-4148-a9cd-0e2eb51b58ed", "comment": "Malware payload (Mirai)", "value": "6fc7880beef73c99388c0ceb9d71ff10874bd450", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282291, "uuid": "a4e2ea84-d79b-49a2-87dc-3943aab4b434", "comment": "Malware payload (Mirai)", "value": "541ef3e1244f420e859265ec6342709d6648f5ec2f11dec2cd572d3020a0757847158820d4e713e246b2db90f0399f74", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652282291, "uuid": "a090e8b6-96e7-4304-9ae3-af50a24eb33c", "value": "T1C7B3F805BF710FB7E86BDC3745A91B45188C995A22F93B32BA70C428F64B64F19E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652282291, "uuid": "b6000525-cfbb-4eec-b254-61c2183ff960", "value": "1536:mYtGmtsRpf674oAKqXsxUFqJ7sDprVGy+y8RZWVymXUSZ0xoa16OA6a10Ga5:mYtTtKpfE4oAhsGFqFsDpr+3SQke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652282291, "uuid": "6d4c097f-b034-4490-8934-c16bb6c75cae", "value": 109844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652282291, "uuid": "e49215e6-3cdd-4ea4-9d36-b8df6498fd97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652282291, "uuid": "1f302a1b-026d-4164-859e-a9b5167ea175", "value": "d1e295cbe8a385596711827b8f94b1da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4067e06-d164-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652299206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652299206, "uuid": "4411b73c-efdf-4e59-a622-038e7560bca8", "comment": "Malware payload (Mirai)", "value": "84d7769be94cfd0267745bb790f354ad", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652299206, "uuid": "d7bfa8fb-ef51-421c-a3d9-6f0f075d93fc", "comment": "Malware payload (Mirai)", "value": "dcee696a98de60be80949d212b8d6e52f00f3a12ebdbe2ede0a85aa14dbc6546", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652299206, "uuid": "1391ddeb-b120-4230-bf4b-c7856908b337", "comment": "Malware payload (Mirai)", "value": "499c0445962feb3db9483b901a7ba446309983ec", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652299206, "uuid": "9661b495-6aad-417c-acf3-795bd5882c96", "comment": "Malware payload (Mirai)", "value": "6ce4b1b359be7f6118b9fc10d9cc70c87b254d50f5bfb7dd873377bb9363f8d69327a9d4479c1323e1ead47fa8f4483f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652299206, "uuid": "81498a7b-c4eb-44e9-b390-1b65343cde94", "value": "T165B2E10E92FB570AC84F013BB35E469B5C7578F3948BE351176B8358C35AA9D4A33D04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652299206, "uuid": "67823d58-4390-4e26-a7d7-3d1206f718b2", "value": "384:MMT44eyTGkYNxGdfVlZVXTkNi6iLvG6pYLbWII4i7Zt+7DGeXKslZFILv1RM:3c4VTqxufVlzUULO6iLCII4Ut+7KgTIM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652299206, "uuid": "fbf8c49a-29e8-4f63-8e62-b57751c95528", "value": 24748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652299206, "uuid": "6f3ac9fd-21c1-45dd-ad0f-b2abe20db0eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652299206, "uuid": "1692b3fc-f549-4dae-ab6a-80b8b2e33dc6", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a224d480-d0d4-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652237221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652237221, "uuid": "1cd62d14-e559-469b-b36c-7fa22d4d7dbc", "comment": "Malware payload (RedLineStealer)", "value": "6206ad0b97ce8e35d5651e615b3b3048", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652237221, "uuid": "eaab4f51-fe14-4219-958e-024cd1c5fae3", "comment": "Malware payload (RedLineStealer)", "value": "dd14e54d550a3bbdbc1bc67553c5b3963a4b3007240b5bfc45bd3bfcf3356fd7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652237221, "uuid": "9cd1c35b-8a7c-4737-86b6-86847a45f114", "comment": "Malware payload (RedLineStealer)", "value": "bc556bdb576a2d7973ba61589fb10582be2a4098", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652237221, "uuid": "61692330-24fe-4d80-b390-39ec60c9cb97", "comment": "Malware payload (RedLineStealer)", "value": "e1eb8860e75b3365f4e579adb75543d1b23497a9fd20dd9c4f1a55be232a05c852f8e86ee5fa6a61a8524f0aa26df336", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652237221, "uuid": "0b7863a1-dd1f-4d31-bf19-c0958c734f2e", "value": "T1AA74DF02B6D0D830D1E38E305870D7A94A7FB88216B5544BF7B87F6F2EB13916AB1356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652237221, "uuid": "848f270b-bb3e-406e-82ee-6ef8605af73f", "value": "d9d95fd58a88cd9dff2eb6f1f682782c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652237221, "uuid": "69e1433f-5d92-406d-828e-144a098f95e5", "value": "3072:F8jHT7zFK0oCBJS/szMKe0n1pLUJ4/Qw3M2a2mGzTRFsxkgaBCh:kHT7xKAJuslei15q4zLWYTAiga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652237221, "uuid": "2be0eaed-0420-4f69-9ac0-16d69443128a", "value": 343552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652237221, "uuid": "9d1e4cc6-0f3f-40f4-ae03-ac3bbff481c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652237221, "uuid": "327ef62e-79d6-47d9-9df8-830119fc5f2f", "value": "6206ad0b97ce8e35d5651e615b3b3048.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13477e29-d0f2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652249866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652249866, "uuid": "2aee0c22-45e3-439f-adc1-f2fc4a5ca1fd", "comment": "Malware payload (Loki)", "value": "a5596d211ed324c578860a74afd33004", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652249866, "uuid": "35b2f11d-b97a-4536-82e2-e8ecbd276b02", "comment": "Malware payload (Loki)", "value": "dd3d5e3e01b86223fd3a517b9d153fa85a842d4b816b18f747d85df181e1a38b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652249866, "uuid": "c59b6ae4-6ee2-4b62-8fb8-1e049ec57751", "comment": "Malware payload (Loki)", "value": "afc724f78950a71677593f82e609289f303a4cf0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652249866, "uuid": "bd1f67d6-8700-448b-861a-fc8490443891", "comment": "Malware payload (Loki)", "value": "d63fba89c25c1f0b21fc3e9744d2e1fe6e32580744c9ce97e13a001fb6f47868809210155ad18ae163f29b5dc50fa838", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652249866, "uuid": "0d8b70f8-b325-4359-a8f4-95142e28e2e7", "value": "T15EC4010566F89B60D6FF1F79247E20140BB4BD17AA72E31E4F80688D7A937820D957B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652249866, "uuid": "90d8a098-83cf-49e7-9935-8ab6e91768f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652249866, "uuid": "3ebbfdab-a9da-4b05-8d49-f322a47fd3cd", "value": "12288:sp/pTe5W/ullAH3ADRbg8ssbd4auzw/PZZqNhJtua5fop:sRkomlAHMJd1MWPzQhJtu8A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652249866, "uuid": "5e5a6db6-5eba-46cf-86c8-20050a351765", "value": 567296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652249866, "uuid": "79b9289f-bda8-4dee-8f56-ddbea8f447f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652249866, "uuid": "e3962d80-10ab-457e-944d-4ceb3ee2572f", "value": "DHL36789_46T7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f63ab66a-d129-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652273869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652273869, "uuid": "c2ef7745-865d-4dc7-993c-08951641b7a4", "comment": "Malware payload (AgentTesla)", "value": "b9af820a76e9b5ca57a6361ef665429e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652273869, "uuid": "a37c9347-e0c4-49a9-8374-b9170b1ece0d", "comment": "Malware payload (AgentTesla)", "value": "dd48115d96e409347d20014df7b3fef93a219a9709396dfd95f4527de62878a9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652273869, "uuid": "03eaa24e-2ad2-4469-8660-b9e56c948433", "comment": "Malware payload (AgentTesla)", "value": "cd70d870eeac36b53b90fd888f3f707ddb2700ee", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652273869, "uuid": "dce1ef15-1405-4fac-ad9b-6314511da02e", "comment": "Malware payload (AgentTesla)", "value": "41554c1a4882b4ad804264929af5e6f17d70e84b98d5c97f42092e56aef89d308abdddb92db1b49313ff86a4410bdc9b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652273869, "uuid": "79566ad0-73d1-4c8e-909a-e9164212e4cd", "value": "T138B2511B775D8221D5F71AB4BC9391880626BF0294D2A31FE4E8BE2F7F3314987B2561", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652273869, "uuid": "491511f9-51cd-41d1-ae10-5de87a668ee4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652273869, "uuid": "9ed6025f-143e-4e1f-999f-953243b71809", "value": "96:i2W5Eu5ZFQ2z9fvgTQbTVrFUC1Az1Vbn9yIh8jBBZ77Ees9CG7YqIlJFnUL:BW5EQPQw93QQbTHD1K99rupts9l8qhL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652273869, "uuid": "92d09048-41e9-4dfc-98ab-dd7009766ea8", "value": 24576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652273869, "uuid": "be6fd94e-5456-47fa-a4bd-19adb71b51fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652273869, "uuid": "0a77d06d-adf1-460c-bd69-de2861bd3692", "value": "MT967730013.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa909d83-d13c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652281903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652281903, "uuid": "5930e658-7f5d-40c0-8267-855a3f50e1a1", "comment": "Malware payload (Mirai)", "value": "92a67176da2b5c090a3da24c4226beb1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652281903, "uuid": "2314490d-c11a-48fd-a9a4-475b2aaa54e7", "comment": "Malware payload (Mirai)", "value": "dde30fe80c424f71cfa0bade9e3d31211b24dae99c69733388217fbc6fd815da", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652281903, "uuid": "8671e8d7-e47c-4886-bba8-5fae3887acbb", "comment": "Malware payload (Mirai)", "value": "50c36e9207cad4718d48181cda4424351faf1843", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652281903, "uuid": "a1a7c367-a7b9-46b6-a9b7-616bf0343f33", "comment": "Malware payload (Mirai)", "value": "190394ad36a828e3ed28ad80897fa3d0875e02d00b95dedd4c95dfd42117b76321d8e6c3fadcd72f7b97c445174b258f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652281903, "uuid": "81f5f890-cac5-4869-9408-f52942b01c6f", "value": "T16583930AAF714FF7E8AEDC3749EA1B4524DC601A21997B79BA30D418F25A20F14F3875", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652281903, "uuid": "4dd6a44f-4448-45fa-a673-25c763bc50e4", "value": "1536:SuSFceW8JP33UBLwYpWoPPcsVsSbBD1OVeBSyR:/SqeT3EB8M1Of", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652281903, "uuid": "b0efefef-b90f-4613-bd11-e61b7946de4b", "value": 80976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652281903, "uuid": "a263b4f0-ba62-4851-a134-0f7cd86066b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652281903, "uuid": "cfdfeae2-baa2-458f-a439-fb51787e609d", "value": "92a67176da2b5c090a3da24c4226beb1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f31c5443-d105-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1652258402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652258402, "uuid": "aff97be9-28d0-4e41-87c8-1c009efa1354", "comment": "Malware payload (NanoCore)", "value": "1f04c12ab3a22f6806d30bacb7552f19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652258402, "uuid": "0dcb3fa8-2ee2-46cb-ae6e-879b860f73e1", "comment": "Malware payload (NanoCore)", "value": "de42477eb270c42a2eaf57e6efb465263fc02e72e6c8442fdbd27aa3bd8e76a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652258402, "uuid": "3a2eb1d5-0d7d-459d-a5f3-adaee4b00416", "comment": "Malware payload (NanoCore)", "value": "9913975b167b01b96364cad477ca6dfab71da454", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652258402, "uuid": "ac916d60-248d-43dd-bafd-a021c19c6353", "comment": "Malware payload (NanoCore)", "value": "a458abf361b5cc780093eac439945470f5a7565cd177193a63e4e811c9ab3a0b2b5765edac7eb90fd3b6872406156f06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652258402, "uuid": "f7a0859b-6ff8-411b-8985-5f45ef8a5803", "value": "T1E24528987254F5DEC85BD071CE685CF0AA207C66C32B820B50173D9DB97EA83DF219B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652258402, "uuid": "56a6df82-4b68-4762-abb8-e6b0a7e78f61", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652258402, "uuid": "e4040588-a753-4601-a06a-0f4a5ee46285", "value": "12288:m+Cenfxt7J00Fq6j/wXgl4NV77zvRE2hEr5hHeC5ROGFmTDcvvj6yVBJGen0ni+f:mZg20Fbo7/762hM5hPTmTAL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652258402, "uuid": "dc3d9ab9-e548-49f4-a61b-e8f5ff73d980", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652258402, "uuid": "f9b67a76-4cf6-4318-8365-b767b0806ff2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652258402, "uuid": "b8af4f21-11f7-4611-b20e-ff9f811d3139", "value": "SecuriteInfo.com.Trojan.PackedNET.331.28355.4334", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fc1e970-d0d3-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652236680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652236680, "uuid": "2aeebed9-fead-4ba4-9f6c-8bf11ab98bdc", "comment": "Malware payload (AgentTesla)", "value": "933a4278a070f87cddf06e353dc33a82", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652236680, "uuid": "ea7ccae0-ff21-4ed4-991a-38ba22603886", "comment": "Malware payload (AgentTesla)", "value": "df2ac2b254e2e1f6cf7775179ec5af8b4785e3eeadf0f0364b46f33da5068e62", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652236680, "uuid": "af0d7c24-1c19-4849-b9bb-676092453e68", "comment": "Malware payload (AgentTesla)", "value": "f5c23f45f7b019f0ddd45ac4a78b53ac72cee985", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652236680, "uuid": "6026739d-115d-4670-aff7-9ea6b4d89a1b", "comment": "Malware payload (AgentTesla)", "value": "da7007acd9ec9bfb50562d72906c7875b49df8e7eaed0ff4b6aef9d4c98c95b97f02d2b8b10b29900c186a1cd07d99ad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652236680, "uuid": "0bca31de-54d2-4ae6-a111-d4678978dc38", "value": "T17FB2215B775D8225D9A30A75FCA351880676BF02A4D2A71FE4E4BD2F3F331084B72661", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652236680, "uuid": "50b610c7-10e7-4218-9594-3247a3107c87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652236680, "uuid": "0e5a722e-1a3f-4b06-897b-2ecbcd4f6fb8", "value": "192:kJLskehDYO0qbh1bTpjy1nup00s9lx00h:2ehMHSh1bRy1nHdHx00", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652236680, "uuid": "12c3f7d9-7145-489d-ac47-7a680fd40a9b", "value": 24576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652236680, "uuid": "1170d51b-56a7-4450-b0d3-59d2c279601d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652236680, "uuid": "a5f9ef88-750d-4694-a2d5-f4f0a3cdc155", "value": "SecuriteInfo.com.W32.AIDetectNet.01.14970.29838", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c59bcac-d156-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652292992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652292992, "uuid": "3f7fdddf-e6e2-4d77-a0d9-5ceb8ad8aa77", "comment": "Malware payload (Heodo)", "value": "e4b993570983b9a9f84f1b9984d5a931", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652292992, "uuid": "0753fbd6-5d30-41bc-9fe2-27391944aad0", "comment": "Malware payload (Heodo)", "value": "dfa6cfe4d1a9ce6f27b36952a2ee4ac5c09cc2f06b7a77c62310fdd6ea2aa4ef", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652292992, "uuid": "392b131c-fa72-436c-a849-d2dae46caf59", "comment": "Malware payload (Heodo)", "value": "16fb235fdbe6b3b1fce7f0819773a2e092565e88", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652292992, "uuid": "9460210f-bc70-4a21-ae72-b126f61d460e", "comment": "Malware payload (Heodo)", "value": "76cafd705b152726ad815758566767db851a52f9eddc5b75a9113693e327578c849ebeaa19e0f15309e0a8f37f020784", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652292992, "uuid": "1bf2c56b-9cfb-4d33-9698-5a2deb5d5ab4", "value": "T110B4BF06B3A504B9E467C174C9735952E672BC121761AAFF33A0436A2F37FE06A3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652292992, "uuid": "934179a3-cda3-4c84-9251-c60e8e54d4be", "value": "6196af15ce9ababd9a592319b3043ede", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652292992, "uuid": "1fcd1f32-ccb2-487d-8d77-ff53f6782bd1", "value": "6144:iuD3jumQgXW2jLi1QPy+hSVL+ymiohaCdtUPM1UlTIqNtF1FMytrf:ZDLVXW2j21QC1+yZottUPMg9Z1FMyB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652292992, "uuid": "967e1e64-8056-4223-b2ba-66ebb6637733", "value": 513536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652292992, "uuid": "5ae3475a-ec3f-4fec-974b-13002043c82d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652292992, "uuid": "62d66589-1ad7-4c2c-9dee-c597042f38b2", "value": "e4b993570983b9a9f84f1b9984d5a931", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80b6f0a8-d140-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652283550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283550, "uuid": "c09f1122-a32f-492d-9362-7c4af4a55593", "comment": "Malware payload", "value": "79c7219ba38c5a1971a32b50e14d4a13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283550, "uuid": "b875459b-b2cd-4d92-841d-2553b0d1c2e8", "comment": "Malware payload", "value": "e0872958b8d3824089e5e1cfab03d9d98d22b9bcb294463818d721380075a52d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283550, "uuid": "bbd4de4e-b5eb-49db-93b8-b69f708515de", "comment": "Malware payload", "value": "b39b3a778f0c257e58c0e7f851d10c707fbe2666", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283550, "uuid": "ee1a4f6a-15f8-4c14-8885-9dc07e100a9b", "comment": "Malware payload", "value": "391737d1573bf904bf3f1b12c3a81b8212e434d7cae86f59581636bebaacfc51edb9128f1f403a84fab7c683537f2867", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283550, "uuid": "4bc3e77e-47b6-47d6-9332-32c6035c696e", "value": "T17AE240102DDB10EAF37B4BB457D9BAFF06B6E4F6690DB6B82492598407326C0D811F78", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283550, "uuid": "4d108106-f580-455f-8980-ee569ba42be2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283550, "uuid": "40be3cac-0d2c-487b-b335-329cb6f5feb7", "value": "768:bEj9FSWZxm3eJ38Etub7B/iGkIJywnYwVMwfJhVRVmHUFeP+SVL/mVW5iV7uVSxH:gaSLub7W8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652283550, "uuid": "907959c0-6a12-4556-9928-8f6750a9b42f", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652283550, "uuid": "5c6ee82c-5a66-49bf-a712-af1b0d049fc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283550, "uuid": "ab25663f-a3c2-4aea-9d36-c64905c51c8f", "value": "update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2febbd4-d131-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652277246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652277246, "uuid": "15fc3dba-7d13-49d9-9e74-671ea0d73512", "comment": "Malware payload", "value": "4b9f28c6d737b4246ffdcc175c972049", "object_relation": "md5", "Tag": [ { "name": "G0nnac0pe-Kekware", "colour": "#D9A267", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652277246, "uuid": "d0f237e8-da64-467e-bbec-95343da5f02b", "comment": "Malware payload", "value": "e0946a55e9cbdb3485f154f72994bad765b74ba280a2149485af113503b7dc78", "object_relation": "sha256", "Tag": [ { "name": "G0nnac0pe-Kekware", "colour": "#D9A267", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652277246, "uuid": "427e2795-e742-4890-8023-dec63040efab", "comment": "Malware payload", "value": "b023024995a552ad2c340b67f2742feed3b4a676", "object_relation": "sha1", "Tag": [ { "name": "G0nnac0pe-Kekware", "colour": "#D9A267", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652277246, "uuid": "dd01b894-5f3e-4405-bd82-a41d570fc363", "comment": "Malware payload", "value": "c2201f609624df3e1f6a17408d11d6ff5b62475726a8f2befc8b663c3761716bf68cec3a2b582b349dcadc87f4d24248", "object_relation": "sha3-384", "Tag": [ { "name": "G0nnac0pe-Kekware", "colour": "#D9A267", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652277246, "uuid": "5af14b9e-f591-4bd3-821b-213fc5d88ceb", "value": "T1AE734FBE0CDB1B8BB13799CEE55A142912DFA9BF1D7A94CBC657B27C5EDB01D000120A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652277246, "uuid": "8697d998-7195-48c5-9739-6470b8949dcb", "value": "1536:mneorgm4Xnv5jqY+e6ijH4mAKqs8udGz8w6iaQIidANBptq+K8i+PjhkomjKyoio:georgh9g4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652277246, "uuid": "400a15d6-a8f8-424a-92d3-d6abc33f91d0", "value": 75275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652277246, "uuid": "a99719f2-9863-4e70-8bde-5ea85d40d885", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652277246, "uuid": "e2a429d3-d889-49d7-83d2-42233e1fc5de", "value": "WinBugsFix.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "484907d2-d0ed-11ec-8e58-42010a9c0032", "comment": "Malware payload (BitRAT)", "timestamp": 1652247808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652247808, "uuid": "413b9357-b0fe-4693-b0e3-b695edc6a7cb", "comment": "Malware payload (BitRAT)", "value": "fe9e747871ed7c17560df13fce52a9ab", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652247808, "uuid": "b14d5960-1a89-4aad-b31c-7c377f85aab6", "comment": "Malware payload (BitRAT)", "value": "e1433f76a11970aa6afb5939d724025e0b0135074e80105ed78c22ffc3f4a614", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652247808, "uuid": "31c54068-ddfb-49bf-a733-b1b493e4d31b", "comment": "Malware payload (BitRAT)", "value": "b091f80e9263a373a401e595e635aa773829e4d8", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652247808, "uuid": "232409f4-7ed7-4517-b0bf-3578da6acf3f", "comment": "Malware payload (BitRAT)", "value": "0371c7b63eec672d3d994434a011035a9e935d2b6b7c75c02e23049fd03856b347f9e09c7496c507729145335f03259b", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652247808, "uuid": "723f09d7-af82-4a76-bdf9-f3c45f996c67", "value": "T1D995331415FD163AFE661D34EE469CA6F0D100B3DDAE4F0E7847310A25AB0EADBAF491", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652247808, "uuid": "50b55d46-ec22-4907-b161-fbcbc6955fb7", "value": "49152:Xtmmf5dlJAW3jCPB2T3zMgs2GVM5nXaFt:9mmf5rJAGaB0vGKw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652247808, "uuid": "b89ece90-c2a5-447e-beb0-9d42190ce378", "value": 1924079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652247808, "uuid": "bfb4051f-bd14-424d-9531-c959500cd29a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652247808, "uuid": "f06c43e6-bb88-46f4-bc5b-172290acf166", "value": "BEIAKO93ND6_PAYMENT_COPY.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "496d6d07-d14e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652289471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289471, "uuid": "0ba93f5e-6ee6-423a-bb9e-ee9bbd689ab6", "comment": "Malware payload", "value": "2cba02527d35ce9822fa1cfcbe483489", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289471, "uuid": "cea89782-9d73-46ad-846c-c28df76cddb4", "comment": "Malware payload", "value": "e24959a7867297c4706f9af679b9a8e51d624183ccef140990264a70735b7b50", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289471, "uuid": "36e97557-3168-4691-beb1-9beea97aa80f", "comment": "Malware payload", "value": "cd18aebf51ac591fcd8f2c9455adb4475849ace1", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289471, "uuid": "6c998734-c9d9-466f-a343-6f463b9a57f8", "comment": "Malware payload", "value": "d029e698355929e547673c97fc39f6aef980e1e5f05b4014a784165ae7815e2beb139ec4af4d90289e8f81a02805798e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289471, "uuid": "e7d6d43e-67df-4651-9b15-9aeb7cc747b2", "value": "T150B4BF06B3A504B9E4678174C9735952E672BC121761AAFF33A0436A3F37FE06A3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289471, "uuid": "9daf854f-936f-426e-a238-32b643bd1b23", "value": "6196af15ce9ababd9a592319b3043ede", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289471, "uuid": "fca5608c-cef1-4d53-a526-72c189171c6f", "value": "6144:iuD3jumQgXW2jLi1QPy+hSVL+ymiohaVdtUPM1UlTIqNtF1FMytrf:ZDLVXW2j21QC1+yZostUPMg9Z1FMyB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652289471, "uuid": "e749060d-cccc-405e-a55d-424f34052f5a", "value": 513536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652289471, "uuid": "f1b443d0-bf74-4813-8bbf-0f120a954dee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289471, "uuid": "af7956f8-740d-4f2a-8477-3021de0de1d6", "value": "N4c6LDzEUU.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bfd6072-d14e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652289394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289394, "uuid": "1166eb0f-6488-44a2-9d9a-25c1e31a98c7", "comment": "Malware payload (Heodo)", "value": "33434fbcb637bae63a5ef94e04c8e61a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289394, "uuid": "694c6610-4553-42b8-8b6d-5b6dc41b53d3", "comment": "Malware payload (Heodo)", "value": "e3280640423764ec1b5963f21eaa0976feef6f732da903b1f98b7c8d28e29bfc", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289394, "uuid": "4cfbe84d-9cb1-432c-8fcb-e9ae1314b8cc", "comment": "Malware payload (Heodo)", "value": "925f6fe4f0e6556160c38d024e9c41e5ec238a63", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289394, "uuid": "0afe6c32-e01d-4925-9f2c-4b9c5fccacf7", "comment": "Malware payload (Heodo)", "value": "cd91d65d25d37d26f0f6b8bc7f7e2e54f045e629990b429208941486b1baf127df88da6354cfe1fb26d352493521be8b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289394, "uuid": "0debefb4-e74c-46dd-8f45-67a8b9360ad7", "value": "T102B4BF06B3A504B9E467C174C9735952E672BC121761AAFF33A0436A2F37FE06A3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289394, "uuid": "16d63158-d541-42c3-a7c9-d23e39fb1cb1", "value": "6196af15ce9ababd9a592319b3043ede", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289394, "uuid": "c157a3ff-f643-4e7e-9968-141be46b5966", "value": "6144:iuD3jumQgXW2jLi1QPy+hSVL+ymiohafdtUPM1UlTIqNtF1FMytrf:ZDLVXW2j21QC1+yZomtUPMg9Z1FMyB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652289394, "uuid": "fcb59f7c-cce2-47a6-81ae-82c2bb877c0f", "value": 513536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652289394, "uuid": "e2e0d1d5-48b2-4827-aa03-c04f386f1a91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289394, "uuid": "e8b4b3b8-2639-4aa9-8351-3a525efbfa99", "value": "9F1GQ6XEomklzG2kKfYZunCqpEdQNs.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7dd16a9-d176-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652306943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652306943, "uuid": "7dad91c1-89fd-45d4-8570-a09c1836f48d", "comment": "Malware payload", "value": "98169823ecba099d103598372ef3f970", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652306943, "uuid": "de165b0b-f470-40d0-9dca-d38ba62508ec", "comment": "Malware payload", "value": "e433cde831e792acecea6b52f79f62d5b0c94db1acc016359f61e9c3150c144e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652306943, "uuid": "dd8fbc96-726c-4e82-88dd-1653af35e777", "comment": "Malware payload", "value": "0950b451c431411ca87696c3210e6188a5ef8f95", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652306943, "uuid": "09a41f0a-aa81-40ad-be11-3144ffe25fd7", "comment": "Malware payload", "value": "edcf1f22bc42dfe32660a0550a45345cf5f5e1506d770c3ac73543a9ede42fd523a81880a5ec35eba60a1aff72c53c6c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652306943, "uuid": "36355727-5451-4d9a-97fd-052e7e008a2d", "value": "T110F30CB4B6D0A917D030C23748924ECB12FC9D506AA2161EED847727D8F1EDA7945EF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652306943, "uuid": "7de26f47-831a-47b8-924d-87fb7546bdb6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652306943, "uuid": "43868e50-72e9-4d49-9bd7-db2216c85da3", "value": "768:UyruI3bII0Q41Y7pOdaPm7z24hMMUcwIeuatsOMoMpY62h+f6XgZPGR:UySI3bII0x20MMUDjaxoMegfGR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652306943, "uuid": "dbb9675f-535b-4c2a-9012-05039d258198", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652306943, "uuid": "6ed98865-dbd7-499d-94e8-a1d2a4a1df6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652306943, "uuid": "6d7b268e-69a3-45cb-890f-0d91931e0dd8", "value": "98169823ecba099d103598372ef3f970", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f10cffb5-d13d-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652282450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282450, "uuid": "8f47a8b7-6c7a-455b-aee3-10702e12f622", "comment": "Malware payload (SnakeKeylogger)", "value": "6da48157826a5b3df6af994d57cfa9c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282450, "uuid": "bd05dea1-898a-49e3-8202-29b5ca516b12", "comment": "Malware payload (SnakeKeylogger)", "value": "e623299d3e59ef8f2ac1d33b98e352e9fc7634746059472239c4a02b3946b71d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282450, "uuid": "f7d9bc7b-41f5-4a5d-aa81-eec03189d7a4", "comment": "Malware payload (SnakeKeylogger)", "value": "9826cd42afc55654bbb44212d4075405e0461102", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282450, "uuid": "ee1c2990-bb9a-43ef-bf09-bd832a0a2ced", "comment": "Malware payload (SnakeKeylogger)", "value": "d53db13358815ba2878a45ef52054b54adf01011f6e28d6d2fcfbfdc100a65930fb434bc84e21de9558d8871592c766c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652282450, "uuid": "f45a5cf9-b23d-4dfa-af62-9dcea9a388c0", "value": "T1E3D4022CFAA6D912E1BE3F36D4F150244B74BE066172D70E2688238E9E027D74E513E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652282450, "uuid": "da5fcf97-f3e9-4c61-95b8-48022ddebd56", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652282450, "uuid": "3e133676-f478-4beb-8ceb-e90030a8ce24", "value": "12288:jsZ3MudaVpNp7Loj/U8b6JuqJQuMSWlDe3BHKeWIRxDrYgCp:w51aVXNgGMyTMS2qxHKe3EJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652282450, "uuid": "aa1c9d5a-2687-4b96-b401-6c03afac5cde", "value": 619008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652282450, "uuid": "44e4eb1f-b2e3-4718-a364-da368f4ebc5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652282450, "uuid": "f7794274-d7db-4cc6-9076-d7ba57be05e6", "value": "price offer.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf255650-d10a-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652260489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652260489, "uuid": "a3627e85-f2ff-4c8e-8f42-ccb5cbce7ac1", "comment": "Malware payload (AgentTesla)", "value": "603d4b86efedb4a675004f6503126408", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652260489, "uuid": "d1680067-5219-427a-bd0c-3208ddf911b6", "comment": "Malware payload (AgentTesla)", "value": "e6d7a02b4d8f76d48fe4851ac6ec355b8216ca641d39a2059aeb930d10305658", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652260489, "uuid": "9bdc98d6-67e5-41de-a974-95ded05d9133", "comment": "Malware payload (AgentTesla)", "value": "05e6cc7567f17112ea9d2850190bb200b5cec0f8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652260489, "uuid": "702bea1f-a8e9-4b20-978b-2f4d6fbd7818", "comment": "Malware payload (AgentTesla)", "value": "c51b948ed954e206c8e66775900b9e142ff5f5552e6e4dbda16ecf7eb97bf499a9494e41daf282bf617d4a1fa3b82dcb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652260489, "uuid": "62e2666a-356f-4bda-add8-53b566fd0676", "value": "T1A8C4239663F02BBC4D04E63F8DCB52E75EC867BBBC1CC9A4541880045BB82E67456E67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652260489, "uuid": "d4ac2637-9325-400f-bdc8-52bb7d6d2bc7", "value": "12288:KqNXA1vpRg1wS7R1ouuLkP4J6xYMfyfdKhaG0REnj+9mjQw:RNw1vpR9S7boupPw0mdKF0REnPjQw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652260489, "uuid": "d895ad4a-cf02-406e-939a-679454da4f77", "value": 595059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652260489, "uuid": "1bd3799a-8172-4799-abe3-fb689a1b41bc", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652260489, "uuid": "60351468-a513-4171-9587-879927ccc7b3", "value": "Office Order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a388e552-d139-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652280602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652280602, "uuid": "2d033807-a065-4b78-8a2a-2403956e2e9d", "comment": "Malware payload", "value": "62ad4dafc85a27980711ecd1d0928728", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652280602, "uuid": "dafaf306-3ba3-472b-96bb-a90a1fe5afb1", "comment": "Malware payload", "value": "e730782adc9452ea2fcce6d1ca98376fc90bcc4893bd67b32515e74e86432b3e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652280602, "uuid": "6d8f44c6-d2ae-42b9-8768-094f8035c28f", "comment": "Malware payload", "value": "76cfe3930a75521a9e614a46f8c97c070054944e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652280602, "uuid": "8ba1c7ea-b370-4734-a5a0-fe6df6898876", "comment": "Malware payload", "value": "49bad50d32fc65b15ead938ed5c4812b98864b65cdb0ae028ce3a4c1d34ebc496c19299497812cd23696957c64c0fc06", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652280602, "uuid": "800768d5-f488-4b54-8c29-54e5bc00201e", "value": "T1DA830282B45A3C6CFC71BF74BE2A2502F7292F38C153653F4120969EE915106E49FA93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652280602, "uuid": "0c11cc24-3fc8-4cd3-9572-504b66cb15ca", "value": "1536:k6edppowoLqrI+1bRVIsRH6Mv7q0eEAa6E6u8OHjbQ:dsF71bRtRHRu05R6EMOHvQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652280602, "uuid": "558c96e4-bc96-42b3-beb9-789063fd9ff3", "value": 85816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652280602, "uuid": "0030af14-ebeb-4428-a967-20f6d5c55328", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652280602, "uuid": "c5f443e8-a782-407e-8490-5db68f9e46fd", "value": "arm7-20220511-1450", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e6055a5-d177-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652307196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652307196, "uuid": "78da01ce-8aec-4831-8963-fc89f5585e7d", "comment": "Malware payload", "value": "fdbb72a18e8e6e029482ee72d900f24a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shamoon", "colour": "#C39FDB", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652307196, "uuid": "a6839c02-38ba-41bb-9d79-1a47bd2d35fa", "comment": "Malware payload", "value": "e74567b575ff61b948ca3e4d41c2a488c67f09bcc29de5e35302716d63796c54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shamoon", "colour": "#C39FDB", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652307196, "uuid": "a404095b-a781-432f-8203-ae3ea9cf7197", "comment": "Malware payload", "value": "cb91a69f6beb5cc62778fc6d72ab4da2eb1bfd06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shamoon", "colour": "#C39FDB", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652307196, "uuid": "aba5c585-ec9b-403f-9bf7-d489c59db3b1", "comment": "Malware payload", "value": "ce9f94b058e3567c88b0b6ec6d18debe69bf4ebbf402138fb0d4c057fd5bf4fc45c7719a883ae4a0ec125a2a1ff36f23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shamoon", "colour": "#C39FDB", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652307196, "uuid": "e43624df-9d15-4113-b230-2e5728d75b88", "value": "T127322D16F3988336DCBE0B764C6372000975F7565A26AF5E6CC9601E9D273890762BF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652307196, "uuid": "f212b28b-7b88-46c0-9ada-ab8a7509e424", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652307196, "uuid": "883e2cf9-1f18-4822-afa3-2d5d670325de", "value": "192:ggGVKMxniQCNsLHlcbFfusUusrHJAmHhUg80H:grpxaKHlcbbTKHU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652307196, "uuid": "06b2d40c-ffe9-4248-97d9-b66b30c88b7f", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652307196, "uuid": "ee844e67-30c2-457b-8173-ad53c4e30aa5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652307196, "uuid": "67122a41-065e-4e78-8b77-b229875707ab", "value": "taskedit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75be1a74-d130-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652276660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652276660, "uuid": "2786981f-f54d-43fc-903d-b7fefc5672db", "comment": "Malware payload (AgentTesla)", "value": "93fde44cdd3d5166544b00c3b3edf546", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652276660, "uuid": "6d0d65a0-8bd7-4d27-83a2-50863bacba1f", "comment": "Malware payload (AgentTesla)", "value": "e829d57c0773813c8a3b24e7d047221d589d4c2965415bb0c80d3565991a51f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652276660, "uuid": "3233c110-2b1c-4025-8638-d1785be91642", "comment": "Malware payload (AgentTesla)", "value": "252581a74a18642ea570bf969552ca1ccaf99a8a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652276660, "uuid": "bac2ca5e-bace-4476-9ff0-9d4cd5abf27a", "comment": "Malware payload (AgentTesla)", "value": "c7fda2811d45e35674a57e62c4aea7e3c485baa240d703073da1e7e9f0e4232b0ddf22a0aff7f226ef3614e72b0c54ef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652276660, "uuid": "07ead12e-64b1-4346-bb64-d8be5979b849", "value": "T106825A1C6381C773D9FB8B3268E70F80AAB4E3695737471EA486163ECB037150A66B31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652276660, "uuid": "448f10ee-b175-4cb6-b396-1bc6b32f037e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652276660, "uuid": "c0af5fe2-3bc8-43f6-b886-d987f9ad0c1f", "value": "384:78/tNFdYufwPMeh/cO6A5SUaepk0OOyd3zDzYR:Q/YkKSUaq1LyJPzO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652276660, "uuid": "36f68ec1-1115-435a-87cb-9e789034aadd", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652276660, "uuid": "3925b3f8-c409-4dcf-9d72-cf47aa32fa00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652276660, "uuid": "db01df02-7483-408c-9112-724e04ba525c", "value": "93fde44cdd3d5166544b00c3b3edf546", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "796c284d-d102-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1652256909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652256909, "uuid": "b46de2a1-9209-4898-ac11-c4183732e4e0", "comment": "Malware payload (GuLoader)", "value": "9811d64e29ef53e107f9379526cfd338", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652256909, "uuid": "192ef30f-805f-4171-bcc1-d4358fd89453", "comment": "Malware payload (GuLoader)", "value": "e94bcf64e3affd0a755df05fc1f8c7fba1fb98303e433edff4d98f75d1e4fdf8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652256909, "uuid": "8230ef98-f7bd-48e6-a7b1-a3776dae0ef3", "comment": "Malware payload (GuLoader)", "value": "b6e84580f902a0c3d3f77748a2a027c9fe42db68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652256909, "uuid": "6c32c933-2cab-40f8-83ff-38a42b6221de", "comment": "Malware payload (GuLoader)", "value": "ed128f7c71088fa88cad1c40c8d683c108f09b01ffc027a8a8d117d3fb018d517b99810bf36df5741beae437fa887bf7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652256909, "uuid": "5473ead7-74f9-4a68-8853-12500d0ecfb9", "value": "T1DE84BFA63F19CC11C39094FD6621E1E999B56E2027BA8662F3E13F6F756CF427D0D202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652256909, "uuid": "10756f86-c78b-48b4-a3bd-b52f55ccb912", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652256909, "uuid": "1cec605c-7a73-4468-860f-5c1567c2ce33", "value": "6144:cYa6FhyPsCD05Fo1/atIU3jNJ7CIzAlb5Eyy77XEwPBkbCt:cYve1/OIMB1RzAlb8zE08C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652256909, "uuid": "c93d9119-0320-4de7-941c-3c58d9629f4f", "value": 384544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652256909, "uuid": "0577bfb2-3aa5-4a1f-8100-ccc28565d4ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652256909, "uuid": "9a86097b-8eb8-4463-ac38-db500fa37977", "value": "EPAYMENT.COM", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6082f5f6-d15b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652295093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652295093, "uuid": "0ead5e7f-b949-4996-942b-3d5286869240", "comment": "Malware payload", "value": "b820f2357b5429737b4333525fdc7065", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652295093, "uuid": "77f6fe22-a144-41d6-a830-2896ee59037a", "comment": "Malware payload", "value": "ea40f470a58fe5a436cbcfc5e812d176ec30adae405aedea780d38c231c88926", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652295093, "uuid": "3e3a7b4c-8d25-4022-8b76-cbb88423ad7c", "comment": "Malware payload", "value": "147936b27250ed586d251897e372234c49cb211e", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652295093, "uuid": "ab09026e-548d-48fe-8237-ae0cc821e37e", "comment": "Malware payload", "value": "f07843aa9077155b8ddfc8336a68f85f73a9f69fbc9f28b0a71fe38923cd53ade308c98b117478274026872e4cf18e5d", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652295093, "uuid": "82b81008-5314-4ebe-9d7f-0e64d345678c", "value": "T1DD266BA6B2C9653EC06B0A3A5937A79C983FBB7125168C1B17E41D4CCF354403A3EE5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652295093, "uuid": "a95f3e96-c5bb-4b1f-a879-fb0585b3a272", "value": "49152:OmkK1//EH+Zpi2quuBcVI/WOSh8xISjLLfcJ2zEWB4YLMswGNAdNnN6O7TjYcGVC:IKtMcV6xStJduDMsqNnoOUrtYAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652295093, "uuid": "c6fff49e-107e-4bf3-8dc8-979236362441", "value": 4820480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652295093, "uuid": "3236351f-b3ac-49cb-b3de-7c91626a7ec2", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652295093, "uuid": "b4bb2acb-de3c-49fa-83a4-97fb65a7425a", "value": "__$FWHHJ\u88c6.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69fc3928-d0ea-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652246576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652246576, "uuid": "4ed160fd-560a-4d65-87ab-dfb866e8473c", "comment": "Malware payload (Formbook)", "value": "2178ec1d53c8e3d3d0af3a7afe90f584", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652246576, "uuid": "e35c1130-8fab-4039-a677-575098e96e1e", "comment": "Malware payload (Formbook)", "value": "eba97a314b1c02ecdd75fe691c6883b214dc0b239d0ba39b7d578162b5218ad0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652246576, "uuid": "2d427a4d-d0d1-4b4b-a4bc-0ab6d6dce5a5", "comment": "Malware payload (Formbook)", "value": "905dc76c6758daa19d6275db0439676532854488", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652246576, "uuid": "538e4cb6-66fc-4ffa-8cdd-0141ec4c4cec", "comment": "Malware payload (Formbook)", "value": "0b91ca9efd6374906fe9f7cbd1a2142c362783fe39503b09f019d9eac8c724406d2770611fd2e4657b5a954416519ae1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652246576, "uuid": "6d03116c-e968-4003-9ef6-d9d69a448da6", "value": "T179D4120467E8A365C9BF3F3964BA31099F75BC56B032E31E9FC0699E29933910924773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652246576, "uuid": "c5fd1c10-e62b-4a3e-90eb-9684696dcf99", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652246576, "uuid": "e7a9434a-7afd-4f21-a138-6052df9fef0f", "value": "12288:DpqphsYBawW3Ioaxs43FanSXFVA5n5W3bA3IY5vzAabbp:DgwYHWVaxH3FanSXDA95/rvb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652246576, "uuid": "e80cc09c-d826-43e0-a2da-bbff95f6c862", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652246576, "uuid": "2625e10e-23f1-464f-87ba-8773aab3260b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652246576, "uuid": "3272c952-1de8-4d55-bc97-d520479e585f", "value": "ST10501909262401.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95a5cb9a-d0d9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Sodinokibi)", "timestamp": 1652239347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652239347, "uuid": "a47ec5f5-8f9a-47f9-8bcb-13d4dd8e82f3", "comment": "Malware payload (Sodinokibi)", "value": "8a18fa2696f31992ef9bb3a971724f29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652239347, "uuid": "b22917ff-06c0-4f6d-91e3-53b77c0cfc5b", "comment": "Malware payload (Sodinokibi)", "value": "ecac12520eaa08addb97ed05c2ac1406d56e58eb422954b704ef5c5516e02397", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652239347, "uuid": "192e10c6-55a4-424f-ba62-0f6d9d846d5b", "comment": "Malware payload (Sodinokibi)", "value": "5aa9a303eedb9d0a6f0dc5d6c78ccd90b1e6852f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652239347, "uuid": "8b022cff-83f0-4b35-b5d4-c234ddd8e5d7", "comment": "Malware payload (Sodinokibi)", "value": "5ed854a4db3136c23d8119611539d364babfe15bb4f6b0ea774ce8d2e98a65db3907ae538e63f8dcaa84bc51b505035a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652239347, "uuid": "34a169ba-ff5d-49d5-8ae3-bcc6c46037aa", "value": "T10B454B297BFA44DAF2BB0639BD360711A173BC609F01D7AF1598421E0D627989E35B33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652239347, "uuid": "b7ab8854-bb98-49a1-abed-50d3c98e7fb2", "value": "24576:0IUWOZcLkzjF+41J89oSWM6rJ4BzjFyDPZ0WeV:0IUWZLkzjFTa9oVgzjFQZ0WeV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652239347, "uuid": "da8067d8-743b-4029-b1cf-53ddc80c2e38", "value": 1243650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652239347, "uuid": "b40c6b2f-d6e3-4d1b-a78f-c616c61aab2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652239347, "uuid": "c4f40b68-a86e-4bb4-af8a-77f7875b809d", "value": "new.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ab5d31f-d104-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652257609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652257609, "uuid": "ec3c4881-d746-4325-bb5e-b80418990691", "comment": "Malware payload (Formbook)", "value": "d8d8690795aa3b38af0dd78fe97452aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652257609, "uuid": "89d4f1e2-e95a-4b68-aaf4-9bf8ad290030", "comment": "Malware payload (Formbook)", "value": "ecf3c66677e8575d09704f7775cf54c15569eb647376f04a887624018b568814", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652257609, "uuid": "258fdc63-8da4-4190-aeaf-57f21e4eef3c", "comment": "Malware payload (Formbook)", "value": "08995c98af5a843e207f6e80f972e0d6a4206484", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652257609, "uuid": "b17490d6-42b0-4e2b-9cfd-0fa969b64de7", "comment": "Malware payload (Formbook)", "value": "85e291475acd4b313ceb4ae34fe1962f7a48823dda386c0d1a63cb34d1046bcf50c0cc6fc8a03850da31eb66213f1f57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652257609, "uuid": "e37f5b4f-9553-41cc-a582-a52e442afbf2", "value": "T17B94E192A45485DBED7843B39C3B891929E67C7EE9F0912F87AAF52597332C30017D0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652257609, "uuid": "682703aa-113c-4101-bd5f-918d1cef4ba7", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652257609, "uuid": "20e3f379-9e4b-449b-8bd6-9e58f115dd8f", "value": "6144:8OtI3eYvYl0BjO73Pp5hn3FW5yga6Z2pFHnhPijJzK+m9hYXBJvqNa8y1I6ziDLF:8OSBybd85zN2pFHh6sOTGLQ5mGA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652257609, "uuid": "e3c341a5-4f72-4d84-a84c-6799f1b57bba", "value": 419257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652257609, "uuid": "251d89b5-a639-49f7-862d-0998e4fdd03b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652257609, "uuid": "c8cd085d-4786-4159-b2be-c67f586e7c02", "value": "QTE00038319.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00db8558-d139-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652280329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652280329, "uuid": "667c345d-3e81-4040-a514-33b7f44cb7ee", "comment": "Malware payload", "value": "563ba2f4ac04737ebc13f6de37f68295", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652280329, "uuid": "0d5d0691-efe9-4fc1-861c-37532e225f2b", "comment": "Malware payload", "value": "ee310139ba31770b69650d464c999c3526aa5cc4ab924ddcc53cf3cb06727c37", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652280329, "uuid": "3efb2676-cb91-47c5-b053-3e13339cf05d", "comment": "Malware payload", "value": "0cf268653215d36876aa798f17cc37890d28075d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652280329, "uuid": "bec2755b-0426-4dde-a797-3b3fb8c4f244", "comment": "Malware payload", "value": "56e0c8878ec61037170a7e465b4191ab26779bd42e774ef3ef2c63624e7c81015b794bcd3ef7f201e2639dfcf564461c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652280329, "uuid": "f00daba6-2aac-4587-9190-4cc4e582aa97", "value": "T1D885338BC5B76CF292A2A7B336888CC5FAC70D5745E41C7C28AE8E163171D4187AFC61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652280329, "uuid": "6eba83b0-7483-4c31-bf73-1caeb8c8a838", "value": "49152:t9X1XAHEWJgzH8IwLGwhwKGA6XKVUsuBQ0NPgGBW:bXZA5WzH8IwLlCKGtYUsuBQ0xbA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652280329, "uuid": "99977a86-1ce1-4ed0-9fda-23ef8a284c59", "value": 1867632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652280329, "uuid": "27662bbe-72e5-4090-a39e-ef7432266387", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652280329, "uuid": "518fa438-92ed-46ef-bc29-071e2b0ce4c2", "value": "SecuriteInfo.com.Linux.Kaiji.D.7126.28062", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8880bf5-d105-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652258411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652258411, "uuid": "ec5fe2ec-4dc6-491b-8b08-9fd400719b04", "comment": "Malware payload", "value": "77e7dcd7efc56817ddb630e05c35ff4a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652258411, "uuid": "5805d41d-864f-4c7d-a47f-56dc8c08e301", "comment": "Malware payload", "value": "eeb0d8bfbfb834e02f8c232513a097de1f40574190716345e7f9cf8c452b073e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652258411, "uuid": "759e64a1-c4c8-4ecd-9d93-9dc82e0c3bef", "comment": "Malware payload", "value": "55d29f259f67396601d93aa5e0516e16e3918223", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652258411, "uuid": "bc31f2e6-c709-4d3e-9937-2b2033ee8c1b", "comment": "Malware payload", "value": "4ec200460e2ebdcda090a08722b178bc63a9340dd69c02991d7bce8cc3c32f0caabef7287c85d00a7a6af3b75c0c252c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652258411, "uuid": "7edd1431-ee6f-4b88-98fb-a36da72e3ad5", "value": "T1F7252385EDC4AFCBC7656238559BEA49508EFD4E5B02F4B6C7A830C32275F3B90A3149", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652258411, "uuid": "77898b68-6726-48e6-8fb9-9deb9b1c585f", "value": "24576:XoU6M7qJFyzbMbTrlnylYZyC422YGnqL4H:XdEUanTZKj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652258411, "uuid": "e560046f-9127-4718-af81-a3db4d4b993c", "value": 1009664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652258411, "uuid": "498b4534-09a3-4cd6-be05-63f25e267a79", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652258411, "uuid": "34c64fd2-8d7e-4edf-a376-5864c9ba4520", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.3962.18846", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88812459-d0f4-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652250922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652250922, "uuid": "a07fbb18-8342-4bef-95f0-2107a8e82136", "comment": "Malware payload", "value": "6ccf4bb38c29d6bf80a982151a76c2b0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652250922, "uuid": "1b141fb4-335b-4dfc-9491-6677b6381948", "comment": "Malware payload", "value": "ef9b5cd510ae1b3c49c5801dd5e8d46f5ebed70cf663185246e95ae764093e5a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652250922, "uuid": "111b1e02-6291-4ca2-8f89-cdb58cde3390", "comment": "Malware payload", "value": "0b790340478a7fd3c9aa55c5c3657227c050eace", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652250922, "uuid": "d41c1054-1dd6-403f-9b18-89c952c45f01", "comment": "Malware payload", "value": "301f45760c9945fd9bc857b478ea40595292f2dbb510406c18a0ced7fab46f91a49437d3f257ba9efbacc3dd3c77ada0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652250922, "uuid": "47cb32b3-8424-48b6-98e7-7320f1f47245", "value": "T158A51408A147E27BFCFD08A3445091D0C29C7FAA7B528DCDE97AD59A101F482B7B6D87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652250922, "uuid": "6ae722f1-b1b8-4776-97d9-f4d28b9cad32", "value": "ae9f6a32bb8b03dce37903edbc855ba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652250922, "uuid": "e9ae4ae0-f450-415b-beaf-541b3e2ad0c2", "value": "24576:b062cSEk8zNlLW5oP1bMB+eb9239RqIv49pu/cHTO6uLsaQg0FtXTsHdwjtC7+z9:A6PaREgn9cfkhe7KJC7wXoWZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652250922, "uuid": "f88bd84a-b873-4d9f-95f8-a7eb8d4d12c3", "value": 2131091, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652250922, "uuid": "b16a008b-21e3-4b00-bd24-a8096a9f92f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652250922, "uuid": "c91e5892-c828-4144-89b4-c0343c7643f1", "value": "6ccf4bb38c29d6bf80a982151a76c2b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60fd88e4-d0f7-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652252144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652252144, "uuid": "8f7b15f9-4c60-4a6e-b8ad-fc2b9dbf3ce0", "comment": "Malware payload (Formbook)", "value": "6410f6e2071f613811bc92cdaebb03ce", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652252144, "uuid": "1c47c3fd-8c53-4dfd-8ca0-c0f1dead1b2e", "comment": "Malware payload (Formbook)", "value": "f11b62470178ff0edd520be4188021b6c07943f09bb5ba1d004ae6eb7daa967b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652252144, "uuid": "4d085e10-e432-4b25-a025-edf8cff0fc39", "comment": "Malware payload (Formbook)", "value": "fa9eef3766ee1902a93aa446490540b23c0429d7", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652252144, "uuid": "59fc5ea5-e027-4813-bd58-f0d8b39a34fc", "comment": "Malware payload (Formbook)", "value": "b0cb8b4381ff05f2eedeb1aabc2c8d38e97c1ca51785c70729de9dc37d57378e1d1775e1af2aae5ca9ae419a994b3f31", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652252144, "uuid": "b7477c82-72a1-49c1-91fa-26c54e8e0d37", "value": "T131341253B6F8CCE2F46A723029B9399483F83EAC8723144197B3A2D593F645D0CB6563", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652252144, "uuid": "97d5bbbc-e61c-4bde-abc7-db58a48a533d", "value": "6144:/3wfieqErGRJhSSwdUzUCoK1CEnqDgSwhF/O+tew/cQNmylI:/waeqErWAhdsoKqoF/OjucQG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652252144, "uuid": "60eda9a5-e1d0-4416-918d-6e41a0c35ad7", "value": 237775, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652252144, "uuid": "6f4e5c60-889f-4f14-ad7c-df67e4f70bc8", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652252144, "uuid": "d67609ad-f995-499e-8906-f4afbe2b5b9b", "value": "Payment receipt.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f747dd3b-d105-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652258409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652258409, "uuid": "f4e791b7-7399-4516-937b-d95383950ae1", "comment": "Malware payload", "value": "a3d7cc8612872109fe2c53a34437fe09", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652258409, "uuid": "d7bd1e54-7e87-4ab8-bac0-7af7096c02e3", "comment": "Malware payload", "value": "f1fe26816be3e7ee0363439747bf0e9f82ed9aa7badd1fb49a8145937a5bb33e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652258409, "uuid": "0ba663cd-01e5-47bd-86b3-0280cbb209a2", "comment": "Malware payload", "value": "2a752ea3cdf8c604a55be4691c4afb00e962bd8d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652258409, "uuid": "81f6df41-e66d-4a82-9ed1-f5eecf528c83", "comment": "Malware payload", "value": "1ca4ca46bf295798a14cf8a09ee92eb0a84da3521329e3240e6b68301b00f47aa2666672267f7dc0dd507e9db82b76ba", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652258409, "uuid": "791c5c00-7e34-4f5e-b754-eda659f2ff05", "value": "T1A3A34B89302AC09ED3A84839ACB6DFF335B17D05A880E64736A1BB2E1D7E754D305CD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652258409, "uuid": "c8d328da-b4a3-4f88-a3f0-74256799b846", "value": "1536:NkqV+nkft349jmcPVjU/xSlDjzc3DYlD0P5n:yqqkGjmcNjUWiDYlQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652258409, "uuid": "f8209a33-b3ef-4e96-8a3f-b0f17c5392f8", "value": 98816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652258409, "uuid": "3e7e71a4-9fdd-43e2-9ad7-d0dfc3319948", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652258409, "uuid": "6d14a86e-6d43-4295-94f0-0d24c355dfce", "value": "SecuriteInfo.com.Trojan.GenericKD.39635349.5927.2465", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcc817d6-d17c-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652309475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652309475, "uuid": "eb83232f-a520-42b0-a326-2951a0d1458b", "comment": "Malware payload", "value": "bc160318a6e8dadb664408fb539cd04b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MBR Rewrite", "colour": "#E7B28A", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652309475, "uuid": "d6dbaf5b-c9df-4d96-a807-5711afe8c8ba", "comment": "Malware payload", "value": "f2bc5886b0f189976a367a69da8745bf66842f9bba89f8d208790db3dad0c7d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MBR Rewrite", "colour": "#E7B28A", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652309475, "uuid": "ad6bcb58-9e4f-402c-becd-b5ff8b8a1153", "comment": "Malware payload", "value": "4b5eb324eebe3f84e623179a8e2c3743ccf32763", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MBR Rewrite", "colour": "#E7B28A", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652309475, "uuid": "c29bf2dd-96aa-401b-a2f3-4572b22884f5", "comment": "Malware payload", "value": "77243e6fd3d9de0ca3493c614c455958a0e592eb7287119c269633caed3c6cb3585d5b7e515520c506a42d27c7de41a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MBR Rewrite", "colour": "#E7B28A", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652309475, "uuid": "d29940a2-e0f1-4909-b2d7-02c70720b323", "value": "T180543AC7FA865DF3ED23037448E6D36B123BA6815616CF63EA20D93A0E53AD16DC4706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652309475, "uuid": "1cb12442-00e9-47c3-9004-04f7e4b323eb", "value": "11484f8397e301b5828c5f167790914a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652309475, "uuid": "872f6117-fd47-46b4-a01c-276141ae7e6a", "value": "6144:h6r+IrezXLUgqspn73GDwG/K6786TEnCAIpi9MxipEl7BuHBTpOdNPIGAZTBO9NS:hSlUXoKOlzGt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652309475, "uuid": "b17e0a88-cbe4-4df3-a73f-2df41c8b1573", "value": 295900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652309475, "uuid": "f394725d-c4ff-4f33-bd82-4ac24df4aec2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652309475, "uuid": "648e1421-2729-404c-9c03-7e9067ef03f7", "value": "test.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd07b9e3-d132-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652277639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652277639, "uuid": "4a0c2218-8619-4664-81ed-f12b554f5d44", "comment": "Malware payload (AgentTesla)", "value": "a0194cd9a67f266b20e9f2e2db082032", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652277639, "uuid": "afce69fc-4348-46aa-b257-346b9a606773", "comment": "Malware payload (AgentTesla)", "value": "f33c53e65bb95c4c28c8ddb7d8ef165fe2ab7d961c0bea756a5395f9e2802f15", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652277639, "uuid": "c5e5dead-d82d-4f11-92f0-7fed71855c0a", "comment": "Malware payload (AgentTesla)", "value": "e29598408a7e9c396f6803663b98be162a29cb51", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652277639, "uuid": "18656e0b-ed09-4faa-aef2-7c31354f8b7f", "comment": "Malware payload (AgentTesla)", "value": "69d622ef8bdfdd84f5219d2a620232504b438ed12351fe91917765408ff23311631aef35b5699c620a9447817a5b7c36", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652277639, "uuid": "67bf2f25-71ae-4f85-9728-af4a6655248f", "value": "T166A44FAD7A411A72FD2ED1384D430A04BB660E336A40B99657CB1DC687CFAED1F05F86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652277639, "uuid": "f0809df4-e99b-428c-abba-3f01b4d0fd56", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652277639, "uuid": "a23e0378-36aa-4978-9f42-ec252bca4515", "value": "12288:uVWTi7FHSqjVhvLhpOuc28bpcr5V/pY1pfii:4n3rpmpcr5V/p7i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652277639, "uuid": "f8c5035d-1c16-4d4f-9c42-ec70af07de4b", "value": 472064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652277639, "uuid": "dd4daa93-9913-46e1-93e7-1a34d8534e32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652277639, "uuid": "3d82ad4f-757a-42f8-b15d-6c32202906e4", "value": "Lincoln Park_Q88(Chemical)_10May2022.docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e124d62-d146-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652286177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652286177, "uuid": "df14da54-da9e-420c-af09-3c0273bb2407", "comment": "Malware payload", "value": "257eab0847319dafe9522c7b4a6a8e67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652286177, "uuid": "4e9b1391-1331-4cdd-aeb9-084be072531c", "comment": "Malware payload", "value": "f35385a0d3cb6488819b0e2c14ed6d97de7f01bbdb08c8fb198218837883b734", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652286177, "uuid": "4db74485-35ef-41f9-9cb4-4c4c6a055c02", "comment": "Malware payload", "value": "bf2c144513911fd1962ed8493294e7ed19586d23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652286177, "uuid": "61d998b8-b335-4e42-9ad9-5feb83deba3a", "comment": "Malware payload", "value": "efd3acf36b478be6c1f1d14ef8548369ed20ce09cff311f892930df7d1d91f911fe7d29291200995fb1fedeec7c21613", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652286177, "uuid": "98e007fe-59be-4379-a7e2-8778959addea", "value": "T1C2B41246F298C772D82D4FB85C73896507397D6A2861C21FACED73DF2DB5B401922A0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652286177, "uuid": "80fd430f-5f7a-4adb-9944-3fd3e2430bbf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652286177, "uuid": "17f2b973-c016-4cf5-b510-35d42140938d", "value": "12288:gMpRnBTdBxkBEajI+x/XmTBy/CFJ+5Fdv7cVdu9:gMpRnB+BEajxAy/2I7Wu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652286177, "uuid": "a7be11f0-e2bf-48f4-8079-9ea88207d410", "value": 504832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652286177, "uuid": "abf69558-be46-4788-8834-07f08ba55895", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652286177, "uuid": "c1bff039-0ed3-4445-af70-dd734b47a198", "value": "HEy0BaVJ6WUy6aM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "259dd04e-d0ca-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652232717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652232717, "uuid": "74c82bc7-6cc1-49ae-8426-bf6bfe4d125d", "comment": "Malware payload", "value": "3d737ca69e426621e0e76eef32b07b77", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652232717, "uuid": "6f416aab-f932-4608-89f8-49da99a8e2e7", "comment": "Malware payload", "value": "f3558f260e576e45fe299419e3e4198473d5795980b07a78cf0cb04953caccc9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652232717, "uuid": "94eb2e12-4e92-41e1-8bfe-de9f432aa866", "comment": "Malware payload", "value": "e68b3620d30ea797a7657fc01c88cd07d60ac1b1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652232717, "uuid": "c8e408bb-69c8-40a5-809d-83f98b1fee2c", "comment": "Malware payload", "value": "89ea88fb2f1dc5958b3279bb12533f1462939a47f2778b47b0590e68ab345f59fd6205350a2d2d52f3004f7fba5f1249", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652232717, "uuid": "774f038f-2c18-4b21-87d8-9c5a8e7ab3ce", "value": "T1EA54B4D9F78D112E423231AAAC2E12CDB77CD171560458AEFD4D597C24A083D83BAF7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652232717, "uuid": "a7a0ee7c-ca8c-42c3-8d64-ede81b0f3957", "value": "6144:lJshNVlG+TCtlFhTeeKpDcYmD2zK8J0JEjPx+WK+978Fyw48L/dC0Y2NzIPfTIY4:VODcYmD4y0Px+WK+978FyqLn+PfNA+up", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652232717, "uuid": "51770912-7257-49cf-845d-0705ad974f46", "value": 292945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652232717, "uuid": "a72f4690-d32c-4e6a-bb5d-ac075c360c67", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652232717, "uuid": "6ec3dca5-11fa-4c4e-966a-a9a6640d7eb7", "value": "model_ip_security_agreement 41376.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61b35762-d0f1-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652249568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652249568, "uuid": "80352f90-31ff-4942-9df6-0b60ebf381d6", "comment": "Malware payload (AgentTesla)", "value": "7c0c7c325a10ee4ae26b9ea34da2806b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652249568, "uuid": "7b385812-3305-4a2f-a260-c378bda106ee", "comment": "Malware payload (AgentTesla)", "value": "f44758774bed0b815e7620d5e8937fd98a0313d10e3334e08424df68f09dc0a7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652249568, "uuid": "64e81082-82cb-400c-b8f6-e95daa21a9a7", "comment": "Malware payload (AgentTesla)", "value": "6404072a0c44480dbdf9697c493da9fe65c2ed55", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652249568, "uuid": "849d3002-c55e-4fea-a377-81b0a766aa79", "comment": "Malware payload (AgentTesla)", "value": "01004c5a264ffa1dd14d174d8e1e23f4095c6108dcab872326f811f3e260ff1ad827c49127fb71f084d7a672544a7014", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652249568, "uuid": "6b245813-db62-49c8-a1e4-041d8e0f77bf", "value": "T15B742360A9B4E177EE931B7247F61BB6CFF78C6145A0BA5B8B51221C7D57002D82F183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652249568, "uuid": "0736356b-8851-4faa-92e9-a4a8d0a5a703", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652249568, "uuid": "df8cd4a6-a79c-4158-b82b-7906ed9c841c", "value": "6144:LOtIOMPwN5mdpqBrT3wpmRb/xvlJbqctJqv1duq2BqH/tEfZ6Y8VkhxpyW:LOLMPwjmdoTgox/xv20JyMq2BKUZNokn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652249568, "uuid": "d74fcb43-6133-4219-87fc-af43774ca793", "value": 354217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652249568, "uuid": "4ae27d89-8a1c-41d1-8396-cf90576ce8e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652249568, "uuid": "94983306-2792-422c-89e7-3cfd1afce108", "value": "14226INS0007573.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ab73e2a-d10e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652261878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261878, "uuid": "409ce049-b006-4f51-9f4b-8a55a8a0d8d4", "comment": "Malware payload (Mirai)", "value": "74f84eeab623bce44faa67587042dca3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261878, "uuid": "3c133aff-28a7-42b5-bbc2-134d10db8deb", "comment": "Malware payload (Mirai)", "value": "f47ec251e4a8ade5b338ebd3eafba88f675c3bc8928789c787aafd1c12721671", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261878, "uuid": "fc131137-9d63-4b7f-9138-7ded8678529a", "comment": "Malware payload (Mirai)", "value": "38bf40182456e5b8250a0c30611d70a56cee75e2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652261878, "uuid": "4d960034-643b-41a9-886f-7da6ae5f3657", "comment": "Malware payload (Mirai)", "value": "dda30233913a2659d5c540e8551918e3bc823981b8a7d49bafe810c567a59ae0017c7ab9d2428e47a6fd94a044b41a3d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652261878, "uuid": "30093616-1906-4ed4-8776-16d49c02de1b", "value": "T1EBE33B86EA408A13C1D5277BFAAF014A3322DB55E3DB73068D185FB43FC6A5E0E63645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652261878, "uuid": "0c73d20a-a464-46de-b020-e3420a25e22e", "value": "3072:t1a5fdUEjnBGrYkRaaWgV9mrsplDKZUmQBKXAVanlX+F8JyvG4hLnAVIl+3jJNxH:tc5f2EjnBGrYkRaaLV9mrsplDKZUmQBw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652261878, "uuid": "ebdc184a-4e0a-493c-adec-e9dfdf0b3cad", "value": 152486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652261878, "uuid": "e306a1d5-7f00-4613-8315-64568fda740b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652261878, "uuid": "b3e340df-27d3-4892-b35c-e1c78ec5b12e", "value": "74f84eeab623bce44faa67587042dca3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3d96a19-d13c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652281918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652281918, "uuid": "060c4ce8-56be-4567-86d5-394ce065a508", "comment": "Malware payload (Mirai)", "value": "b039e99c2414669c35afc99d4b9bc95d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652281918, "uuid": "9314d7c7-e0ce-4362-9865-7cd32c5731b1", "comment": "Malware payload (Mirai)", "value": "f628903a799b011572a24ab4f1a77b4fc41a7e2467d4978d5a23ce13b59049ee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652281918, "uuid": "51b38481-d978-4b93-b222-51ee4156c1a8", "comment": "Malware payload (Mirai)", "value": "4533e4c4aae218ad75aeebf47a92abdf1d372fb7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652281918, "uuid": "06266ac1-d2c1-4663-a70d-ff64c1289020", "comment": "Malware payload (Mirai)", "value": "d513998d0e26e114224fd38ae1744868377f898158190ed7454e95b22dda52b060eee468adda73e38a5578050c3e72a4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652281918, "uuid": "aa26a882-80d2-42b2-b96a-2e6705697507", "value": "T190432785BC82AA29C7C0577BEE5F115E3345A7D8E0DA3353CC184BA4BACA90F4D27B45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652281918, "uuid": "47a8f58b-a937-49c0-ba41-99e86b31d966", "value": "1536:RJM4cZEcCB1fUli2D2Mu07kgweZWy4aCuP:HM40EcCB1307vww0aC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652281918, "uuid": "b06b804a-79a1-418d-9fb8-0c1e93c8a985", "value": 56056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652281918, "uuid": "463cfc3f-ad25-4034-ad9a-72ca42331d16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652281918, "uuid": "0a4db3a1-f26d-44eb-aff8-c3f380bef268", "value": "b039e99c2414669c35afc99d4b9bc95d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50f9662c-d0d0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652235367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652235367, "uuid": "e275b5bb-d7ac-4077-bb3a-e272c86ab35c", "comment": "Malware payload (Loki)", "value": "a80c1cb28d7e941212bf80883c37aa11", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652235367, "uuid": "769fdb55-f9e1-4238-a31a-d8975a93bb1f", "comment": "Malware payload (Loki)", "value": "f896848fbfa650f435933573780768cc2206b903408f31e705ec5ebef24c0c0d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652235367, "uuid": "b53af1af-77d7-4cfb-acac-c1f975a112d8", "comment": "Malware payload (Loki)", "value": "5691767d7977d3cb5a0a1431ccb0d808c2616614", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652235367, "uuid": "7088d400-9592-4ac6-ba56-01501aef2cf6", "comment": "Malware payload (Loki)", "value": "5d192e784b7fc50739538c6a65537b8261edc731287a1e7e3e58f04f50903db2c0034fb339647d0da6efed6699073f83", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652235367, "uuid": "3aa84262-c31e-4cd4-8946-aaab72ff598c", "value": "T1CF44AF00BB90C035F5B712F4897A8768B92D7EE15B2445CB62D53BEE86356E4EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652235367, "uuid": "6560798a-9c0e-4729-b247-5ecb6ef90030", "value": "ef3edcc44b2f6221fa7a1991ae483108", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652235367, "uuid": "e53d5992-7ef3-491a-95dd-a005f094e4cb", "value": "6144:HG3G06zBHxtQ/RhFS4Xs4oY4GKpefq9VL05hQIRT9o:mgNRtuhFSss24vyQi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652235367, "uuid": "3d46cfe2-8f13-4fc4-99d2-e584e44afbb0", "value": 269312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652235367, "uuid": "0b9044db-6361-4874-99d5-7836a5ab5d22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652235367, "uuid": "d1ac506e-1749-4f79-b47c-a2981b5410cc", "value": "a80c1cb28d7e941212bf80883c37aa11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5476ecb-d139-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652280605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652280605, "uuid": "442ae808-1dbb-4822-b025-d0505c93f096", "comment": "Malware payload (Mirai)", "value": "91e27c837a34167b1d3ac9a91f624063", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652280605, "uuid": "13eff53e-bbf8-4458-a6f8-f968174c7c18", "comment": "Malware payload (Mirai)", "value": "f97ccf275ca57a3ee367f54b9f38b1cfe1265c9582fb0536f3087fc3960137de", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652280605, "uuid": "59cc0671-3913-437d-acd7-8c1a736f4ded", "comment": "Malware payload (Mirai)", "value": "de678bc45df8ed50ff1c27d7d2ddfe175f12b0c2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652280605, "uuid": "6d6fe0e2-771c-4ce4-8e71-81a0bed877d3", "comment": "Malware payload (Mirai)", "value": "508327529877a171591c49b2935e96009d9cba1405784e9222a4d9710c99d2b04a15502eec1d38b8057a9118df80eb9f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652280605, "uuid": "7b570e1b-9a41-413f-9add-c65881a4384d", "value": "T14E531781B881AA25C7C05777FA5F008E371697D8E0DA73038C296FA577CAD1F0D6B64A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652280605, "uuid": "95c5061c-7f74-46c1-90f4-44124d8db9d8", "value": "768:ooKDq4TBh0SNlDKZHyfws6id9C7s0JVEhtRQah9kHuLwCVy/Jx+5H8hG1rmCd/5K:HuNh0OlWxYh6ivKEhtma3BeZWc0L2DT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652280605, "uuid": "a07f9b75-9378-4b84-9614-e31c21bcf822", "value": 63728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652280605, "uuid": "19d26158-9cd2-46c7-99d2-404a7cd22208", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652280605, "uuid": "0cfcfaae-5e9d-4228-9919-9e10305178f9", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9931bf1c-d14d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652289175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289175, "uuid": "804a9cb2-f0c9-4b62-899b-58e70624c119", "comment": "Malware payload (Heodo)", "value": "13dc4e071c6314565eee2cfd991224fe", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289175, "uuid": "f7c031af-6bc3-47ed-8d88-70bcc2c25c07", "comment": "Malware payload (Heodo)", "value": "f9db31e540a9121eda94cb4f1c667fb6ef11c595cfe2b3e4a9007640fe4dbc0f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289175, "uuid": "0a1699df-cb60-4c5a-9a9e-9d1523b2fea1", "comment": "Malware payload (Heodo)", "value": "aef10ec631cefb4df5ee37f7eca89742e5634317", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289175, "uuid": "3dd69ea1-cea0-479f-8b05-b1366dbef072", "comment": "Malware payload (Heodo)", "value": "cb5ccb50e99184d6b8aa4b58411aa10006f2191273ea635e961a0ad6e20dc876b8dc1d5df54439bfdc0ebd8909e0995a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289175, "uuid": "5fbe1ca7-b737-48b5-ac34-37eed61f8545", "value": "T1D9B4BF06B3A504B9E467C174C9735952E672BC121761AAFF33A0436A2F37FE06A3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289175, "uuid": "0d0a45d7-7418-4d6d-9a99-f2e8c47b8117", "value": "6196af15ce9ababd9a592319b3043ede", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289175, "uuid": "4e484375-8381-4668-8f57-87574093f25d", "value": "6144:iuD3jumQgXW2jLi1QPy+hSVL+ymioha/dtUPM1UlTIqNtF1FMytrf:ZDLVXW2j21QC1+yZoGtUPMg9Z1FMyB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652289175, "uuid": "280a94c1-5538-4b89-bca1-646cfbdd5fac", "value": 513536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652289175, "uuid": "f13e23a1-77b7-4d43-92ed-ce80d0996eb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289175, "uuid": "13e60c55-b892-45b0-8d66-aacdb31b6fb9", "value": "13dc4e071c6314565eee2cfd991224fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a47d773-d149-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1652287459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652287459, "uuid": "64988590-ead2-4fbc-90a6-97ee1439164a", "comment": "Malware payload (Quakbot)", "value": "d2944320fd82bc01030a53077220ce07", "object_relation": "md5", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652287459, "uuid": "ea1ceb78-efc2-4769-a88e-50b4615b08fb", "comment": "Malware payload (Quakbot)", "value": "fa6e2254cf1793674194d998b03953ad70297cd4e25d5b381cc8ac512130a14c", "object_relation": "sha256", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652287459, "uuid": "fcd67854-2462-4f20-8673-620fa1cb321e", "comment": "Malware payload (Quakbot)", "value": "a96ff3b6370d9634a763b4e286c2f26e6292ecef", "object_relation": "sha1", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652287459, "uuid": "397eac23-b073-4a2f-8b30-5dc6239d0e70", "comment": "Malware payload (Quakbot)", "value": "6677b729a873c216e1a95cb06cda8a12749298c3152ee93241ed5f3d7148d0ecfbad2d78fb3b2febd5593b6c218b30a5", "object_relation": "sha3-384", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652287459, "uuid": "636220ba-10d6-428e-89d1-23ded1ab1090", "value": "T162E48E27A3D0487BD2771B3C8D1BB7A894397D112D78988A3FE41E8C4F3968076652E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652287459, "uuid": "81251e71-b6a6-4e99-96b1-a32b58b55748", "value": "f7eb3e856a00ee4120cd9bbdbac23f92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652287459, "uuid": "b9cad23f-2300-4a21-af55-130ccbbb6fe3", "value": "12288:lJam0AsChqCGBO6pMbrr+r894ovZRzYB:HnWChi7mber0zZRkB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652287459, "uuid": "488b3797-b6ab-40a3-a4dd-7dba3a8d5186", "value": 699104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652287459, "uuid": "fa2db6e7-80f7-4660-95ff-bc4e2641a022", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652287459, "uuid": "fd9e300c-379f-4403-8329-a6ba7c917b19", "value": "fa6e2254cf1793674194d998b03953ad70297cd4e25d5b381cc8ac512130a14c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22ea268b-d12d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652275233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652275233, "uuid": "f217ad51-d53e-4c80-af2d-af1894ff6cbb", "comment": "Malware payload (Formbook)", "value": "63a1d35e401001e1327a062169b78fde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652275233, "uuid": "13114e19-4fad-477b-9add-b82f92590823", "comment": "Malware payload (Formbook)", "value": "fa8c154dc265fd44150023639ed16b4a0112355d0622f39a9b305acb7c940d6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652275233, "uuid": "5e99c1b2-559d-40f3-b353-e45d84b4bde5", "comment": "Malware payload (Formbook)", "value": "cef230e114ee7eb4fef4fcd03df56b9b45fb1522", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652275233, "uuid": "16d80c17-8791-48e5-bc74-e1f4b0f4d50d", "comment": "Malware payload (Formbook)", "value": "f3e690a18a56e63ce8f288ed3c6077ba2027e7ec6e988b2f464fba00ef4c4e22572063a596e3f3190b2223a7a968c8c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652275233, "uuid": "b0503360-e6e7-4625-9b78-538af9e7c0e9", "value": "T10924AC6D1ECB7A9DD0CF03B8853AD38D07A3591497E061DA27E362274F9B3A05CB5263", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652275233, "uuid": "4af60984-1dfa-4007-82c5-657cbc21269b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652275233, "uuid": "55ebb19f-a03f-4923-ad54-8027f9173b0b", "value": "768:l2o8+VWANOhR60OfZGzuV5qeo6+lrd8MDjeonF+EMTB1Am/PRs8GH/NAW6y:lj8qihzOfZSjAgkEA/Pa9fN9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652275233, "uuid": "6bab22b5-a4f6-4147-9173-e2b42bebd8f7", "value": 221184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652275233, "uuid": "5f8bd618-ad52-44ab-b86a-e08628caa19e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652275233, "uuid": "d16b509a-ea6f-4c66-9366-fbea64643479", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c96ebda-d13f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652283087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283087, "uuid": "c531c9ae-91fe-44cf-8466-faa813ef09d5", "comment": "Malware payload (Mirai)", "value": "321be36508d19980e7b11e04e8a501a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283087, "uuid": "111cc65a-3b41-41c5-9818-2dbad0205f64", "comment": "Malware payload (Mirai)", "value": "fb6dceda612cf6e67cdd3d2abecc81c58ec7dda1b6fb4ef84c84f03c10a9ab85", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283087, "uuid": "b3629dc5-d665-4f24-a8a7-c3d5e889c521", "comment": "Malware payload (Mirai)", "value": "fbe3461531e6d72abc311ab734a3f6977f34d7d6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283087, "uuid": "fe02e910-41df-4374-ba2e-8ca377c8e800", "comment": "Malware payload (Mirai)", "value": "35b6ba3cf18a8654d8ed3f7a5f9ebf3c278d795534ecf249cfac01ae4aa42ed82225a1183709e115fa90ba8147d6b7a0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283087, "uuid": "47abcc12-c662-4c59-a9dc-f09b81a0c80d", "value": "T17B93800AAF611FF7E89EDC374AD92B0524DD511A20AD7B39B930D818F25B30F19E3865", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283087, "uuid": "a85dce9b-b5cc-4209-8c8d-08f80f38ff4e", "value": "1536:zUYsxrXP40ODyPwHRQ9PlzTRfyToNoZqui:zLsxrKDy46Nb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652283087, "uuid": "c3754f73-ba69-47ed-9c17-64e6f8e17436", "value": 92100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652283087, "uuid": "264e22af-a70e-44c0-b1bb-f641414a3d14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283087, "uuid": "3cfd8659-1a92-4356-b5ed-f27a0e1b71a2", "value": "321be36508d19980e7b11e04e8a501a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d24fb4f-d13e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652282685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282685, "uuid": "68c9917e-f0cf-48e7-bdb1-60afd2537d6f", "comment": "Malware payload", "value": "264807eee4d6d3798d7181237877b3aa", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282685, "uuid": "37a7350e-0480-4144-9624-264e0f413638", "comment": "Malware payload", "value": "fb99076405e184a937cc43ef207547a806ae9495374568ce225eefa9a6d651a2", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282685, "uuid": "1048aa33-b801-4690-8f02-bdc192fa449e", "comment": "Malware payload", "value": "effd1bf23164790b5991c1ba1b90cda45a8baa6c", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652282685, "uuid": "74f74b39-50d6-46d8-9963-c9493432f2ea", "comment": "Malware payload", "value": "b1efdbe43aef6f8b07f9029889438979ac22d3889f4a8e1600df7e60574e2cfc376f67b6ca060711c7551993bddf7e7e", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652282685, "uuid": "ac7f7679-8a16-465d-b4b8-7cbdfae66828", "value": "T1B8C2D1D8C5915520E27FC03B80B831E4EECD25958B8A49CFE765B50C6E91607D37E3E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652282685, "uuid": "4c00e4fe-4fc5-46d9-a301-b15418dc16d7", "value": "384:wc3wmDR3CIHc5mTu9MfharSx4qbflDdd2T11lRHC14APedAKLSep4qIuo3L:wWYUcwTlpXaqbpD2LbjndAKLSxqIbL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652282685, "uuid": "d1abd833-44d1-48b8-a2b2-99844d1e4494", "value": 26735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652282685, "uuid": "7d64fb76-e3cb-4695-b519-ebbe082293bd", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652282685, "uuid": "2b3ccc49-8795-4ad4-872f-b97e708a565b", "value": "Park Edge March 2022 T12_Maxus.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b95d1d3f-d14e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652289658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289658, "uuid": "83234d45-c5cf-4f9a-bde4-1115c6ae525b", "comment": "Malware payload (Formbook)", "value": "66c81ce63eff008caa8bdc9d8d1d1da6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289658, "uuid": "69a8539c-ea55-4c86-a1d7-edda834e024b", "comment": "Malware payload (Formbook)", "value": "fba9fd3b1bbadb44fa174a16181c1c20ccc04515a6f50ac2212b45e5c390f6c1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289658, "uuid": "1d9848a3-e485-4722-89b6-d011b5bf5828", "comment": "Malware payload (Formbook)", "value": "5f1f37ec99598251731ff6a6ac33b4d00b1a6401", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652289658, "uuid": "064ef4f9-b89e-4255-bd39-621acfe8a57f", "comment": "Malware payload (Formbook)", "value": "83cf32cdb146ffe9ab631ff4d14541b73d4eac8723723225b905951d2c5f892b4c152020b92e1851f3e0e6101bb49eaa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289658, "uuid": "83c58749-3a84-4f5c-b3c1-5ee4d39f411c", "value": "T11E24AC6D1ECB7A9DD0CF03B8853AD38D07A3591497E061DA27E362274F9B3A05CB5263", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289658, "uuid": "65b663f2-8acf-4a4c-85a8-a7e5ec64e6bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289658, "uuid": "5ed279e2-8988-4803-9887-49f8d6f563f0", "value": "768:xr4qjFWANOhR60OfZGzuV5qeo6+lrd8MDjeonF+EMTB1Am/PRs8GH/NAW2:xsqBihzOfZSjAgkEA/Pa9fNW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652289658, "uuid": "fbe7c4ae-b940-4c59-ac11-ca438836675d", "value": 221184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652289658, "uuid": "446199d6-2abe-414a-b758-bd9201cf1082", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652289658, "uuid": "f5cb884f-314c-4826-9038-0b21162aa3a1", "value": "66c81ce63eff008caa8bdc9d8d1d1da6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a938a4e5-d14c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652288772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652288772, "uuid": "09c35853-26b6-430f-ac04-86a47303af34", "comment": "Malware payload (Formbook)", "value": "2b1ffd2106c1d2f1358f5fef67e93cbb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652288772, "uuid": "99ed4c36-1263-4860-881f-788a20586578", "comment": "Malware payload (Formbook)", "value": "fc016404ec0f895f233c8c1f6ce91e4dbf2d6f083a8dbc9429788d6839d7ae0d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652288772, "uuid": "55b31806-8ad2-4ca2-996d-c71b55e5cdc9", "comment": "Malware payload (Formbook)", "value": "a97780203cb16b321ec2bf2c0950a36e4dd7961e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652288772, "uuid": "640f807b-f1a1-4f7e-bf33-1d9a13c01dd7", "comment": "Malware payload (Formbook)", "value": "970460fa0cb2769a908bc81792bd2ad4ec364b03a43d8932f44d6de85fffc50697f5c6999a31a3a3b30d4902c9115d6e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652288772, "uuid": "5cf57d5d-999f-4168-ac67-a9321223e47e", "value": "T1EA3412112B90D4D6F99303311DB8EF858AEBB60E2671D58F13A45FACBC354D14E0E3A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652288772, "uuid": "e584da5c-953c-49bc-808b-9fe0ef1aa4f7", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652288772, "uuid": "cff7db4e-a829-400f-8ce8-03c51e9e48a8", "value": "6144:HNeZmPvTPbr3JmKgQTU1uU/xaXdHtrm0dm+gJhw+0SW0:HNlT/3JmK7U1Jyt6omPJhcSW0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652288772, "uuid": "608ab70c-198e-4982-b731-57b4f4c9d7b0", "value": 252108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652288772, "uuid": "000adf3a-b02f-4959-8e60-b420acdc12e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652288772, "uuid": "d964b0d8-a9ad-4933-b740-4da1d97e3282", "value": "2b1ffd2106c1d2f1358f5fef67e93cbb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e1260fd-d127-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1652272621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652272621, "uuid": "e09dd4a2-957a-494b-b9db-c8d3de7de0f3", "comment": "Malware payload (GuLoader)", "value": "5d0444b70ff5caa4ec3b2ca2e563e724", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652272621, "uuid": "1a466368-892d-4cb9-85e0-49778e46fff8", "comment": "Malware payload (GuLoader)", "value": "fd620fd2a9d5ca1dea1e11013eb4ec486f2f5cb340cd28bcbe39e78271fc5d26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652272621, "uuid": "42ba54dd-50c2-4f0d-ba91-4254d6c96260", "comment": "Malware payload (GuLoader)", "value": "27309fdae9005f71dcde3501f023819ae6dba6cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652272621, "uuid": "d98e9e79-c6c3-49fd-a388-4bd01ae9e8fe", "comment": "Malware payload (GuLoader)", "value": "263d7606b77cc4c8005b6deb875692c24eb653d98ed47475a7780f1c173c55f32615dc39bf7460fbbd9ced17c7f00660", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652272621, "uuid": "6a3d0064-f5ea-422b-a66c-e831e62b4b92", "value": "T12A84F141BBA8D4A7C5720B300CEA96A55ABDAD502996070B338077ED3FB37D19F1E319", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652272621, "uuid": "f8d0fc7c-77e1-4c44-9b91-1d31dde79aa0", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652272621, "uuid": "f72e201e-19c6-46db-8d1d-1c9d4c6827cf", "value": "6144:ZYa6W/pzBlsLyHIlr3SkSHyO5AxPO5khaL6YSsA2gaRD:ZYwxY3pC3Qmeaqspt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652272621, "uuid": "c4c8878f-3bda-4452-8fc2-2b921fe984d6", "value": 379352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652272621, "uuid": "cbc9ce8d-daac-49d0-aa5a-698a6f50b7e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652272621, "uuid": "d867f74f-f2c2-44a6-ad70-76bdb2878ff5", "value": "PO#4200000866.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61b71676-d129-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652273620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652273620, "uuid": "5862077b-c909-4698-9b26-1effae670cc7", "comment": "Malware payload (AgentTesla)", "value": "2cce7207e98bb1d084033b01fde91237", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652273620, "uuid": "30272752-9cbb-4838-8ec2-42094e33c743", "comment": "Malware payload (AgentTesla)", "value": "ff0f441a25326427cef88d4558d1376d1ed113493bb9a6cadcc0c003d68bb0fa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652273620, "uuid": "e2884a49-b2c6-4ca4-b78f-de6ac8bd78ba", "comment": "Malware payload (AgentTesla)", "value": "ffc385c978431fa3cdf864894ece9401ff235405", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652273620, "uuid": "33f202d2-61d1-4188-861c-066f088a82ce", "comment": "Malware payload (AgentTesla)", "value": "69d85e3db5ff02e506f1068052913d15b78a1cdb916d1faf82d7fef0acaff23cebe0584008de1d21da9beabebf368d87", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652273620, "uuid": "c575ba60-409b-4b34-8de5-edffef4a7850", "value": "T1AF9423C4F223A63192A4E2BCA6C4C2A56175FC930713B4591BD9BBCDFFFC2D58A41609", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652273620, "uuid": "052aa8c9-912e-42f7-9764-65a3ed819838", "value": "6144:TY+GQc+C0EgZicdeqm3XLj8Hz/KRSd2rnNzZSBXg4k36+wmrlG+3ej+rAMlt:TY9EptYqOLj8Huc0pNSx9k36Eo6BH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652273620, "uuid": "1ee0c06f-483f-434b-996f-28e32291fe68", "value": 420027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652273620, "uuid": "13289e19-cda4-4e16-9acc-c99e04df3269", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652273620, "uuid": "ae14a2ee-4089-4601-bcd4-dde7b9fc22c6", "value": "invoice.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95e9927a-d140-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652283586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283586, "uuid": "4f964898-0aef-4b23-9e75-9cd27a327208", "comment": "Malware payload (Mirai)", "value": "433e54bb2471fc1c23ad09f1b3ae22ca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283586, "uuid": "d49a72d4-411e-4662-ad90-46384b14c19b", "comment": "Malware payload (Mirai)", "value": "fff503bd73884c317a91fe3527890522efdc50c7c3d6597f306989dff243de1f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283586, "uuid": "1e2a7465-5c56-408e-9de8-dbe28c00fc13", "comment": "Malware payload (Mirai)", "value": "7d1ab6b26958d1bc4a6ae5081aa75f4f21e26e0e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652283586, "uuid": "96b942c1-ebb7-41cc-a71e-d3b990d539fd", "comment": "Malware payload (Mirai)", "value": "e2c9cd2e6e2c6c440baa8796a7aa9e5a4bab582b914139a779efff581031d4e2e9e9b3a46bc4df545c646949249968f7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283586, "uuid": "0b087023-a220-480d-9c4c-dc596cb7befc", "value": "T1BA934CD5F4015E2DF88FE579861F0A09BE6562801F930F37E6A3FCA75CB21987922D41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283586, "uuid": "109b8b40-e922-43b4-a5e9-457819f1fb0f", "value": "1536:Bya+6a/vogbTavtld9yBYdp5wwgLFwipsw95l5bKh9HCuM8gKOQSLxg:Bhjvt39Hdp5wwgLFwipD/L0HnyNxg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652283586, "uuid": "62e2c841-6dd7-4f7f-8053-cf0e6ba96548", "value": 90068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652283586, "uuid": "172cdf17-745a-4cd6-bb5e-6686297bd2e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652283586, "uuid": "b2f62527-e695-45b4-b965-27641e675b3b", "value": "433e54bb2471fc1c23ad09f1b3ae22ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }