{ "Event": { "published": true, "date": "2023-02-21", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-02-21", "timestamp": 1677024181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "a664def7-fe85-4cfa-8417-646efdc027ab", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f84c1ca6-b235-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677018038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677018038, "uuid": "b3531a32-be97-4283-b7b8-1cf43e194c7d", "comment": "Malware payload (Amadey)", "value": "bce91e071a77c3699fa7e1466b41b4f1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677018038, "uuid": "fd72e3bb-6075-41bd-9bef-e7dad4a7b06d", "comment": "Malware payload (Amadey)", "value": "001ddf52e1d8097d36db73b7549bf206b749705018bae2668611619002c16343", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677018038, "uuid": "3dfe4c54-2bc3-4be8-83ae-aff8e533d358", "comment": "Malware payload (Amadey)", "value": "dfe40065d848f544b6fa4e7ffa6905e1cadcb037", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677018038, "uuid": "12cdcbb3-2b07-4bea-88c8-f126d2f7d64e", "comment": "Malware payload (Amadey)", "value": "48eb70cddcaefb09e7f2f82d6c44c0fded4cd44f5aea47838748fb49cb071fe1857c7a126c0626b42b8afef2edaf6951", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677018038, "uuid": "89cca29f-eb53-4d04-a1ee-8dc32ac47637", "value": "T1AC35234BE3EC9070E8B56B7119F203E30A367D905B79938B678D9D661C222B5B233357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677018038, "uuid": "a4fc7a37-4844-4f00-bf08-45516f58a070", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677018038, "uuid": "66e4e339-30cc-4f1d-8e66-7637569c5c22", "value": "24576:qyXMVsNz9x7jlDRA/J/NOQ9QY5kdPhs0yGWCkQ6:xXMi59x7xR0JFOQqgms0Qi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677018038, "uuid": "d4c43f9e-5b13-4c79-acd5-f15aeac80609", "value": 1099776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677018038, "uuid": "48b3c46e-7cd4-4c7a-8fb9-75d1f4df7610", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677018038, "uuid": "293d2c62-97ef-48f1-9b6a-7980cf3c312b", "value": "bce91e071a77c3699fa7e1466b41b4f1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06419dc6-b1f3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676989285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989285, "uuid": "7b92f222-550e-47a2-b28d-71cba2e977f4", "comment": "Malware payload (Smoke Loader)", "value": "c22734d52380d07b58fd97b59930c4cf", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989285, "uuid": "f07d0874-95e5-4b7c-913d-259165acee72", "comment": "Malware payload (Smoke Loader)", "value": "010908bb38b8228dea6d625bb4a0f637e892cff3843460a594f18090a4f6b248", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989285, "uuid": "7b171c98-d7ee-4154-a10f-8b9790649a0b", "comment": "Malware payload (Smoke Loader)", "value": "53c41a2900b5ab6a3be6712993ef3d3d99c9dc65", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989285, "uuid": "2db63bd1-ae1d-406c-90ec-a69a5dbba517", "comment": "Malware payload (Smoke Loader)", "value": "64766e53539c2c37c67c34f677bdad54ac64d6b227b36b81a43f370f643198583cc49668135cff9f983c041377b57e71", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989285, "uuid": "6b5e97fb-b99c-4eb3-ae32-86a684448fdc", "value": "T1FB35F105E161DD2BEC625930E8533587C226AC6EAD18DB4E32C3732F96327F61E36E54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989285, "uuid": "89b9ffb6-d761-4276-a9b6-061a6825e026", "value": "24576:JFeGF/SFem/MdYjmtmXzUbn7mGcHPeuDf+JXXXXXXXXXXXXUXXXXXXXXXXXXXXXE:bLgvlGn7aveuDrs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676989285, "uuid": "56b76c49-bacd-4c20-a651-a126ef65882a", "value": 1163264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676989285, "uuid": "67bc455e-7a11-435e-b84d-98fb80fdd72b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989285, "uuid": "cf6d72b3-0f35-4643-be75-6ed42e1eaafc", "value": "inquiry.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "877c76b6-b18e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676946123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676946123, "uuid": "84e619fb-7416-4bde-9b34-62ad8dc18408", "comment": "Malware payload (Mirai)", "value": "d5075629249965549794b1346716773b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676946123, "uuid": "e62276ab-d8bd-43cb-acbc-b53667130c91", "comment": "Malware payload (Mirai)", "value": "0180f68edc5650a0ee961880dc0bf3d49878e3deb774cd199451ff7ec992cc20", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676946123, "uuid": "37b926cc-c004-4dca-bba0-202edd1c2614", "comment": "Malware payload (Mirai)", "value": "76e740e1d39bcfd9ec960878a4c99721f9d93731", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676946123, "uuid": "7a98bf84-3351-4275-810c-7be6823a418d", "comment": "Malware payload (Mirai)", "value": "d15406f3b4ad18e6fe61274f368f110e919cd32d82712f9975cdde7e99b80db4f9e92e48a569f0791e9af92261ac604f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676946123, "uuid": "866a59de-8acf-4709-8c07-fca64a28ea45", "value": "T1E6530846F8818E11C5D412BAFE2E118D331757A8E3EF7212DD206F247B8A96F0E77916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676946123, "uuid": "ac8d543e-215f-4d66-90ce-e9e4a21a1560", "value": "1536:4UnXtyx98Id3H5cFCG5ij6KkdzpImilhdT1Qk:ty/8A5GCG8jJhdT1Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676946123, "uuid": "8c7cdab2-af32-4a35-9214-292bc3f9c319", "value": 62984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676946123, "uuid": "8ec19eb8-a707-4815-893c-5ed00de2516b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676946123, "uuid": "ef28628e-3bd3-414c-8ec9-52bdc030ee00", "value": "d5075629249965549794b1346716773b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f62a5a40-b1d5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676976803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676976803, "uuid": "1c12eb38-c9c8-4bbb-85b9-095a8fcbaff6", "comment": "Malware payload (AgentTesla)", "value": "22a40d5e41711b6afba8306a79f39f81", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676976803, "uuid": "db6d7c9a-2943-4976-88d6-095135777a58", "comment": "Malware payload (AgentTesla)", "value": "0228558ee95635f31f43520f57de4f7779e10692228828d5f9e51a493525f8f9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676976803, "uuid": "a77a17fd-b1a7-4aff-a3c2-c4061c1054ea", "comment": "Malware payload (AgentTesla)", "value": "37c45f4b7fdc4aa122755cb4ffa32bd1fb746b41", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676976803, "uuid": "7d19b4c2-500a-4135-9919-73bc30e15f11", "comment": "Malware payload (AgentTesla)", "value": "07ec14f91358e19c5c7e41aae26c0c1b56d36ff07a116d950ee3ae737caa281272f8d8b0e73906a9b8db63a828b22e5d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676976803, "uuid": "b6eb6a1b-64a0-48b0-994c-78578efeac9c", "value": "T1DD25BE9937B46473F4CB01FE5C38278C2E2025577119E36E9B77BB92A2719FB7298102", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676976803, "uuid": "ceb9a430-8549-4e26-aa34-ff83706356f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676976803, "uuid": "53a91254-648c-430c-a074-a1c024d03a75", "value": "24576:Vky9IISlJ+HlwGBeTJrIY1uw2lkVE1XErfHgGnu1Q:33K5IQuw2qVE1WHPu1Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676976803, "uuid": "74c28900-1794-44de-b0b4-a3418f9f49b7", "value": 986624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676976803, "uuid": "b968e057-0346-456b-97da-ce68e40d793e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676976803, "uuid": "98310913-bc67-49f1-a7d1-f821e80187a4", "value": "AWB NO.3522849002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "038c7643-b240-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677022352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677022352, "uuid": "db109bcb-319d-40ca-a1f5-0ab583d28c28", "comment": "Malware payload", "value": "5ac5d2bfb46d310338ad8bb70a0b562d", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677022352, "uuid": "c3af7ae5-4ca1-47a4-9984-d1b3ef42c2dd", "comment": "Malware payload", "value": "05aa0587937c153ffbd573c6ba35a446e7c9eae62a39308d6e800e127156c468", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677022352, "uuid": "98e40733-58f1-47a5-bb7e-7cdf72b0a6f1", "comment": "Malware payload", "value": "bf07b0e67bb50fec99ff89b17ec6d4f8a19a57e0", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677022352, "uuid": "bd5e4ded-59aa-4e8f-967e-a567b40e0918", "comment": "Malware payload", "value": "81326316069434221d03e2e45bbccfb3ada515072484908b9d4d0744ae4fde4a013107d897a3a22ee09a58d29bb5273e", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677022352, "uuid": "88a9390a-1dc4-45a5-9b5a-2760c99d008a", "value": "T1D665C06103EDC3E5F2FA4D7418F30ECC943E6C12D6A6C9671E55A420E96324A6FB1B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677022352, "uuid": "2b46df8b-6436-4bc8-8317-a2d7d7f9511a", "value": "d896fbd44874f6dc349fa19cf7d92573", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677022352, "uuid": "9fa7ed42-373f-4579-9f82-0a02da8672ce", "value": "24576:XS9VBCocBwQ4v4by+6WUjI9+Wq6w6bX2du9RXr+3:C9CJBp9WHFIJq6Pbmd2RXW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677022352, "uuid": "b4182a75-af44-41f1-b33d-cb7142570cc2", "value": 1500824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677022352, "uuid": "9aeb0e98-0d08-4733-a586-9ae8c55bba77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677022352, "uuid": "b6782e98-a150-4e16-b91e-4df3e260fd84", "value": "Contract_02_21_Copy#48.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49ef6a79-b1f0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676988110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988110, "uuid": "9f213529-ef0e-4516-9c29-aa73412224da", "comment": "Malware payload", "value": "e706fca84dd7d60992c5e091c785a7d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988110, "uuid": "997a33b1-6c51-4777-b4e8-81a8dbdf3482", "comment": "Malware payload", "value": "06bbd56f97c98fe910af5904b60443fcbf1d88488f374f35d4a0423f045c7b4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988110, "uuid": "630c4a11-2055-451d-ba10-34aec870d90b", "comment": "Malware payload", "value": "e18021f376bc036021f7db58066cec9cb69f6ba1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988110, "uuid": "c72ac79c-746e-4463-9a85-9d4787614ff3", "comment": "Malware payload", "value": "8c4c3d9611fc6ca90cbf7d4e3067b34090042f5a918e3fb7e764b13ac265a7ef63474a9f8d083524ee83631ac58786a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988110, "uuid": "1e6d8bb2-a194-4902-b972-b0a4e79c6ec8", "value": "T15B94BFD2E2548CFAF86602B28C37DD2521977EAE80F4551E615FB62566B338300BBD1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988110, "uuid": "b8a5daad-356e-41ed-bc46-61f319daef71", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988110, "uuid": "d7970bea-7445-4aa6-aa22-b97dfa69e106", "value": "6144:vppcUsPO4DTxoXSRCu2x/fwgpkJ7Hnu+kMZ8OHGRRyJ+ATgIr9AqWl2XVCOAzXdi:/qTUSRC4tuqHGRd49DWiVoXdlSvPR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676988110, "uuid": "f5fd9426-83d3-416b-a2fe-139daf2c3172", "value": 435040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676988110, "uuid": "71303448-e2b8-4f38-aac5-026bbd6f8d50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988110, "uuid": "08cf7a0d-d2c0-43fc-b639-522bb1cfbe31", "value": "RFQ_SiN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bf58782-b1c6-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676969968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676969968, "uuid": "03ca14d9-635a-4cf1-9e17-1afd4cc4471b", "comment": "Malware payload (AgentTesla)", "value": "3133a24b46145061ef7c6a8f9679202d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676969968, "uuid": "3754c7a0-b0ea-47ef-bd3c-eee9c3959799", "comment": "Malware payload (AgentTesla)", "value": "077694f8e71ba304da202f9522402ccdc7f546985fe932cf841bf05960e96b66", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676969968, "uuid": "619ed365-f41e-4f36-afe6-9977c1e8f671", "comment": "Malware payload (AgentTesla)", "value": "cde4ae061f005e90439cada1d9a1281fc5851eef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676969968, "uuid": "440f8ad0-429b-4d66-8117-65f699747a85", "comment": "Malware payload (AgentTesla)", "value": "d6ba763f8e1d65e6269ede7f16d8a639f367f708ae6271d5577a730713f5cef51895695bf98d481245c03150b2e43c10", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676969968, "uuid": "e0279b05-b68d-4353-bc8b-71d1344ad100", "value": "T1465423408A3A21FD83CE453C1EFAA4CF3A3154AEB154B20DBC37476565E5BA0DF5788A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676969968, "uuid": "4d445d49-2a45-497b-9734-daa8d93d8681", "value": "6144:MStjCWt3CHWblcotBrL7Wqh7znQ4HNhrRkAi7nHEYsDF3:VtjCWtyHkbrL7hh7znQ4hk5rHEYqF3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676969968, "uuid": "8ab7398c-3c31-4b44-b720-5a54c44206d9", "value": 281337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676969968, "uuid": "6e672f26-625d-4b73-9178-50c17d02f911", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676969968, "uuid": "0c7d6be2-7b42-4367-a126-a982c67099e7", "value": "Shipping Document.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb61ea8c-b18f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1676946666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676946666, "uuid": "d2ffc9ff-b675-4691-8f2f-d7b69ba3be2e", "comment": "Malware payload (RecordBreaker)", "value": "5ae6a3912bf6fc52c8599063b40c7aee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676946666, "uuid": "aaec0d95-e7b9-46c2-817f-b1a30fa45ea5", "comment": "Malware payload (RecordBreaker)", "value": "07b82bbca7e60fbff6c81f297f2f4db4b076bf3fbcc59140ef4f2dc8b0558d35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676946666, "uuid": "a3f2e102-c05a-46fb-87a2-2894e6dd6a00", "comment": "Malware payload (RecordBreaker)", "value": "18b5097668b921b39686c9c6ba0b25fcdd8140f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676946666, "uuid": "af5c4ff2-f510-4847-87ad-625c17b57f1d", "comment": "Malware payload (RecordBreaker)", "value": "5ad131cd52343f9976d8f73c7c9da3c812a9d31d68b43ce16384dd7590fd06f152baa540e6b685bab966b797822d5129", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676946666, "uuid": "311a23fd-b836-4488-a809-985694ea60f9", "value": "T198D6336362201019E5F5CC39893B3D95B1F93EA69EC2E47D6AD2FCC518728A4F603D4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676946666, "uuid": "0d965340-be23-4803-8802-2cd516ed1d9c", "value": "e0224bb1f86777b26682b150d90a08db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676946666, "uuid": "7173b217-0d4c-414d-87f3-25517de29b5d", "value": "393216:BjV/S3K9h8tXvM713H1WEMEjwPl2LDv9GgQZxl/Lm:BBbetgH1WEVwULDFul/Lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676946666, "uuid": "8180ad98-00cd-4c15-b6a4-f780035d37f9", "value": 13328313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676946666, "uuid": "5be32d5b-bd05-48a5-a646-ed5328313cac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676946666, "uuid": "dc890e48-60cf-4ca3-a993-b76052166e50", "value": "SetupFile.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7015316b-b1c6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1676970136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676970136, "uuid": "ac125ed4-0883-4b78-92f2-d15f77701736", "comment": "Malware payload (RemcosRAT)", "value": "8c668d830c6e1ca73a8553b12d6e5a66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676970136, "uuid": "be014846-1dae-487e-8600-3079fe7c3a98", "comment": "Malware payload (RemcosRAT)", "value": "08c829e7056b8e022539076acbc962dea072e6506184d4036b785cb0e4592371", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676970136, "uuid": "5c8862ed-1971-4677-aa2d-0049481d1a89", "comment": "Malware payload (RemcosRAT)", "value": "32b779d88a8ac581d22981679e3cdb7e735a8d55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676970136, "uuid": "c8b28c16-688e-4fa1-9554-55d2c4853fc9", "comment": "Malware payload (RemcosRAT)", "value": "78d8210d5de55e74f863e4fc542e6c8d8be57faf53663c61598a26f5f86af3f5f0c80113e98b7c4bf0ccb3ebe51cc644", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676970136, "uuid": "eae0111a-bc53-4dcd-b8d7-e1ab4129b85b", "value": "T15DB423357FD8E1A3D0B217721D387AB7B9F6F412646E862B13D02E0DA91B521E58D323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676970136, "uuid": "f061b8f2-4489-41cf-b336-baab24af781a", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676970136, "uuid": "3c6e6b38-2471-4e67-8d83-c86fd525e77a", "value": "12288:vYNfBSiAraRaep5V09h8rc2Z7jnE7wP1VO2dF:vYN5SChyhsvZ7i+1VvdF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676970136, "uuid": "1ba78d88-7ade-4fb7-a1d7-e44b5f77a980", "value": 509252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676970136, "uuid": "92d4783d-b92c-40d8-ad71-5e1fb682fe73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676970136, "uuid": "33e5caf0-54e3-4bf4-9850-0aff98b9f066", "value": "IRD-N.\u00ba 8800.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb2236b4-b18a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676944572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676944572, "uuid": "396e9c86-a821-4e90-80e7-26bf24a4a674", "comment": "Malware payload", "value": "d385c682d52389c63362985f993f2a2e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676944572, "uuid": "8dca4284-ae6e-4025-b4fd-b6952cd9ab5a", "comment": "Malware payload", "value": "08e4cbc2915eea6115e9c1614e3274c5b59116638dfa166d314801414de5f9d4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676944572, "uuid": "9a11318f-b5fa-4088-9b75-ca70986a1323", "comment": "Malware payload", "value": "c79c81ca2fdab6ef5edf544e7709d25d8c517774", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676944572, "uuid": "5c8b8035-5c33-4496-b656-1804ae4dde30", "comment": "Malware payload", "value": "e51fa4bc5d45fccc4e6df7fc645f6e03f5e66f942c7bb1807f8d2e8f346b36070a597bcdfffd157440cde84b44be591b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676944572, "uuid": "f99bec6d-ba90-439b-838a-afde9ae85d67", "value": "T188A63373576522C2D4C7C831923BFEE872FA535ADF82B8B449D76AC120225F4A352C67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676944572, "uuid": "dd06b837-25cb-48c1-97e7-db679b5882ce", "value": "fbedced926bbe1076fa200f0974d45fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676944572, "uuid": "f146609a-6c36-4921-ac1c-3bc8017c0867", "value": "196608:kufmaDg0KCrRpuxLaq8VWrTGk9lDLg9PXLb5N1hF1xEG5n/ZVX:kufXDg0KtLjt9lDmPLdPhdEG5//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676944572, "uuid": "db582ed4-35a9-4e56-8a9a-c5ca46e70be4", "value": 10327000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676944572, "uuid": "48a50f96-e735-4c9a-9c48-3964b10aedfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676944572, "uuid": "ad052153-60e4-4764-982a-a05e63b8628b", "value": "d385c682d52389c63362985f993f2a2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96294f3a-b1f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676989097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989097, "uuid": "78056300-2d02-42fd-b622-c20f598eab62", "comment": "Malware payload (Smoke Loader)", "value": "b1261bc1ca8b37fe71a675852638f075", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989097, "uuid": "18429ccb-a411-4fea-9e64-bf0cf18f8930", "comment": "Malware payload (Smoke Loader)", "value": "091dbad724980aa725a71055aee69323fb38d2e67a4ac37d823ea54680055ceb", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989097, "uuid": "225e2bc3-ed75-4f1b-be4e-0c0ab102471f", "comment": "Malware payload (Smoke Loader)", "value": "ee6b6b92e7bbafcac8afbcabb7aab17e8d2ade51", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989097, "uuid": "1d8f45d0-4b4a-4ed7-a913-ef9112cd18d6", "comment": "Malware payload (Smoke Loader)", "value": "bc20cf2b2e3adbac5d920f12f49f65d85df25af3dee77defd4d2737b988bdb7033b3fb4bb73539c78e58648364a0bd86", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989097, "uuid": "29d85261-5ec0-453c-a8a8-da1b26fe5f77", "value": "T1CEF3CF2236E0C0B2D1B3563018B4C5A56BBBB9523575CD8B7BA8223E5F703C19B79357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989097, "uuid": "0a55a453-6428-40e8-9438-7e389281e2d5", "value": "3b9c426a6fdec2cb62dc7c138a0d2616", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989097, "uuid": "1d8dd267-63d6-4f35-a596-a72ebe2643e0", "value": "3072:0trG3qTIxMRtQN+CwiCkYrh5+rRmn85zw4mwQnXnKal6uL:05G3qThRtC+Crrkh5OMn85zw4mwUXKQ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676989097, "uuid": "5351f1e8-c336-4f38-95c9-169f2f4ecda1", "value": 171008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676989097, "uuid": "02200514-2eff-4ecf-bda2-8e86c4e647ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989097, "uuid": "150db430-27ee-4d49-b129-113021adcf5e", "value": "b1261bc1ca8b37fe71a675852638f075.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3a21f02-b226-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677011454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677011454, "uuid": "8642d545-97db-4586-9a00-a89f4c9dd4cc", "comment": "Malware payload (RedLineStealer)", "value": "068545587756110eca81a50bdd6bff67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677011454, "uuid": "b809ef80-621f-4e34-85c0-c6c9c549a6da", "comment": "Malware payload (RedLineStealer)", "value": "0a12415d4ce544b02e87b14fd12ac08cee2fa00ec80717f466a5c8c03e7d76ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677011454, "uuid": "cb0ca930-7584-42bb-a86a-79b61a5c1dc7", "comment": "Malware payload (RedLineStealer)", "value": "c419813e8610d2585e7b29eea7b8c440cc13d295", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677011454, "uuid": "59245647-7c77-4d62-a202-2deb82761e96", "comment": "Malware payload (RedLineStealer)", "value": "5e9ac29edb520637ae681f81c555c66bb063d617ebded417ece08ec58b98eec6794b894ae16da1b4cd164c09a8fd6d68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677011454, "uuid": "f803ae54-ec0c-4199-a4b4-3b5f32fe7ed2", "value": "T112C40207B7FC8532D9B49B705DF603D30936BDA06A39469B268B5C4A1C732B4A63137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677011454, "uuid": "fcd43c5b-d257-48bb-b4aa-b1252eaf3b95", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677011454, "uuid": "42a8a123-ba75-426d-97e7-ef9089afbf00", "value": "12288:rMrZy90ThxXVM55EkQqAb0A7pb80fmXPT5+C56v:uyOVMLmb17pb80fmfT5H56v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677011454, "uuid": "8d4de459-e5be-4514-8bf9-18833d29289e", "value": 578048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677011454, "uuid": "a7a9cce6-07f1-4a00-a525-aa3f73a9d4b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677011454, "uuid": "92e1d890-6750-4378-9a36-8f958c56414b", "value": "068545587756110eca81a50bdd6bff67.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f7c532c-b1ce-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676973409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676973409, "uuid": "0e945ed5-4e9d-4b98-b9d7-733832cafe5e", "comment": "Malware payload", "value": "b6c55f8ae6bf4f52c4550694cc36c88b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676973409, "uuid": "097e1bc6-7eb9-416b-a9a9-f25f84fc32e7", "comment": "Malware payload", "value": "0ae8bd8fbb3e87f3c9423c21eb092b79b2891484291154fb4d5e831c44449104", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676973409, "uuid": "d3037161-c567-4bd4-88df-721c2ec9b36b", "comment": "Malware payload", "value": "8810c8d35f6957146a0714797d42d8f50bdc782f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676973409, "uuid": "8ab127a5-1388-4c5d-afb2-5ab78478aea6", "comment": "Malware payload", "value": "ea7cc8f02e331e024b38ade33be83044eee24316bb8a08cc7bea1a449548d3be36cc544184df5a032e921c6ad97b2690", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676973409, "uuid": "4272dcd3-1ebb-4428-b699-a75ab4e60e9c", "value": "T1BC542369DA649775C3C62AF64EEDA28F231657B10F1843C3E86810AD84F7D1DB29342F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676973409, "uuid": "d9986f77-a96e-4f53-93b3-0866d13a7dc1", "value": "6144:QSUAmgMp0HXymetXfCMiHOrwNYGr9OcodVVoR0OJ208uzA:Q8mgMNftXfLiurooVoOOJ2wc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676973409, "uuid": "9c9f5a46-8860-48d5-8ff5-135612e56f1e", "value": 284411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676973409, "uuid": "4b45b825-e6bf-4661-9297-c98501066005", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676973409, "uuid": "7fc55bfc-7f53-4fd2-bb03-c8f05c4da183", "value": "Revised PO-2023217___________________________________.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ebad33c-b1b5-11ed-88f6-42010a9c006e", "comment": "Malware payload (SystemBC)", "timestamp": 1676962805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676962805, "uuid": "bc39882f-6b83-4aa7-88d4-657dc7f8c92c", "comment": "Malware payload (SystemBC)", "value": "378bda0406817eb6000c2c2a88cde01e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676962805, "uuid": "4da6cb95-18b5-483e-9b96-33965fe4ec7a", "comment": "Malware payload (SystemBC)", "value": "0bb8fe7fced43fd8623d9a43746c0ed5627612518d50b4e93f8f5d98d68a5dc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676962805, "uuid": "4967f580-39ee-4e5d-a62c-b87dcf6f12c7", "comment": "Malware payload (SystemBC)", "value": "96f296540382185d4f704d66f9e9ec298f89a1fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676962805, "uuid": "0d95396b-43ce-4bf0-9649-19ed5c67dd23", "comment": "Malware payload (SystemBC)", "value": "d35993468e7e44990c69d50f68d3501052151fe9b4f1ad32570438740d994331bbe4433e7af67aef7adab4ea4beb0d33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676962805, "uuid": "ca9af4db-07b0-4cb8-8322-6c0f0bdc16af", "value": "T1C645BE027391D036FFAA91739B5AF60556BC6D380523C62F63983D76BD702B1223E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676962805, "uuid": "b8743a39-861e-4083-a3be-464f7ad27ee1", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676962805, "uuid": "4722267d-04f8-4d61-b694-cf599ac3332e", "value": "24576:MAHnh+eWsN3skA4RV1Hom2KXMmHah8Hm6gpJxAnlq7L0j5:rh+ZkldoPK8Yahsm64Aq7I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676962805, "uuid": "36d1e7ad-b9d0-45a4-8adb-1c57f727b60f", "value": 1262592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676962805, "uuid": "14a7ec9f-7db4-4961-9af8-dbfd50f1e72b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676962805, "uuid": "62349073-e38f-494c-8ce6-b1330e5d0bb7", "value": "378bda0406817eb6000c2c2a88cde01e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebb71fe0-b1b6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676963471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676963471, "uuid": "39a26851-6b54-438c-b750-f79ec38d3352", "comment": "Malware payload", "value": "060d5dc1b33c7cef3b96aac8207af740", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676963471, "uuid": "cee2dca2-b0f5-43d5-b65f-0656a7bb7005", "comment": "Malware payload", "value": "0bd6d3905b8463f23246c3b7953239277f0ffbf0096367ca02dce1cc38cc4e27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676963471, "uuid": "d5509e84-e232-41e8-9a6b-d8f257351971", "comment": "Malware payload", "value": "25ffc5dbbe287731a8bc4d215f628dcb8c1a91e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676963471, "uuid": "645bba27-e777-43bc-b6a1-69bfbbd9e0a9", "comment": "Malware payload", "value": "72e4dd989e1dc489d77ad0211b3b9f453579b220abaed56f0fad090513dbd4bd70543b6e9ef3d08f62fa3bb2277e8d25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676963471, "uuid": "db9746fa-89b6-41c2-bbc8-ebcfb200dc70", "value": "T1D594231028F1CC5BDE7B4B741EB987B12DA3741260AB9F0E939026AC7B65D838D0B771", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676963471, "uuid": "6e34c08f-55bf-404d-88d0-f90aaece4366", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676963471, "uuid": "84d9541a-93f7-44af-9cbd-4225e6917f01", "value": "12288:PYpAyvX+1e8wufqk/sRG2yEjD2WT9CGg/J+I:PYpAYJ80kxjEu6Eb4I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676963471, "uuid": "ffccae4c-d9e0-409c-98ad-c335c7f2f4c0", "value": 429024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676963471, "uuid": "3108caab-2f82-46d6-8680-1f7b095689d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676963471, "uuid": "e3b268b9-9a7f-4377-a354-0ca80cb1bf2d", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af6736d0-b1dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Adware.Eorezo)", "timestamp": 1676980120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980120, "uuid": "7637f88d-edad-4994-a344-c342fe83de83", "comment": "Malware payload (Adware.Eorezo)", "value": "dffd83a85fc7c3bb0608a19e53e14088", "object_relation": "md5", "Tag": [ { "name": "Adware.Eorezo", "colour": "#9423F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980120, "uuid": "3eacb33b-245d-499c-bab5-72b08eac351f", "comment": "Malware payload (Adware.Eorezo)", "value": "0e414d5dcbe2e543d543696a28c4c314e09eed78480fcc71aae271cdc50dd491", "object_relation": "sha256", "Tag": [ { "name": "Adware.Eorezo", "colour": "#9423F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980120, "uuid": "057005a0-580b-49f3-9791-684949a8c963", "comment": "Malware payload (Adware.Eorezo)", "value": "8143301289206fbbe2ae040eed9c3122d4c88755", "object_relation": "sha1", "Tag": [ { "name": "Adware.Eorezo", "colour": "#9423F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980120, "uuid": "cc643766-cd3d-4476-93dd-25c27b78ad90", "comment": "Malware payload (Adware.Eorezo)", "value": "80035f7ba28acdc15940fe5e0b3497317ce51f36ce6363286b3f08871b83283dd7e8fffd76b86224944e46a36ed6b664", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Eorezo", "colour": "#9423F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980120, "uuid": "514dcb1d-4d31-48df-bd0a-3d346723ec3e", "value": "T1C9B41202E4868574EBA0A7B43EB9C5624A3B3FB41D304416729CBD4DC771AB3DA9B317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980120, "uuid": "7349fa59-5555-4195-951c-3ae4ce301f9c", "value": "2fb819a19fe4dee5c03e8c6a79342f79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980120, "uuid": "b064fb3f-a1e7-446c-93d7-a784f2ef1113", "value": "12288:j7blMA1GNEiBePgpLvkL1tr2DX+UjZsJsfCNqA4qURdlPUuuOG:j7blF1EKIp4L1p2DuUjZN+4HvlPUua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676980120, "uuid": "5222f846-1d6c-452b-9c55-773d16a5436b", "value": 493720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676980120, "uuid": "f22e4c29-085e-4745-926c-395c5dfb9e30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980120, "uuid": "c7655e2f-a3e9-48f6-a128-92774f84a7d0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc55d8e2-b1f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676989269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989269, "uuid": "9d8b3d1a-8c34-4a71-bd8e-8cc4623e376a", "comment": "Malware payload (Loki)", "value": "c97c74573f79a2623140f9bdff4571fb", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989269, "uuid": "6e5629c4-f3ab-4504-90d5-4279179dbb43", "comment": "Malware payload (Loki)", "value": "0e9b243b8d35f7d34f952625dc851d9f8a4001bfbb0d0b5e604390469335ebbd", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989269, "uuid": "1864c2fe-b498-4779-928c-d20f6ce9970f", "comment": "Malware payload (Loki)", "value": "9bfbedbab4faae92bce8cff934f1bb5056a4bb54", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989269, "uuid": "e2a6f4c4-7655-446e-9f70-88e1df251eaa", "comment": "Malware payload (Loki)", "value": "b68d0d40d4ed88efd1674257f2e62f2feb2396a455e7a08f43a1723feb1f62b9c3a56df77f3bf92643f34ad92140a057", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989269, "uuid": "3436c9b4-f020-4456-89ba-a8df3def093f", "value": "T126136C5AE74F0265CF511277631B0A89AABCB23EB35554B134AC933433EDC3E42666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989269, "uuid": "d409152e-8aa3-40d5-911d-16ebe78423d8", "value": "768:eFx0XaIsnPRIa4fwJM4Sg+tY9KjoAGAktXVrrIMakx7A/97N9X8YgY:ef0Xvx3EMZg+tc+oUktXBI5kxQ7NN8Y1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676989269, "uuid": "ef6577f0-b9d3-4a72-b5f0-7df0d03c5a6c", "value": 44195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676989269, "uuid": "3ece6a4d-2cac-475c-9e4f-2e72261c2cad", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989269, "uuid": "b030e637-a3e1-4876-9ae9-fdff5d1ba7f8", "value": "RFQ_SO22234850.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de85e3d0-b23a-11ed-88f6-42010a9c006e", "comment": "Malware payload (CobaltStrike)", "timestamp": 1677020142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677020142, "uuid": "07b5b882-3a01-4aae-bebd-842234f596f7", "comment": "Malware payload (CobaltStrike)", "value": "70e9b32f8f4c559068e706ce38de3180", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677020142, "uuid": "a6d9983b-0fe5-4b81-aef6-f5f463e3fd1f", "comment": "Malware payload (CobaltStrike)", "value": "0ffdeb5f315763a2edd720acafaa9022dba2955ec52f6ac569ce7f5feaed57a1", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677020142, "uuid": "1f87f6f0-bc73-4132-ab19-fcb3764ab281", "comment": "Malware payload (CobaltStrike)", "value": "db30c44419cc0ae62a4b98bd405bce4f641df650", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677020142, "uuid": "279764b9-30bb-43b7-8f75-51b60c8ae5cd", "comment": "Malware payload (CobaltStrike)", "value": "0e19d751b3c97f47baf987ccf56439ec49508a2306073a0064f61056966137edbc4e796b2d9d75d615f7e6e61f0c301b", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677020142, "uuid": "c7e9c872-bc92-4a68-8261-71730c6388f4", "value": "T1F074BE3966A182E8FD7280328DF15788B2727231471C6BFB4260D263DE17781DFB665E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677020142, "uuid": "0b0afeeb-6614-43c6-bb6f-0ea88e68e107", "value": "8a2bf18436241443146fa3c53b806e47", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677020142, "uuid": "436f2954-6c27-4bb3-86c2-1be96a52d53a", "value": "6144:zFwxiiWpGtphmLiEq8VqMOZNX1UIPau8NhVQNQyr07ubkveSWiT3nk4te:zFzJAHMqMO40DlkveSlkK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677020142, "uuid": "fe9fca34-0843-4939-adbc-f826e7c8f67d", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677020142, "uuid": "487e1b22-58b3-4775-92cf-dfa8eaa5e202", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677020142, "uuid": "167a441e-84cf-45d9-805c-eddf245eab83", "value": "70e9b32f8f4c559068e706ce38de3180.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e084e6d-b1f8-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676991607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676991607, "uuid": "601699e2-b028-40dc-abc7-36a08d5f27e2", "comment": "Malware payload (RedLineStealer)", "value": "ebf8a5da5e1c7eda2d2f4ba33f30f4b7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676991607, "uuid": "3e305b82-cb13-4e82-b36b-b1214be715ab", "comment": "Malware payload (RedLineStealer)", "value": "10c301f78c4ab9a5b1be09c8abdaa7092a1b6591e1a374d9cbb4c53111b8ffee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676991607, "uuid": "2119d781-6f83-41ff-a0b4-9ad0678eaf4e", "comment": "Malware payload (RedLineStealer)", "value": "4585b9c2e720d2d8438973d9cebdac357c0af265", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676991607, "uuid": "19da8111-a3ac-4e95-b974-2c75779113f1", "comment": "Malware payload (RedLineStealer)", "value": "a4896fdeff138fcdebe1219ee17978a4235ba750f3269f6953de516de58e33fe893b55d992535e4f0951b690688d0167", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676991607, "uuid": "3ca53685-7bfc-4ffd-92db-4369156cfd24", "value": "T1BE352307E3EC8162E8E59B7018F741C34732FD909778C2536A9FAC6A4872279663537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676991607, "uuid": "32d1fdc1-00f0-423c-b90b-0e263f8917fe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676991607, "uuid": "1a345598-42d8-4a17-bece-af4c13a451b7", "value": "24576:yyR204HBeU9ouPURrOEBDVxgqFag5gl/vMHxNmfwHjOC:ZYJHBUuPUR5/vMnM/mID", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676991607, "uuid": "a66c7fa5-8772-4886-af37-bdf3e5e8898d", "value": 1099776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676991607, "uuid": "4758a4c4-2ada-4b74-b54a-1951e7d147fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676991607, "uuid": "1ab53e73-162f-4d2d-abb3-8be800300026", "value": "ebf8a5da5e1c7eda2d2f4ba33f30f4b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a05414db-b1d2-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676975370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676975370, "uuid": "f1fe2bcf-bd3d-430b-a893-e69f535d3750", "comment": "Malware payload (AgentTesla)", "value": "3eed0e5b1b191a0853b41734727c1a76", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676975370, "uuid": "021bd783-4cd4-4d81-88d8-c2683653a44e", "comment": "Malware payload (AgentTesla)", "value": "12033e338b9f4627d0cfc9c66f928334a2c49363cd78d1e65cf85ec1aeb62ac0", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676975370, "uuid": "490102d2-3d2b-450a-a1e2-45288dabb469", "comment": "Malware payload (AgentTesla)", "value": "4415d89f963e1b235cd6279e7b0a241e0bc09989", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676975370, "uuid": "37164c4e-a154-4d3f-8249-20e5b4e09383", "comment": "Malware payload (AgentTesla)", "value": "2b9527e6be3b9dc8119b5e751f439b3755a53499eed7eb7120955f8cdb6facaa28242a6b3f3e7e133200c65cb84bb787", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676975370, "uuid": "5d88fa7f-d28f-491c-b841-dc1f6801bcb8", "value": "T1C6C433DF892B3924F80A1358A7FB75864625F3CC221BBA4C09C35523B1E7E946A1D6DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676975370, "uuid": "741db1bf-0e9e-4909-9583-65a9fe94a7ea", "value": "12288:Cf7su38i+HjlOa5zZzkWuFhovFmcMR8IvVBAra9tPCQGIXOPqOM4fNYFmi+:di+H5pXuzoI1Ya9sWXO+3c3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676975370, "uuid": "0cd30942-21a8-443f-be9f-558fd6604d6b", "value": 591571, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676975370, "uuid": "17e6b32f-c890-49c8-9e90-0ed7b9a67f46", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676975370, "uuid": "60c5bff5-27b0-4e12-a560-a8abd64375e1", "value": "SOA USD 460,000.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb2eb569-b1f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676989267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989267, "uuid": "a1c8bc15-38e0-4042-a35b-25f983ef3956", "comment": "Malware payload (SnakeKeylogger)", "value": "fc8131b023baba52d4e2d417d88686f4", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989267, "uuid": "2821f498-75c7-4c9c-bdce-a19fc54e51e1", "comment": "Malware payload (SnakeKeylogger)", "value": "1386aa920815a972e7da0b4e227b86adccdc0ad6af2ec12f87b7168501dca824", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989267, "uuid": "68a1d578-808e-4991-8d2c-1f5550a929c5", "comment": "Malware payload (SnakeKeylogger)", "value": "24454edd64b49ec6fa64c1c51c1ca773a18f76a4", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989267, "uuid": "23bdcf4e-5f60-46ff-b5f7-01ecb25d2e04", "comment": "Malware payload (SnakeKeylogger)", "value": "7a2f549ea1237b4ea7b8c2fab52d1d7657104814cf0df569a196c02aa4a3de12b285725f8763e13c208aa692d357fdb3", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989267, "uuid": "a180ecec-8500-40bf-ac33-840a3b09d8d4", "value": "T15D046046FBB67C3AF5550738B6B2A18B1653AC32B911D91A2583734F9773BA06C32E01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989267, "uuid": "07925a4b-a11a-49ed-97e7-ff4daf9a93e7", "value": "3072:2kZ+RwPONXoRjDhIcp0fDlaGGx+cL26nA0gH1QN2Y8:DZ+RwPONXoRjDhIcp0fDlavx+W26nA0F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676989267, "uuid": "27a8814c-8241-400c-a4e1-0ce9cbb2b068", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676989267, "uuid": "d99c92cd-39e7-4fc5-8299-7f935c96e16b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989267, "uuid": "913a0c55-af69-43b8-ac35-d0b390e37db3", "value": "PO_40019679.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91d681c0-b231-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677016148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677016148, "uuid": "03d1efdd-9c20-462c-b3b9-0ff16be3e5f0", "comment": "Malware payload (RedLineStealer)", "value": "598edb0aca50c3d3cb3cef1ef9c852fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677016148, "uuid": "6f17ca12-5936-4a38-8d93-66730eb536d0", "comment": "Malware payload (RedLineStealer)", "value": "14c0bffd95c773ce08eba775cae7fe5b0fe0e5ea82fef286ffe7bd985936e5d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677016148, "uuid": "81f20a33-9de3-41f2-b41a-4ec3f693831a", "comment": "Malware payload (RedLineStealer)", "value": "601d3175278b049e0cee9e793a13a6b271881b2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677016148, "uuid": "738b99df-5cd5-4581-a100-432ba1fe10ab", "comment": "Malware payload (RedLineStealer)", "value": "c97375f4b0622b283d2f97b34d4de2dc2668e966be4ae93bbb91160086b71f138743f042925eea2d983e3ef87e9a57b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677016148, "uuid": "42f5e69b-ac98-496f-af6f-12e6328fad91", "value": "T146563885D7B39E81D188573B715F99001778EEA3A24AF71BCE8C2D5A178F7B345C0A88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677016148, "uuid": "aadc0e3a-b484-4d45-976a-abbc5ad37035", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677016148, "uuid": "74f31528-c280-4e60-a76d-3f45f901bc66", "value": "98304:tr/ObIAiTUheLiq0d5LsiFEtmtKZ3/Msj:tr/Ob3mUhqi1NFEtmtI/Msj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677016148, "uuid": "a94c3b5c-2a1e-4671-9440-03e175254f06", "value": 6198784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677016148, "uuid": "78931d71-765f-4b5b-99ea-711fc080b790", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677016148, "uuid": "57ab7c25-38c2-4b61-93b9-4c609db70a71", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c1bb501-b1f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676989027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989027, "uuid": "0a001bb3-a750-43fd-b05a-59450a28bacf", "comment": "Malware payload (SnakeKeylogger)", "value": "341016fe13794ec20d440e0ceefb4505", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989027, "uuid": "e2fc842d-6e50-44a5-ac5b-f8a6c5fd6381", "comment": "Malware payload (SnakeKeylogger)", "value": "14c7331b5afeca593ff69250804ea1cffd8ccdbe2c0370e991eecbe87c6599b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989027, "uuid": "f9795eba-5c2a-4d9a-b428-9c462e0aca68", "comment": "Malware payload (SnakeKeylogger)", "value": "b270828ee3f0fd313b8ea59a14e385ab6e3d1c33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989027, "uuid": "e70706a6-c817-4dc1-b030-a68bda2b5c72", "comment": "Malware payload (SnakeKeylogger)", "value": "d4171e145a380a71067936da9fbb4e21bd870739d562fa70af89e5d6281be378f4e15e1810c43ee2b3ddd01038a57a1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989027, "uuid": "8ad251b9-5aab-4f0a-82aa-a74f94c3a624", "value": "T150059D9977B4A473F4DB01FE5838278C2E3065077519E22F9B77BB91A2709FB7294202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989027, "uuid": "f41b60da-e6a1-4385-8563-0bac9e1e9f73", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989027, "uuid": "31b32fc8-cfa1-44c9-880a-4d4dea406d14", "value": "12288:HWCXkyLr2ayjh1eNIWl9S76/5tdZXnlZIoKCf/PFnrr45qpeZFWFftMQYNf4uMNA:Dky9IISW/XPzIoj/Nrr4gvt0Nf4u/cC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676989027, "uuid": "6b0a94f0-7172-431e-935c-d47e43adb537", "value": 815616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676989027, "uuid": "37e24649-2e9b-4a7b-90a4-129d75e59d38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989027, "uuid": "264cf98e-efea-449b-adef-171ec52173ff", "value": "002802- 2023_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4a74ccd-b1f2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676989122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989122, "uuid": "5b6c6107-34d1-4a8d-a0a7-07fb0bc80186", "comment": "Malware payload", "value": "186f63c903d67898b0a9817b3392ec62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989122, "uuid": "cee68ce1-177c-48ad-abeb-dd4b25629931", "comment": "Malware payload", "value": "155c76210badfc3ef9bfc764a7ab3cb9702f76c9d63351a213f61d44abbf0b4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989122, "uuid": "531eefa2-e4db-4d38-9190-b1fdf570c95d", "comment": "Malware payload", "value": "7eb20571e0008195ddc5d7d4b59db55d6f0353f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989122, "uuid": "2783d85c-dc40-4a04-8f86-f37355dfcbc8", "comment": "Malware payload", "value": "2244e508c806dd466577cad138c6e3cc88d4a482e81b53cb620a8127df3637c2351936fd3eed7aaae19d6d3d5ff2f31a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989122, "uuid": "efe525e6-4ab2-4438-8702-476f81ef555e", "value": "T1E8A53391F7E9D537C4B50B70027A869313B83C92E931830F72489A1AEDB3AE46675773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989122, "uuid": "82baeaab-0e23-4927-9dad-a166316fd8fc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989122, "uuid": "27164ff5-a5cf-42f5-a718-eba7ef8b7156", "value": "49152:pYkxIiXxybmRXmrLT6Qm+1DhGQNVLwF9IMmk4PcE55cOk:ykxIExybmRXmrLJNgALq9IMpHynk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676989122, "uuid": "486f7270-be5b-4071-82ff-a206e110705c", "value": 2195968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676989122, "uuid": "e4eddfd3-d7e7-4c53-adca-50e8402ae32b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989122, "uuid": "0c4a3f1e-4145-4fc0-a76d-8a41f6f66526", "value": "186f63c903d67898b0a9817b3392ec62.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d6658fb-b1fb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676992975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676992975, "uuid": "0cab4fc0-f8a1-4af3-8eb0-9c26c7adb2a3", "comment": "Malware payload", "value": "79ac902c20628bbee40a8db4d532fc57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676992975, "uuid": "e00f3d88-62b2-4daf-87c1-324e8ee2278c", "comment": "Malware payload", "value": "1587857ad744c322a2b32731cdd48d98eac13f8aa8ff2f2afb01ebba88d15359", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676992975, "uuid": "6f36d012-d0f9-407a-b326-3cdd6c8d9a75", "comment": "Malware payload", "value": "88d5af2c79bb46165c7e9c56dcf6306f7fa204be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676992975, "uuid": "fc04dd7f-7dfa-45aa-acbb-0ea260b3dd97", "comment": "Malware payload", "value": "3d1e6940402588902f8f37d7fa870c50464cb3f5d10d8934b511a6136262d1382dda0309648f12b062f03cd54643c38e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676992975, "uuid": "12aa751d-86de-4201-95ff-edbfe862ceb7", "value": "T1FEB5183A9E025596E8DD0AF00A5DBAE4E07B0939D55518593F8F3CACB4F27A383EC153", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676992975, "uuid": "debcf857-a29f-4582-9240-4177045f8f54", "value": "039032eedb13fb00811bf4343043c31c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676992975, "uuid": "bb272e83-8073-4316-a932-d9e9ef53d1f9", "value": "49152:nbAOGbTSWSsSsg5e9wuLGtp9FqJPqJpsfq9SXLBXbwWMObh/NO3GD8J:bXGbTSWBSJeWuLGZFqxqJpWq9CLtbwWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676992975, "uuid": "a568f344-117b-45a3-9496-36cd589dc131", "value": 2400256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676992975, "uuid": "dde03c3e-884e-4e15-a4b4-a1d5f838cf99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676992975, "uuid": "b6c043c9-c604-466b-8a11-af58860b8058", "value": "Tissue.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09bf78a7-b1c9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676971252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676971252, "uuid": "0860673d-27c0-4d60-ac0a-3760cb96baeb", "comment": "Malware payload", "value": "681a9076b182457e2106257367769c43", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676971252, "uuid": "0a2545c4-fb36-4c96-94d4-1302c773881b", "comment": "Malware payload", "value": "161a5a1f6adaf0e9fc55af3697fc02c7344730d78fbf0913f915fdd1cccb1c23", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676971252, "uuid": "ab6eef24-17e0-40f7-b50f-40b78c5098c7", "comment": "Malware payload", "value": "0ad1181bae3c66ceefb03a338074b3c5fe853923", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676971252, "uuid": "6ac2b199-ec6d-408b-95fd-0c307e173e70", "comment": "Malware payload", "value": "ba63e60e40b662897a76b30fc9a4e4a8d4f64e9bd866b25a533b615c1e742b36275962bf076bd34b1e93b2d2324ea79e", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676971252, "uuid": "0139e0f5-94af-4a13-95ff-081db7556e0e", "value": "T1BA92D0D11ED1F7E0B0A28697977D19E0B670BD841376F049027735D722162C56AA0ACF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676971252, "uuid": "e2269ca1-8249-4df5-89fb-74c8a077db6d", "value": "384:rNUrKFYjDOWgKDIAFa0F796EgQMgCIknAfuNVOxk1L:rGKFYlDnFl6vgYAfu7Ox8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676971252, "uuid": "6d9ddf0e-44af-43b2-afb7-f2c50638cf6c", "value": 19644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676971252, "uuid": "5c0a7747-90cf-4191-a6ea-a4622a630ae8", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676971252, "uuid": "e09c6288-5732-48f4-946d-9e9820bba483", "value": "d634bd61-5aaf-4129-fe96-08db13ea2d78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a627b25b-b1f0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676988265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988265, "uuid": "72504ae6-8ae3-413f-875f-34ccb03df973", "comment": "Malware payload", "value": "92ed14338965981cac6665dab1f28821", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988265, "uuid": "ecb7f71d-ab05-4b5e-b52b-670058250514", "comment": "Malware payload", "value": "163eb7885f0296ef94627499426bea3bfef9b3f95b4f2a83ac39e0a50005b63f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988265, "uuid": "4972556b-cd76-4c55-a6c5-1b98ca17b924", "comment": "Malware payload", "value": "6fd532c8b237d368cb61cc9acd67b65fd55c027a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988265, "uuid": "6e0e279d-4cfd-48b6-8705-9deb3ab8b487", "comment": "Malware payload", "value": "69825977863165eeb32fd6d8ccbd3af2b4cb66ffb4bb2b893eb450f5f00f0fe3ff7055fee2576ff6e802d55dbc7fa995", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988265, "uuid": "5d0af5b2-7286-45e5-87a1-40042876a98b", "value": "T123A22951F52C9B21EF95C67FD8F78F8053A0AE637022C64F788073852C92756DC5E6A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988265, "uuid": "bf54c85d-bc0d-432b-ad5e-17a302a99ea1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988265, "uuid": "48510a6f-b5d2-498c-b173-e65e3d39e1cc", "value": "384:xAbEYo1LpyBb06XLgJIrfwAADXeWLx0AeG+96gWmE1q2:xAbILYAXIKreyuAehV92", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676988265, "uuid": "5f1daf6e-c7cd-401e-a31d-531289f4ee2d", "value": 22016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676988265, "uuid": "d5de9b95-0deb-4ff9-9706-4813c49dee9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988265, "uuid": "e719a37f-c346-47f0-8d12-d23869dd9d5f", "value": "parcel information_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d0ba994-b1e6-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676983955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676983955, "uuid": "f9e17b73-717d-45d2-bddd-10d03d2a127c", "comment": "Malware payload (AgentTesla)", "value": "4fd2e815818ca5027b1ddd9e61ac1ed9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676983955, "uuid": "6a097e22-82f0-4bf1-8d14-759f13838e79", "comment": "Malware payload (AgentTesla)", "value": "165a4a13cc076a6cf2a41f4b6bb1d2336033d9976d0abb8f02e941eb64a6f963", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676983955, "uuid": "9aac9f6c-5b7c-4172-a5ac-630c5d68a736", "comment": "Malware payload (AgentTesla)", "value": "b7e828fbacaeac01a5f88e742c556e10cba0d3f9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676983955, "uuid": "b6f34e2a-a755-4325-bcbb-c3fa29a9e0bf", "comment": "Malware payload (AgentTesla)", "value": "dbdb10dd678fb4f2a4bc112632f9bf9808d281462e391a6af642ce7eb8b99cef823a0815e86ff572c99bcabd3ee9977f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676983955, "uuid": "a550bcfc-2449-4e82-abd1-5bcf903df3c1", "value": "T1E45412A03772C4A7E9F207311D3A1936ADBBDD77849C474B034056197E22693CA1E3DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676983955, "uuid": "8afce110-773e-4ea9-9b07-2135f3ea44e1", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676983955, "uuid": "91bf499d-1944-4ef5-8100-cf7a13d438b0", "value": "6144:vYa6Mx0qt18IpwQLAeZcdgHA9ximWARdXRhoPz/bZVY+vImcfwd9L32S:vYCvtfpwQzcEA9xoARdBmz/rp9r9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676983955, "uuid": "abe93915-0843-4914-a8b7-6f5a4eb44c07", "value": 296421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676983955, "uuid": "46535df1-ef04-4496-b893-ebdbc7a1aac5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676983955, "uuid": "0cf32f55-fb50-4de3-9268-55c8aa3d6618", "value": "Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6776f6c-b234-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677017552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677017552, "uuid": "7572b393-6a71-45df-9b09-8e54810c07d1", "comment": "Malware payload", "value": "38eb99782693834506cbdcc60ee612c2", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677017552, "uuid": "bfb02b80-601d-4dce-a9b6-ffe1a0471576", "comment": "Malware payload", "value": "194df463b3795e851b230399d08a63717af9c4320366aba5f8dd191eed3aa43c", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677017552, "uuid": "51461a6a-c6f3-439a-83d0-74d1b8e31b6f", "comment": "Malware payload", "value": "ba0bdddb14a4e6d315f9f1103e846500cc77589d", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677017552, "uuid": "dd9743fe-2b4e-4262-8702-448a143d4a53", "comment": "Malware payload", "value": "46cb396c86657ba35a2982b55c6dae1b73e83521e57b0b08fa882b86b3e3e1c24a69da56b56d405b98b2d608276315b5", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677017552, "uuid": "fc59672e-9057-4dce-a41d-37701ab330ab", "value": "T145137D5AE39F02A4CF5112B7631B1A89A6BDB33DB35151B1346C933433ED83D42666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677017552, "uuid": "8b04c0a9-279e-44ac-b71d-935cec54d12c", "value": "768:uFx0XaIsnPRIa4fwJMgkZxSSXM1a1CA6LfsGh/+izSXw:uf0Xvx3EMgw80NqfsGhJzSXw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677017552, "uuid": "792b0f07-837a-42a5-97bc-2768aaece835", "value": 42083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677017552, "uuid": "f7075075-319b-48c0-bd74-a3ae10020119", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677017552, "uuid": "f9b3137b-fb82-4e34-a989-25fba3b71bb3", "value": "details.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8256079-b1ea-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676985691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985691, "uuid": "47088934-c931-4fee-a69f-23734c9539d4", "comment": "Malware payload", "value": "062021168682bd960c04a0e1a0af552a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985691, "uuid": "bd68f278-d5bb-433b-93a6-57419b607778", "comment": "Malware payload", "value": "1a6dcb18b2d3627d35e18aab269ababa8d2af33be25a23bfb44a4b6144816ea8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985691, "uuid": "fc810d03-d31c-42b3-a9e8-c4ecf651696c", "comment": "Malware payload", "value": "c8329deb48410f2ab44106112757c1c4ea78a111", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985691, "uuid": "4f9e7546-8170-4e32-bf2d-6464f433b9ee", "comment": "Malware payload", "value": "03916c3842b21e151c9fcf1fd89fd7ada052fe857cea0b49c2eaf3fc2af75776dd32c924967b60fe2a012964741a4367", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985691, "uuid": "f2e94053-f4ff-4ac3-8b44-acfa4c3a4256", "value": "T1EC457EC5B2B084B7F89B05F66C3E662424627E4E7454D10D577BBB1662B23B330DEE0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985691, "uuid": "4353c5c4-b75c-4a2a-8d90-1913cef99cef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985691, "uuid": "f7bced4a-8690-4c09-8257-8979ecd4e22f", "value": "24576:Cky9IISphX0+nOtoDXX5qP3G9H7JcPPaJ+Hl:fpDgP2N7KPPR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676985691, "uuid": "7989be9f-3bcc-435d-921a-9e1ebfa39201", "value": 1239552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676985691, "uuid": "3a723bb1-eb26-4f4d-bda6-5d1e0d97ff58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985691, "uuid": "48723ead-bd05-4192-9084-4b76167abf1b", "value": "Fatura.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0e13888-b1b1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676961332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676961332, "uuid": "d55d2740-b97c-4838-8714-bcebe6392990", "comment": "Malware payload (RedLineStealer)", "value": "0c86f0de00404f85b8f106628a193967", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676961332, "uuid": "7da8ee83-6415-4d9a-adcf-fd78e3c1c8af", "comment": "Malware payload (RedLineStealer)", "value": "1a7d0b9fda7c42a768506c247cb920ba72800cd25ae0f2f02d0111a94b79a050", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676961332, "uuid": "b5c81f5f-1112-480e-9558-f3785d61db60", "comment": "Malware payload (RedLineStealer)", "value": "055b2e7bae850985f41b1da95fa3adc19440b903", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676961332, "uuid": "c87f7254-eb2f-437d-b4a3-d6bd81c95a22", "comment": "Malware payload (RedLineStealer)", "value": "12fa15284725ed7cb104eada735663c53a74399f50fcb30d09a14da475ec1911bc04a90384a24489713e546bbd9c5bde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676961332, "uuid": "4f4e032f-d545-4c02-941a-00f3136d1cb4", "value": "T13E5633E13691EC9EDA1E1E3C008E625E2E7D78D7759F4812B3976AE03DDF36118A3501", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676961332, "uuid": "27ec15be-66cb-4fd8-89f9-c99d7d28ef95", "value": "5e5ac8ab7be27ac2d1c548e5589378b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676961332, "uuid": "2b078ee1-9602-4007-b26a-8ddf9beb7229", "value": "98304:1YpTasoTHbj0ToAa4LHhZIl+0mvnV7Azuo9WHCReBe75YebTC+Rw:1MGsoT7oEyTh+I08VSuwW42eVYefC+W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676961332, "uuid": "f1ca49bc-bcc6-4d85-b218-38e4af37312b", "value": 5920672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676961332, "uuid": "a2805778-3a86-4dae-835f-bd82888c0fd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676961332, "uuid": "734720e9-a070-43c0-ad5b-24c820f74747", "value": "0c86f0de00404f85b8f106628a193967.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3fb332a-b1d2-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676975377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676975377, "uuid": "78454b6a-f44a-4f93-8c23-ec95edf83c82", "comment": "Malware payload (AgentTesla)", "value": "4623c7edb0d2ac7be145a1869a20a866", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676975377, "uuid": "6d020b58-730a-4920-8c03-dde5df4d21e6", "comment": "Malware payload (AgentTesla)", "value": "1a7d3c68a19d93324a37bfda905c8d9df54a6ca7c3d45176e3dce50fa736da65", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676975377, "uuid": "5fe9a075-758a-42fa-a17c-80ded05c0c95", "comment": "Malware payload (AgentTesla)", "value": "a2b47673d61d46d93cbed7317384eb4a99f0b438", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676975377, "uuid": "9962d8c7-8180-40da-aa57-be6a6ec2b53d", "comment": "Malware payload (AgentTesla)", "value": "7959a74406144ec6bd8165c74509565febd28117f2390ce864a3c4fd09039789430ebb959085aadc16aced71ebdc506f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676975377, "uuid": "5b3881ef-54ff-4607-bc28-112b5eb506d8", "value": "T13B05063D39B796D2C239FA3386E7E120B6BD81923303D959D9D61AC04F426827DCE65C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676975377, "uuid": "9719aa06-f634-4e21-b2e8-ecb6ebb97cc8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676975377, "uuid": "7d54f21c-9f61-4479-b45e-8eb2697ec929", "value": "24576:wamoJTsIBMNjnNNOhAe/S0gj1FSQNfwchAa9EkXO2vs/:q9VCkX7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676975377, "uuid": "00a95746-4e53-4bfa-87bb-0aa4b7f4c400", "value": 797696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676975377, "uuid": "1cf976ee-b380-4b6b-ba04-53cb76dcaa8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676975377, "uuid": "94a50f9f-3474-4b3b-837e-c12c4e35364d", "value": "SOA USD 460,000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0456eade-b233-11ed-88f6-42010a9c006e", "comment": "Malware payload (IcedID)", "timestamp": 1677016770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677016770, "uuid": "ed7eb92c-d9fa-4726-989d-b0d256ffa954", "comment": "Malware payload (IcedID)", "value": "d1da347e78bf043e2dc61638e946c3da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677016770, "uuid": "f3278b87-50a9-4aa2-91d6-6aa7918dec0b", "comment": "Malware payload (IcedID)", "value": "1ab812f7d829444dc703eeb02ea0a955ec839d5e2a9b619d44ac09a91135cad1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677016770, "uuid": "c6262fbc-77d7-40af-aed2-81f5ae12b9c1", "comment": "Malware payload (IcedID)", "value": "d87a3c22771b1106a1a52d96df7b2944d93fa184", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677016770, "uuid": "b500168d-11e9-42c9-a78b-de2a0e4f69cc", "comment": "Malware payload (IcedID)", "value": "575bf585e19db8a86f5e817aec375e605b3ba71a5046abbe4009bb011b75e5add8d1c128db53e39a1cded2ead69c840a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677016770, "uuid": "8359abb5-1954-4bc0-a192-3b4102eed724", "value": "T1EB94F63DDDD4E93CC885C1FED2E7423E21B3AC56D0E6DF3719898C70861B325A54A6A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677016770, "uuid": "e4eb9b47-68b1-4154-9904-d840509ec5f9", "value": "6144:36ctLPPp3PPPfUPD+Zidc/xQelsXkg6Fnue:X00HlsXkgwnue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677016770, "uuid": "4258f0a5-4e48-4069-a200-c0957c457953", "value": 418906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677016770, "uuid": "9ead643a-2d8e-49e0-b6a8-c81a5da81cd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677016770, "uuid": "5c701353-1a33-49d3-b54d-9d4608285a82", "value": "COIm.jpg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68abfa20-b1f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676989021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989021, "uuid": "8b23b9dc-22b0-4b33-b4ef-4c2bea7bd990", "comment": "Malware payload (SnakeKeylogger)", "value": "7f1b2e54c8fdc07d576a6a22ac7cac5e", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989021, "uuid": "67342cd5-b72f-4a4d-9688-74c481061285", "comment": "Malware payload (SnakeKeylogger)", "value": "1ae0d83b1f08a6268eaee2abde29fe2bc0ac1573b55b11a04ccc6fe3e5d90356", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989021, "uuid": "e637feb6-3c38-40b5-8440-ba63378720d8", "comment": "Malware payload (SnakeKeylogger)", "value": "05ecbf8af4337fa09d63cfdf241c0dc43a3a495c", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989021, "uuid": "743c5ac0-be36-4af8-a194-e9cffd266000", "comment": "Malware payload (SnakeKeylogger)", "value": "e2b4f34336d3733723f3df4c592f23194701316ae835a0c7f5d97eecbc8132141d04f98a3201160e3854688d56c572ce", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989021, "uuid": "f9eba6da-ad7a-4ee9-9722-fed21140fefb", "value": "T1D2F4C33D39B796D2C239FA3386D7E120B6BD84923303D95999D61BC04F426827DCEA5C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989021, "uuid": "e632f79b-e113-4c53-90e8-ccbf4b0f7411", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989021, "uuid": "e4a0fed4-e0b6-4819-a37d-a0ca1088adaf", "value": "12288:0NdA5m/EnIkegET9jsIBMNjnNNOhAe/S0CN3L2j7ZFdYg6VTMNn0ITDRTRKoNUad:MpjTsIBMNjnNNOhAe/S0CIj1FSQNzPR0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676989021, "uuid": "59cf6738-60e3-4c22-8a34-a56c008d7849", "value": 732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676989021, "uuid": "8b4e9b50-bbd4-4b12-a61d-13706319b409", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989021, "uuid": "0b50403a-2cba-4902-b031-6fd96c177d2c", "value": "DHL_EXPRESS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68d10042-b205-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676997182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676997182, "uuid": "61a707a4-68ab-46b4-af7f-641356ec4e58", "comment": "Malware payload", "value": "471d4d991f68e5c86cf6040672d8de04", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676997182, "uuid": "94d9c10c-d74d-41eb-a9a2-8cc3bd0811c7", "comment": "Malware payload", "value": "1af781208df5f480b5abf1984dcc507fa8aecd8034705b78d51ab3268482c9b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676997182, "uuid": "73ff43c2-eaeb-4347-b48c-40e5d31da63b", "comment": "Malware payload", "value": "592635744b66d14d9d66dea5c225bf87b3c15ddd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676997182, "uuid": "a7b3eecc-891f-444c-bc29-5b9ef70da6d8", "comment": "Malware payload", "value": "86ad1877047fb969247cd8b6a0a27236d05533c6cfdd649309fd3cbf229a25c2850cd7c9d60298d039e57f7a3419e2ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676997182, "uuid": "84e3f84a-8bac-4f7e-ac6f-01da6c8c28bd", "value": "T1AD836C86F9819B16C9D52176FB6E818C37271768D3DAB302CF1A1F20A38786B0F3B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676997182, "uuid": "ccdfd4c1-a8aa-40d9-87a0-9248cb8e0d94", "value": "1536:vmzUJJh9Gy5dmbcgwTwleLPZzPvSVN8l3z:+6nmbiQeVzPvSVO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676997182, "uuid": "b542c256-9577-4df5-8293-41e041e099fc", "value": 83976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676997182, "uuid": "6c9a1654-48e4-4b3a-9824-7d3b99039968", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676997182, "uuid": "5d645b57-8e30-4be5-bf37-9d8b2a5a010c", "value": "scan_arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcac69e9-b18c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676945407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676945407, "uuid": "6cdd184f-ae50-41ce-8de9-f78ff4041556", "comment": "Malware payload", "value": "0392d48e53f663e0f4a847f350314c05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676945407, "uuid": "551da9dc-1792-4f79-9a30-6194b85bc439", "comment": "Malware payload", "value": "1b19261e6e1442e84b8a53e47227ca22396e1ced1ee6484d2b8f96f0fcef68c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676945407, "uuid": "2c2574f0-80f6-4880-a2d0-79c4f1be51f4", "comment": "Malware payload", "value": "e757406bffee53c120a91fc4ce531371a45e4810", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676945407, "uuid": "b0c4d19b-0daf-4037-80af-e3214ac3b133", "comment": "Malware payload", "value": "38b5aa4fa630244c7552e5f92b2b40132aa5feecd54d667f5ab9de554aac5ae3a52402142d4140bcf9e0b5a3d472d9e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676945407, "uuid": "65fa15d7-dfb6-4190-ac33-0f16614330a6", "value": "T1A655124DB29608F9D41BD23A8A869725F2F3741953B443CF57248B769F0A7F2263E342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676945407, "uuid": "9eb45590-50c1-444c-bf36-211e765c7394", "value": "edc6c3de5dcea9514b11905219670b4c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676945407, "uuid": "5ef93fd8-9e06-4d99-8ab7-6b44a8b25131", "value": "24576:slxObwiok8Ty80JGTom2s8iQ+FVu1YteAqE9DpQGjl314ZD3bQ2jgcMFS6:slgw5m8PMEb5F4IeAvUGhF4l02oF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676945407, "uuid": "5fdfe287-b3f9-4387-aed1-c8aeeec61b53", "value": 1387008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676945407, "uuid": "bdf542c8-c2fd-4cdc-8668-059752f28a93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676945407, "uuid": "524999e3-de55-4493-b8c7-79f9b2f560eb", "value": "0392d48e53f663e0f4a847f350314c05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cedb948e-b191-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1676947531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676947531, "uuid": "e4fe73c7-51fb-48f8-9616-f7843b5622fa", "comment": "Malware payload (DCRat)", "value": "3b0b6cba9b485cdfa2e7f75d787684a3", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676947531, "uuid": "feaffb09-dd5d-4e4e-b8b3-49eaec674214", "comment": "Malware payload (DCRat)", "value": "1e4c2f6f84fdb1ef49ad27be628eca64837b22c6d9d8d1cfa124b172869e003b", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676947531, "uuid": "bd6ca42a-684d-4a52-9879-cdbf8e3ec0bb", "comment": "Malware payload (DCRat)", "value": "f014f57e133d9ebb3a2e2217f1850f68a1bde46f", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676947531, "uuid": "123a3f13-96dd-461f-ab84-9970a9419f22", "comment": "Malware payload (DCRat)", "value": "06df1671f753bfcf88ea3f99023c45aad1d28a70ebed89bc50fc5d29e9a15e5211fdbfeceda3113eabd1bd3c03a217e0", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676947531, "uuid": "4413d2ab-d8f2-4020-90a5-c7f0af05f5cb", "value": "T1B7B5CF027E448E81F0191673C1DF420847B09D516AA6E31BBDAE337E952A3A77D0E9DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676947531, "uuid": "bd2d13da-c3ab-404c-aad3-aa561bb364dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676947531, "uuid": "06f7db83-7d20-432a-a808-5d44d9ed6453", "value": "49152:oh6Y1IitKKinVnE13qPXBxi7xwHp+dM/fbkjrfu/LL:oh7jtKKinxE12giHpuMcMLL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676947531, "uuid": "8be7887f-4ca2-4bf1-b2d5-cbebc087782c", "value": 2285056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676947531, "uuid": "0fcf650c-2280-4437-a8e5-eccada5bddd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676947531, "uuid": "637abcbc-34c4-482f-b9d2-af32b90ee676", "value": "3b0b6cba9b485cdfa2e7f75d787684a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d8b7ae3-b1c3-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676968816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676968816, "uuid": "5397db28-9a6f-4092-857e-b18be1c386dd", "comment": "Malware payload (AgentTesla)", "value": "296ec804ea11d06feaffa06127683b5f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676968816, "uuid": "8567d5eb-ae45-4a9a-8466-dd8b4d7df838", "comment": "Malware payload (AgentTesla)", "value": "1e979fa4a0145a6da971bf2f00dcfaf6f909357f6bc56d243ac9a8821efd85bc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676968816, "uuid": "b6f0bb2e-5045-4298-bf61-18fa057ae257", "comment": "Malware payload (AgentTesla)", "value": "579543daab7c6f44356e75c188a9967fe4e5f959", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676968816, "uuid": "8eee14c6-7b66-4ac4-b350-fad097b18b9e", "comment": "Malware payload (AgentTesla)", "value": "b82474566141f21b2bbc321fdf898994b3c6916a1bebd2659cce95c7dd9bc3d273ad14109e25363e3e6bb8c0293e4f98", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676968816, "uuid": "90defd1c-ede9-497e-839e-b70d83e9c376", "value": "T1D175BE5ED5B35F8FD2295A38940E0E023026C7C599BDDB4A6A9BED3C309458FE379231", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676968816, "uuid": "98ea5402-8587-4144-a915-9d2d828afc43", "value": "24576:NPVixuXbymh4F7cs0polLGzXBWTAcCrnAS7HaCV6ZPh/wFWyXG6Cw5lKudy+:brXbymRs0OliQZKnJ6CV6ZRwA015Tdy+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676968816, "uuid": "582dd090-a9b3-4342-8278-5f04db3b7c64", "value": 1566720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676968816, "uuid": "04d2c259-1cb8-4efd-9e0e-a3e7aedebe58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676968816, "uuid": "064b421b-8369-41ea-b290-ad7786839de3", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "893eb202-b1cd-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676973184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676973184, "uuid": "1c6b8025-a3a5-4cd7-b7b2-e9c13619b826", "comment": "Malware payload (AgentTesla)", "value": "59350f8bb02fd4fee4fa75d54ab35687", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676973184, "uuid": "e285f044-9f13-42a7-9fb6-dda4ac496434", "comment": "Malware payload (AgentTesla)", "value": "1eadd6ee510489020381a9be7fb6691944ca613e54c6009ac8abad0d19e5af67", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676973184, "uuid": "ce6b05a9-953e-4ed8-a6ce-fcd3c59026b0", "comment": "Malware payload (AgentTesla)", "value": "5f01644e6bff56d43679c994c21a6b9ffed8a720", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676973184, "uuid": "7cf31b1e-9d3a-477c-a3f6-6d11393cbbe5", "comment": "Malware payload (AgentTesla)", "value": "527fbe81744741ae051066f98dd1039c879905ddb68c148e5946febc5a6b92437ec5cea4b3a2398d1b803d2e7ed802d7", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676973184, "uuid": "83b26b7b-d276-4db8-b83c-ab0efa546c30", "value": "T1B9C423DBA583D8796AFEC99D1FBB91D51818004028D8E4CB3BA75888F6D787066D1E33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676973184, "uuid": "dadbee15-33a3-4c90-9ab2-8eb3096f2607", "value": "12288:8HUxvzFD8tzCn6315DuU5zDtozs3o4pgWTDY1v9KxYrE:8HUxruun6TuetQhw4IxIE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676973184, "uuid": "74e6e4d4-bd16-4c37-a082-db284a27de56", "value": 580331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676973184, "uuid": "23d7c6b1-3e87-422d-944e-cb19527e60a1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676973184, "uuid": "71410f22-48b4-4eaf-a7ba-368b804806e1", "value": "PAYMENT INSTRUCTIONS COPY.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d705c756-b1e9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676985341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985341, "uuid": "2a291190-2ef7-47f5-a403-92ff1bde1a2e", "comment": "Malware payload", "value": "eeaf5e4b7851b97592dc8ffd34d826c9", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985341, "uuid": "6be1861e-79e1-4aa5-afa2-ba7da77b8007", "comment": "Malware payload", "value": "1f2de247ae1b09f1ded617af4ebe08fbb6b034f80287a871aa3881b2b0014cf3", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985341, "uuid": "0118e526-2f7a-457b-99ad-218f9ccb4512", "comment": "Malware payload", "value": "c02f276394aed1c50b460b6b22c9fdb7d88e9eff", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985341, "uuid": "fcf7d694-5c6d-4972-9a8a-e21f138fb178", "comment": "Malware payload", "value": "a062a6ab63d0e8810dc2515f4f9e0e03544a22c2bcd04c1ccf3af950b04475607bf12e850c9cd4cca19bc299600a7659", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985341, "uuid": "d90ecb46-f8f8-4bc7-9bed-6d65a77b43a4", "value": "T1ED4657F0AD01D4C1F57E5B6AF2FD3A48A1343217EBC94A4A00E7E6551EF6A11B90ECC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985341, "uuid": "530d9a01-8942-47bf-8c79-a36025e177c9", "value": "24576:1AsAW7wsQejK2ZXK+K3O1b8uQpcQW70qSoHjm3m0gv3qHMkDWIJMDLnmgGEuebjE:Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676985341, "uuid": "afc0d845-1361-40c0-a0c1-b6dfff39c260", "value": 5752138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676985341, "uuid": "3aea9cf5-2cfe-4543-83ef-78eb60f1eaca", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985341, "uuid": "ba80b0bd-9277-40ff-b6b3-68235e3871f3", "value": "Veneto Banca Payment Copy.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eac1610-b1f0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676988092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988092, "uuid": "eca88019-ce00-469f-a219-2675b385e263", "comment": "Malware payload (AgentTesla)", "value": "03699c2404b7a0e9dea78e1e26fdbb15", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988092, "uuid": "dcfe9b41-abe6-4930-836f-5407c721c8c0", "comment": "Malware payload (AgentTesla)", "value": "2047eac119d133e43a99c820bffa0cf6ad280292bc6e3b17c3ad1a6fba25c2e8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988092, "uuid": "570f217a-f98b-43e0-8b82-cb9ff6fc47c3", "comment": "Malware payload (AgentTesla)", "value": "696c5ba824514fed5d396130865eaeb89712f7b2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988092, "uuid": "49f6ed03-b4f5-468d-b78e-a0e8cf8a5dd6", "comment": "Malware payload (AgentTesla)", "value": "56d0ed809363d7f429c6745d0ca76fb08737c8191c145866ab24e726fc832f03c039118a1ac42051310914a8d445ff73", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988092, "uuid": "b85f6d8f-ec52-4e4a-b540-d146325d6587", "value": "T1A28423345F6284A7C8B22F7359321A6B57F9EF171569C2672B504F2CBA26313ED0B720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988092, "uuid": "14c25567-9168-4950-aebe-5dfe158cea23", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988092, "uuid": "afae4a41-07cd-4297-8bdb-af85a1764c04", "value": "12288:PY+eoA/fSECrTYDzNQ8rhxUqrsz+n7kO/s5+gP:PY+qfSRTYlQ8roqrsz+UcgP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676988092, "uuid": "d3b2900b-183c-453a-9f5a-8f18155692a2", "value": 397405, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676988092, "uuid": "b05b95f5-1321-4795-8ad5-88a1dad2dbb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988092, "uuid": "13f12c93-fe70-4162-83e4-7f5a675565ba", "value": "transferencia.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0b4d479-b201-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676995611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676995611, "uuid": "ebe63b6b-158c-443d-9606-d677188a5931", "comment": "Malware payload (AgentTesla)", "value": "4f9594914be1ae2b7f560c763ea9d6e3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676995611, "uuid": "4ef3361d-06a6-48ad-9336-376dcfe5512c", "comment": "Malware payload (AgentTesla)", "value": "20b546000970b371cc3171325437bcd9a3d6d6b44895541c18b147c3002b764d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676995611, "uuid": "b14f740b-50f8-4985-a2bc-914bf0bebfb3", "comment": "Malware payload (AgentTesla)", "value": "06e9c73b1816e46dd74e28b1f3662bd2162211c3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676995611, "uuid": "dc3b38b4-3d18-4e63-835c-5e3de6c826da", "comment": "Malware payload (AgentTesla)", "value": "b1a8f4d14c2f223bb932c6dfd6062608ab0bc10aaf7e06c9cba3cc2538058914ca38bd0af87dcd0da66a47235a795683", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676995611, "uuid": "41ff9e20-b45c-4901-98e9-602a6b34a96c", "value": "T15B541214AB96C1A7F5F20F3104B607759B76EC1214A59B0F37A0FB787CB7680694B2E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676995611, "uuid": "40923527-7b8c-4ef9-ab28-2e5df66d4ac8", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676995611, "uuid": "d587b1be-5aed-4e7c-b827-05b3c727cb23", "value": "6144:PYa6753ya1JhTTUEfmxdE9qAOJj/PYmixvwuWLQ/6Vq70u5:PYJ5iaTOEfS3JbY5pWLSIq70u5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676995611, "uuid": "d22c5996-2869-4a33-8284-5886389f76f5", "value": 297053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676995611, "uuid": "a6c293db-7f6f-4bdf-b9b1-234a7fd58b2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676995611, "uuid": "d2a2a3e5-9a59-4b43-afcb-536825749e58", "value": "TT SLIP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afb629f4-b221-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677009326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677009326, "uuid": "53bc6b68-2c01-4e63-889b-26f8a0b418f9", "comment": "Malware payload (Amadey)", "value": "ab3cc3753c44c1b84004de601eb6a830", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677009326, "uuid": "6a9f9b14-4e8d-442f-af7c-a7b6cbc3ec6a", "comment": "Malware payload (Amadey)", "value": "20bd893c6533e002d8b51e41fd1f8b6717e34a10e0691fc41254807b78f77a75", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677009326, "uuid": "a40407da-e24f-41de-94b3-9abb387a112b", "comment": "Malware payload (Amadey)", "value": "f8ffd15c4dd8eed4e75ab1473f5267db3dd384b4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677009326, "uuid": "dc28134e-0105-49bf-89fe-54de3c88f23d", "comment": "Malware payload (Amadey)", "value": "49bf7ab0db0b815fb2124e26dd7b28ddb000c13b060f90b20d7d926a579c0323e5431f3ea9875023c309db27667a5f24", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677009326, "uuid": "4d60173c-2dd5-432b-b128-bb9f11e25f1f", "value": "T1A5352357A2EC5126D8F963700DF413C30B3A3DB12E3E9566368EAD0749A39A1D1353BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677009326, "uuid": "c1887622-197a-4eeb-a2a3-ba2240f4e2a8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677009326, "uuid": "2d24b2e7-7446-4d96-a010-4b69ddb19493", "value": "24576:cy4IUG0U5YS76LcKu5LioT3Fj+sSjmFe0oS0pqRiF7IK9fG/a1AzwB:Lq9ahNMeFS5TNS03mSfN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677009326, "uuid": "02d5fe88-62d8-4dd4-946f-32c6c83b4bf5", "value": 1101824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677009326, "uuid": "0b092908-0792-40a3-ba47-b615260b7327", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677009326, "uuid": "7f30d9e1-778a-4457-b518-255b8900338f", "value": "ab3cc3753c44c1b84004de601eb6a830.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6336356-b18e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676946201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676946201, "uuid": "965fc0f2-ef89-43a5-a7bd-49ecf904d7cc", "comment": "Malware payload (Mirai)", "value": "c1a6742ad94c3afdee8c247bfd93686a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676946201, "uuid": "14f776f4-2457-49e3-83d4-29b9990760ae", "comment": "Malware payload (Mirai)", "value": "21880f04bd34be2611b90c38616984f5737a97d13d739144b8ecac98db7d4a3a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676946201, "uuid": "3d6ca718-c366-460b-9f28-67768f9fd035", "comment": "Malware payload (Mirai)", "value": "9e05364e9960d274d6a40eb7141385fa85770afc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676946201, "uuid": "0c835100-c9a0-4eb8-83d5-9e8318e42885", "comment": "Malware payload (Mirai)", "value": "5abf6a4651201a89c640d0e5a445244a465af3ac88d9767b5189636f6ebc237618b0cd5deb7172cf8ce961901df1597d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676946201, "uuid": "405de50d-6225-4fe3-924b-56d3d437fbbd", "value": "T124234AC49A43EAF5ED120A7420B7FB335B37F07A1159FA87D3659532AC42B11A20B2DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676946201, "uuid": "b00a34a8-a6bf-467f-8223-37392dc27732", "value": "768:cY/QjSN+MGBs8WWE3/NRHgzqduOxPZdFEwaK3g+ZdG:cY/QjSN+MGBzXE3l3duODdRaK3hZdG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676946201, "uuid": "426e7fb0-f2c4-4c81-81af-d3e377ab0388", "value": 46640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676946201, "uuid": "ed711fda-b936-4754-81e9-1646bca3dd57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676946201, "uuid": "a598d04e-da64-4766-800d-713f8ad39b1a", "value": "c1a6742ad94c3afdee8c247bfd93686a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd02ec9e-b1f1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1676988733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988733, "uuid": "d797c724-8fe0-4f2c-b751-fbac09536571", "comment": "Malware payload (RemcosRAT)", "value": "5fed20d8783f9145b88bb422b672de93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988733, "uuid": "57e68e81-e6e1-4cd2-a9b1-01fc454280f2", "comment": "Malware payload (RemcosRAT)", "value": "25ba7b40ff6921b6590360a905d4389e799e0fc9f69f131f8ec21611482cde82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988733, "uuid": "9756a24f-b017-4170-b27b-1b81328b6b4e", "comment": "Malware payload (RemcosRAT)", "value": "23bc47574a50a32c974d1dc4aadc67983042e922", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988733, "uuid": "156909df-3313-457b-8ed2-0f6f54e83d26", "comment": "Malware payload (RemcosRAT)", "value": "48cf484dd0a5ce8ef57c4772971dcda4823f462181c6c9d1718f3d56b31e30916ea674d43cd13c4ba521b09a93a976be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988733, "uuid": "2a780dd9-5c08-4b70-a3df-7fe62c53920d", "value": "T1D6B42344A7B0F62BC8E247F049BA4B4F93739A1B805872DB3B112F9A7D63943C71A715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988733, "uuid": "225340b4-ed51-406e-8aeb-e4a078961b65", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988733, "uuid": "eb079bb6-856c-4c7a-b8ce-e4700bdf46e4", "value": "6144:vYa6kBclFZwc1svqTuycWtk2NZYqddBAP6yT21MK0D/ciIueKM/G2ifpfe/TWLzx:vYm+niyJaIdi6yTmey/GvUTno4EQez1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676988733, "uuid": "f70bd5c0-49bb-493d-af6c-f20c77b256ce", "value": 510587, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676988733, "uuid": "151ff961-fc23-4f3e-aa21-db99f18a6a61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988733, "uuid": "b8f8df44-34f5-4d1d-98a9-92db84044f83", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bc235f4-b232-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677016380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677016380, "uuid": "7fb03771-df0e-4664-89a7-a6005d15dfda", "comment": "Malware payload", "value": "fd7cc6115c89bc07d22abfc54324db05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677016380, "uuid": "d061e6f4-dadf-4cc8-9770-212b0542bcda", "comment": "Malware payload", "value": "264287c5f1b361ec812fe7ecb1976f7dd6ef60bff2e40000f6258f190d481ccd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677016380, "uuid": "1649e60b-c4b8-4427-a209-7abe05952706", "comment": "Malware payload", "value": "60d582c4695d2d5003cb95e8b865d1486d89b81f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677016380, "uuid": "02594456-52d0-4d28-82d7-b5457161a021", "comment": "Malware payload", "value": "d3e235d69239eee77bb5b2a1622015a9a0be5a5471104f235288f164ecaa304faa734b8a076f9558b62b0959a389a3b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677016380, "uuid": "9a007949-f73d-4f5c-8e14-7f17d75699d6", "value": "T158B4125823BC4627ED6E43F41F6545D103F2B4666452F345AF97A8CAA177F01CB22B23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677016380, "uuid": "6d5b98e1-aeb8-4173-9d84-9e2a430e991f", "value": "12288:YodZoI3oeBYx85qg1I8Clgp2KqakTyT+QOGbJfNuK0JD3j:FdtYeB6magIPar+QpJVuKSD3j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677016380, "uuid": "89aa0f4d-6852-43dc-a493-e3197102153b", "value": 511488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677016380, "uuid": "45677365-3f3b-4267-b2f2-c666e809f333", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677016380, "uuid": "ac1a3f05-c8e1-4dc0-ab3a-d4879f3e53af", "value": "Shipment Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f4a9cc6-b1f3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676989301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989301, "uuid": "c1e60f9d-29ef-448a-a041-4e83db1971fe", "comment": "Malware payload (Formbook)", "value": "6292f016864345c3d68b85b5b4ac3196", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989301, "uuid": "b17d9df5-5503-4f8e-a816-78620a8cd1b1", "comment": "Malware payload (Formbook)", "value": "27659cf1d5123268149e78cd8546b1eceda43edaf998971894125f8ce520f1d5", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989301, "uuid": "d596a2ae-324a-443e-88c3-3ec5b3f46b4a", "comment": "Malware payload (Formbook)", "value": "7cf48d22e30965ed2cd936766f597a2afd4c4cca", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989301, "uuid": "b38c4b0a-133a-478f-ab7a-f3f88f409178", "comment": "Malware payload (Formbook)", "value": "bb2b94fff77b280a7d7741d08ee7cb8b0e1ddd85086e9a4d94719492e3c1dce4e746729e40ef59a7f4928a34a616819a", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989301, "uuid": "4fc5076c-79af-4c0f-aa5d-4301dbf1afa5", "value": "T1C975AEF875047DD6666F17ABCA96ACDD13B61B239ACBA4CC8064B7C305A3375FE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989301, "uuid": "9ef0f0b7-da21-4796-a35b-1315cde4f256", "value": "24576:crpJo3APk0yOirZToEAEtElt5FlMt878v/PKrc9BpkRmCrK+xp6AB9ZBo9z1GQdj:p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676989301, "uuid": "56b1bb68-7c4d-421b-a75a-10047e8e62f4", "value": 1557703, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676989301, "uuid": "707bf1a4-7c6a-4897-8cc0-85ab7f51a5e9", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989301, "uuid": "542f9968-2443-43fe-8d0a-d018a5bf03ca", "value": "AWB 812451609424.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68dd4d2c-b1b5-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676962822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676962822, "uuid": "9b4f6339-38fe-4815-82dc-29e0d4a1beb7", "comment": "Malware payload (SnakeKeylogger)", "value": "3737be08a84361a1776b1365d505a451", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676962822, "uuid": "6059092a-d466-46ef-b7c8-70ed328635c9", "comment": "Malware payload (SnakeKeylogger)", "value": "29032ae14e315863a55a0851c3e1c9cb246beb4513a279d8b1bf7fac97be6ff7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676962822, "uuid": "de1be285-8e55-4f89-8e3b-5a5e65efbc98", "comment": "Malware payload (SnakeKeylogger)", "value": "fcea334eadaf808ddf053f9dcb63e002540078ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676962822, "uuid": "17bb2b1a-30d6-4238-b364-8ab0152577f2", "comment": "Malware payload (SnakeKeylogger)", "value": "cba5f518bf11e762565aaf6fac96851c8a0be3507feca2178e97eb5cb9fd7582896fcf944e7aadd795d5b81febc26ca0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676962822, "uuid": "7a25f571-1f7e-4bbf-8443-be58e06c06c4", "value": "T157A40658136671AEC1D6BCB188C99E86DDF08ED23FE16D11850327DD9FE80BD2908DAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676962822, "uuid": "5b0ad213-edaf-4d53-9f12-dad93ea149ae", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676962822, "uuid": "ff7f777c-30a5-4154-8228-675a09e6c3d7", "value": "6144:cYa6OHPGTjpoVXT5SCR8rqfklKBhak0kegvjeQcFo8VaKrD4PgDaCesqM:cY8HPGpKXT5lacRD0vyjZcF4Kf4PgDB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676962822, "uuid": "71b0eb97-3192-4024-9411-e91aa904fb96", "value": 468323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676962822, "uuid": "d8b41d35-6ec9-4a9b-8bf1-b6b0e5c3f84a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676962822, "uuid": "773470e2-2b31-4591-b05c-850b42d54928", "value": "3737be08a84361a1776b1365d505a451.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0886bd7-b230-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677015824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677015824, "uuid": "9cc5d004-1c9e-4056-ab4c-afa3d012212e", "comment": "Malware payload", "value": "42da5f5c8a51d34fc7b3cb3541b52068", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677015824, "uuid": "262a6b20-eba4-4ad2-8d8a-25497851c4b3", "comment": "Malware payload", "value": "2a1b9e0bc2bbf49b67af6743d924ca5b2009e148770d3dc6d805f49de05f9d53", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677015824, "uuid": "6e899ffc-0770-4e3c-8861-38cd20d407af", "comment": "Malware payload", "value": "3991ec84bd94eadb765b5d0f80cee22bd23ef1c2", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677015824, "uuid": "7a7bde73-29ff-46f9-b02b-568bac1a8602", "comment": "Malware payload", "value": "1c7bcc2fb7e0fd98c44b993973890707319ae5b54d6e1cb8d0cca5b361cb2556a6d2c9aafe8770dee85eba04cdce4f2c", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677015824, "uuid": "dad8b0c4-0005-4874-9c6a-e1450066efea", "value": "T10B45125823BC4627ED6D43F41F6506D103F2B4267412F34AAF97A8CAA577F018B22B27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677015824, "uuid": "4c4143be-f788-4e99-b172-98fce920f828", "value": "12288:dodZoI3oeBYx85qg1I8Clgp2KqakTyT+QOGbJfNuK0JD3j:ydtYeB6magIPar+QpJVuKSD3j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677015824, "uuid": "cf59f7e8-b8ff-474d-9daa-2c4ab9015df2", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677015824, "uuid": "ff33d5bd-bee4-4778-bcb5-e943b7e4aa3b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677015824, "uuid": "fafb3201-2226-43a8-a579-3d3cbaa83fbb", "value": "Shipment Invoice.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0323d3c-b1d5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676976793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676976793, "uuid": "a4c0af5c-b067-4bcd-8918-baeb80cc4bc7", "comment": "Malware payload (AgentTesla)", "value": "0726c213ff08ef6ad97f3caf3754062e", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676976793, "uuid": "38f9c1a6-dc37-48c3-abc8-ca87cfe242cf", "comment": "Malware payload (AgentTesla)", "value": "2a1c0d2f2d8232598048488268828d7c1141427f96dcdb9a897ba1f362d0cc57", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676976793, "uuid": "878647d9-e3dc-4819-8d06-e62e9291aeb1", "comment": "Malware payload (AgentTesla)", "value": "e5e5642a29e23ff390da7ca3e699480484eb347a", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676976793, "uuid": "b933cefd-75d7-40a5-ac5e-15010b4364ad", "comment": "Malware payload (AgentTesla)", "value": "d08c57f32b805aaab909f42f017ed8be3d0761883dea9422cac578996f0cdbab730108bf807505da06e59daf9450c7ad", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676976793, "uuid": "5e6ed599-01d2-47a6-9ab8-b83a9e97b1b4", "value": "T1460533823E150C3EEB0D2E866768C709D6129CBD33DC6F6269556C1EBC8B9B8C17815F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676976793, "uuid": "4c0fa312-657a-439e-ac31-a44367707ca3", "value": "24576:1CbvTYs09RnGJ0THxm43ua8lkr81JErjZoG7UdQs:4vTm98ERmsua8qr81aZrUdQs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676976793, "uuid": "7341250b-fb55-41bf-9ce3-fa5635c7adda", "value": 859533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676976793, "uuid": "c8bd6375-1e1d-447a-8472-ec0a0c0ba271", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676976793, "uuid": "a8d2b1a6-4af4-4434-b035-2645cad34631", "value": "AWB NO.3522849002.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c156ff2c-b1d2-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1676975426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676975426, "uuid": "b75e5a63-4cca-46a8-80a0-1c93d257e882", "comment": "Malware payload (NanoCore)", "value": "4b271fd529c4540f4306808cc333ab06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676975426, "uuid": "288dc78f-2284-4a5b-a4fa-e40a8505195d", "comment": "Malware payload (NanoCore)", "value": "2b733276f28e8a547f7e2197e1be209c13718d5371922855264d1a5511ca66a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676975426, "uuid": "14f86ba2-7a16-43f4-a539-52b4d29f9960", "comment": "Malware payload (NanoCore)", "value": "6a2604e432c74aa662fd3fa9b7b31f123f624ed8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676975426, "uuid": "7fb3049f-d879-4dae-9c7c-cafaa89dfeaf", "comment": "Malware payload (NanoCore)", "value": "0eb465c046b74cf415a4f6c0da8a5d7f6ca305b43836de630f6bdc08732a72f13df25f3d6086c782cbc1f68b7e1a2b2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676975426, "uuid": "14b5635b-95a9-455c-8593-ace209786337", "value": "T11695BF55EBFAC8E9E49708BC04341B092832AF53690EE3D9963A7E30E5786D3B1C4D75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676975426, "uuid": "e55d3a95-72a4-4af3-aabd-e1229cef6518", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676975426, "uuid": "44a5ebf1-cb79-4a7b-8f1e-862eda5e1c21", "value": "24576:Qky9IISMoa5nCnabmOE2tVvJYE3pJBeK549dUQ5ugKTyN5yWTrvyEXtmJQ:IZDGE3pqU49z5F7TyIy6m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676975426, "uuid": "2e25a503-3cd0-45a1-b4e6-6bcdc62ac8ca", "value": 2042368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676975426, "uuid": "eb0601e0-fa12-4432-b7bd-a3777ea2578a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676975426, "uuid": "248cc119-c7a0-4997-86d7-165d39f50e51", "value": "A1DB2JVWGG.CNT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d14e2203-b215-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677004229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677004229, "uuid": "6e022eee-cb62-4117-9e99-dc28de8b1be9", "comment": "Malware payload (RedLineStealer)", "value": "8588ae534aa1576d29e9c6462232cc0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677004229, "uuid": "7e6f8b7e-7e2b-40f0-af84-caf1764b952c", "comment": "Malware payload (RedLineStealer)", "value": "2c9c5dbdb68863ae4863c444c9ec8b67968be535fab0808ccef55800370950cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677004229, "uuid": "daf12b30-06ad-4236-9f3f-20111ca43eb4", "comment": "Malware payload (RedLineStealer)", "value": "ac5cccf5a46f2ab7e66901e99c09700b5bd4403d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677004229, "uuid": "c3c7ac8c-fec0-405f-9a13-d023908ac62c", "comment": "Malware payload (RedLineStealer)", "value": "637418dfacc44537c2541c043734e713fd4efb44d0f99a9cf81f0eb960740286148ea9827649a9ced1c598c5b1f2310b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677004229, "uuid": "3fa43840-4e6c-4f89-a362-c9753686dce3", "value": "T129440122B2A09072D4EE167E5470C7A09E7A7E1212784C4F7BB8367E5F603C19A7935F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677004229, "uuid": "c395cb4a-2803-4bc6-8e45-a8ae11a3db5b", "value": "2ea63b0a2d7d284ede6e5b1ecbc1f123", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677004229, "uuid": "ceed5cac-870f-4b8b-8a11-27980a21e241", "value": "6144:kQv2REiBjj2bOJ49vTUZ3On5T/TG4/jY9n7Q5oyIdeQn:kQv2bBjj2bOJmvT63URrGUCQ5opnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677004229, "uuid": "99ee6856-c0ef-48e2-b101-51168d61a99c", "value": 273920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677004229, "uuid": "fb2a2920-e4e3-4617-b7c2-a4ec38aca39d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677004229, "uuid": "0f14b99f-ee68-4373-a33c-013b358bcac0", "value": "8588ae534aa1576d29e9c6462232cc0f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9a8fd9b-b1f2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676989264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989264, "uuid": "ca9f6542-3f39-4e1a-9d56-e117fe252af3", "comment": "Malware payload", "value": "3292b28a0a8d84498e87575eca07dec1", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989264, "uuid": "1e91cdb4-433d-4027-b369-abf449f3897c", "comment": "Malware payload", "value": "2ceb940fa5a3e698781c4166c28c491b7ed24caa5f5a6e551a4953b1734009c9", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989264, "uuid": "c9e6d824-faeb-4b59-bfc6-999d86fb1ca5", "comment": "Malware payload", "value": "f922e29bb5f4ce823e90dc2e7713a0ba2c34ae24", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989264, "uuid": "0e7278dd-9ca9-46a8-8bb5-ccb3f5f82b63", "comment": "Malware payload", "value": "bb3de49e74fc4664f8cb61adcc12f0b3335990ed9f08b09628ea9c36663bae919cbe53c610a46cebeea0271a5214c71a", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989264, "uuid": "5d2ec018-de0d-4939-89c2-1157e2655387", "value": "T185350206E151ED2BEC625970E8933183C226AC6DAD55DB4E21C3732F57327F21E36E91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989264, "uuid": "9425a143-2c79-47e7-9613-059909581e2e", "value": "24576:uFeiPHqFPUFegA8MdWfmpmhAcsrvT/sqwAmrSXXXXXXXXXXXXUXXXXXXLXXXXXXR:OvPKuTPlsLTsb+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676989264, "uuid": "f97dc7d7-3f69-4612-8752-31769ebf6e64", "value": 1163264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676989264, "uuid": "775a9b9b-f8bc-49d9-8217-ad419bd221b4", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989264, "uuid": "2e8a4650-ffe9-483d-9f67-f3a90c3e3a5d", "value": "Enquiry 220062 Krause K + K GmbH Armaturenfabrik.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "340503ac-b1d2-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676975189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676975189, "uuid": "0d61031c-6577-457c-9732-875ee2b238e9", "comment": "Malware payload (AgentTesla)", "value": "ca0e7874ee9e37aed18d4e4a7887c5ec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676975189, "uuid": "ea235377-45ac-450b-bf8a-40161616bf5d", "comment": "Malware payload (AgentTesla)", "value": "2defe16bb3eb5455234555130530a62369b70e406e03975f8fe2d4c5eff8f8a4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676975189, "uuid": "1a149ab7-64ff-4faa-883f-d09da6cd776d", "comment": "Malware payload (AgentTesla)", "value": "b903959041665409540405a25ce57c1cd0330df6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676975189, "uuid": "5e9e7e7b-bd70-42fa-a03f-d944ad17e353", "comment": "Malware payload (AgentTesla)", "value": "918e68f32abfca22d013c1e3da5c1b74ca47cc9cd3564c583920e24d0b9cfd929a14d99954507289709e9fb8e1bd6500", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676975189, "uuid": "338753b5-6864-4ed4-a426-0e71a199c61e", "value": "T12D54126415D9AE78202B04EDC4A80F86FD7DB74137C9B19DBC19398328E07ED6E2D998", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676975189, "uuid": "2bc1ede9-fbed-468b-9763-6e7259970dc8", "value": "6144:S/jUb75dNKqPVWvadM5pW1nUQiRCdguCvieLS8PrI42mts3Qa+G7V:SrUbNdcCXdKW1nUvL6ISyrp2m+gajV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676975189, "uuid": "146b35fc-6e2b-486d-aedc-c8c72b3c30d2", "value": 282596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676975189, "uuid": "d6ab556b-8e98-48b1-8574-f36fe9a36d5f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676975189, "uuid": "fdda2902-db8c-4d45-ad6e-e1b5b89d1c9e", "value": "PRE ALERT NOTICE#207734.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b318c8c1-b20a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676999454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676999454, "uuid": "038d9647-0f66-4cbf-bfa2-eddd203c047e", "comment": "Malware payload", "value": "99df17c7da12f1f71994c0398048ff8d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676999454, "uuid": "9f9298e4-a49e-438c-926b-5686c83fff59", "comment": "Malware payload", "value": "30cd176eaf085c7d69ee84a4af9826b38cf2da43d36463927f9cfa6152cb9ed3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676999454, "uuid": "c8370afb-958b-45cc-8ffa-b1c22e5df3c3", "comment": "Malware payload", "value": "f53ecb8377073cfefa52078ff8d24268bb423e7f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676999454, "uuid": "be7c3fd9-e6b7-4a81-8954-0cb5474f3847", "comment": "Malware payload", "value": "b81e9e6c89a92883602763239f0fca9e7744002c3b050f33cfb300b1e2dddd0015c8df0e3ae126c25a56bdcf88ab0d57", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676999454, "uuid": "99f1236d-858c-4f6e-b69f-2ee0e5a1c53f", "value": "T163568F7B7CCA5634FBC5FC7A0CB68A2E00E21C524029955697767C27E13BE7097F029A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676999454, "uuid": "60904670-2a65-468b-94fb-1249fa83bb95", "value": "12288:vb9Xn7Mu3qI70c9viIRub9Xn7Mu3qI70c9viIRyi:vJX7MA0c9vxkJX7MA0c9vxQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676999454, "uuid": "25743d7d-5872-4e4c-a825-0faa23b84b19", "value": 6311936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676999454, "uuid": "9a428ce7-3db1-4cc8-97ea-8bc2e8e3c260", "value": "application/x-virtualbox-vhd", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676999454, "uuid": "19ca49db-70c0-4f79-91d3-0c202034ee00", "value": "VRWEFAOPH_PAYMENT-INVOICE.vhd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddb5021b-b17c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676938537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676938537, "uuid": "b3d15ce7-23e5-4f6a-9e01-987828fcf224", "comment": "Malware payload (RedLineStealer)", "value": "37bda89ee908544b4d8fba8ae6415a88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676938537, "uuid": "23b38f87-bd55-4eb8-a6b6-be317802ae0f", "comment": "Malware payload (RedLineStealer)", "value": "30d36306f65daf2130ef45742278aa32da3a21fd332539d521389b1165a4c601", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676938537, "uuid": "89e1488f-fb77-4cfd-a7bc-e864f14df74e", "comment": "Malware payload (RedLineStealer)", "value": "0568a5cefbf7d2ff60174a8b2417210c567f9964", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676938537, "uuid": "844af8b8-7bb3-440a-ad01-25f5b945f856", "comment": "Malware payload (RedLineStealer)", "value": "20096552a00db2c4dd24d8315f12aef9d1a338aa2c123e6b5914b9ead1318d8e23e61f8b402ce190010f5ddfb1472e2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676938537, "uuid": "44759840-8ac4-4386-a87f-d64d0a5f2fc0", "value": "T1AE04D51437FCCD11E1BA1A3F6962A05046BF9802AD42F25B76C767CD1E32B40F957AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676938537, "uuid": "25e346e1-e96b-488c-a62a-e1160e21bd61", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676938537, "uuid": "8da2379d-3dd2-4f6b-9760-48575c4190c0", "value": "3072:ixqZW9VaCk3Dc7P8I8eTx9+h+PxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuwb:QqZw7PHn+h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676938537, "uuid": "ae47745d-fd25-41aa-9769-5715b21ab843", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676938537, "uuid": "65114103-de40-4173-a2bd-e72e647f7359", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676938537, "uuid": "c3b75f87-c6eb-4c3b-9559-13fbd5fc013e", "value": "37bda89ee908544b4d8fba8ae6415a88.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60ad4f1e-b1f8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676991585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676991585, "uuid": "3df6009b-ebd4-40e8-b89a-7a46da3657d1", "comment": "Malware payload", "value": "1189f6cd2c64f64bc1ecec714e63ab3c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676991585, "uuid": "40b1a223-1618-417c-b696-33c0a960353c", "comment": "Malware payload", "value": "31d27525497d7f30c165e944ff59fd2e4a928c11f00abe3157bce9dabc665e11", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676991585, "uuid": "9e0cf485-1029-4a7a-ba18-e4b0ce43a89d", "comment": "Malware payload", "value": "98d408b83ea04fed240c3517777aa156f5e81630", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676991585, "uuid": "b905f77a-0531-4781-b2c8-593424329ec8", "comment": "Malware payload", "value": "245ac93256cbcab5ac8b93c26c2de9c9d6fa30ea00d65c74bff424cb9811144f04c12aa858948ad2f84c4a2174a75ced", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676991585, "uuid": "8287b8fa-9957-4d6b-8311-f21f42c85595", "value": "T1B7B3E103A3C94570FC502570D49FC3C259A7B832DA465A9F31F92A335C563D2B6F1EAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676991585, "uuid": "818661a5-6b19-44a9-bd4b-3780a9c34ac8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676991585, "uuid": "12380ce3-a158-42f2-b106-41dd94332b62", "value": "1536:eRhNkYJTrgdiPluOcN6IBVQqqTxJHWe2zm4uz5dh3Hkq4/T6dcE19gLIaru7:eRh9ttcQIToHWef4u136E/gLIaru7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676991585, "uuid": "553ca12a-d75c-4ac6-a11c-41e9b74e58fe", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676991585, "uuid": "ae5de0fb-618d-4d4f-8211-566b39e8945c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676991585, "uuid": "a49a5be6-fe15-4961-850a-b42dd03b4965", "value": "1189f6cd2c64f64bc1ecec714e63ab3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25ba45fb-b1eb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676985902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985902, "uuid": "45297e46-21b0-4643-8003-f230666ef8a9", "comment": "Malware payload", "value": "fc7c8e5471782c9b1d8477e36d53f6a5", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985902, "uuid": "898868fc-1837-4ca6-b8a7-2b0061df22c7", "comment": "Malware payload", "value": "3234892d88c61213e63ce768d7437c924dafc1cec2c95edec327022e79d0f5ef", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985902, "uuid": "65b41359-a6d3-4a86-838f-1c018efd9f6a", "comment": "Malware payload", "value": "a606848308c42a94086c22c9f98968b8a7799d86", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985902, "uuid": "772b42e3-206b-4afa-9ce7-072f187be617", "comment": "Malware payload", "value": "32023e44544c27c5601e700f2d11fd5581021e41b5bbabc2cfcf88ab7157a91683a7c9fa386ceedee29c5449c7925449", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985902, "uuid": "2ff5bd82-d044-4362-8b6a-083483e268a3", "value": "T13C85AFF875047DE6266F576BDA96ACEC03A627239ACBA4CD806477C305A3375FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985902, "uuid": "eef7ddfb-31a8-44df-be47-1467b9d4f3e4", "value": "24576:kE34nTie3gmpl2eJY4gtjgQ2a2G9g+cVp4CrdfZ0ip/JerLGPcW59dbfSLK7bstd:5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676985902, "uuid": "da73b579-7747-486f-9ec1-2f1767cd1da7", "value": 1849099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676985902, "uuid": "44832f29-7cb7-4cc8-8cbe-6e3394b7b18d", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985902, "uuid": "3bb51968-3d8f-4e3f-97eb-4b1fa7de9b68", "value": "PI-GT23011602R1-WK.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40be32b3-b18f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676946434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676946434, "uuid": "821ddfc3-26f7-4e38-a237-1fd0d31015f7", "comment": "Malware payload", "value": "52df19b9845a6da6197831525c7a1f01", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676946434, "uuid": "b35aa79b-1107-4d5d-82fd-6bbcfb61efb1", "comment": "Malware payload", "value": "32b617dd0ea32902a18d93fe74b4a8865d23ec398666736ffcb4c4e9dfa9c6ec", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676946434, "uuid": "d269b4de-24f7-40df-ab6b-5dbce62836f4", "comment": "Malware payload", "value": "44bc66e19570256985f1f38a6f090ed4737e5b4f", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676946434, "uuid": "b20e28ea-1bab-451c-aaf6-6820f94bbf5b", "comment": "Malware payload", "value": "c513d142bbda6071c203526b7d53fec6d25f1752189750f97c5c52014bf6e2e7ae82c0da12b102b349a38be0e7612791", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676946434, "uuid": "b4b399ec-4753-4766-895c-a4fb5f5ae674", "value": "T1D80623E17CEB14BAFDDA453CC05A2FAD4350B060A66DA9EFB2BEC3D05D648441324A5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676946434, "uuid": "b19d9e88-1073-415b-aedd-03918b2846ee", "value": "c24ea937b2b0d62e829e8a8faeff5a8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676946434, "uuid": "1423a0b7-30df-4291-b53d-c9378e1338e7", "value": "49152:lNn9hglTk53CXPgmsyL1dvIcfYNGRaKDFCC2PPGshxSZjUni1h2/MgNRIfxi3vyf:ld9hCcigVyLPIcRaesSZy9hAx0vyq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676946434, "uuid": "3a458455-1ef7-4806-acd2-1c385e707143", "value": 3758080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676946434, "uuid": "a3f4931d-d786-49d5-b2a2-7bd5cd78874a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676946434, "uuid": "1747cf78-d081-47f3-bb35-aa494a235561", "value": "IXWare Builder.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1dc142b-b1ea-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676985815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985815, "uuid": "31fec63c-8dca-45fa-8eaa-3cba8bec3dab", "comment": "Malware payload", "value": "7f9063bd71b112bd839aeb8ad7a9cc6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985815, "uuid": "f151063a-ca51-4b86-9282-d633d67bd7aa", "comment": "Malware payload", "value": "331efd4229ce75b618c2ef415ec9a3acedf3c32c5cc28f1c3f3f5af121d00618", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985815, "uuid": "c3e78062-cd4b-4748-a3f2-6a97b718e248", "comment": "Malware payload", "value": "3d76f8623b5d7e1fe909d027250936896f25fa13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985815, "uuid": "e878d431-4be1-4e36-b80a-a824ba14c341", "comment": "Malware payload", "value": "19521c0e4c9b6ba5b941c870daf3564781b94e40d154dfb808512f597d6612f1974eb2ad759e2135f6a0111fb76ae68e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985815, "uuid": "6c680cec-6309-443c-8e67-41519bab3e6d", "value": "T186C4F141B115A4F6E83313B04877DCA326A9FD286911863F7296F7BA7973F43021F94A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985815, "uuid": "a90656be-a164-413b-ae8f-01d5cb02646f", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985815, "uuid": "73afe131-b5f4-429e-a8b5-d8a79adfc5ff", "value": "12288:GTMjg4wizgPP/U5x5acmstvl9NoTBPlcrdcu/YvdgdJ:MF4wizgc5x5aGtbeTBPliKSdJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676985815, "uuid": "a29c304f-40c8-4bdb-9002-616b60a80022", "value": 585264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676985815, "uuid": "e8e20f64-932b-4bea-adc1-bfe73fce801f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985815, "uuid": "2f2633f6-1663-4e20-a19b-cdeeda8e7d44", "value": "DETALLES DEL PAGO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff92f797-b220-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677009031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677009031, "uuid": "3d970df7-ea93-4542-85d0-dac4caa2d02d", "comment": "Malware payload (RedLineStealer)", "value": "ffc6b8145bd1eb1556623582bb78465e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677009031, "uuid": "0cb46cdb-363a-4c67-8d7b-d09fd4819639", "comment": "Malware payload (RedLineStealer)", "value": "33246d2f91d2e22590129f20c87ae87721ef288bbac63ec505a32e8086f9c14b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677009031, "uuid": "15230fc0-ddfc-4e77-9dbd-486fc9b6884d", "comment": "Malware payload (RedLineStealer)", "value": "ad821cd32733f49e882068264e49fb5db767670c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677009031, "uuid": "60a006ee-9bf0-406b-aec2-315c6a35c8af", "comment": "Malware payload (RedLineStealer)", "value": "44d1c5877f04dfe404aba4aeb863bfebde41fa8ee163e0587cb4c3ca0a307b2df8daa826d0fdad1f747129b32813a2d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677009031, "uuid": "4baf418b-3a95-4ce8-9229-794115a79edd", "value": "T1ECC4024BF2F84032F9B4277049F613D30A35BD606BB8865A739B1D5A0C726A063757BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677009031, "uuid": "b2d07866-1485-444e-ad9e-437ec4554ad8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677009031, "uuid": "7b5914f1-f3da-4d1f-9a14-da4c9aa1f5ea", "value": "12288:wMr1y90hLNJrzLgXOZ2GvpuKRrGf4CYwEImwTrNJoXW:VyKLCEpjRGwkv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677009031, "uuid": "96a49ab5-2cdb-484a-8055-d979697b3749", "value": 579072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677009031, "uuid": "dbbe81d1-c72e-4125-ab51-222d1cddd006", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677009031, "uuid": "7e6d3c05-daf3-4d65-abeb-0bac9b76f804", "value": "ffc6b8145bd1eb1556623582bb78465e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a73f6d72-b1cf-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676974094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676974094, "uuid": "a2ae93c8-48cd-4a28-acaf-9bc928377bef", "comment": "Malware payload (AgentTesla)", "value": "fd9c2b981387fbc017a8499bbcfc4c16", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676974094, "uuid": "74893769-4b08-4e64-8e6a-eb6f58d2ee93", "comment": "Malware payload (AgentTesla)", "value": "33f07a8288a5e65ddd564e4c03abb8541aed954670b69afcdde73b86f7b8ee7b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676974094, "uuid": "74392054-a798-433e-b6da-e57ed8f854d9", "comment": "Malware payload (AgentTesla)", "value": "0209e92e40f96d6be8755280bc5b360519f68c79", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676974094, "uuid": "ac94dcca-1dcf-435f-ade0-c690b29c8e32", "comment": "Malware payload (AgentTesla)", "value": "fa696b8ba116f39f7df6070345598e07c43115fa865e5095220a9614ce66f1f6198b58f7ae702039fec1f068596ebc33", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676974094, "uuid": "af5ca347-0c55-48ba-ab13-96d220d3b2b2", "value": "T1FDB47D2FBB553B26EF4F913489350A0CA7F29B031351EE629FC700D667AB5A79E41C81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676974094, "uuid": "6b171ef8-1841-45af-89fb-6afa6c4bd088", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676974094, "uuid": "96d44bf1-7b3f-428e-813b-0d20d0a945aa", "value": "12288:bJ/lppJHwp5e/viEg6BqyOWSZ7Rl/94KK:3NS8/vi3iQdl/y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676974094, "uuid": "5fceab6d-5ee3-466f-85d8-d471970623ce", "value": 508416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676974094, "uuid": "efb8bf5e-785b-453a-8135-5101a8fd063b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676974094, "uuid": "acb5ecbf-bf58-44ec-b32c-e54c7986cd5d", "value": "PODPISANE ZAM\u00d3WIENIE NR. 016200-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb7bcc54-b19c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1676952223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676952223, "uuid": "d2683e6d-1f52-4f04-91d6-e030d0fff7aa", "comment": "Malware payload (RecordBreaker)", "value": "3282ea72e2abbbf6b4150816461125a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676952223, "uuid": "f7d7837c-3700-4562-89bc-e0698f1df238", "comment": "Malware payload (RecordBreaker)", "value": "3456b3d72716fa65c41d3b6d8ddd5e6c365cfb8c7fd298a57be5f30b6caf28dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676952223, "uuid": "0267d393-6574-4ecd-9ea2-9a70a0b75e64", "comment": "Malware payload (RecordBreaker)", "value": "8bc40caa035804a6d99a09d34a1a9faa90ee78f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676952223, "uuid": "0e06b342-ddab-48f2-963f-923279110dc5", "comment": "Malware payload (RecordBreaker)", "value": "0c7ca7cf1bf69670557ebd903833ed28a1625cb6a57ecd3238dc923c5c90fe597c776c4ddd6aab531f54416b2030baf0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676952223, "uuid": "ded0d7c0-1459-417f-9260-191077063ddd", "value": "T1F16622629371C078C8B8B87C4C267CA436F959567680B8B8BCD76CF3FA12450866E5DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676952223, "uuid": "6367c038-b3fe-41be-98cd-a95f30778030", "value": "161839a78ef6f07a30d3f07895f6fe23", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676952223, "uuid": "54f088cc-0865-43da-955a-0a0c09616ff5", "value": "196608:ppUI+/B0d1FOw1vGzZQ7Ey3aHczOBfmpLHe+VV:cI7bowozaQy3NzOcHeo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676952223, "uuid": "b02852ee-c45b-45cd-ac48-073a4ec40fc3", "value": 6819795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676952223, "uuid": "f488b83f-7f68-48e4-b750-e35a738a055a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676952223, "uuid": "96d75a3e-394b-417d-b7e8-83afc183a823", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f425a2f3-b203-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676996556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676996556, "uuid": "e23ba65a-abc0-4bef-aa8c-4dcb70392176", "comment": "Malware payload", "value": "5defb0f3da7fc80407bbbe684e71521b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676996556, "uuid": "303796d3-0d5a-43b7-87df-fea89dceed23", "comment": "Malware payload", "value": "34fd6c819f0ff0375583329f712d9ac94a78ca8314e612d4bd303ea8b918d4f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676996556, "uuid": "d1e24e98-1c12-4e51-9754-0124ed642517", "comment": "Malware payload", "value": "23e4c34ddb45a54f445563616188cc75376b547f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676996556, "uuid": "2b181324-dd4e-4c0d-a695-c7415182b454", "comment": "Malware payload", "value": "4e44f8a6c3ec052e8221a52778a1b656efc85d375da605e7c8e0722e7e5342edd1993e6a393d951acb28510fde1595ec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676996556, "uuid": "7d5690c4-6dd8-4032-b711-13d84c2ac735", "value": "T10A352307A7ECD936E9A5577059F202D31A30BD601938827B27825C6E1D776B0B732B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676996556, "uuid": "af58db98-7fda-4e76-8859-3326c9768cfd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676996556, "uuid": "8f131950-bf79-404c-904b-b77dab6349f8", "value": "24576:5y5cl0Ck/SSvebnT7+tZSVbu6Sf7zMGBtruzWxMojk+/r9:s5cqZ6SvGnngZCSPMGBtNeowe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676996556, "uuid": "5e9964ee-cfc3-4b68-a212-5325d6315a0f", "value": 1092608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676996556, "uuid": "ee166850-e4f9-418e-95cd-6731bde64763", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676996556, "uuid": "393c5461-cb65-44e2-b34e-9cb182de0771", "value": "5defb0f3da7fc80407bbbe684e71521b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90fb5525-b21f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677008416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677008416, "uuid": "f71cf539-fe46-4443-bc6b-386ed184beb1", "comment": "Malware payload", "value": "817ee46423164cf2502ae2accffecaa1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677008416, "uuid": "f49e813f-05ce-4d79-b394-ee43498e668b", "comment": "Malware payload", "value": "350edaca28b1572c31165431bafc7d1e0552c45f3186ffa039de33a58e55144e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677008416, "uuid": "056e4abe-4d22-40a1-b583-dc219bbb1d0d", "comment": "Malware payload", "value": "565cf5d2a163b63cf77e15e9e0800f760e7af92a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677008416, "uuid": "4a811416-d248-409c-925f-92af48600339", "comment": "Malware payload", "value": "2ef403ca89f2ae202bb7b24f373ddf0de56b5692e1627be51e3119d482aaa57b404dd36a1d7bfdb485964750d800a33d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677008416, "uuid": "25dab786-8c6e-408b-93e9-e6cf83a87de8", "value": "T1ED048E12B8D180B7D873053006F2D7B15A3DBD323BA19DDBAB461A7C9E342C19639B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677008416, "uuid": "ab87f277-4ce7-4774-ab86-501e96bec32a", "value": "c18dafb5cbb6c721a4f06cf1fbe29258", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677008416, "uuid": "60d62013-90c4-4259-b653-57902fe3de7a", "value": "3072:zVIfP18LszB9a93iz5AOmbKtpJCjutK6n58+ZMCTXlmIghEHCL9OqiWLBWQAAf:zo18eY3sSOGc5HMel+hEHEqw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677008416, "uuid": "1bed40b0-25a5-48b6-8568-293e45245a2f", "value": 178688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677008416, "uuid": "6bd31c5f-3adb-4833-af9e-1483f5faced8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677008416, "uuid": "a287ce20-3088-47a0-9c35-f2f3700f99a0", "value": "817ee46423164cf2502ae2accffecaa1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5f3cbbb-b18e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676946228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676946228, "uuid": "6867e072-eaac-4f6d-bf9f-e5d23c2cacb3", "comment": "Malware payload (Mirai)", "value": "1b56526833ca20adf587b8ba64f37c19", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676946228, "uuid": "23854377-b9cb-4c11-a9ad-d39dbbf9288d", "comment": "Malware payload (Mirai)", "value": "3572d2c6551d92e066b2f42e4823cf6fbf84e6c078880af73f1317a448717304", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676946228, "uuid": "d0748214-b050-4c4d-a683-298f53ccbb9a", "comment": "Malware payload (Mirai)", "value": "ec3dcdce57fe2936f9984161016d88083bf5aa8b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676946228, "uuid": "3ea27267-25c8-4b7d-bb22-25a7efac437b", "comment": "Malware payload (Mirai)", "value": "6d99446cb461dbf07f09e4f3fef599b2e72696ceb42a04e0f1123a523e33b8b1ccf52cbf56da4e854b2c40a2790e0f94", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676946228, "uuid": "16334502-e54f-4f3e-b8f9-c348c9de71a4", "value": "T15E238DA6C8796DD0D1584274B9248EBC1B23A405C6A33EFE5E45C66A4007EBCF62E3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676946228, "uuid": "84884688-4dd8-4d68-9030-11961dd43c4f", "value": "768:FaTwtkionAqeqUyYP/CUwiBGrGCynnkrC9oNibz+CGIK:FaTwtkhbxQ/CMGGkr5Ns+CGI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676946228, "uuid": "7b598f71-2ed9-4ba3-8798-c8d3927d1476", "value": 47700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676946228, "uuid": "0355029c-82b5-41a4-9b17-c43d0d4c6db2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676946228, "uuid": "7fa85a69-d99c-415a-a2d8-7ec76b0abe7a", "value": "1b56526833ca20adf587b8ba64f37c19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdf6f66c-b1ba-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1676965220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676965220, "uuid": "78b6f9bf-2fb6-4f17-b0a2-e79cb48db952", "comment": "Malware payload (AveMariaRAT)", "value": "7542e3bd86fdbcb73fa415eee4e8e3e1", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676965220, "uuid": "09fd2456-afb4-438a-8d17-ef83233f756d", "comment": "Malware payload (AveMariaRAT)", "value": "38af759cbc6513d04d12de480a4554bc4b1ac50124b8a7c0174e22b7ea1ec2ae", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676965220, "uuid": "c094889d-44a6-434f-b590-96622c80212e", "comment": "Malware payload (AveMariaRAT)", "value": "65e230f2e5a20c59a45876d4dee09b88ff92381e", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676965220, "uuid": "aa03192e-a5a7-4ede-af4a-a00daa35f9f4", "comment": "Malware payload (AveMariaRAT)", "value": "6309364999e71b5e803ab29e0463df74281577659f342fbb3d0d9fbb60f0bd898c39b47390d1982a5a3ce72090865ee4", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676965220, "uuid": "9bbdb09f-805c-4e0e-9138-ba7e0c6a07f7", "value": "T16604D12336D1C473C0A35B309874D5A57BBAB4131674968B37A8233E5FB06D14B793AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676965220, "uuid": "e3aef49a-2f5e-4627-b2b2-d5b746b17adc", "value": "3b9c426a6fdec2cb62dc7c138a0d2616", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676965220, "uuid": "8e691d74-d374-41a8-8c96-b134c7587da5", "value": "3072:DVrEZcnerbTEm3NlvjXURv1pacVKCjpnhnOdFHr8NYKUkJ2CETdRaar0Ka:DxEZcobTEmdlvjERv1NDp9OdlrrKUkws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676965220, "uuid": "c69dba4f-21a4-499d-9f4f-5e0f91e7048c", "value": 183808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676965220, "uuid": "7b1fec8b-be81-4aeb-810c-a358e7f57fe3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676965220, "uuid": "764ab327-e64f-46df-a5a8-0c27334ccb41", "value": "Nel2023-02-2108-37.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fa8fbdd-b1e5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676983315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676983315, "uuid": "60e3c5f7-9f08-47fb-bc40-99a1dd8d99e8", "comment": "Malware payload", "value": "f002d9e575d3e2d873f7d4be331a5615", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676983315, "uuid": "c046b2dd-ef93-4de4-aca7-83ecbff299ba", "comment": "Malware payload", "value": "38bdef89810064d59177528f80cf6ace04acfb743195321fcada4fd7f576b9a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676983315, "uuid": "46e70986-adc6-4662-b784-76a6b4bbceb7", "comment": "Malware payload", "value": "cc20d4b5e2a98c225b006a470cf02cb71052b659", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676983315, "uuid": "f3f3b0df-dfbe-4eaf-b8b9-131aac178fa7", "comment": "Malware payload", "value": "64bc2481cb1ab684785c94117ae5ed8e38f91ed07a1e60d363bca8db2a310311695d84d83ddaf2cdd22004ed8199ca3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676983315, "uuid": "357c156f-f828-45f4-a337-26354b67daee", "value": "T16C435B1237A1C03AD4A302345D74C6520B7F7EA29EB4C2473BE41B5E5F721D6AA293A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676983315, "uuid": "6fcd9171-6a03-4889-8bf8-54a28d346927", "value": "e660360e9b49d39062886798924e4f6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676983315, "uuid": "e95d543c-ce60-4d15-beb5-cdb0cfd8d5ca", "value": "768:LHahwAwLz1dXmpCL6eTdG5eVP5ubYAOEjYMNWZDiSrr2INKoWTB6Y/famem:LHt1GW6eTd2eV5kFmdoqme", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676983315, "uuid": "f39783c5-c1d7-4e0e-9e67-589fb902b65f", "value": 55808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676983315, "uuid": "e7e951e8-b624-4b01-837c-0abb26f2b475", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676983315, "uuid": "40612bab-bcf5-43aa-8c03-e81419acbcc2", "value": "SecuriteInfo.com.Trojan.Loader.1312.29302.27720", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e0ec53f-b1c9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676971501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676971501, "uuid": "ff63e837-686b-4e2e-a6c9-1b47c58961ea", "comment": "Malware payload", "value": "e55223373648601b9a1cb28056c3af55", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676971501, "uuid": "850108f6-4225-49de-8ff9-4a48e80be059", "comment": "Malware payload", "value": "3a4391dc38bcc93f4b20fd1f34c00c0eab896290e38bd7dd7a2e02036c70a1fb", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676971501, "uuid": "cd0807ca-9bfd-4d04-90e9-8fb657baff5b", "comment": "Malware payload", "value": "6b37677c069a8e3cb241f62106a3a15567034d3b", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676971501, "uuid": "14bb3785-0b06-4280-b1d4-b49436999970", "comment": "Malware payload", "value": "eb29a374cb14baca4b38089d8a91ee290fa410d2083f4fa518dd7c5abb5589db98f08f712c0e5c06d9e062b326b29dff", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676971501, "uuid": "0bc30c3c-4106-4a69-8066-fb2b3b1f5a66", "value": "T13E23B05AE79F02A4CF5122B7131A0A8996BDB33EF350517138AC937433EDC2E46665BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676971501, "uuid": "df9e7d0e-f268-4c38-b288-8a0c2c918cb1", "value": "768:fFx0XaIsnPRIa4fwJMrtqy2GvbtHNtkr3RxfobFcf2oxy3D/rzzYv7:ff0Xvx3EMhpztHNyDvfMGfU3DDzzYv7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676971501, "uuid": "e0b779a9-aa07-4fa1-8611-f2ef0e675fe6", "value": 47544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676971501, "uuid": "20983669-901d-4c88-a097-bc259080b7d0", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676971501, "uuid": "72b0e1a2-7013-4c52-ab38-eafae40dc5b9", "value": "Order0002212023.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a0d45e6-b1c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1676968032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676968032, "uuid": "5ce92d1c-c7f7-411b-90e8-8dad6024730c", "comment": "Malware payload (RemcosRAT)", "value": "d51e8ebb04a5849f46514dcaef7f4c32", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676968032, "uuid": "964dc0cc-bcd9-4ed2-a64c-0fca6fc8b628", "comment": "Malware payload (RemcosRAT)", "value": "3a573796b5e6f1cc3a92eef7e268fa4e74aeddf34f5dd62f7b02109fe560ecd2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676968032, "uuid": "ee783be2-d0e5-4ea6-ba8d-ac60663e4f0f", "comment": "Malware payload (RemcosRAT)", "value": "93b803d920a4c0a5e291cdca4bf250c379cd729b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676968032, "uuid": "60a47234-0a64-49a1-a6e6-8d66e45cd259", "comment": "Malware payload (RemcosRAT)", "value": "1dd593fd88abb6bb4cd8e01ded97c5325efb14e4100fb25a05d5436526d14dcfb9121cc5f7e8173062a2bd949f5c1c29", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676968032, "uuid": "6ec74cbb-a9df-414e-865d-fccb09d72b1d", "value": "T19EA52F2122EAD6D5E5B26A30ED7671F10E27BC50E9359C0F2D883D4A3BB7940E57072E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676968032, "uuid": "79232fb6-51e8-4841-91a1-fddf2baa4cc8", "value": "4dd24c5aa6efe26191b8c320e81469c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676968032, "uuid": "7eb481eb-bf18-476d-8f81-d17089eb8125", "value": "12288:3iSHMv8y+XQcA6AJPe+kDuOlwflEzQBxfQPoQaM010P4AiwlUpq+C3AXwvYzcOFG:3K+XQcA6Z7vglEE1Qv3qUTQLwurLM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676968032, "uuid": "de3a475d-c65f-4d32-bd17-62aa7446c848", "value": 2168632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676968032, "uuid": "9540c483-6172-4888-a31b-b8685307c2c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676968032, "uuid": "333279fc-e1cb-4dbb-b6cb-215be70bb35f", "value": "d51e8ebb04a5849f46514dcaef7f4c32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcbe971f-b18c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676945353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676945353, "uuid": "579c2c20-cfc5-4d39-ba66-00a1dec437a4", "comment": "Malware payload (Smoke Loader)", "value": "101345f206a311b2f8e5d2dbe5deaead", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676945353, "uuid": "14972733-cea0-4c0a-996d-29dab119e3d0", "comment": "Malware payload (Smoke Loader)", "value": "3af1fc031ddbed621380b99ea34ea261e5e5b79a4cfb918898bad80f1f6822c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676945353, "uuid": "57262811-d558-426f-89f1-7b74d47385bc", "comment": "Malware payload (Smoke Loader)", "value": "f3ba05c18615b3e258a5a4e9bffd47cf295d3c49", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676945353, "uuid": "52af98cd-9275-4634-8baf-2d5210b862bb", "comment": "Malware payload (Smoke Loader)", "value": "ed9361717f65e2378f4787a6b36713f2e5faad7689fe05cffb479c77a0bfb7e99cbaf402e9779831c8b7ec6f4f53e4d7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676945353, "uuid": "e560a7e5-0900-4f5a-95d3-f425538a3f01", "value": "T15324D03179A0D072C4A680345471EA955EBEB8336AB0898B37F42FBE1F207E17776316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676945353, "uuid": "52c5ec41-31c1-4cea-b2e9-5e5814251072", "value": "5b5cd0be7c7d3fd97ef45ae33cdff77a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676945353, "uuid": "4ebd268e-e326-49c6-a07c-fe6b00aef12e", "value": "3072:/eghnOpyLgKbWgDnT/C7ASUgTbXxL1l1IN7ShBewNsB0/kCf3MjbLIK:pnOgLgKDnTrkLxLjqN7SrewgEkE8jbR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676945353, "uuid": "9cf2f0d1-9e16-49ec-925a-7c5167ec7c40", "value": 217088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676945353, "uuid": "a54c3db2-1770-44a6-8e7c-92f09676b9b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676945353, "uuid": "8c59a6ce-dd95-4f1d-9a0c-043d03164017", "value": "101345f206a311b2f8e5d2dbe5deaead", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1207889-b1c3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676969064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676969064, "uuid": "dba05332-5b7e-4099-8f16-15f0d7db1a1f", "comment": "Malware payload", "value": "54d32550d7f7488629721686e9482c21", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676969064, "uuid": "c8679803-60cc-4a38-8590-bff2380e5871", "comment": "Malware payload", "value": "3c3e24c01a675b3b17bee9c8f560a33c3ecca8c44442fd5b3dd8c0f4429f279b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676969064, "uuid": "e34f8c87-0996-4cda-9a73-a161b0277eff", "comment": "Malware payload", "value": "69494a7dd626cc0f50e058c51dfe049282dab0ce", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676969064, "uuid": "d9b53a74-24e1-4884-bef0-3a7f404294de", "comment": "Malware payload", "value": "de0c02ccce9acfc5cc65a69310fbda667ae605f54d3fb2951b4878619b2b9fd829453cf4c45236b32f0356e2ac8fff07", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676969064, "uuid": "6530c94b-ce08-4408-9350-30a04eac093e", "value": "T15BA423F2083D5266E3EA1C7BF203EC560BAD70EB07F003191556AB08E77691C5B6779A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676969064, "uuid": "14875843-a766-4963-a25f-678e652339c1", "value": "12288:KcqqeIuzQaPK/aQLR1hGHirmBdgWKEl1ojB/B:KcmIPaPbM1hm8CEB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676969064, "uuid": "2728709e-207a-4908-b8cd-2b3598539417", "value": 480461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676969064, "uuid": "0e68f4e1-da5c-496f-8108-1842989e6aae", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676969064, "uuid": "51887ba9-0776-4af4-b5fb-b294dd97f482", "value": "Card & Booking Details.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f070695-b224-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677010533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677010533, "uuid": "e536e74e-73d8-4ae9-b163-89968afecaf7", "comment": "Malware payload (RedLineStealer)", "value": "57f3651ea63f7796f7eb0eff0f54daaa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677010533, "uuid": "a0dc46c1-e4c7-4480-84ee-0da9965b9112", "comment": "Malware payload (RedLineStealer)", "value": "3c6237985dad9e5f18e9947df34b86cf18b20c38390b63234dad5ba2a7f081ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677010533, "uuid": "0f3b83c4-c1d8-408c-984c-a304b02f1e8d", "comment": "Malware payload (RedLineStealer)", "value": "ccbe665b8324f0453d93bf8011f0f23679eea576", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677010533, "uuid": "eceddb01-307a-4c68-98fd-375d93f3399f", "comment": "Malware payload (RedLineStealer)", "value": "f9f17aa17fc3e561fde5ba260836841ca61225584d0c8c4882d82a3b49252638fe938a47c633d954f0596e48ed0bf7ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677010533, "uuid": "293de316-cdef-4bb0-bcfb-a9a1193bfbeb", "value": "T1C6372888B79035DFC4A7C172DE981E28FB50B46F9B0B9303906706A99F2C587DF558E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677010533, "uuid": "cf1a6b1d-ec43-448a-84dc-71a80cc72f5b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677010533, "uuid": "338cc181-cea5-4c5f-8775-60c0151f1546", "value": "49152:8wZL4R2ITakQjuP0qFjDPx3tNcMF4I9ESAaQCFEAPlGdPoKI6:86Lc2WaNkzDPx3tBF4qPrPlGdPE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677010533, "uuid": "fd75d634-42c8-49aa-bf87-4b75ea0db15a", "value": 24314880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677010533, "uuid": "2fb30e64-8147-4155-8ec9-c822b13a1d8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677010533, "uuid": "c32b7700-897d-4d86-8314-051c32f64829", "value": "57f3651ea63f7796f7eb0eff0f54daaa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31cc874e-b193-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676948127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676948127, "uuid": "70228c2e-2ecc-4e3a-92e9-bae4f0ce24eb", "comment": "Malware payload (RedLineStealer)", "value": "07ab02e91231463aa1e1ea3797612e53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676948127, "uuid": "42b45e70-c099-4efe-8b17-54f9c788080e", "comment": "Malware payload (RedLineStealer)", "value": "3c7883524728e43e640e1b53d4ce65d582cf7b7c42ca2baf3371ac752ddc216d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676948127, "uuid": "e4aa90b4-3e04-492f-b5b8-efe077217f2c", "comment": "Malware payload (RedLineStealer)", "value": "fdc580cbc7a3736224bba08d83d6d034a7e1c98a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676948127, "uuid": "dddb941e-2595-4430-9561-48942fabb5b8", "comment": "Malware payload (RedLineStealer)", "value": "1f2617a3c5d048aaddee534d425b973227f02c6085bb52f012b675d3b97bdb66c69040cdc2ede621f2b3b14a0909db5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676948127, "uuid": "182629dd-7d0b-4be5-9a04-5489a6db22b1", "value": "T195647C01B6E04F85EAD81E75D1E31434CBF2E5963732F34A2F6415EA2D823A4CD8A7D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676948127, "uuid": "77c84324-6350-4ba2-a01f-11d35dbd983c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676948127, "uuid": "388d4705-f3d6-419a-875d-d0ae938b67ab", "value": "6144:XjW1Cw2dfI26znPsxXvp1uqxyxAevD2z4Er2gvgJiVIqY:XuuQ26zwpMqQL2h2w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676948127, "uuid": "9547e55d-33d0-4613-bdc2-829d18acbd89", "value": 323584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676948127, "uuid": "898de0fd-a427-4ec5-9e5d-65df704b820b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676948127, "uuid": "99093073-12d7-4882-aa20-78c42ae69a10", "value": "07ab02e91231463aa1e1ea3797612e53.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0393943e-b1d9-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1676978114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676978114, "uuid": "21c3ebef-6c32-4e20-9691-c9bc4f0bfe2b", "comment": "Malware payload (LaplasClipper)", "value": "00f4a48364a6b7dda4bf98e3847fd94c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676978114, "uuid": "eeddd411-24be-44c3-ab4c-fe803f245a32", "comment": "Malware payload (LaplasClipper)", "value": "3c931d38985be69682cb7b634d67dcb20c68218267660ceca6bcd62fd8f659ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676978114, "uuid": "099fcf0a-7add-45ea-afc2-5c7d6857ce0b", "comment": "Malware payload (LaplasClipper)", "value": "f5287134ebc11785912f8c44a3c709233a8f7fac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676978114, "uuid": "d1b79582-521f-44b4-bb98-d6fd62a07f72", "comment": "Malware payload (LaplasClipper)", "value": "541edf198aed9dc6a5d8d68cad86a0db34e3f4dab047756d948c64e19803bcb86403d2f6abb22752f9bb3d89d08a581a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676978114, "uuid": "dce69cf5-ca8b-4145-a939-d32c524534e5", "value": "T15714DF0175C1C072CC6A85B44474DAE61E7EB8F097B8859B337816BF7E303D19A7AB1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676978114, "uuid": "f5c5f394-e2d1-4c1d-84f6-72f56a8ec93c", "value": "fe3f0a4e7edd5e3383cb3beed7a6c3c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676978114, "uuid": "d59432f6-4fe0-4476-8ed8-ba5ed934aedb", "value": "3072:hvYLtNOLLnWA+ponmAk86LqhDOyIkuCXwuXKU+Ogki3W6l3ccR5t:WLtIL1+pq6LWO0XwqA135l3ccRz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676978114, "uuid": "66ce61ef-d6c1-4e99-9e35-77d88cb40be3", "value": 206336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676978114, "uuid": "21f622b8-3469-481d-a635-03f08ac348b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676978114, "uuid": "0402729e-b182-429f-b14c-c58ab55433d8", "value": "00f4a48364a6b7dda4bf98e3847fd94c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fadf14f-b1c6-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676969974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676969974, "uuid": "b442e0f2-d26a-4706-8e8f-2925dfb7e926", "comment": "Malware payload (AgentTesla)", "value": "7666650174081f5feb7cd4f012728291", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676969974, "uuid": "3eb4ad6e-eb02-4cbf-b1fe-4ae2f35f27e9", "comment": "Malware payload (AgentTesla)", "value": "3d3b0128f3bd2fd0c85b37496812b834ae8b2a9bc454eab9d04748182da5d25d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676969974, "uuid": "39197c77-fdfc-49e2-bfdf-9da22d322b0b", "comment": "Malware payload (AgentTesla)", "value": "38e28cbde2d4e9051e349f4377bc5fd4e731d551", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676969974, "uuid": "a5aa7590-0d19-4c42-81e7-97b039adb251", "comment": "Malware payload (AgentTesla)", "value": "8143ceb96386b4885fd41fe84de7583bd734185fe712a2219b6d4113ca1017c2b7f94235229edbb34bb28a1aa21b164b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676969974, "uuid": "46453363-b5d5-40a2-b101-15c3b4821e23", "value": "T1DE5412045375D1BBD1D70B350EBB998B3AB164266124B20F2F301F9A79B2790DE1FB92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676969974, "uuid": "250fb255-326c-47a4-99aa-e2a4fb56faa0", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676969974, "uuid": "b7f6505c-1b46-4fde-945e-36c8cb5f8719", "value": "6144:/Ya63y8UIO/30HWbfcotBrL74qhPzfQ4HNtrR4AijnHwW8Dml:/YVxU5/EHMfrL7DhPzfQ4B45zHwW6ml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676969974, "uuid": "3719c8e0-3786-463e-b777-e7318d0ae97b", "value": 296111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676969974, "uuid": "2cf7ba57-fd4f-4796-bf3d-98d7495e284f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676969974, "uuid": "5631fad9-8279-45c6-8db8-333192d2d21a", "value": "Shipping Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fb104d8-b211-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1677002374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677002374, "uuid": "801ba501-832b-4914-be60-a660d656db53", "comment": "Malware payload (Rhadamanthys)", "value": "6032496ec240128b1948c7d09db5973d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677002374, "uuid": "36a19a0a-a67c-4adc-9335-c65e24344ee7", "comment": "Malware payload (Rhadamanthys)", "value": "3d4a0e8acc9c3b87dc1af95e584c3b6d834c9fae3d0f7ee0ce1b2ecb49257cc5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677002374, "uuid": "0ea24f10-2488-411b-9d88-116bed6ab962", "comment": "Malware payload (Rhadamanthys)", "value": "82e040a2c392f2edb6c4431f0cb2c9f76d50b274", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677002374, "uuid": "ee63cf47-198b-49bd-8e5d-69341f9f95fb", "comment": "Malware payload (Rhadamanthys)", "value": "4f1a20c67b6f96ca9eea8ae6083c4b7d2f6cf18f595a76ccc934f2f74fec00812a12a7f533ae400bef1fe43eebd3f921", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677002374, "uuid": "fe64d692-2675-4bfd-b75c-5c317e0ade54", "value": "T14B24F1D176E1C030E4B72A365831DA605BB778232679458FFB68172E0EBC3D28979793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677002374, "uuid": "e692777b-6987-4e85-899a-e9b94745c79f", "value": "2ea63b0a2d7d284ede6e5b1ecbc1f123", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677002374, "uuid": "a163ba75-e9d1-4cc4-b25e-334ccdfafcec", "value": "6144:sZUJgDlKYySZ4EeLUWchYOvPOcXAPq4zN:sZUylKYykdWZOvLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677002374, "uuid": "99494b62-60a3-45cf-a201-91384ef84e63", "value": 216064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677002374, "uuid": "5e7a32cd-a7ed-4af9-a598-2ea1868f56b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677002374, "uuid": "d4e41339-0db1-44f1-9915-6e9a80110944", "value": "6032496ec240128b1948c7d09db5973d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b21ef67-b1e9-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676985186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985186, "uuid": "b5b479bd-89c3-48e1-a7dd-c932ad6e4121", "comment": "Malware payload (AgentTesla)", "value": "cba5bca6867e5ee3767b9ee9bd6ba54b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985186, "uuid": "4ccd9dfb-e52d-4cea-8d03-4289a7e64bac", "comment": "Malware payload (AgentTesla)", "value": "3dd86fd201a02816a323f5939b99f92cb9c5b451514b63af79b1a66b0a0c1d96", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985186, "uuid": "7a1ae563-f314-4f96-9ff8-c9eb9d0ee677", "comment": "Malware payload (AgentTesla)", "value": "f64ae440a13501c46ea868ee83c90e95ef7dc93d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985186, "uuid": "42679680-0269-4cf9-8f1f-82b87ef1b9c2", "comment": "Malware payload (AgentTesla)", "value": "d32872c3370462ac9e041935961dae31323fe1b98bab6aaba099e4c149290db976b08cc48a2c6e0ad9c4d5bfcec4d452", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985186, "uuid": "bacdba19-85a8-4c97-964a-c41df8ee6948", "value": "T1FE25BF9977B46073F8CB01FE283827CC2E3065577619E26E9B77BB9192709FB7298101", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985186, "uuid": "826d5c04-8b6b-4d3b-9b6e-76a2b706143c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985186, "uuid": "8674e57e-3c6a-4866-8baa-a530e91e11b1", "value": "24576:KXky9IISDJ+HlesWzIpNcpfP1UZvwp6L44PGHC:KLYDEpuXcwoL4OGi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676985186, "uuid": "fb27ebfb-d1a8-4753-927c-b3a29939fafe", "value": 987136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676985186, "uuid": "ea550dc1-ff0f-418e-8e99-1e2bd70e7f09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985186, "uuid": "b5c62866-6518-4304-a6ea-938e711aed39", "value": "CamScanner_IMG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be2dd918-b1dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676980145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980145, "uuid": "bb701854-bf97-4f85-b81e-5e3250e22354", "comment": "Malware payload (Loki)", "value": "6696d584aa20684b71b5511b632ae1df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980145, "uuid": "b7751357-6db7-4732-86c6-915d31cc50ac", "comment": "Malware payload (Loki)", "value": "3e2f6ec5d299c785d30e65c3f48b2697b2dec1cd476f94882aca3986962bf27a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980145, "uuid": "544f5c22-a70f-4531-bbf8-3bcab825f6a5", "comment": "Malware payload (Loki)", "value": "e8489324a62859e3e0eead861188ea4d41afcce3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980145, "uuid": "db4a0df0-50d4-449e-920a-119f5e3c4e5d", "comment": "Malware payload (Loki)", "value": "d456f5049ede62bf12c94a6660f29e1f62a3785589800ccfdca0e86ae8e10e169256c8c9b1aed3ecac62f4040490185e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980145, "uuid": "f04c68e3-2ebe-49d2-aa96-1f52e7a030d8", "value": "T1A81412087AE8A45BD993433216BA573F7FF1AA0124F9AB0F53106B1DBC76213653E352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980145, "uuid": "48c5c684-bb79-4a92-99e6-60ec2137742a", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980145, "uuid": "ec7963af-5220-4c89-9f3b-1a73a9e1e4d4", "value": "6144:/Ya6S+sHU2ANoABi1CTQZK00A+j52IPnd:/YE+XNoAk1CTQZV0AFEnd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676980145, "uuid": "83ca88e4-15c4-4e55-8344-317773a024eb", "value": 197144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676980145, "uuid": "c76111a1-2c20-4315-be0b-665447ea0f4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980145, "uuid": "51471713-fc76-417a-9602-88e65ee2eb84", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "042b987e-b1da-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676978544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676978544, "uuid": "e4345562-a251-44a7-bbce-78d9dcd87a81", "comment": "Malware payload (AgentTesla)", "value": "00e6b9e33f5c3d38f8041ee6a78fa937", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676978544, "uuid": "ae48abbf-225d-41a3-a374-f27bc8287254", "comment": "Malware payload (AgentTesla)", "value": "3edf9b88ed2c64782751cb3720be89a1b29dd8a94d6bdacdd90547f9f0898ab0", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676978544, "uuid": "6f37c1ac-81b2-4e4e-bf9d-2dd674750f89", "comment": "Malware payload (AgentTesla)", "value": "acfaf26efd4cb9d1ced308ba5c999b25aa830807", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676978544, "uuid": "aa1ab694-9f52-4f0c-be73-40876617d30f", "comment": "Malware payload (AgentTesla)", "value": "db19636070c4307d52873785f04795db0d96822f330a51298a660dea491cc0d160a6c098e67a78917b15ecaec9a610ff", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676978544, "uuid": "83f55547-1869-429a-ba88-eb3f8ab86219", "value": "T178C423821A7CCC9E981FD3E41315F69D62AE6D223DA1C1DCF60FFAD0475272528D84A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676978544, "uuid": "b01af174-cd0a-4da2-bd81-674fe310842c", "value": "12288:cDYBPS/+oc7Dx9+K7peo1Cx7sSkp8MUtiy4Pc8TcXSNfR590:UY++oQDx77R1CUp8ky4LcCN/6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676978544, "uuid": "fe9f937d-848f-4930-914b-cb3cdd4528c1", "value": 573876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676978544, "uuid": "a1fc82ca-3868-4190-bbb6-bae650d89930", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676978544, "uuid": "3d442d62-d004-4229-9d78-e28c0c81c7ca", "value": "PI160256.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38053254-b1d2-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676975195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676975195, "uuid": "4a2ce367-0e03-4616-817d-68ee6d96a46e", "comment": "Malware payload (AgentTesla)", "value": "5ad608e5fe19131953eda85c66e37e5e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676975195, "uuid": "9821a815-7afd-4c1a-8ed1-f5550933d307", "comment": "Malware payload (AgentTesla)", "value": "3ee7671cc6464b59118160bb27fe955fd2ff0f8cc74d6e07da97c27f95c9c32e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676975195, "uuid": "9365a425-3c6d-4397-95c8-29912bf379d6", "comment": "Malware payload (AgentTesla)", "value": "1578153cf9f36fdcd4d333998d66726ff59bfd96", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676975195, "uuid": "15669eda-cae1-4b81-987f-79a3295c1cd7", "comment": "Malware payload (AgentTesla)", "value": "a4b8b71c1de56d34b7f66092fe0957fa77b122163684850c16bd47d93bba47b3f059e8ef358e1c0dc674bb3487159439", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676975195, "uuid": "c9274ed4-04e8-44a7-be5e-c94d115a6e27", "value": "T19E54121022D1C975E07309B198790F96FFBCE61125D8A29F3B402E863DE17E5DE1DBA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676975195, "uuid": "edce03b2-f40b-4053-a858-047bef4bd524", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676975195, "uuid": "b9924ce7-770e-477c-8a76-0ab5ce930f1d", "value": "6144:vYa6IWByNK8PfWva1M5pW1jU+iR4dg+CvYejS8Prei2mtsHQa+H7T:vY+gycEX1EW1jUr7AqSyrP2m+waCT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676975195, "uuid": "ae12579d-e2fd-44ec-9f12-0a6d6e5e93be", "value": 297347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676975195, "uuid": "eaeef2ec-6458-4773-82bb-9ffa33ec5406", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676975195, "uuid": "8415bcd1-0542-4bff-abe7-0ec9661d105d", "value": "PRE ALERT NOTICE#207734.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db8a62d3-b1db-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1676979335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676979335, "uuid": "da515136-1d14-4234-8ac7-23180ca7b9e3", "comment": "Malware payload (njrat)", "value": "1cad7586655422fb4fc3607b5adcd7ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676979335, "uuid": "44a469da-d3c6-4eab-96e5-fb6f29671164", "comment": "Malware payload (njrat)", "value": "3f94410ca4efbf107e729773b3e560f7be39b42d8bcf9e233ee3b539b892f123", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676979335, "uuid": "01c69c85-a3bf-4aef-85a2-228a88c831ac", "comment": "Malware payload (njrat)", "value": "15242974ea5fed1d03ce5ed3b4123245e455fb28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676979335, "uuid": "f119f7e1-e148-44e2-8c62-f52bd72f3929", "comment": "Malware payload (njrat)", "value": "075584f17baa9777dc2d46ec0b1480b4cbe81a920829fcfbbc5ca5f776700810126c1f97a05149dbcc7b4486ab73a691", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676979335, "uuid": "2956fea6-2653-41cb-8b07-ff77f29f050a", "value": "T1D913C64DB694E174D5FF8BF0B4A2B2890B71A01BA902D30F99F154D94BB3EC09611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676979335, "uuid": "2495a6db-2838-4cc8-8b5c-737a643e19a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676979335, "uuid": "52d09691-8248-4f81-9781-6f2d2c0ada4f", "value": "384:XZy0pOydsbhKIyKhx7ZAe4EWLr2z8Iij+ZsNO3PlpJKkkjh/TzF7pWn3/greT0pu:pHNiwFKj7ZX+EuXQ/o6/+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676979335, "uuid": "3fc32596-9b77-4592-9af2-cd274aa57ee6", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676979335, "uuid": "9ca02cc4-e639-4a63-9931-0e3b820074b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676979335, "uuid": "b3a497d5-9bbb-4977-8724-9ab318506db8", "value": "1cad7586655422fb4fc3607b5adcd7ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a64a2f2e-b207-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1676998144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676998144, "uuid": "82c82f83-1790-41ae-b0ef-6a5df67fe777", "comment": "Malware payload (RemcosRAT)", "value": "269a507240127094fb6d637ee7605995", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676998144, "uuid": "f8051834-60c8-4d90-9cbd-9588ff06648a", "comment": "Malware payload (RemcosRAT)", "value": "42ae178b10fcc2f9cb62490f59bcdbaaa636cc18a269d2a4a1f9a524dce39010", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676998144, "uuid": "99a3c91d-40f6-4b04-87e1-1716305094cc", "comment": "Malware payload (RemcosRAT)", "value": "d7af4aacf2aaada625a20b6900a01312ca858791", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676998144, "uuid": "973950cc-17d5-4dfa-bc94-bafbea3f2868", "comment": "Malware payload (RemcosRAT)", "value": "6b3b56a69aae437bc061a39d2aac94978c039037baa6facb50a659e8bfbe8eb8a86021c875bb464ddcb01e07218b32fe", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676998144, "uuid": "9d7bd2ce-090b-4ca9-84cc-19d8e322e192", "value": "T11DB423599731771E18F1ABD049BA978F8363551FC11830EA3E136EEBAB62C57C712A0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676998144, "uuid": "a565da14-0b36-415f-a03d-67541f9082ac", "value": "6144:qH+ZTwc1sveTuacWtk2JZYqNdBAP66T21MKsDHciIUeKM/G0ifpfe/TWLziM2HEA:s+lhiaJKqdi66Tmey/GlUTXE4KQlzD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676998144, "uuid": "69c1e444-1d4f-4e1e-96ab-b4acc132b71d", "value": 494824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676998144, "uuid": "1143d2c6-1c39-4bb6-8159-174004734a0b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676998144, "uuid": "3a257c10-aec0-4474-a48b-074a8fbfee6e", "value": "hesaphareketi-01.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ded1268d-b1d0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676974616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676974616, "uuid": "8c7dd248-2820-4fa5-9dbe-7f827fd57579", "comment": "Malware payload", "value": "29c72ab2e14540042deaad75996bdb87", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676974616, "uuid": "9e7e1f45-00fd-413f-8405-59a24cb138ac", "comment": "Malware payload", "value": "42f27146c75b4a36cbcd50d12ddfb2302165aa3ec592a7f2bfd00ff93f342bf8", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676974616, "uuid": "2e6af42e-1fbb-48d1-b128-d0621fba4160", "comment": "Malware payload", "value": "a2f1e3a86dfb1a2f272e63c7e8fc384cfa5b0446", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676974616, "uuid": "dcf867ed-a11b-4a86-a24b-5e8faf07d380", "comment": "Malware payload", "value": "64852ec270979509087192fead8404d3364b125466de98a43a03e517559acb7649cf3ed3a4a0f0dc3ba3464885bb856d", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676974616, "uuid": "0727c45f-7104-431a-979d-2b6efa15257a", "value": "T192F3EECF28826384D596AE6623274BEC0BBEA6B1D08470F5E16DD5F2B8433D587C57B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676974616, "uuid": "b1f70694-2265-48e4-9d3a-847e451faf04", "value": "1536:pRbGHh8z0QeNiTGpLYZNu30hbRLsPURbGJ1BcmJEaKmj7zCDTYZBESX7lRgy7EH1:G4pi5PqfyxdQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676974616, "uuid": "6b80fd55-a6ad-4aa5-8fff-b54d3edafca2", "value": 166276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676974616, "uuid": "eb4f39ce-8bf7-4c5c-8c7a-8c045877d07d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676974616, "uuid": "befb4aa5-d30c-479f-aa2a-a74c3e4efe83", "value": "curriculum_vitae-copie.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95db5e98-b1fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1676992533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676992533, "uuid": "cfdb3950-70d1-4951-8521-d16a84ce4b7d", "comment": "Malware payload (DCRat)", "value": "4e1f7fca4c3a6a010f9907a895de89bf", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676992533, "uuid": "2967c8d0-54f0-4fca-9348-0be524915277", "comment": "Malware payload (DCRat)", "value": "43adbc9dea3dca81385da1bc763a6b9fe10c2c8ebced731d451932877857bd2a", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676992533, "uuid": "8a60a300-5b81-4b90-8b6b-86bcdab31e82", "comment": "Malware payload (DCRat)", "value": "4fa2e0cdd281d5ea2c9918337c238a38d65d8c61", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676992533, "uuid": "7ba79594-c111-42ab-8bb0-aad241c79ff8", "comment": "Malware payload (DCRat)", "value": "000c39f8c6d54b2ef8b905c4aa0f502c47a5f6d347e9fdf38f8d81b1b00acde202d2769e63e3bb30cd38e9eebbeb1fa4", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676992533, "uuid": "70349087-4817-44ea-9c87-e575e06cdedf", "value": "T1CD353A017E45CA11F4085633C2EF854847B1A9516AE6F32B7DBE376D96223A73C0E9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676992533, "uuid": "ad028654-b968-4661-8c95-90d70e7af007", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676992533, "uuid": "5f02eec1-0f49-42c2-a8a7-f0c7bcdd3377", "value": "12288:VKC/IrjF1KuMFStXt7oPgMHbotUfl6NsN5knCDbnZ3KdhmfU3AZ6cGfxIxj9w8Dt:gj/KuMWo4MHMJHCIdhmMQZ6c8swGt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676992533, "uuid": "6b290666-7113-4472-b50c-b7db3213524c", "value": 1128448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676992533, "uuid": "9618dc4c-902f-42fd-9652-d9b6c3f11b57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676992533, "uuid": "a5c2fd95-4276-4031-8a69-5bd539a650ad", "value": "4e1f7fca4c3a6a010f9907a895de89bf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4abcdbf7-b1ca-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676971791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676971791, "uuid": "8c2f02f3-8d70-44ee-9fb7-481488d611cd", "comment": "Malware payload", "value": "4b19b4b92853baa8284596ff1862d8ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676971791, "uuid": "db9eb6ec-4f70-4189-962d-065d31bf6484", "comment": "Malware payload", "value": "44019fac65e004db67c647aa8c7a63d61d0bd185d7fb1ea48cf2c14b67333707", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676971791, "uuid": "66291e4c-432a-42db-94cb-512c101c2862", "comment": "Malware payload", "value": "f122c375df6f77dd4a11ef8ab7c0b26e77f457f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676971791, "uuid": "7176edf0-2e65-43ce-91d1-47024478da79", "comment": "Malware payload", "value": "288ddb5dd6d29d67bfb989e8db147883349c2bb6271891b6e02be636f89428c23850b27210bc2a703b5e16d9a3cc12e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676971791, "uuid": "4d40612b-e57b-45b2-8532-bec4c87eda1b", "value": "T12C462843F85445E4C1BED1308A359322BA713C855B3063D77F60F6B92BB2BD86A7A394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676971791, "uuid": "7886b472-331b-407d-8c14-981d8d6e0227", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676971791, "uuid": "206025ad-eb68-4895-9538-a32525e2219e", "value": "49152:uMuAzMaCj7t0z9jjRpSUKIYjhiWGGTzmOZQLcjjOtdjwY1HAl5E6AlMzHV7EAf/m:uV7bGjDOOwEDMB7xfbgDqS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676971791, "uuid": "9a11894e-b06d-475b-aa57-0171488b536b", "value": 5844480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676971791, "uuid": "36c12ea1-0167-4fc5-9e3d-b1c8d98aefe6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676971791, "uuid": "0711fec0-8682-4eb6-9594-c8e69964efb7", "value": "SecuriteInfo.com.Trojan.GenericKD.65537617.16965.5294", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b5724b9-b1ed-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676986771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676986771, "uuid": "0ca65c0b-3342-43ae-947b-460a65f0ecc1", "comment": "Malware payload", "value": "9ccde48d9e4af73012f22a8741a274d6", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676986771, "uuid": "5dc1bea1-5fca-4df4-a514-011f93302243", "comment": "Malware payload", "value": "453f9ddf681939e4e0427dbfcf710385d860d03c7cedec09db53569161e73a33", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676986771, "uuid": "a39da80b-8a39-410f-9e25-16419e04ab81", "comment": "Malware payload", "value": "25d5f3bd79abe51fd6575a3df8d1833173a59ac2", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676986771, "uuid": "baf7d203-96bc-450c-9438-01ca66854989", "comment": "Malware payload", "value": "9aa9dad706aa90d4099ef4bd4abdd5ca9904e0ad741efac17d77bdca3182e1c389295fba2a98597ddd84ac13b15109be", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676986771, "uuid": "3dc3a4a3-29ab-451e-879f-6b484e25c9a9", "value": "T11223B05AE78F02A88F511277531B0A8996BDB33EB35455B134AC933433EDC3D0666ABC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676986771, "uuid": "db8abdbf-dd6c-4024-8101-b7e53d66093d", "value": "768:XbFx0XaIsnPRIa4fwJMcYU3CYzPJ+KMxQn47tJVlrLxEjVgqVJ:Xbf0Xvx3EMcJ3D47tJ7VEjVgqVJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676986771, "uuid": "b5cea95e-4fd5-463f-b196-768f5c9b6da7", "value": 48136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676986771, "uuid": "162512f2-8739-4da7-b709-f6ce27038401", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676986771, "uuid": "9d65d9aa-fc60-4fd2-9648-5b13fa714d30", "value": "Order_Confirma_doc.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "719245e1-b1ae-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1676959830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676959830, "uuid": "cd152404-5009-47ab-ad58-5bac9bdcb1a7", "comment": "Malware payload (Gh0stRAT)", "value": "038c409ccf72458931e0fdade6b3256d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676959830, "uuid": "a7dff852-7407-49e3-9422-939e0c3464a9", "comment": "Malware payload (Gh0stRAT)", "value": "45827fa3c271acc4de2ec05ee95079341ba6f414e5c9e6a9e90526feb412e402", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676959830, "uuid": "8842d677-f89f-4a0b-b081-ba5d474f4210", "comment": "Malware payload (Gh0stRAT)", "value": "fd876e85548af7f3f7682d0fb79bf8e1b1bd37f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676959830, "uuid": "7d9f9610-d87b-4d6f-91d9-ee9f0edf439b", "comment": "Malware payload (Gh0stRAT)", "value": "acb714226175562d0ddacfc0991051b677cef22f0dfa88cb18b4e4b93b92d8d54e79a049300d27277b39b658c0d0ce36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676959830, "uuid": "54da345c-1fa1-495d-8cd1-f2a740c07eaf", "value": "T1FAA4E10623D454A9E359B2BDC08397D041294F437F69AAD76F70325B2EB22DCBC31E5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676959830, "uuid": "472b372c-0865-4b37-9d29-85a855d7d2d9", "value": "e58ab46f2a279ded0846d81bf0fa21f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676959830, "uuid": "23d5d780-0c76-4265-9c05-b33d56f86448", "value": "12288:mqcVMrUmuImVHYmMf6U7p05Hux7xGTjCbqWd+YcMU:mqcSrXuI0pMf62p05OxdU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676959830, "uuid": "4240b343-38a9-4c66-858e-7dd64956ca0f", "value": 460288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676959830, "uuid": "beb035b6-dbe4-4299-950a-d7c848bd6b2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676959830, "uuid": "7d674024-752a-404e-b2aa-bb323e4219a4", "value": "038c409ccf72458931e0fdade6b3256d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf4a7af8-b1dd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676980174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980174, "uuid": "9cf3ee9a-e08c-4081-a810-1f7b05495eec", "comment": "Malware payload", "value": "ffae9d3dd55cdb9bb47aa553d05d458b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980174, "uuid": "b21ca69f-63a7-4f28-ae94-47ef070029aa", "comment": "Malware payload", "value": "4689a7fee8a2d671659d2f8c68d9bd8d1d734867654abb88f059defc5beb9b63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980174, "uuid": "20ecb713-aad7-4e59-bc07-dc6c82df64d0", "comment": "Malware payload", "value": "e43439834646330d3f3dc1f142acead1e7ac6f24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980174, "uuid": "278f89ee-ee79-4967-a788-76e7ff6cb573", "comment": "Malware payload", "value": "9a74127d7225c05ff1a166206170a6a9a8be759530556278839565da92164da7915186d75f68d6f8cb8fc5d41167749a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980174, "uuid": "c58f3220-7cde-4b17-9a33-631d981cf6a9", "value": "T1C295BE017E50CA51F0181633C3FF4A0857B4AD506AAAE71B7EBA37AD55123937D2CACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980174, "uuid": "78e93a3d-8246-4ba5-8fcd-35faec710df1", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980174, "uuid": "90cede21-68fa-4289-94fc-b8d29fe0c524", "value": "49152:ubA3jqYHNVf0jxYiwmy+FsT2vB+098DeDt7:ubrSfwGiwH+UYBt9bt7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676980174, "uuid": "7f596f5c-beb8-4d1b-9047-efb424f14d02", "value": 2032782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676980174, "uuid": "9a85a7aa-590f-4dc5-9e0c-883c38d246ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980174, "uuid": "a8401ccf-07db-49db-aadb-6c6f52190855", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4d6879d-b1f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676989229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989229, "uuid": "b24a783b-2f4e-4cb6-8a55-e8ba495b3d32", "comment": "Malware payload (AgentTesla)", "value": "a748695a2d9079570fcd80ab14e2fc1c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989229, "uuid": "791e5a85-2dd9-4dc2-92c5-ce3aeae8c6c5", "comment": "Malware payload (AgentTesla)", "value": "4716f5a7d91fdb1c91bd3c3aaf4b776af86eb218a50efc55bd5ea2085f6f658f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989229, "uuid": "21cd6f2d-ce59-461e-8f04-99bf87d7ba09", "comment": "Malware payload (AgentTesla)", "value": "b3f4d809f73b91583b1092cbf2a4e6f42bb24d64", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989229, "uuid": "b7a53f47-dd58-4ce1-ac9f-d64598982ff7", "comment": "Malware payload (AgentTesla)", "value": "15c87fff0135c2de437a3282fc13286d6e64904d2f87ef2cd36902fb9b15c04063516d2a5029d8c9783dc83d4b64cf3c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989229, "uuid": "73d26506-c659-406b-a0b6-a43c63a16c21", "value": "T11D54126C79E4C1CBC0A34A3147396BAA5EA9E1166473978F2330974D7E35250F90F72B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989229, "uuid": "c390d1ee-b36e-4a9e-a98e-e29e8a3e0b53", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989229, "uuid": "d7a82d3c-86c7-40c2-b216-670c21fb068b", "value": "6144:/Ya6kk1Kj0Ko8nzHOyrEJzs+/XK5yCbXAWmyOmFUJJIc1UOOq1+Al:/YSkMznnvgVtYhbXmyMJJYO3P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676989229, "uuid": "82a60727-8a57-4377-8b4e-4c12e64c5ea2", "value": 294704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676989229, "uuid": "ffbb419f-faba-44e9-bdc9-cd0505c961ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989229, "uuid": "5f115824-3058-4232-8b5d-fc739c4a669c", "value": "TSL Company RFQ PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cb87051-b1f0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676988035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988035, "uuid": "cd1d63c8-6e49-47bf-850e-b8142a5fd7d6", "comment": "Malware payload", "value": "c3d68efcbac9af5dd3062bd3e4578bb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988035, "uuid": "b6ddf463-00dc-4bfe-a2ad-baa6a2b8ab2c", "comment": "Malware payload", "value": "47ba891d8f441fd58c50dd9d1ed4863ee8a4adae9543d8b7f426c4510bc651eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988035, "uuid": "feb13ace-63b8-4c53-a83d-39aff977ebc5", "comment": "Malware payload", "value": "928521662d4ace097b2815cf1495a9fe6da6971c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988035, "uuid": "0342d1fa-9507-49ba-a606-1952404ea6b0", "comment": "Malware payload", "value": "277218ed54ff16b00a03c5d6e04c7b1e0b8863ff9f80bb99136af9840e15ec7ad4cb38ea922b8e9feaa0bfc0e1c607ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988035, "uuid": "0544cbe7-7ee5-466a-8008-6898d0792d60", "value": "T1CB45E09C3250B5DFCA5BCE72D9A80C60EB60647B430BD207A09712ADA91E797DF152F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988035, "uuid": "c6c69394-0949-46b5-8490-dc29aae648ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988035, "uuid": "268713f9-2a31-4388-9de1-bfdc8ce05e4e", "value": "24576:S1KFme1QwurYE7cB0iPd0mUI/n6/6eX3XqiONjnFzv0zABcd:ZnxpEYG61x/6/VqiOBFzjB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676988035, "uuid": "a84add19-ec03-4070-9646-349e555b6ad4", "value": 1280000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676988035, "uuid": "9d2dd2a6-75ba-4c83-99ed-384575778f92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988035, "uuid": "cfbef27c-d956-44f2-8a00-7867af4144fa", "value": "DATASHEET.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32112df2-b227-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677011693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677011693, "uuid": "39dcf1cc-13db-4a2f-b9d8-a9b83bc8503f", "comment": "Malware payload", "value": "73cb9d740d86a8549528ef420912b6e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677011693, "uuid": "fcd06098-8da8-4ba5-a944-65542ce4e8e2", "comment": "Malware payload", "value": "486edade746d5b684a16c06280d15f60b0f633246c6af839947d8226a3f9d5db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677011693, "uuid": "774a1dab-143a-438f-9cb1-0afeacacd978", "comment": "Malware payload", "value": "3d6f89f760ecbd51eda4a3fb85e2ea81d0b684ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677011693, "uuid": "e00e2564-9567-483c-8d56-787080e04ea4", "comment": "Malware payload", "value": "5c5f1519c760958918c2cdeef37f1205d9cf4b0e1f8805a4aad1e5a0fb246366a2ff65aea98414ce6d7fbb3a8140630e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677011693, "uuid": "c330bd2a-68f4-4765-b4eb-3bce3a8c3ede", "value": "T139435B1237A1C03AD4A302345D74C6520B7F7EA29EB4C2473BE41B5E5F721D6AB293A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677011693, "uuid": "8d26fed1-64ee-462f-8e1a-e076a6068721", "value": "e660360e9b49d39062886798924e4f6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677011693, "uuid": "ae65de1b-fdb6-41d5-b267-a53427567eda", "value": "768:5HahwAwLz1dXmpCL6eTdG5eVP5ubYAOEjYMNWZDiSrr2INKoWTB6Y/famem:5Ht1GW6eTd2eV5kFmdoqme", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677011693, "uuid": "3a2f233f-a8c5-4479-8234-0430694fe6ea", "value": 55808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677011693, "uuid": "f4656615-39b8-480d-a3e5-d2b1da911c80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677011693, "uuid": "a4e26397-6112-4048-af57-4a1cb663abe3", "value": "SecuriteInfo.com.Trojan.Agent.GCZO.25632.13537", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf931c9e-b237-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677018802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677018802, "uuid": "4bf92ec2-ce6a-4972-af5a-5fb0a0404d8c", "comment": "Malware payload (AgentTesla)", "value": "a51cf93e2c3b4efb645f1513bbbd939f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677018802, "uuid": "6d514925-00c5-4618-abf3-d935956156c2", "comment": "Malware payload (AgentTesla)", "value": "4912fc7f7dcb3e0a72ab0b4f47db02e2defd6ea6f6e104eaabc01c29503f36f1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677018802, "uuid": "cd7bf73a-e86a-4c7f-a418-81db93091cfe", "comment": "Malware payload (AgentTesla)", "value": "bdc8c6546d8618278b0422fc944d237404312141", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677018802, "uuid": "546a3a77-1eb4-4d8c-906b-aaa3f9b930ca", "comment": "Malware payload (AgentTesla)", "value": "5701ee69eb6c67127125eff3e814a9a096308c6b845b5a50aab02f5c17bc60a573fa3b93031cd7542da7a8cc333aea35", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677018802, "uuid": "29bf3751-e38b-43b7-b392-6dbb84f3336f", "value": "T15F0523A8A20A56CFFD5385BA5D9EDD0179701E8437398980CAFD8A192C97C7337D0E38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677018802, "uuid": "4189cd96-e20a-47cc-81a7-2d1d87629645", "value": "24576:QeWWR9S7F7XQBJ6xhDiOxW0qvGXEyEUkB:7WA9Sx7XQXCGOW0VEyET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677018802, "uuid": "c2264621-b26b-4fea-8323-8f02478791c3", "value": 851993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677018802, "uuid": "3aa483a6-d303-4d88-99d7-c913c1b3194a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677018802, "uuid": "37989957-2317-49cb-94dc-62580be2612e", "value": "9046- PA118- SUPPLY & INSTALLATION OF EQUIPMENTS OILFIELD EQUIPMENTS & SUPPLY.pdf.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f15e6120-b18a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676944583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676944583, "uuid": "cf066aa5-82ce-47df-bb07-b7d184972150", "comment": "Malware payload", "value": "7f0eab3d9fd28cd740117aea8090684d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676944583, "uuid": "9c27bc1a-2bf3-4a47-ae02-2a1bc60f270a", "comment": "Malware payload", "value": "4a65ce15a43524285f05b2d2720603c491cf16bd9b23daa0e8d280a0af51ad81", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676944583, "uuid": "3df1114e-6509-4232-b445-742877f48894", "comment": "Malware payload", "value": "9113d8a97832d62af6d7acdb50143937a73c2882", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676944583, "uuid": "30585364-8b06-43fc-8a9d-af24232e2575", "comment": "Malware payload", "value": "0bad0f57587a60ef3e2a13fc71fc89d8bf45545627c0e48c9d7653f229e95a4346c0c0be26546e958a6a17d0b31e3969", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676944583, "uuid": "66d18bec-9910-414e-a9d6-8d676ffd916b", "value": "T12A24AF11F681C073E0B2043114E4DBBD9A7EB9300B6558DFA3986F7DAE216D1A339B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676944583, "uuid": "6f9023ad-0f38-42c6-9558-d25413050d4e", "value": "1f08e787dd8a37d7ed70b045bf88000a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676944583, "uuid": "eeea572c-bd61-49f6-a60c-2a831b010407", "value": "6144:dRjBa8WbdzkSVKSQyT73LJbXdTBQcZENzfA2i:dPaN5YSVrQydDdTqcGN82i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676944583, "uuid": "428ec4e9-eee9-456b-9f4f-bb5cfb7d7e06", "value": 225280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676944583, "uuid": "af2bf93f-b50a-4c4a-8fc9-b47e07d9bf33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676944583, "uuid": "870ae065-cdcc-41cb-b560-b93404269422", "value": "7f0eab3d9fd28cd740117aea8090684d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f3ec4d5-b18e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676946136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676946136, "uuid": "b51c207c-e0f4-4425-8d8e-5811555d2130", "comment": "Malware payload (Mirai)", "value": "ff3ee80b757b3eefc3cfe64fbc31d9d9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676946136, "uuid": "56235dd7-3468-4a9d-9de8-41edfe1b337d", "comment": "Malware payload (Mirai)", "value": "4b10cd0479ec31c6f8dae377976329ce48a01c824979ec6a37ab2d6e6857c647", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676946136, "uuid": "ca1995c0-fc89-431f-b86e-092cf2b02521", "comment": "Malware payload (Mirai)", "value": "0c32c7d914e0db352f3f41bff8e0e25c00d23967", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676946136, "uuid": "78c3a34a-7c05-47a4-b007-ad725983bcbc", "comment": "Malware payload (Mirai)", "value": "b192067020900a8cdad6474678f781445dea29e154e7daa852ba1ae8ac8c14147745ca8a6b8b93c778c841ed1a6bbada", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676946136, "uuid": "b4e039f9-d27d-437f-92af-4e44d0cc6800", "value": "T10BC34C46EA818B13C4D51776BAEF42453333A754D3DB330689285FB43F86BAE4E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676946136, "uuid": "494e3cae-90dd-405e-8460-bbe64362cc75", "value": "3072:ya+vd4QU0FPLtn8BPPYtkeiWlP7Hf6M/9RU7:ya+jUSTtn8BPwCeHl7HyM/9RU7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676946136, "uuid": "68ceff07-cbce-4b5c-bbda-17d73776df51", "value": 127275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676946136, "uuid": "cbf8badc-4675-4066-9dde-b62da3c47c3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676946136, "uuid": "ed0d04a8-08f1-4b87-b7c9-b5cdc0c4f642", "value": "ff3ee80b757b3eefc3cfe64fbc31d9d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8826dcc-b1c5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676969908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676969908, "uuid": "bdec1912-e084-413d-944d-aa0f27772262", "comment": "Malware payload (AgentTesla)", "value": "a095171ddc4c7ddbfae69ef010ddf759", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676969908, "uuid": "6c6a7c97-3f85-4860-888e-92e17883d874", "comment": "Malware payload (AgentTesla)", "value": "4bf77771dd244cda6ae4d11273ab10ca8757634e0f98c65d900b85db7ec3c4c5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676969908, "uuid": "8e1abea2-102f-4f05-a46c-a8397fbb025a", "comment": "Malware payload (AgentTesla)", "value": "1cae429bd286631b4e692c2676b5cdc49e815ba2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676969908, "uuid": "83829c47-29c7-451f-b416-97ffce842487", "comment": "Malware payload (AgentTesla)", "value": "87cad8724ece1984368888bc708d7b7ef8280f9cb0177282d8e76041136920db674c7dcb881d0a0f1d4b10cee31e627e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676969908, "uuid": "aaccb708-4c8c-42b0-87b9-784b010ef30c", "value": "T1935412F501DE298E0BA38731D7E0495233E58F0AB70A6738EC8453766D7AE4577A284F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676969908, "uuid": "f8fa7cf9-2d08-4c44-8d0a-f19a59ce2619", "value": "6144:BStrYOqsPGa8x6u958iq7M65jnmH7Tq/I3P2CxE:strYOqsPn6n8vmbTqA/2EE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676969908, "uuid": "2c0bd5aa-370b-4eb6-8615-26f621ef8e8c", "value": 281677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676969908, "uuid": "be4f0bc5-9c0f-4bbc-b323-4f6cd212f857", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676969908, "uuid": "13392657-3d1a-4790-9186-327913e2a392", "value": "shipping documents.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ec812d3-b20a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676999420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676999420, "uuid": "90407aa7-4470-4916-86d8-2b6aa4ca77e9", "comment": "Malware payload", "value": "b3da2fc5508648ebb60154f77c610007", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676999420, "uuid": "8f32d4b4-1c9d-44af-9495-235a5a240e48", "comment": "Malware payload", "value": "4cd7f58cabdb46b77c71edfaf0e17f6258f0228c0c85d77dc6413b22dfeb763e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676999420, "uuid": "ce4cc3f5-bb84-4078-aa98-ad89e7897d2c", "comment": "Malware payload", "value": "895e0215c51d4e1d8ba82015c8c646c49d0512ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676999420, "uuid": "b6bf892a-0013-47dc-9edd-3267d21b649a", "comment": "Malware payload", "value": "c860af5dbf45c5a670bdab58ebda9ca655f7bb16c62a845697fcae5c1000ec1bf64fb0a3e8808e0eb49da7ec6934e8d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676999420, "uuid": "22615dc9-aedd-4f29-ad16-7441e66aeb64", "value": "T175C402993A95C93FCAD35A71A662BA1F4A7E5D3826215B0337D87F0D3F3E4C0894D221", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676999420, "uuid": "1f0f344c-0bdf-4732-ac4c-321d61efd507", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676999420, "uuid": "c9fd6e85-993c-474e-a6fb-3f1cc3f46f3f", "value": "12288:K7YaMPI+XCGs+I5YxXK7BeIL3+zM6K3Gu3Yj1+exH2:1mys+fN0BFRzWuM1rN2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676999420, "uuid": "efddd7a9-bfd8-4e6d-ab87-c370aaf500a5", "value": 560346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676999420, "uuid": "f012a525-4d12-4328-89cd-aefff132e5e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676999420, "uuid": "a50004aa-57b8-4e9c-a166-42fa8bdf48c1", "value": "1082300000832.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "161c8f26-b1bc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676965690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676965690, "uuid": "9e51b5b7-39aa-4bfd-9a40-0cae37bf7440", "comment": "Malware payload", "value": "bb305858814d868425bd5d85e202991b", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676965690, "uuid": "1d9ad3af-15c6-4f05-b799-5d94e54d033a", "comment": "Malware payload", "value": "4da95ef6e49749b7b925c11ad25822791179a009f87ff46b3507322c0bff086a", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676965690, "uuid": "7f951ccc-860d-4d52-b99f-ef26e61cdfc6", "comment": "Malware payload", "value": "4c152743525f39a16e56f9bd15e8a0924044355d", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676965690, "uuid": "3b4927f6-a089-444a-81f5-248f98ad509c", "comment": "Malware payload", "value": "d551c23bac70aba45be3856fa670371a0ad2ddda0dec86fc9c02387b4657910248b9d10f4decc863d3ae3fafba36b896", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676965690, "uuid": "74f80200-2e0c-4b4a-bb4b-7a5878281bd0", "value": "T1F182A8565B8C4C61E26AE8BB479DA00E187CF12634D215C4BDADE3743B7D10E0B6B6F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676965690, "uuid": "a13e1128-8cf4-4616-8699-8670a4591b00", "value": "384:iCANLIAcU/JWDB4XpJiDdGcfgfJiEALyc+/QlfQlPeh/CxP2VnOZckMG1Y:iCgLTcbB4biQALy+AGh/CUnO2p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676965690, "uuid": "ec7e24c0-8661-4976-832e-db4a2b7471d1", "value": 17986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676965690, "uuid": "71f732b4-3e2d-40fb-9b0e-5fa750a91811", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676965690, "uuid": "eb0fe797-a381-45f4-8667-883fb1e79ce7", "value": "bb305858814d868425bd5d85e202991b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c9fe95f-b1f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676988920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988920, "uuid": "ec934211-832f-4da4-908a-5d2b3b81a6fe", "comment": "Malware payload (SnakeKeylogger)", "value": "93780eae56d0a5f244a24b78e6ce3199", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988920, "uuid": "25d38725-96ad-43e1-94ba-452b7af8e62e", "comment": "Malware payload (SnakeKeylogger)", "value": "4db11ec2fd47da3b2453479ada853755d43fa81142e235914a424733418b3ea0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988920, "uuid": "1c6eceeb-5b78-48f9-9c7d-a91e6601b128", "comment": "Malware payload (SnakeKeylogger)", "value": "9aeba7dde54b2ce9a338971a742ae871f77a84b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988920, "uuid": "a0a14ae4-739d-4753-a8a3-ff1f05450da3", "comment": "Malware payload (SnakeKeylogger)", "value": "679e86ed6a0c92b8222c4c9eb40a6dd96ab01ad0afb4cbbeb02f6105302270e738dae1bd988fb1184ba7d9ece473f3f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988920, "uuid": "2785561a-8bb8-4242-be09-782f94625e4e", "value": "T14615AE8977B46073F4CB01FE5838278C2E2076577509E26F9B77BB91A2709FB7299102", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988920, "uuid": "52bc9da2-77e7-45ca-9a6f-f4d93db99187", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988920, "uuid": "9031aa78-4b05-4381-a47f-edbae7eb311c", "value": "24576:hky9IISaJ+HlOIwJ7ZVvYMTuvgzeSrLYlbe+4Y:0EJrlO0eI6q+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676988920, "uuid": "2e076495-0412-493a-a392-f65a518f21f0", "value": 949248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676988920, "uuid": "277deb72-2770-423e-a12d-80dcd0abde0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988920, "uuid": "01f694f3-e805-41ca-aa47-d0d7f3d96c31", "value": "arinzezx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f9ed061-b1f0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676988174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988174, "uuid": "6c1dd769-d8e2-4ed1-8b27-4ddaba5860c6", "comment": "Malware payload (Formbook)", "value": "0b68925d5097cb0f4e5cbd560d3e4648", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988174, "uuid": "c9a66998-dfeb-431d-a240-c9b263946c9b", "comment": "Malware payload (Formbook)", "value": "4e11fcc1a1b57eda0d4a01087856ab72ea159ec8ad1f8430c0db94fb250c65e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988174, "uuid": "c6bf5e9a-a1ac-4324-b30a-44d0c63c41d6", "comment": "Malware payload (Formbook)", "value": "5b5e9f6a110aac8bd5e38e20d321425b44a65590", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988174, "uuid": "9d8764ee-5b5a-4d71-be47-731178602c68", "comment": "Malware payload (Formbook)", "value": "96ac26776665cf85271b1d3e80b9333c8f5583e04e02b572f4e7a94246f531d9edc00893ce1e9c37a654834b2e215368", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988174, "uuid": "7d7810cb-ca33-4d84-aff3-312988ffc666", "value": "T13B5412283790C162F5E20A302E7AE6FD5AA5AE16DD74570B3BE43F9FBE36041C809751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988174, "uuid": "c2c2b54d-a145-496e-88f6-4539f47df3d6", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988174, "uuid": "93305e2e-c07c-4f4d-a207-43d243393c9c", "value": "6144:AYa6qZSJJqGQ1Qg4mPJNKhfGcuc0YSe881XRsWv:AYcZaJq1FPJpc0Yd881XRf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676988174, "uuid": "ee3fd4df-0a5d-4ddc-9ef9-1c366f100ff6", "value": 292641, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676988174, "uuid": "13cfe049-c34d-46b9-9864-0268fc276e5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988174, "uuid": "1f4012a3-1a77-4d9d-bf4d-28db02ab7344", "value": "bobogint2.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "085972fd-b1da-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676978551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676978551, "uuid": "0ad53130-0fbc-4407-8d6f-2c3960fd37a4", "comment": "Malware payload (AgentTesla)", "value": "4bce0bd7bc18a9e5191c5ce0d57b7107", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676978551, "uuid": "3ab42a31-6e32-47f6-8f79-0bf086f26c8c", "comment": "Malware payload (AgentTesla)", "value": "53025972b0c9068ecf36dcb51a0ee76f14c386f58d87603b57943832224b72b3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676978551, "uuid": "7a174820-0aed-4afd-be04-3f7302f920bf", "comment": "Malware payload (AgentTesla)", "value": "42562572625b9cd969f491ce69266d55c7d9a22e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676978551, "uuid": "4a2d8769-48c3-4b59-bd7c-4743e1c14aec", "comment": "Malware payload (AgentTesla)", "value": "122d772ae25594dd0e27ae49648b33b1444c5702e1d135e9686e926c03e891137b72ecebfc4ae1f9d49b24972b5434cf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676978551, "uuid": "5f2e6e67-cfa9-4f04-8534-0d3d5902efd4", "value": "T128F4F53D39B796D2C239FA3386E3E520B6BD81923303D959D9D61AC04F426427DCEA5C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676978551, "uuid": "3ffc1973-398b-4a03-9594-27b946cefea3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676978551, "uuid": "e3ed8e8d-1e49-440a-81e1-8116ddedbbad", "value": "12288:yfdAIkegET9jsIBMNjnNNOhAe/S0ftrS/+IclDZ/+07xYw1CP7KSs58b3L2j7ZFp:+d3TsIBMNjnNNOhAe/S0i+IUDZL7V1CG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676978551, "uuid": "f3e64674-2ace-4571-8807-9ef414a42772", "value": 779264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676978551, "uuid": "d01ca345-e2ab-4adb-8c18-c8b0bfe1dc77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676978551, "uuid": "0a7fa649-49f7-49a2-b395-03b6826d963c", "value": "PI160256.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc729fef-b1f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676989215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989215, "uuid": "2ce2edca-5e3b-4361-8f2d-7c0279daabb4", "comment": "Malware payload (Smoke Loader)", "value": "266a70b8ea91e3dc494065843fd11fd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989215, "uuid": "901a2673-868a-4f17-8723-18e20dde1fdf", "comment": "Malware payload (Smoke Loader)", "value": "532984d78ab1ddfe2d4d9fd8e085eea19931f6893577bbb93977cb9ffbf836a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989215, "uuid": "47412f94-a43a-4a38-8160-174f04e052f8", "comment": "Malware payload (Smoke Loader)", "value": "3aa8c6da076d0183e925124fafe197527d5238c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989215, "uuid": "c048bdf0-f9d9-496c-af5f-e7a5e67a2b95", "comment": "Malware payload (Smoke Loader)", "value": "d7e3eb1cba2e9f1fa58544486a7115d2711048821c531837369d8bc82612ebf25e3233a6f8d91115e5f9532599324b0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989215, "uuid": "38197d51-0187-4f7c-965c-12b466b70b51", "value": "T1E924D01079D1C473C387C5B4983CDA616E7EB8A14665889F33B8176E1E702E066BF37A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989215, "uuid": "047bd2a7-9b32-47ed-8f2e-4d66fb2c5aa0", "value": "5b5cd0be7c7d3fd97ef45ae33cdff77a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989215, "uuid": "0389c455-fba2-4d64-888a-2b0b89602d72", "value": "3072:aed9vpD6LJbWT7HGWC7ASUn6/nw+Q9PUGCbcTTOnXx8iiAE4UIK:jvpOL47HG2ewD9PUGOkKx8i04a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676989215, "uuid": "f6817d0a-dc7b-4f59-948e-e918aa76a3c4", "value": 217088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676989215, "uuid": "6ec7423d-2a9a-4a67-b7c3-cf27cd73a950", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989215, "uuid": "cfac644f-4352-4f8b-aa10-d0c254fdd0ea", "value": "266a70b8ea91e3dc494065843fd11fd2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "858b5c4f-b1f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676989069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989069, "uuid": "31cda0e6-2314-4bd5-ad47-47a4178b1bdc", "comment": "Malware payload (SnakeKeylogger)", "value": "dc8e568f7000020e9424cc7829189b9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989069, "uuid": "cd8dda01-7886-40f6-9fe9-2af3546bf916", "comment": "Malware payload (SnakeKeylogger)", "value": "53e78ca9d4a478e74ccf5473c7a2d954629c5a1839948514f557c8c360bc49c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989069, "uuid": "ff1bd662-2704-4d12-87ff-7537e4b52a97", "comment": "Malware payload (SnakeKeylogger)", "value": "3f03067af8e092e09e6c87ff123167b5286d3ef0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989069, "uuid": "b6ae1aa8-1565-4381-b48e-c72d9d7591c7", "comment": "Malware payload (SnakeKeylogger)", "value": "e107be47dfd20d3d56a4e89e7f0266dee284eb0b023ebd76c4ab42e76727f433fdade03c0c486c8284c11fce99f287ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989069, "uuid": "6b214eae-3ac9-4ce8-a3e1-e4fa6c04ef86", "value": "T17E458ED5B27088B7F89B01F56C3E662428627E5E6454D10D577BBB1262B33B330DEE0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989069, "uuid": "53128f52-d978-4ad4-99e4-fa705541c592", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989069, "uuid": "273825bb-99a4-42bb-b308-aaaf16060f05", "value": "24576:+ky9IIS5J+Hl6wsPYl1auepW3gsgOQ3IG1w:UoP+1BQW3VI1w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676989069, "uuid": "1ac75535-1e2b-4ecd-807a-de708a1dfd55", "value": 1239040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676989069, "uuid": "be4f8715-cd64-42b7-bd2d-149421d67afd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989069, "uuid": "2287358c-5f4a-4c9b-99c1-9baf51f22f3f", "value": "[URGENT] PO#8754302.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acb3464e-b1dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1676980116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980116, "uuid": "03239668-eeaf-4f09-a9eb-0e2e2d2adc6e", "comment": "Malware payload (Rhadamanthys)", "value": "eb23dfb2c1a82d4d680db3fc5fa38c8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980116, "uuid": "38f9d267-ba03-4119-9c67-a6f687b3df1a", "comment": "Malware payload (Rhadamanthys)", "value": "5547630b3895bb6fb045d3a51fba05cc41a10d872c0f4d817a07c1d6874e772a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980116, "uuid": "605d8879-d951-46a4-a228-78efe42f7f29", "comment": "Malware payload (Rhadamanthys)", "value": "f85e9d3bcc1c3a14417b793200f73093d2f7fdce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980116, "uuid": "f85e8d3c-1d3c-46e6-8776-6195ebaba683", "comment": "Malware payload (Rhadamanthys)", "value": "753bc5fee055ad9ed2f9b1487e79f0066905bc968d7c2f59b8e86a836f26f0211e5ce01f680c70e6e6908b463f155eef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980116, "uuid": "a7baedfa-f200-4c96-bcab-23a1b2d150ca", "value": "T15B24F160B5A08033F0A769755CB4C3A5EFBA7D2225784A4F7B580A3A4F736C19B71313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980116, "uuid": "4bd1f91b-9b35-480d-904e-63471e33327b", "value": "f2d6b2352080e69423e108f0f791087d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980116, "uuid": "f6b4c812-080c-40c4-ac38-913a8783d1dd", "value": "6144:oBVTI1hHFB7ATQ/uSdjmQdkCqs/FsQ04s:cVSlB7LZcwkwP3s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676980116, "uuid": "e858a6f1-0ca5-40a4-8b9f-19a5b276912b", "value": 214528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676980116, "uuid": "c6799085-3bab-4037-b1c3-e2694c42af97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980116, "uuid": "139eada8-3dff-48dc-ab81-1d9519818a17", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1bb4ba9-b18e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676946248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676946248, "uuid": "77ba5e64-e2bc-478b-ba42-d660ade71446", "comment": "Malware payload (Mirai)", "value": "3d19af1be7259b2579fa467e701cfd72", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676946248, "uuid": "5df6f230-162b-4f3e-b783-b60ccae4015d", "comment": "Malware payload (Mirai)", "value": "573dc97df49292f5e1e1e063cc3c1975c823d714d983f23bde2ca425a3d4b483", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676946248, "uuid": "b29c2aa9-fe58-4afb-b968-1730b7d9e4e0", "comment": "Malware payload (Mirai)", "value": "bdb17026115671543debba47e0f2007bbf0f3738", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676946248, "uuid": "744bd7cc-fc19-4b38-a210-861fd9eb58be", "comment": "Malware payload (Mirai)", "value": "7edfef37381364e201e10da4d327f758e682be1920f86b094b68e4c7713ff539feaccb79b2a5337694cc8b597651c98d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676946248, "uuid": "1b551a0e-ad79-4773-ae23-d24f2bacc0ef", "value": "T1B7E2E1E65BA99150D4CF7078B24EBA1D08A4E80EE1811952EE8C319F3FD5B8133343DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676946248, "uuid": "3ec74101-309a-40f7-9df5-3d1c8fb75947", "value": "768:OdM9gErVYdnSuXvq92D0ZdX0PaBvqtss0Eikrp0GSnbcuyD7UJLURQO:aMpO9SSS9A0ZdEiB8gnouy8JRO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676946248, "uuid": "bd712200-c17f-4bb6-9ce5-836e90b6818b", "value": 32748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676946248, "uuid": "0c99af21-6885-43d1-a15e-9342c7da2a22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676946248, "uuid": "177c9658-18ec-4bf2-a8eb-10a7d83e7894", "value": "3d19af1be7259b2579fa467e701cfd72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e937886-b1f6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676990641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676990641, "uuid": "7cc445db-5f7b-4523-b01c-81b1cbbe3dfd", "comment": "Malware payload", "value": "b1c1ac6cfd88546d4188ecc9c522e23e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676990641, "uuid": "46e97b73-2d94-48c4-86b8-17d2d5e558d0", "comment": "Malware payload", "value": "57c9a1386f10bd2baec86bb2a0624dcf1b1be53b0f4bc8ac5c76244d7dc35baf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676990641, "uuid": "09b4be8f-2fb8-4ffd-835e-a17c0dafc09c", "comment": "Malware payload", "value": "6a958823ba2b0a6ade46b17908444cf86a4fe837", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676990641, "uuid": "7479ca04-9da8-433e-99d3-26ae808788b4", "comment": "Malware payload", "value": "05ec65490dde6c515e9577d967ec30c9a49bff3b1007cd1269904d757ba6aacdf38d8dbc66a58b40f46d01611c11c26a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676990641, "uuid": "7d223025-4b1e-4d9f-b9bb-6273e5f38ff2", "value": "T17D25F657E89550F4C0FEE174C726A213BEA13499073827E76FA186F11B26FE866BC314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676990641, "uuid": "ce12734e-03f9-442c-a075-3ac696803f94", "value": "24576:ci3nHRD3wC7g9rb/TBvO90dL3BmAFd4A64nsfJ7FOQzjFyR:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676990641, "uuid": "0f7727ef-76aa-44b0-ab0a-dff90fa7357b", "value": 983040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676990641, "uuid": "b4a5dc1e-ac41-4c97-ba5e-a75afb43a5c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676990641, "uuid": "95e36a88-23d5-4654-b8d6-318fbca61e15", "value": "57c9a1386f10bd2baec86bb2a0624dcf1b1be53b0f4bc8ac5c76244d7dc35baf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c662ee5b-b1ed-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676987031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676987031, "uuid": "0b2bc355-9344-4625-9a80-64e8a03ac7a6", "comment": "Malware payload (RedLineStealer)", "value": "653c741f4d93880f34c7d22b39e9a10f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676987031, "uuid": "5b6bae3e-46e4-4e9b-9c00-a294d0dc2463", "comment": "Malware payload (RedLineStealer)", "value": "57faf10d8b88aa01b650deba123db2ab0823b541044fb8e6585a2bfc319f9a4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676987031, "uuid": "315b370d-429a-479b-887a-fb4f927b669b", "comment": "Malware payload (RedLineStealer)", "value": "9a860645cd5ec5ad94e876aa6f463c3ecb7cea06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676987031, "uuid": "38452e7f-698e-4eb7-baa1-1c5eaa509266", "comment": "Malware payload (RedLineStealer)", "value": "0932890c9f75df992801ffdbf6e650ff054c8d01e02298ad18d8fedab294b9cb11ab26e669e7e20119e84f1589a5a1e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676987031, "uuid": "45802a99-490a-443e-a078-c68f0619b3de", "value": "T167756C02B06EC869F45943FEC8D8CFF2056666B32D5E4BFE5A94C7146B90388719F853", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676987031, "uuid": "d3c442eb-37bf-4ec8-ae23-44b14503b806", "value": "ef2a5385d81720e77693d85ac42793fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676987031, "uuid": "6c17f418-d0e3-4c8b-8624-12820538ebe4", "value": "6144:mdDrEoGPuFlethIg3YY/AODeSI8a6ciKQai2dZTh6:mdDrE/ulC91I8a6uDh6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676987031, "uuid": "209edce0-4aba-4dbc-8ff3-ea0e3c696882", "value": 1687208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676987031, "uuid": "137871f3-509b-4e21-93ba-5f57dfe49471", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676987031, "uuid": "eb463a43-a9f7-465d-855e-4e699d2b46ac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91ceb57c-b230-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677015719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677015719, "uuid": "6eee5b62-3259-4c14-a93e-a502869a2a27", "comment": "Malware payload (Amadey)", "value": "acf68a1604dbc293289d9a99c316c93e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677015719, "uuid": "2e88b84a-16ec-44ac-a0b8-efe1b3c346dc", "comment": "Malware payload (Amadey)", "value": "5a79df7f29187b026397ac74bdbd213ab78568d0e76d86e2af054289cb11626e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677015719, "uuid": "4fe1de38-acac-48b0-a15f-dd699449406e", "comment": "Malware payload (Amadey)", "value": "0035909d80423342527a18d298be4b2d469f8320", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677015719, "uuid": "4ac6966e-7bab-4a70-8688-c513f6484444", "comment": "Malware payload (Amadey)", "value": "c990232b68574da4f850aca4de168581420c6361e1ac9db9d72b0e5974242a879ab2d0952f827808ed34a648f69420da", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677015719, "uuid": "3de50b91-9e85-461c-bda9-b9f82164192c", "value": "T15D35235BBAED4426E8651B3048F703D30638BE741A38475723EB6C1E48B29B1D67D36B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677015719, "uuid": "66377100-c611-4cf4-86c2-c1db4e329834", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677015719, "uuid": "6b43f8bb-41ba-437d-b9a7-5c9ab4e4be12", "value": "24576:LyBjs/SMysoSlFPifzmYckUGjrGe5rJfAvM4:+BjsH7oSl0iYcJGnGenqM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677015719, "uuid": "d3e64775-fed9-49f7-b1aa-7ed8997047da", "value": 1101312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677015719, "uuid": "a403abf1-d0b4-4b40-b1e0-1154f8576574", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677015719, "uuid": "dba1247b-c0df-4203-9bd6-6230e37b4092", "value": "acf68a1604dbc293289d9a99c316c93e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca52acef-b23a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677020109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677020109, "uuid": "1e200a87-d02b-4561-a338-3d731a648e86", "comment": "Malware payload (RedLineStealer)", "value": "689ee5077be60bcbb04feb573d8dadc4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677020109, "uuid": "b2eef4b9-14ab-4c84-b8bd-12df6b065e01", "comment": "Malware payload (RedLineStealer)", "value": "5ac002daac747f4b29a1aedb3274953c8632278919c11244cdb1ca73da8f8006", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677020109, "uuid": "506aceb6-d12f-4261-ac62-bc1749923ae9", "comment": "Malware payload (RedLineStealer)", "value": "750b47f03b194b033de197d463d6c8b5526b7081", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677020109, "uuid": "e65cdeb8-f85d-42ff-9587-02d6f67915fa", "comment": "Malware payload (RedLineStealer)", "value": "a5914c195d4c8a35e83b6a7f9be6fe2109e4f8cf2023ccd6b6cef989da39dc7f6b64a28e4f4b6225b92d2e86201e291e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677020109, "uuid": "92a5666d-7b2b-47c8-a00f-000110ff4406", "value": "T1BB54D02035C1C2B3C4B7453085E6CB799A7A7072477A82D7BB9D27B96E213D1A3362CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677020109, "uuid": "3915295c-8660-4b29-a463-4c621e6f9ab7", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677020109, "uuid": "e445b643-69f1-4e09-ae9d-4e32534c1166", "value": "6144:MDKW1Lgbdl0TBBvjc/XMExIqgG8UwSib7hl0lo7gq:ah1Lk70TnvjckExIM8fSCFUq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677020109, "uuid": "1c0d4436-a997-4fc6-b1e6-51450b92b712", "value": 287232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677020109, "uuid": "08e24c87-7616-414c-b3c1-9202bc97d428", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677020109, "uuid": "05644d58-5664-44a7-81b0-f9628ee2ad64", "value": "689ee5077be60bcbb04feb573d8dadc4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89bb741c-b20f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677001532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677001532, "uuid": "1de78c7e-d330-43ef-8029-e342bc886eed", "comment": "Malware payload (RedLineStealer)", "value": "35ac35cb4db6d700eff9e2da0aeaca40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677001532, "uuid": "c771d249-5e80-48b5-8865-82f355fbee54", "comment": "Malware payload (RedLineStealer)", "value": "5b448efa26739f46016d83c4d735822880e2ff5288d191c99c545666f04ba356", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677001532, "uuid": "1c31f234-1b8a-4da4-9509-7eb51361fd38", "comment": "Malware payload (RedLineStealer)", "value": "a85532835b308580a0b2f85e5a4e649ddcb35538", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677001532, "uuid": "e2d1d5a8-07f5-4a57-8c1f-7776e0893822", "comment": "Malware payload (RedLineStealer)", "value": "7548a1b8523d0adf14a18aa7d64f50885c604101cafa397786b0f5333f99b4861abcf6be4d62e19f3d5d32315ab0e0ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677001532, "uuid": "0a5004af-c23d-45c4-b641-7a81d3f5fd53", "value": "T1E8757DE218518C3FFF1580B2509CB53ECDA877722B9056EEA2CA0BC747947A496FE171", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677001532, "uuid": "c0449843-73ad-40c6-8f83-a8ba3fc15a07", "value": "ef2a5385d81720e77693d85ac42793fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677001532, "uuid": "71bfef53-a851-430d-84b1-1f979e641a33", "value": "6144:S9Z1GEGV2lpM1G6Ic3Yi/AOif4p+JsbfhabN1JEIIIIIIIIIIIIIIIIIIIIIIIIN:S9Z1Gx2nAIf4ksDwxrmh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677001532, "uuid": "e62fcec4-73d3-4d34-831b-6825c4b68adc", "value": 1676288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677001532, "uuid": "42c009d3-40bd-4f1e-8ed9-6512fa71fcda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677001532, "uuid": "4518842b-2f43-473d-8e93-f855888158cd", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bfaf06f-b1d9-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676978289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676978289, "uuid": "b91e928c-6073-46bf-9569-7c136b3b9329", "comment": "Malware payload (AgentTesla)", "value": "fadb0834265458161b8f5eb793193b0b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676978289, "uuid": "6c37a2ab-1d45-4356-a368-d40b59cf74f1", "comment": "Malware payload (AgentTesla)", "value": "5d527329e8357f80cb29fda1069d67b7799a7e7b0147dc3a494bb0f80fa63152", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676978289, "uuid": "8b3bf5e7-40f8-47a9-b80f-7b932a86df11", "comment": "Malware payload (AgentTesla)", "value": "8510e8f412709fcaf0c0ae18c8560369f64210de", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676978289, "uuid": "be9053a6-bb85-43e1-8219-fd9949c90400", "comment": "Malware payload (AgentTesla)", "value": "9185c330f0d3f60261a82120242829a78509788ae862157146444bacf1090eae53f5e5ff6485ddb2745784a90cff839f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676978289, "uuid": "8e8a0a96-3a0d-4add-91a3-8533bfd2ba4b", "value": "T1ACF4F43D38B796D2C239FA3386D7E520B6BD80923313D959D9D61AC04F426827DCEA5C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676978289, "uuid": "6ad33520-2ae5-4e95-b66a-56131d54c35e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676978289, "uuid": "dc45de51-9250-4ead-ab25-692288225709", "value": "12288:zYnC4OIkegET9jsIBMNjnNNOhAe/S0U3L2j7ZFdYg6VTMNnQAmvdchRlx+e9koRT:z2jTsIBMNjnNNOhAe/S0Rj1FSQNBC0Pj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676978289, "uuid": "fe273c8a-0b8d-43b2-afe1-cdb5cec97d18", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676978289, "uuid": "e78274c9-70ea-422a-adea-82a3c70818a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676978289, "uuid": "38cb32dd-baa3-41be-958e-a539a8f15a1d", "value": "YNTG7UUiZ63KVXh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0da32365-b1ea-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676985432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985432, "uuid": "3c2a16ba-b292-403f-8460-3941e3962d7f", "comment": "Malware payload (Amadey)", "value": "a13def4f680ca4491f798194d3021f4b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985432, "uuid": "6f28b279-2b32-447a-b417-f82cce4cb3d3", "comment": "Malware payload (Amadey)", "value": "5df17f53387714d342d63a5946626f3e52be8438ee0701b44c42506f7d003367", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985432, "uuid": "cc4efcb3-b634-42f1-ba29-d09c4bbaefa3", "comment": "Malware payload (Amadey)", "value": "3af37599ed379717a5f785b3786110c16515fd1f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985432, "uuid": "eb21e8d5-cde1-4593-841d-52cd293746f5", "comment": "Malware payload (Amadey)", "value": "6112cdd9dba989417020c70b4b6ae4f5f0f795701c8353d5bf85a93a7570d823ab852ca5f9ed6082271c218c07c7da1b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985432, "uuid": "3dd95b99-5611-463c-8516-8b69449eef3c", "value": "T12735230BB7EC9101E0B5577109FA13C32A33BDA28B71C61B795F9C1A4863275A63572F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985432, "uuid": "20b3bfdf-597d-4e8c-b244-edec472d2ff5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985432, "uuid": "b473b5c9-755f-4c76-b794-c1bd80565a68", "value": "24576:3y3GUYOO4k7H7jeKlm2vw+lIyD7/r/Cb8lDdHf:C3XYOur3jFOy/TZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676985432, "uuid": "fa94c350-551c-43f6-89d5-bceee698c11d", "value": 1091584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676985432, "uuid": "546f7533-469c-42af-945f-6b3a9a0652c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985432, "uuid": "c8ebbc48-f247-42a0-8d6b-46020328c9b8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b20116d-b208-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676998528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676998528, "uuid": "10ffea53-5176-4835-baca-2efd482ea34d", "comment": "Malware payload (RedLineStealer)", "value": "8895e242da648a542cbb86b50fc4f44a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676998528, "uuid": "5843bdae-2656-4496-bed0-a0ac7ca62735", "comment": "Malware payload (RedLineStealer)", "value": "5e61ca396611b20ac59f4701d471fce71202fa690f5481c5f71d0f1b00336406", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676998528, "uuid": "baf0cbe2-0a84-43c9-89b1-28dc807fa44d", "comment": "Malware payload (RedLineStealer)", "value": "a4159a0240e3e92235c4586fe7f809713d8b030c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676998528, "uuid": "de59d044-34a9-482b-8893-20335e3f2616", "comment": "Malware payload (RedLineStealer)", "value": "4b3d2f5dff880869db8ee6f35265e54325b2a4a911364343ca72e1cccb0984ec72fca851b1fe47677ff5ebe08c23f0a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676998528, "uuid": "77860cf8-e690-47ab-80ba-30140695c4c5", "value": "T18A352347E6ECD521F9F847B018F255D3063A3E523A38839A679F9D0E1CB3260623576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676998528, "uuid": "d216039f-3ec9-48d6-9ed8-cfa42c11f601", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676998528, "uuid": "dea58b89-424a-4c1f-a5c3-bf8b912841e1", "value": "24576:Jy+sGl8pTRSdaTtu1Dt9vXFxBLU5ht9QQ8JNw:87e814L1Dtxm5htZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676998528, "uuid": "58042658-d77e-4fb1-b22e-8fe03e9dcb30", "value": 1098752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676998528, "uuid": "54547ba2-96b8-44c1-8190-ecd99c31d99c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676998528, "uuid": "e0ab085a-ceea-4e93-ac17-f78e34bcca54", "value": "8895e242da648a542cbb86b50fc4f44a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04ab260f-b1ff-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676994437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676994437, "uuid": "6f99fb3a-059d-4978-a771-901b848a66cc", "comment": "Malware payload (RedLineStealer)", "value": "647aa1e94ccc4ad44c82866d38488d44", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676994437, "uuid": "8b038548-51f1-4ce0-b035-2b8c9c455b35", "comment": "Malware payload (RedLineStealer)", "value": "5eca819baed9b9624bfcf5b048699cbde7d8a9d9a0f28a99fcad341f775972f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676994437, "uuid": "50cdea50-5bbf-47b8-b97b-7e3b50d468f3", "comment": "Malware payload (RedLineStealer)", "value": "9e3c7236bc5d15b87e9c7ec98c3c0dafd253e21d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676994437, "uuid": "a2941b43-6270-499e-80b5-c56de6ee0685", "comment": "Malware payload (RedLineStealer)", "value": "f84fa980e3bbcf9307dd03f2782f60942fbf1b7e0bbcec22addf8fac0f6bba5eca440c7fbe87d1b5219e871e10d9bcc8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676994437, "uuid": "84f7c6eb-4a5c-4035-a084-d25f4e6a3338", "value": "T18A35231766DC8012E8B957B41CF153C31A363D811A788F9E678F6CAA1C735B0A23576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676994437, "uuid": "dffabe55-ca86-4e92-ab55-60c0bf901308", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676994437, "uuid": "afae6686-00ee-4683-8356-a037271c7d51", "value": "24576:ly9yBCX2YeFdl5jvUhf4vYyxSeFabLIJ6OBlvJ+NBtyNTveOInzgTn:AkBC3eLvvUhfef5VhBlvJ+NLyNbeLzgT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676994437, "uuid": "5fa40655-8692-4908-b5ab-865366696f36", "value": 1091072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676994437, "uuid": "f4f5f645-4872-49be-92e8-7aae29c40f26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676994437, "uuid": "edf2deb2-4b71-4f89-bfa5-99fd9b9ce93c", "value": "647aa1e94ccc4ad44c82866d38488d44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b970018-b1db-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676978986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676978986, "uuid": "a62ff080-673b-4a88-940e-e35dc7451780", "comment": "Malware payload", "value": "ff2f1edb6acabf1cf3d4896d49b94231", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676978986, "uuid": "7e2913db-8156-477e-9e79-33b76b355627", "comment": "Malware payload", "value": "5f384710eba2cfe85af07827d7db6a825618694fc2fbe3c054649b3ef7d51cbf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676978986, "uuid": "18f09ca8-a792-4fca-a81d-8ca45c0c45a8", "comment": "Malware payload", "value": "46dfe55f2a08d9d3aa9703d169b83167c50ec04e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676978986, "uuid": "2ccc2caf-72d1-4f77-99d7-2501cd72754c", "comment": "Malware payload", "value": "ac4b68bc579059bbb48aa4d41136622cb0ac842a9a87ed74ef2ed3cbf2d0d27558d869d2510dbd954f1a5dd4c81d1a0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676978986, "uuid": "d3822463-ad02-4a3e-89ec-25111efef859", "value": "T1B9E6260CB899E329E54A2E39DEDBD0759A193E0BCE40111374D2B76EED76908C3EC45E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676978986, "uuid": "7aff193f-8849-459e-9a91-eb502eb7743b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676978986, "uuid": "77b5a3fe-b0c1-4b6a-b0b9-6a118f1414b2", "value": "1536:hr2lIYI/9DYvCeLwvpppppppppppwqbetsx/WLBw4vmEDTke5oAUNdL1MZP2ux/s:hyK9/9DYvCEw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676978986, "uuid": "5d3c3281-1eeb-4ed1-8a66-cb3dd6791063", "value": 14720512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676978986, "uuid": "4ff242f2-1570-4a55-b145-0a78fedf41ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676978986, "uuid": "2301a8fd-193c-4249-91f4-18b87d4f9f53", "value": "SecuriteInfo.com.Trojan.Generic.33216154.14853.21794", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e643248-b1fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676992332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676992332, "uuid": "8a5d5898-3afd-44e3-b34f-16306655cf03", "comment": "Malware payload (AgentTesla)", "value": "fc4f1b555ec348ccf814fedbf06a45cc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676992332, "uuid": "d132d1f6-a7b7-4ce3-b923-78ee84547161", "comment": "Malware payload (AgentTesla)", "value": "5f4426ef4ff23950b7ca635f689c0e2274a36ddb3233509e22e7a6b19d6719ae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676992332, "uuid": "c3558acb-0d22-4076-8d62-d7d365740702", "comment": "Malware payload (AgentTesla)", "value": "33a666dd9b6ee57bde594d3720adba26191ca9d5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676992332, "uuid": "5f895cd3-5f08-4224-80ff-b1d7086d14f6", "comment": "Malware payload (AgentTesla)", "value": "00c59407b86c9704d5266055e40dd27a115222acf914ababe73bb2c18cb19b9c675ba6c28fa86514fa9c7a37c7363771", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676992332, "uuid": "41c20f68-8539-4af6-9ac2-cdb8bcc2dc2f", "value": "T15825BE9977B45073F8CB01FE5C38278C2E207E577119E26A9B77BB9292709FB7294102", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676992332, "uuid": "94c7bfe1-836b-4f39-86cf-9388b4c8a061", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676992332, "uuid": "0685bad0-ca0a-4471-a2f6-b7d1f3f170fd", "value": "24576:lky9IIScJ+HliHVazSolP56TO5YnzVwS1Tr:aUHVaXRZ5+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676992332, "uuid": "30ff34e2-0f4f-40f6-aeb6-88a4322e0f3b", "value": 1002496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676992332, "uuid": "0eb94e4b-7259-49e6-adab-8b1df78af06d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676992332, "uuid": "9016eb4e-ba6d-41a3-98fa-f852d7acab02", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dc70fef-b1f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676989030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989030, "uuid": "0113c165-13fa-4ad0-bd4c-147a682acc02", "comment": "Malware payload (SnakeKeylogger)", "value": "2cab8d8600f62b70d0dffe8da095239c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989030, "uuid": "e8c072ca-3487-48a0-93ba-efb7e052e50e", "comment": "Malware payload (SnakeKeylogger)", "value": "5f935489fa1a58fe71aead038c33240f6cf5e2382ccc563ee01a3f9efb68499d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989030, "uuid": "2d8e5fb1-7233-43cc-b277-d5765dc3132a", "comment": "Malware payload (SnakeKeylogger)", "value": "97418eda27e16f5512d947dae39b3ee1d1f70dda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989030, "uuid": "81bfc5c3-7c54-4c49-94b7-cb1e8f33ee85", "comment": "Malware payload (SnakeKeylogger)", "value": "2988ceefae9d265ca8292550e931244b23bc7931e027573c64efff5955a9ff6492e2b15525939f3a5fecdf7d33a8c75b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989030, "uuid": "5888ad7e-97b3-4cb5-9cbf-c5d30dcfa636", "value": "T17F441251F7A8C063D9A29E315E3646059DFAE824A0BEA36757503F683E363D1EF2D340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989030, "uuid": "27925ea8-4d75-4758-bf34-2caf3fe805d6", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989030, "uuid": "5027d07a-1894-45b8-a027-764618c17872", "value": "6144:/Ya66Kuup/4d+JvhSlRqnnof7BCVgc83ve7STTA6BM:/YUKT/DkMjgX3YSoYM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676989030, "uuid": "f44cfa3f-70d6-4180-9c7e-04cece30802a", "value": 257766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676989030, "uuid": "47dbb187-0243-43e5-806c-e3c14e5376cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989030, "uuid": "e80c4faa-3fca-40dc-b4e5-271e45fcc4c7", "value": "MY27758783895.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af968d20-b1ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676986563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676986563, "uuid": "da09bd35-a366-4310-90d9-1f2f40239616", "comment": "Malware payload (AgentTesla)", "value": "8cc06ca7554b5c8a443d8beb5f13164d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676986563, "uuid": "363a0620-ba22-49a8-accd-dd3b02111417", "comment": "Malware payload (AgentTesla)", "value": "60230d8230a3927a13571a6c4a9373a064211251e65633f9c6c1f1881bc08d1f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676986563, "uuid": "61a10ff0-e15c-4cf8-b976-e37d45404a79", "comment": "Malware payload (AgentTesla)", "value": "d7b0f0f5c3f85fe7130da6a5818b2b4704cb8096", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676986563, "uuid": "c8007a70-0163-4b40-8afa-86fb04cadd87", "comment": "Malware payload (AgentTesla)", "value": "c2b71039718742e061de2266d2089cf5fad0ac78c92357b4384fad4ca64fd15dadc700797915b84699957363d26b278b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676986563, "uuid": "4ccdb232-aa5f-4252-9eb5-4f543cfd3538", "value": "T1395412092F544483EAF707331E39637B6BE1D62112AC854B07A0EA287DA3716DD1FBD2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676986563, "uuid": "dacea2e0-05b1-4730-bcc8-815d313e4e65", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676986563, "uuid": "93bed6e1-7d48-4732-bed2-35d0ea503e4e", "value": "6144:/Ya6BoQmAy6/5GrBu9krwGEHDQV40lwOKxqi6VuzEL:/YD1dy6x0rwFEfSZ6VuwL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676986563, "uuid": "ef7875ea-da66-487a-ae4a-25a85658c5c6", "value": 299535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676986563, "uuid": "e0d1cc2c-c0fc-4885-9d10-5ddc92afaf41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676986563, "uuid": "1f5bd75c-b0ba-4813-aa86-66b8627cfde8", "value": "z1Inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f1bf205-b1d7-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1676977328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676977328, "uuid": "2f5f43fb-cec2-4fce-b037-9ce1f2261674", "comment": "Malware payload (AveMariaRAT)", "value": "039811bde6659620969c587a331cf604", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676977328, "uuid": "e803d7b3-737a-4787-b704-02ab889c420e", "comment": "Malware payload (AveMariaRAT)", "value": "60a45dd4711c5aaa146e4b973d33934a6e7e29e530666202b7a88a6fb845ccb1", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676977328, "uuid": "cb038c2c-a112-4bcc-856f-03ab7d853f8c", "comment": "Malware payload (AveMariaRAT)", "value": "35fe477056ea6785ccd7691c124f0b2af0044758", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676977328, "uuid": "48611eec-d5ff-4306-a617-fecb8ee2e900", "comment": "Malware payload (AveMariaRAT)", "value": "43fd09398ac3648d480cab5ae9c7cc175e26816bc14d6cf0247d1f7d7399ffdd7db214f46888b96a1f8880b110420fc1", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676977328, "uuid": "f3d2914a-1838-4a05-bca1-332a179b35f4", "value": "T184E4AE2FBB812B72EF9E94308A790A5CD7F147035250FE725FC700D69B5A6AB6E01C91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676977328, "uuid": "bb8fc566-68a7-49a7-a935-35f1399524a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676977328, "uuid": "62abe6ad-a5b0-4e4e-a93e-3385f738c796", "value": "12288:5f/lppJHwp5e/viEg6L09W8/8GIGxV+F5IBRKYWTHToJ:51NS8/vi38GxLRu8J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676977328, "uuid": "f94725c1-97e1-4840-a8f6-8b18e7f908c4", "value": 704512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676977328, "uuid": "1aef6deb-f759-4009-8286-f31acac2ba4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676977328, "uuid": "6d7bc58b-62a5-491e-a5d7-c6fde3d38502", "value": "Eigenmann & Veronelli S.p.A. PO.77210008.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4928e0ed-b1b0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676960621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676960621, "uuid": "7f1e0881-bd54-42e7-b322-ac1def397d86", "comment": "Malware payload", "value": "43fd90c89df305d76a86ec1963a18fd4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676960621, "uuid": "fbcd8b88-ad20-4fa3-88d9-f70331975015", "comment": "Malware payload", "value": "6426eebd06283f74c5f710184bcf97db75b07b8f67c838a8fca63bb7e5c23d92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676960621, "uuid": "d07b237e-e5f2-4fb7-bb1f-4985a891990c", "comment": "Malware payload", "value": "19b41539ba06d4b4b4cd9df10228d34eda243402", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676960621, "uuid": "376e3c9c-39d1-4f3b-8a4b-82ea861b2259", "comment": "Malware payload", "value": "361799bb2f53e66de190c78e70ce4122c23c6011c941c1472372cdb9f7939a7a89c67c8a5586828c3a0c7ffcc5fb506a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676960621, "uuid": "a3d991fe-34d4-439e-a88a-e9055e4a2ae6", "value": "T16E34C5947E4C997BFDD269302582AD4D6C5CBF93B92C718F348FB2556833E04CA82D1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676960621, "uuid": "d2f15a4e-7013-48c6-84ff-b516a7948520", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676960621, "uuid": "651a1a0a-78f7-4cc4-9301-537406f02a08", "value": "1536:oC4qb9YCbOGmppqlsti+pj5WgMccf1uZNoraIlrxCka5GoXKsuWoZ:oCpOCSt6lsMlcLtsVKGOKsuWoZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676960621, "uuid": "b1d1f56d-9b7a-4cfb-9022-d79ccc72a47d", "value": 237056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676960621, "uuid": "e8b13dce-b606-46cf-bf4d-4b2eb6e9eacc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676960621, "uuid": "df6375d8-986b-4f49-b8c4-cf7a4d9739b4", "value": "6426eebd06283f74c5f710184bcf97db75b07b8f67c838a8fca63bb7e5c23d92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7996a3f2-b1b6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676963280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676963280, "uuid": "dc9d4c5d-0307-46b5-9393-1d002c97b98a", "comment": "Malware payload", "value": "b83b9107362bd9faf2dd74668ccc1780", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676963280, "uuid": "b6fe339b-88dc-45ae-9822-9bcd6e8c998a", "comment": "Malware payload", "value": "6518dc835d22e7520ce00460a18304bce53a4dee89b4236dcacf3b4f071868d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676963280, "uuid": "ec50be2d-b562-450a-806c-3bd73849aacf", "comment": "Malware payload", "value": "2afa190e69d1d39cdff308a1e2dbe8e1e6aa9d65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676963280, "uuid": "6271316a-128a-4c66-8649-26b42523bfdc", "comment": "Malware payload", "value": "ff510263f5e133e8935a7a586fff4e8844c00e836b8bf64a6195b875aaa451b70950a91aefa6acebf11b9b59aeb49d1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676963280, "uuid": "5a085634-c436-4ed3-bbbc-a9a1c62bf631", "value": "T1D7942347A790CAAFED6A1273F83151F99546CC74D06A874B67F1BE7038F62824F2C252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676963280, "uuid": "e1f5239f-63f3-411d-8f7a-61d2bf5a4efa", "value": "5f0c714c36e6cc016b3a1f4bc86559e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676963280, "uuid": "2c59cf3b-0760-4ca5-b7b6-124c65cab87e", "value": "12288:Ss6i1DdZ7CuJ41easH1T5dQEfIvmz43Ub0f:Ss6iBv7CA41PsGQEKp0f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676963280, "uuid": "45695874-210f-4638-b596-4e5a05e8f3d6", "value": 438127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676963280, "uuid": "8890ee34-13e9-411e-bb05-4c7b4f83a194", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676963280, "uuid": "67a55426-9f8f-4e45-8c2e-64fba7cd16ee", "value": "FNX Proforma Incoice No; INV 20231131003197231. 20..12.2022. SOA ref 202212234351972.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b2244a7-b1f8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676991629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676991629, "uuid": "5a47fd57-611c-41bd-883e-892747b941e7", "comment": "Malware payload (Loki)", "value": "d3a2fd5c67961ba940ef68397552082f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676991629, "uuid": "c3382d11-3f50-45a5-820e-2acc51f819a1", "comment": "Malware payload (Loki)", "value": "66bf3cedae82f70793c807db231ed455594c60e5cf0daabbfebdd7d69ec1f91d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676991629, "uuid": "3ee1318f-c8cc-4d01-93f3-089bb1e2b6c4", "comment": "Malware payload (Loki)", "value": "d3f4e4d817406bf12aadc75be85487d0daa9e633", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676991629, "uuid": "1c303e70-ebb9-44c8-b600-ce71d83e0bcf", "comment": "Malware payload (Loki)", "value": "ef921abad466bca00f610b1d8655890533f2deb1db1f502057f3dec6e9c44d5789e5dae5db65a8d8979ee84fc31b5c3c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676991629, "uuid": "2db1620e-0385-4f31-bcca-8146c904bf91", "value": "T1D915BE9977B46073F4CB01EE5C38278C2E2076477519E36E9B77BB929274AFB7288101", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676991629, "uuid": "86542159-0a95-40b9-8479-e944f56ad707", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676991629, "uuid": "46b10452-c4bc-465a-9422-15bcaa1658be", "value": "12288:ozXkyLr2ayjh1eNIWl9S76MJtEHccs8z5xX7Gv2cybuqxuekOYWLVqFm/yCBRgf7:Gky9IISZJ+HlrG+FuqXYWLV+mqC833", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676991629, "uuid": "d17da1bd-67e9-4c10-b85a-6d116e080654", "value": 911872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676991629, "uuid": "6dd00a06-e6a9-4544-8639-0aeec76902a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676991629, "uuid": "ed8bafa9-25fe-4e26-8a5c-e16c2e59fca2", "value": "d3a2fd5c67961ba940ef68397552082f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64396422-b1ea-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676985578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985578, "uuid": "b1fe9ded-680f-4846-a5de-03ca7387a0d8", "comment": "Malware payload (AgentTesla)", "value": "a39f88ff85d6cfda6c57ac1e6fc25c3d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985578, "uuid": "6b972529-8adf-422f-92cc-749bdd7553dd", "comment": "Malware payload (AgentTesla)", "value": "67d4ee9e6ff5fbe379250a946da129ed87a24d5d519d223450b7dfd885b4ab11", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985578, "uuid": "68f21b18-5e74-43ae-b6c6-be7cd4d0ec2e", "comment": "Malware payload (AgentTesla)", "value": "ea45e99f1ece256147ed20bb9f342fac188646c6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985578, "uuid": "96fff20a-7e87-4d18-9738-91a56181ab95", "comment": "Malware payload (AgentTesla)", "value": "d4bb67ee8125e36f62ecaa970c4c301eff142cc6fe79e58895b659d2cefea1b288ee80ddc9492322004d588b0240cb88", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985578, "uuid": "78c4c8f0-9ee2-4ffb-9a9f-1489a068d603", "value": "T1026413207BF48673D0C24B742D37936B1DE6A6262D2A928703404B697F33790EE6F795", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985578, "uuid": "26120f70-4a62-4a3a-997c-400e6997e9b0", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985578, "uuid": "07f58576-b172-455d-87b3-aec526883bd5", "value": "6144:/Ya6JmeZi5u4y5ZH4xCm5/MsuHVTU73HhB4+cQHboDDjwbEa815bK9cvCZ1/YxTw:/YTmXQpsV0sgVTU73Bu+2Eo1dKX1/U8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676985578, "uuid": "c9d8df57-2ddc-4477-9b9c-a8965312869f", "value": 328535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676985578, "uuid": "ae72b9eb-0e58-449e-8489-b9b1ec25946d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985578, "uuid": "080dc3a5-a6bc-4fad-aa5f-39bd8cc39001", "value": "AWB733988905AA DHL Package 733988905AA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "febb7415-b232-11ed-88f6-42010a9c006e", "comment": "Malware payload (IcedID)", "timestamp": 1677016761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677016761, "uuid": "ad13a0b8-dd6f-408d-a695-81e1bd20c42f", "comment": "Malware payload (IcedID)", "value": "6b8d028370567e717055e49101d460fa", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677016761, "uuid": "660823bb-a1d7-4f1e-a518-68ede9e66ac1", "comment": "Malware payload (IcedID)", "value": "681217e6c8ed3ed37c1312646afb8e0cfe25e6840f461d10a7d9cdd4ffa725cb", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677016761, "uuid": "59a5bb9e-9c3e-4511-997f-e030ff890de1", "comment": "Malware payload (IcedID)", "value": "96f5d75af40b30738c06f78dfb1dd09c485ac513", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677016761, "uuid": "f0b9483f-3e46-45be-871c-5d9db2ff1ed5", "comment": "Malware payload (IcedID)", "value": "6acaf83d10c23ecaf74cc9c468285006eb31f841f43454d1aacb4a1703ee447567cd25ee6376c4c63d8a002a6b5ed1bc", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677016761, "uuid": "94ad5a4c-5478-4ce1-bb5d-627b97e6dbf6", "value": "T1DA31CE3F083E9A36B1B7A0EB9B5A3AD15BCDC7B21748EE9C4E010D853F240E50246D05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677016761, "uuid": "8ca6cad0-cad2-4be0-af78-2a1f97bd6195", "value": "48:546vsqjkfhlzextB9xrjRauBwBvo6Bf6Nee85nJJy5+l5nJJxB:7vzoLYBLj/T2ee1nJJrnJJf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677016761, "uuid": "0025ba1f-e1b9-4665-b235-885a6d418559", "value": 1679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677016761, "uuid": "fa02a563-92c2-4ba9-b5a2-d04c5048468a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677016761, "uuid": "4bb61ac6-faaa-4de6-8662-37d2a2326711", "value": "O p e n.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7970543-b237-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677018815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677018815, "uuid": "806fa9dd-8178-427b-9a10-4a547b02fba7", "comment": "Malware payload (AgentTesla)", "value": "8af257b8a3ff3fda1e212e88a4315381", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677018815, "uuid": "1e022f09-c109-46f2-898a-5c2d73430818", "comment": "Malware payload (AgentTesla)", "value": "685009598ad43caf98a36998b832e2e0b68bc79701837afc5911e8816cfe8b41", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677018815, "uuid": "6d451676-f922-4ef8-b048-50cb710e1425", "comment": "Malware payload (AgentTesla)", "value": "52a1a60b897688b22fbe8617fabbd152b2d65edf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677018815, "uuid": "d5ae738f-bbd4-4837-96da-d2fa58749ffc", "comment": "Malware payload (AgentTesla)", "value": "f98a5ad237f74b30eea49a946358dd046c612470ae44217c1fdba9b0adcd4ccf0006b21b4605cd6d1e9525507c607cb7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677018815, "uuid": "6faa7ccf-7f57-4b0e-93f3-19f139e89753", "value": "T1A825BE9977B46073F9CB01FE5C38278C2D2026137509E36E9B77BB91A274AFB7294112", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677018815, "uuid": "afd820b0-1ed8-41aa-9846-91f1a9b682b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677018815, "uuid": "4da1be0f-11cd-47df-9ee0-d88841c97a61", "value": "12288:0ZAzXkyLr2ayjh1eNIWl9S7IMJtEHccs8z5x6nCCguekw9mcqHxryA7MxZTWIG8u:0Eky9IISfJ+Hl4CvvfaBIPfa6da+uuM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677018815, "uuid": "4bdc24a4-4810-4171-9fa2-1894436107f1", "value": 981504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677018815, "uuid": "aaaacb3c-77b9-4751-af68-edd28b8985e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677018815, "uuid": "54710b91-94f7-4bad-9ee5-fb392e86cd01", "value": "9046- PA118- SUPPLY & INSTALLATION OF EQUIPMENTS OILFIELD EQUIPMENTS & SUPPLY.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e79dc03-b1f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676988977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988977, "uuid": "6ee33427-a69d-4876-a267-7d30a5e32465", "comment": "Malware payload (AgentTesla)", "value": "30559d30e7cc4c6f75ab46d63ce31dcd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988977, "uuid": "8788e8b1-30c5-4c39-bf3b-8636f355e653", "comment": "Malware payload (AgentTesla)", "value": "68d5ca8cc172f06770b92182cc32ca1f3f5879cd4e8dba6f399bf9dc4157d617", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988977, "uuid": "8219235e-a47f-4788-b485-c97d69c72b9d", "comment": "Malware payload (AgentTesla)", "value": "7f8373319ff1c78b458347de77810ea7f724b8d6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988977, "uuid": "3dae4419-90ad-4ae6-81d5-4fd56b9565d7", "comment": "Malware payload (AgentTesla)", "value": "f46ca5861f0fe297373d30284a772f3cd236471f3d3933c880e54ab25750105e3b4b1d9109888c7c8749e180ef02f539", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988977, "uuid": "f3357e20-2847-4a93-9893-8b1f5b45df24", "value": "T14C54130163D4D893D4D252B309396AA2CBFFE9026479CA9F03541B6CFE637E5A70DB60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988977, "uuid": "6fe944fd-23ab-44bb-ae90-a794299e9c8b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988977, "uuid": "1a57f918-305c-420e-ad99-b28196a4af50", "value": "6144:PYa6NASHrN8wPMQ+oBANrYQ2J0pencdTlSQChp3tw:PY3RHi+2kaP2AecdTlSQCNw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676988977, "uuid": "49f45fe7-f724-4838-986f-e6edb6a0b1a3", "value": 296647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676988977, "uuid": "b6fe72e2-04df-42b8-a3f3-436afdb02197", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988977, "uuid": "2f484b26-7d65-4acf-809e-1c3ffca1244f", "value": "PRE ALERT NOTICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15f898f7-b222-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677009498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677009498, "uuid": "fd2da541-0adc-43ea-b236-ffc8e44b9263", "comment": "Malware payload", "value": "54a9c57ebe9caed29b3895d94a15dedc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677009498, "uuid": "b3a85aef-0cf9-4c0d-ab0e-c4f3765b9dd8", "comment": "Malware payload", "value": "6959627cd55afe30c2fd6e4a871132aeacf2322798ea4d9172b65f6f46de0d9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677009498, "uuid": "5ad365d0-1e55-44f9-9de2-75b7f4a28f8d", "comment": "Malware payload", "value": "c6798a6134d34ef40dbde6d14b922c78abc0ca1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677009498, "uuid": "98276dd4-e1b6-4ad4-a21c-2a7b7b3a81ce", "comment": "Malware payload", "value": "9979762bc78451e57755d26095cf88ec370d1c24fe56fc2a25916d4463f74bfe672bc265dfe5f74c36623f5c5df5ec55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677009498, "uuid": "2b3871dc-9593-4cbe-ba83-a40cd8a523ab", "value": "T14BF51212FF9618B9C06DC474C6474A729E2278DA0726F9EF45C412292F7ABE46F3E344", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677009498, "uuid": "bb6f3146-4724-4656-9ba8-790ee1ba3da5", "value": "7ed760a544356f2402219a3e05245cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677009498, "uuid": "d9d91a76-99e5-4993-817e-fe669cc47304", "value": "98304:JMBZq1o3K/YaZwhj4Fys9MowDikr79Inl:uq16Kf3ys9MoM57G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677009498, "uuid": "a1956f03-f0c2-4740-bb2c-fe10dd63a525", "value": 3337728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677009498, "uuid": "ebd73606-d191-477a-b670-2e287482309f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677009498, "uuid": "cf0197c5-89fd-4c16-a1b4-6ffc2bac3971", "value": "6959627cd55afe30c2fd6e4a871132aeacf2322798ea4d9172b65f6f46de0d9d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f2212a8-b1ea-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676985623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985623, "uuid": "c947f37c-d14d-4c4b-a31f-bf12c8ce8636", "comment": "Malware payload (Formbook)", "value": "dff3d6417aeecc465378554ac8e1cef9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985623, "uuid": "d56726d5-bc88-4dff-8d88-0dedb745fc82", "comment": "Malware payload (Formbook)", "value": "6962c8773218a9a75d08204d9f509f32f21ec96dfa1c5bea5bd9345d8abba98c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985623, "uuid": "044ca3f2-8696-492e-ba95-65e973d0f29d", "comment": "Malware payload (Formbook)", "value": "56e3e97cfa5dd95fe46e7e3107b7ba9a3dc217bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985623, "uuid": "913742a5-a245-44c5-b6b8-c3eefe13e428", "comment": "Malware payload (Formbook)", "value": "be6f934e3af65aee0248dccb666ff6deb2f1de14f096ec0c8ed62f4c56eb6fbe38db4e0711038af5bebe006c679ed9ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985623, "uuid": "7796d03f-c80a-4c6e-a93f-9cafbf8a2d50", "value": "T19325AE9A33B46073F5CB01FE5C38278C2E2076577619E26E9B77BB91A2749FB7284101", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985623, "uuid": "d0b3f004-8b43-4a6d-871f-2778aa05c0c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985623, "uuid": "154fbe84-7f68-44c1-8a8c-4b6659c8cf86", "value": "24576:Sky9IISrJ+Hlmb+5rsP4EnWsBOHC8Myzympry:G++5rPsDwymB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676985623, "uuid": "f515aaa3-0f3f-479f-8921-64b38e61b889", "value": 1007104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676985623, "uuid": "91716d42-60c1-408e-83e3-75c9f1235e3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985623, "uuid": "0a04a2fe-48ea-498e-b504-62ebb213b388", "value": "OR_HO1163_SKF_AH23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa7b5123-b1eb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676986125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676986125, "uuid": "f2545fb8-0975-4e8f-b53e-18a8130c8e25", "comment": "Malware payload", "value": "9859ff63359a7f701c8b6f50e45c1dfd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676986125, "uuid": "4296ff29-4b14-47bf-a2a6-4f8cd4b334fc", "comment": "Malware payload", "value": "69ca8a3504eeebaf8a581f21e31f52725fe70d69fc9e619d753ab8c4c7a358ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676986125, "uuid": "aeb26e29-8457-4a26-85b0-307288e322e6", "comment": "Malware payload", "value": "c0f9918870826ba82222c33d4f47876f7680532d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676986125, "uuid": "ffe0eee3-77e3-4df3-9b4c-b9781211b012", "comment": "Malware payload", "value": "c162c06e1af474c126d78281b108ec49abce61a7e92790fab8ff021206217a6dd2c02ed7c1d72aa833b128a073868a5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676986125, "uuid": "84580e7f-fedd-4f40-bb4e-39a53172d481", "value": "T1EA336B217590C032D8A225300874C2719B7B7D225A759A877FE85BBE9FF13D09B2D37A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676986125, "uuid": "8b3109b9-af21-477a-8773-76940e791640", "value": "62b2122782640bd9c89fc5c1f765b728", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676986125, "uuid": "eb1512ee-3b43-43af-b6f8-de49b5632d8b", "value": "768:3O6YLGNhsSTMbqsPgQOdhXT54ZbsSqwrdDUapBjmxGlPhEDpPndrdqkMRI:3gWsSY2sPgrNss9wrd5BPPUQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676986125, "uuid": "e8e42da2-e8d7-467e-b6ec-db1478c32ff3", "value": 52224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676986125, "uuid": "4518398b-eebf-49a5-8373-44466615e9df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676986125, "uuid": "838b28d3-c85a-404d-a2d4-5877d7b6a051", "value": "SecuriteInfo.com.Win32.InjectorX-gen.27058.31366", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "839a11a1-b1ea-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676985630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985630, "uuid": "914e705f-1e5a-4c37-81de-fc93c01ed241", "comment": "Malware payload", "value": "c5688b096d8108174a14ec3cbb5edb3d", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985630, "uuid": "ee10982c-8698-4eb4-a4d3-b969509891d8", "comment": "Malware payload", "value": "6adfe5b4b574e0665c0e59b2c3be39bf51be16a755e0a35b2d7f967bcbfdcd26", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985630, "uuid": "102c3f9b-7e44-470f-931a-2b0eeb70a5ef", "comment": "Malware payload", "value": "ccf38a5cfda5ea4103326a439b61297f1c8a535b", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985630, "uuid": "d8ba0e4c-4971-43d8-9ed8-b358ce6037ee", "comment": "Malware payload", "value": "2d4d6bdea8344a6b56f07f6486d256c38b11c42ed2660fd892722f6526b4a08716c998e279c89e7e6f6756b4cb6857c1", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985630, "uuid": "252d21df-a8c2-4fc9-aa79-e0f62be2b44b", "value": "T10F35AE9933B46073F4CB01FE5838278C2D2176577519E26EAB7BBB91A3719FB7284201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985630, "uuid": "f3346a48-5cb9-48da-a1ed-64fc30008b02", "value": "24576:Vky9IISrJ+Hlmb+5rsP4EnWsBOHC8Myzympry:V++5rPsDwymB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676985630, "uuid": "9e1ff8d7-d2cb-4fdb-a6a5-aa613f78008e", "value": 1069056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676985630, "uuid": "f25cf413-4266-4942-b84e-d1e187cc7a5d", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985630, "uuid": "5f0281e1-794a-4b67-b2bc-e2b46a1b308e", "value": "OR_HO1163_SKF_AH23.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61cbb5b8-b1bb-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1676965387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676965387, "uuid": "81d15cde-d48f-4649-9b95-d88bc2838de9", "comment": "Malware payload (RemcosRAT)", "value": "2dc05009b77754c9b2ef8f1117858ac9", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676965387, "uuid": "885cb244-b891-48a2-b119-12ec2f3a30de", "comment": "Malware payload (RemcosRAT)", "value": "6c59d0e3c10e4901486725fcdd4fa986d2ff808525133de66f14460f715c71cc", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676965387, "uuid": "7eb00dba-d6d7-4914-8e7d-a92e067589c2", "comment": "Malware payload (RemcosRAT)", "value": "809f734ed2aa31c17eec48a819ab1e029159e893", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676965387, "uuid": "9e2a1c64-6bbc-4244-b586-44c83c62ea37", "comment": "Malware payload (RemcosRAT)", "value": "05d36698cc0579bdc7d61f60a566703538e736b6d66f396763292443864b9ef97a3a1896d9957221517a1c5ea85cbdff", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676965387, "uuid": "378c9fe8-0689-4a44-b4ce-83fa80af7290", "value": "T1F7C402283A8655A7C07867CDBF43F0BEBFD238F5561820D5B3E0F2938848559D962E74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676965387, "uuid": "4bb0fb55-fcf0-41f9-954a-48663157cd42", "value": "12288:ve/Y7p9njJWS8TL/OHmciOZu09FOyX+bjijTDgD:G/sp9njJW7qGcimVZwGgD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676965387, "uuid": "5dba49f0-7260-48f1-bdca-c8977b45d343", "value": 551667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676965387, "uuid": "0192ebc3-82a5-4983-a255-863305256bb7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676965387, "uuid": "3794945b-4758-4732-bb49-56374d10f6bd", "value": "DEPOSIT GRUPPE.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0e22bd4-b1db-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1676979317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676979317, "uuid": "13542055-04c5-42a1-8030-26f6fa3a6680", "comment": "Malware payload (LaplasClipper)", "value": "4e1d3b852081588e65fa84fa25c24de3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676979317, "uuid": "ca246fc1-1190-4892-9d83-7e89a1a5e16d", "comment": "Malware payload (LaplasClipper)", "value": "6ca49ba42f95b240f28ffceed2de0ecae7f1b70cae703fabd569082b17d1a722", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676979317, "uuid": "42c10e95-b46c-4579-9d6e-d71ec42675cc", "comment": "Malware payload (LaplasClipper)", "value": "58b384db9659fc8f6aefb70a288addccc27da330", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676979317, "uuid": "6e6277b8-c6b4-4713-9191-d0ea844959a8", "comment": "Malware payload (LaplasClipper)", "value": "8e6f7f598d3a0814f3486282b97502d4df549656b729d46b3b2f9353d91d6b8bd34336b1ad8752ca2095648e4e7d98e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676979317, "uuid": "76d9c364-506b-4ea5-b286-e61bba34d508", "value": "T153F3C03336E0C072C1E7563058B096A26F7AB8521B7585CB6BA8173E6F706C19F753A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676979317, "uuid": "f735eb13-4269-461e-a266-cac0053ba3dd", "value": "3b9c426a6fdec2cb62dc7c138a0d2616", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676979317, "uuid": "fc640fc8-2ae0-451a-a512-8ac410d1eaff", "value": "3072:CKrdcqxmYIYNPqRS8oxBFZ8Gb5+S11J5wGz:CUdcq1IaPquFZ8GUYa2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676979317, "uuid": "60330f57-4f31-43b9-ab76-2859eceb45f0", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676979317, "uuid": "15270d71-bde1-47cf-935b-7697a9a85590", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676979317, "uuid": "05511ed2-709b-43ef-a878-63398a8ad764", "value": "4e1d3b852081588e65fa84fa25c24de3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67fe7eac-b1b5-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676962821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676962821, "uuid": "d766a5c3-567f-49ec-a0f4-0331f1a40933", "comment": "Malware payload (SnakeKeylogger)", "value": "74efb4b8017372cda7f592eeec459b39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676962821, "uuid": "13e681e8-c6ac-4f9f-babd-6b87aec6434c", "comment": "Malware payload (SnakeKeylogger)", "value": "6d2189719085c6f3191fd868643aae9449bd49c5e6a0076f5112b7281130b99d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676962821, "uuid": "10df90fd-9b55-4353-bbb7-edeb16472c83", "comment": "Malware payload (SnakeKeylogger)", "value": "7861b25d883d9270213ae9eac3e5391fccbbb07d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676962821, "uuid": "01b3b44c-c342-432f-8e8d-9c9c83187dca", "comment": "Malware payload (SnakeKeylogger)", "value": "0962e33c676ca74152914248f506db4f69ee0fa34444a96b154d52d9e39e4f9f47cbfeec2ae6ed897b244e13c7e2f6cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676962821, "uuid": "d4788f73-1510-4fdc-aa1a-0c7505e84c2b", "value": "T14AE4E23E39B653D6C238FA6346E7E520B6BD50923303D958DDD61AC04F81582BECEA5C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676962821, "uuid": "43f4b902-2a1e-496d-9c33-33f564b1032f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676962821, "uuid": "0ce593f8-3056-4f26-be95-ce058ae574c9", "value": "12288:8aRIkegET9jsIBMNjnNNOhAe/S0rdYg6VTMNnx3L2j7ZOI/7UjYI0XzkSpoDcBGI:eTsIBMNjnNNOhAe/S0rSQN8j1b4YRY1r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676962821, "uuid": "9af5af5b-72d8-4bd8-a8aa-7c1d1e608f01", "value": 692224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676962821, "uuid": "dbfc0f8b-b7f6-4d32-a9eb-026cae9a3c15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676962821, "uuid": "23f63631-7c2d-47aa-a0f1-ebddf6c9d689", "value": "RFQ-INQ-ATV-HV-001-1098099898.zip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55d7cbc2-b1f0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676988130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988130, "uuid": "941d11a3-893d-4e57-b9c4-9c7b65ae3374", "comment": "Malware payload", "value": "4a8d678a7c09cca89a6a3c0214b7f124", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988130, "uuid": "8f18d7d7-51f0-41db-aa40-5d1dfd79b6c0", "comment": "Malware payload", "value": "6db45a2a365127c83431dad4929cc501f3ac9bc437a933f8b232228096aea114", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988130, "uuid": "cb277dbd-6577-4141-bd4e-07b6bf33f148", "comment": "Malware payload", "value": "c806885c939cc5943dffb6ec9b72caa3f1051787", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988130, "uuid": "05e74af5-2a45-4c02-8061-adfb109712e4", "comment": "Malware payload", "value": "139ab820679000086a2238d5bbff6b76e5886b47361e20a1dd118227fe8cdf6c51bb6914d1afadbc6e933d3a503860b1", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988130, "uuid": "c0d2ede4-7894-4c6d-a4c7-21648d0e1aa8", "value": "T143338E41DE67120C852F2F6AEE420E98847D991A65326938FDED0BDD74836BCC27F634", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988130, "uuid": "b33be2d9-b659-4917-8dd2-c022cd8155e2", "value": "1536:ovJkg/q6aQsN8mwVFmc7rOJf1ERZt0y4QpsQqZo7PWhsfKXSQrCAXqVoPPlFNesR:j6aJ8TVFmc7rOt1ERZt0y4MsQqZKuhsC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676988130, "uuid": "afa366aa-958b-4a5b-abb5-14f7b0b768a3", "value": 54906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676988130, "uuid": "ed1f94d9-77a4-432b-88e2-381285654214", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988130, "uuid": "bf1d8f7f-0de3-4291-869b-75383f3fbcda", "value": "110384846246.GenesisAWB.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e19bd5e-b1db-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676978991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676978991, "uuid": "e155fce8-acbc-46f0-8c0b-3f79aa038de4", "comment": "Malware payload", "value": "e55e497ceadd037254e847187b6996da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676978991, "uuid": "2d7ab1b9-7e47-4dec-b59b-2051013bacd9", "comment": "Malware payload", "value": "6fb82ca662f7e3f55cdd0f930507f2add996eef09c0f60a9924f469648c915f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676978991, "uuid": "4ac76441-3f63-49eb-a55c-f810ced7cb45", "comment": "Malware payload", "value": "bbb72cc9d9a8a24ecc0ab658f5cb958f1ce5cc1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676978991, "uuid": "f380370f-c608-41bb-a772-a473bb783e21", "comment": "Malware payload", "value": "c8a86993261f14a281e23301cb28f8f0bc2647afd5f93682eafeab3f8e361a2e45052bc8e4061789b661f18b63f2eca5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676978991, "uuid": "f1189e3d-53ca-46f5-83c6-ab6b2e2adbdd", "value": "T1BEE62608B899E329E54A2E39DEDBD0759A193E0BCE40111374D2B76FED76908C3EC45E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676978991, "uuid": "39c5d385-e5be-4fbb-8318-479af775a6ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676978991, "uuid": "b7786963-6d9a-41a2-86c0-4bcda8950057", "value": "1536:sM+IJu90b95YnXeLwvpppppppppppwqbetsx/WLBw4vmEDTke5oAUNdL1MZP2uxE:sM3Ueb95YnXEw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676978991, "uuid": "07e17ac8-75f2-4736-ba16-f6f5341ff535", "value": 14723072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676978991, "uuid": "55ac7fb7-0daf-47db-bae8-3d9942d9f6d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676978991, "uuid": "7e86bbfe-a82f-4303-b35c-4f4ceeb45112", "value": "SecuriteInfo.com.Trojan.Generic.33214581.30909.31148", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb321953-b1ea-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676985723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985723, "uuid": "a92fd037-c6f9-4325-868b-a28999169434", "comment": "Malware payload", "value": "7d23dac5ad7e2c356643cac87947d87c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985723, "uuid": "35eb12ef-4a19-4c2c-adcf-2ce4c7f6b69d", "comment": "Malware payload", "value": "7014118b071bb5d4bdad0934a5486ea8d0ee2307b15e84bb88f7207a30522bb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985723, "uuid": "cf314467-5a38-4cf8-84c0-a64ffdfc6ce8", "comment": "Malware payload", "value": "be623464311835365654f36d76801982ae213bfc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985723, "uuid": "1a15118f-c751-4e49-ac84-9b66e6f6068c", "comment": "Malware payload", "value": "ffff2b72b7a6594656e6910dae5b53ff496d354e1c604f1c748d095a4bdc5dd9f7e8c6026e4c90df941c7cca5598a500", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985723, "uuid": "0986efac-7986-4c9e-b217-5a301b4ce44a", "value": "T13975BE5ED9B35F8FD6295A38840E0E023026C7C598BDDB496A9AED3C319458FD3B9331", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985723, "uuid": "6e17416c-286e-40ea-8161-d62945849351", "value": "24576:b5/K7Jk3yEqPC1ML1IXBWTAcCrnAS7HaCV6ZPh/wFWyXG6Cw5lKudy+S:b5i7JRx1lZKnJ6CV6ZRwA015Tdy+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676985723, "uuid": "f21bcb5d-ce9c-439e-a8d9-bdc7b321e95d", "value": 1572760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676985723, "uuid": "0e73f2e4-1ce7-4e49-8333-c62e75c6070b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985723, "uuid": "48ca6cad-f6a7-4d9b-be70-0eb830bb6767", "value": "compra 3100332005.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fafac39-b18e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676946164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676946164, "uuid": "f5795a28-331e-4f64-a0ac-84b95e2a9f13", "comment": "Malware payload (Mirai)", "value": "c4b476fdbe720f607143556c630d2f32", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676946164, "uuid": "fd8cb7f2-5718-40b5-970b-576ca4ae01c7", "comment": "Malware payload (Mirai)", "value": "7018cf03791afe56c5f50e8c50cc73ee176f2e35b0ed21bde46a92e17756ee6e", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676946164, "uuid": "dcc63c7d-bdd5-4a02-b6ff-680f053eff93", "comment": "Malware payload (Mirai)", "value": "81a6a830797d74b78f5f8ae630d897e0dfb9b9cf", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676946164, "uuid": "fcc650c8-4be8-4423-9a62-ce94e4f01e21", "comment": "Malware payload (Mirai)", "value": "1b7f9638d50b2132a63ca71c59d28a8d50c39570a95adeb1c00558e04d7ec635ef97b2e2ba1f4b6913ee47705e603bda", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676946164, "uuid": "bbbc5ea5-e3cc-48c4-9470-dc30306fb57f", "value": "T1E2333B03B98280FDC15CC274576FBA36C873B87E0339B5AA37D4FA266D46D611E2E905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676946164, "uuid": "00aa37af-9e64-4afd-8dad-c12b73ba1955", "value": "768:JlDVAvqjbwNRaNVq5FllnaT7vqXpeFTWMHCVM3lYtYErn6FTENNqEv:rJCqjbwNRaPq5FllaiX8zH7Ej6uNqEv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676946164, "uuid": "4d850bdf-3614-4e24-bd4e-423818c8a8f5", "value": 54592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676946164, "uuid": "3b11afbd-7b4e-4c8b-abd1-fe4d24feccbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676946164, "uuid": "3fff2134-4562-45c8-b8a8-d5000ccb8649", "value": "c4b476fdbe720f607143556c630d2f32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "554d3879-b1c4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676969232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676969232, "uuid": "7fa39b25-ae76-4676-90e9-53d3d7d3f9d9", "comment": "Malware payload (Formbook)", "value": "84768f999455afd498c45d9a11e2c240", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676969232, "uuid": "906b93c6-35fd-4696-9a1c-7a77089edbf2", "comment": "Malware payload (Formbook)", "value": "715aa59e7d1e568ad1e76c6ede8c762ec5d671723439d131f6b638c025fd7cb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676969232, "uuid": "a9a72f4c-bbb5-4356-a208-d3d3404af380", "comment": "Malware payload (Formbook)", "value": "3a7d5fd64d1ffc7271187893f6afa8ecb17103ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676969232, "uuid": "a7c2eef3-4ecd-4629-a938-dcbb55b4efbb", "comment": "Malware payload (Formbook)", "value": "494ea8ae9b3823b54126cc7073716581e0992d373e126081818a92bdd40141849a18c7f113d2e1f400510455ce21d873", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676969232, "uuid": "0138a34c-fa53-4ad0-9380-55b0ac1f08a0", "value": "T1B6451202BAC1C6B2C26309726966AB24667C7D601F79CEDF7384369DDE311D0DB31B92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676969232, "uuid": "a994ae1a-3d3e-43a0-8c1e-0ec066050e35", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676969232, "uuid": "60c8f2a1-bd4d-46d1-9c28-3a338aceba09", "value": "24576:ETbBv5rUVGgovq8oUv52+oiYqfPBvfG0BC3+speeCjV/YY2JqBKMPd:2B0ov/vtvZPFG4C3Rh3Ib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676969232, "uuid": "4105accc-99f7-4a72-8e16-e5a89806d9d3", "value": 1194443, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676969232, "uuid": "ae5109a7-1b31-410e-90db-231ebcfb3e4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676969232, "uuid": "a07b482f-5c8f-4e44-9046-ed74b22f4c76", "value": "RFQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fd4f6c7-b212-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677002723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677002723, "uuid": "f7a1138f-05cf-4dab-b390-65f86deba1c6", "comment": "Malware payload (RedLineStealer)", "value": "c77267c4ceac0118a6d0617c05642286", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677002723, "uuid": "d33b559f-7455-496d-bd6a-1483c9c88e74", "comment": "Malware payload (RedLineStealer)", "value": "7458552d7c845c70b436f63923f8d78954f6fed891be8aa275bf8a5a5bc7af3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677002723, "uuid": "c6c75b5e-32ba-4ff1-abd4-6be4fc8eb69c", "comment": "Malware payload (RedLineStealer)", "value": "d4052329448f2ba04ae72a2a2c4ff2e55065a96a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677002723, "uuid": "265f13ee-3b38-4bf9-be4a-851832390232", "comment": "Malware payload (RedLineStealer)", "value": "1a327623491fa50a27b30278edf0b063064b919189eaf5a9f0aed14f73682e137109783d00e12da5124fecb0997f576c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677002723, "uuid": "6ab8f895-7b40-476d-b3ce-b02d18d6a908", "value": "T1EE04C51437FCCD11E1BA2A3F6961A05147BF98026852F25B7AC367CD1E32B40F957AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677002723, "uuid": "d280d8b2-223f-4d77-aed7-b995fb4cd379", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677002723, "uuid": "5abc7887-a3a4-4dc8-b35f-8e50c153cff6", "value": "3072:AxqZWJBaKULo3kx7IeJpemc9Thg/xNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOV:uqZIkx7ZJETh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677002723, "uuid": "6106aa87-ce3c-4af4-ae82-4923437a3ae2", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677002723, "uuid": "fde5107c-1919-4581-a238-72508e62626b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677002723, "uuid": "8e051eba-38be-47bf-b3c8-8ea0e5019ddc", "value": "c77267c4ceac0118a6d0617c05642286.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c55a51c0-b1f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1676989176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989176, "uuid": "c2044a8e-7f8f-45dc-9c10-94896de0e448", "comment": "Malware payload (Vidar)", "value": "a32ee68cab7021ae6aa6e16e8b70a9b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989176, "uuid": "4079f013-fdd5-4237-99df-1eab005eafde", "comment": "Malware payload (Vidar)", "value": "76d3b8781abaea750616e4993cdc85696fb12b5d0afb7ef66853f604d141758f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989176, "uuid": "a618c719-2bdf-410d-a330-5c08ac61560c", "comment": "Malware payload (Vidar)", "value": "22e86ec447a074098e19e3f686c373dc53aaf9f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989176, "uuid": "1b01a9ac-11f0-4014-8af4-df1e2fdc8f9f", "comment": "Malware payload (Vidar)", "value": "6fa72cf8af7b80cb36fd728d7e1acf1ab8ca75b09951614ddb430a71c6f8744fa05803f2450736d2a594eda1a651bb62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989176, "uuid": "f81bcccc-a2bb-41cd-87b6-e7c16479f1a8", "value": "T10B64F11075A0C1B1D99A46748425FAE96D7BBE306A34D9CB37A4237E0F303D19A363DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989176, "uuid": "3e2b9eb4-e5c0-42be-8484-b9576e3ef7ac", "value": "471967c5dfd2336871d1f235e7099fa4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989176, "uuid": "96b0e796-5ca3-46ce-80f5-a67fef67b668", "value": "6144:4SQDLbYaw8NPIXh+FjImhk0oV1a09pvIVrh20HpDPIXbwLvw:0D3Yj8ZDFlhkDV17Arh7BIcLvw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676989176, "uuid": "987ae9ed-53f5-4532-a5ab-2cc31536d82e", "value": 330240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676989176, "uuid": "8fc65f96-17e5-4768-8bef-fd2b8a426e7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989176, "uuid": "738ac6aa-2d4b-40f8-be07-c4f1bfb283a1", "value": "a32ee68cab7021ae6aa6e16e8b70a9b3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cce053af-b1f1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1676988760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988760, "uuid": "b49ba7a4-3f44-43f7-8879-f2d550fcaadf", "comment": "Malware payload (RemcosRAT)", "value": "d3a2dc4479967bafb3d2b796cdfb6cda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988760, "uuid": "fb670ad8-c1b9-408a-a55b-ecc5e9371ed6", "comment": "Malware payload (RemcosRAT)", "value": "777b1fcf106f094c989933f56d47f1c411be0382ebf7c5836c2c64399b0bbe73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988760, "uuid": "adfd41c2-1cb4-4a62-aba4-68f1ee70361c", "comment": "Malware payload (RemcosRAT)", "value": "7bec687c3e9ad25fc2c038ef7fbaf1d0b1e05f7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988760, "uuid": "29d5ecfd-1294-4789-aa1d-f98796b8ae86", "comment": "Malware payload (RemcosRAT)", "value": "66dc517bc2f9f8324fa35dfd03ab29808c54d4ca7df428f5a6c5a82a134a210c169131a948703a997f8daea009af06f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988760, "uuid": "b1129003-e323-43ff-be24-61551ba49c52", "value": "T143B42304B7848E73ED7707752E294E0F7BB955362A81520FC3804EE9B836A84B32F316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988760, "uuid": "c36cf811-2957-4234-a491-a51c9dc36a0a", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988760, "uuid": "cd0cafba-0ebb-4650-ab7b-e9f39b5ddcf9", "value": "12288:/YrFaibfQwXaItQ7XWADVmMQZY2gudvaRosfL1N+GyignxA6jekfmn2A:/YrYibVaISFpmhY2NaisziGvjE6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676988760, "uuid": "5d7e361e-8c4d-4445-ae5d-1cccbda724c3", "value": 506511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676988760, "uuid": "1cd33780-674c-474f-ab2b-772378bde0e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988760, "uuid": "3b6e9478-86f3-417a-aa6e-caf699a207ff", "value": "SOA FROM UNIBEST--JAN 2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6afa3a6-b20a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676999433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676999433, "uuid": "5182b255-e01b-4423-971f-cecbee551142", "comment": "Malware payload (AgentTesla)", "value": "089a989b8d2f9544764e65f16d33b070", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676999433, "uuid": "7d1011b0-68c7-4e4c-aeab-cea3e37dc60d", "comment": "Malware payload (AgentTesla)", "value": "77914b701e7bd437779738d4369ef9784816ca7d84699d331cdee31012e1785d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676999433, "uuid": "58416b1f-a781-42a4-8209-99926a00d3b0", "comment": "Malware payload (AgentTesla)", "value": "8a7f00c67b5f716db5afc831bd855f464a4ef200", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676999433, "uuid": "7eeda8e6-9403-458e-b823-a3169a291b42", "comment": "Malware payload (AgentTesla)", "value": "fa39fa86d606808921a4eb9caf1154be511d72a25279e0ed2cb82a7afe264d5e7ca0bd26653bb450b775a50eb89b0985", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676999433, "uuid": "53fe1861-c9a8-4c80-b4df-0de6450cce51", "value": "T18E452381282C4773E57807FC84AB80D5A3F671716240F6467EDDE1E52F8BB9886B950F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676999433, "uuid": "758b834e-5d12-44b0-8178-3a9d91e5f244", "value": "12288:Gje06/FkYV7mkXfZkRAxu05YE4WPHxtsruhgJ:Gy/FkqqRAxHqE4cc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676999433, "uuid": "a6c717ff-d1ec-4a4c-80eb-fdfeb4ae10a4", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676999433, "uuid": "c461b0dc-f93f-4854-8ce6-5fc19c6be737", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676999433, "uuid": "514070ee-7f44-4939-bfb7-c5e6ef3c9ccf", "value": "PO-000001306_1.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c279130-b1d2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676975310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676975310, "uuid": "115f5f00-1a37-45fc-b9a1-99ec914bcdf5", "comment": "Malware payload", "value": "0d049f764a22e16933f8c3f1704d4e50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676975310, "uuid": "09c5adc2-a919-4741-ae12-970624c00184", "comment": "Malware payload", "value": "77d6f1914af6caf909fa2a246fcec05f500f79dd56e5d0d466d55924695c702d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676975310, "uuid": "05bc245a-8651-4fa5-896e-b65476c8851e", "comment": "Malware payload", "value": "5faad57c7341f76c18ae813e9fa9fbfe434f7b41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676975310, "uuid": "49c8015f-3a35-4cb8-9561-d5a67935d3e3", "comment": "Malware payload", "value": "80571a8ac6ea11d9c51014769824a71e6629ae5afbc48ad13f8d1566bbc01835a37d281028f628ccfb4174a52bf48fd2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676975310, "uuid": "155f0e00-37be-4250-b364-85ab0afcfc32", "value": "T1B583E729E672A2F7C851C5BC31095AD6A23A4975305EE483FFA45F82BDF00825DC8F97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676975310, "uuid": "29725aed-6039-492c-88ce-5cc4db9dc3c0", "value": "3ea275f08a220b994925af0527312bae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676975310, "uuid": "de21a790-1e50-4456-9815-56f1f1b46630", "value": "1536:yYsVdxtfVnAo5lg/qrZ7B2QVu0BZFQLtqhG6ha4kUYXKl2WK:yYsPPAo5lg/A/2dYZFQLUG6hTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676975310, "uuid": "94578ba3-7afb-4c2d-ba6a-cf835dc5b051", "value": 81408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676975310, "uuid": "4c3bc134-ead1-49ef-90c6-7274cf8845f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676975310, "uuid": "e76bddc8-29be-4ae0-a635-f327d785e4b6", "value": "stealc.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a073790e-b1c9-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676971505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676971505, "uuid": "dc9be068-3530-457a-9ba9-ecfecc2c0d30", "comment": "Malware payload (AgentTesla)", "value": "703bd2f480bf1c40f2360959efd10990", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676971505, "uuid": "94debfbd-bac5-4065-a2bc-085fae3f5ee8", "comment": "Malware payload (AgentTesla)", "value": "780820fc83c352314c4cc0dd4f09b486b8fc95abc03857211d985737fbf267ad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676971505, "uuid": "df42779c-6943-4e6b-b138-17c7d172a6eb", "comment": "Malware payload (AgentTesla)", "value": "6dc845c604d50cd072a3b6490aa1baef125612ef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676971505, "uuid": "e3354bcd-ceeb-4c7f-9a44-71d9254fb394", "comment": "Malware payload (AgentTesla)", "value": "0e2880107662ac5975a32cf8313eed2e26e2ddb589f53b2e16415d4aed62a01dc05336d34830cb4b51d7bfe879f58c0c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676971505, "uuid": "075723f6-f158-4e4f-999e-a80401192b3c", "value": "T1C925BE5977B46073F5CB01EE5838278C2E2035577619E22FDB77BB92A270AFB7298101", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676971505, "uuid": "d39cfc32-dda6-4df5-b0bc-98ea04bd35bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676971505, "uuid": "e808e9ec-4240-408f-bed9-bae9899ce83b", "value": "24576:Pky9IISAJ+HlQSLWKrmnr+nEOQ+hy+Z3+N77JnXp3Zs+R9uFYZDa:0qr0Er+hDaJ9ZmYZDa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676971505, "uuid": "b3b76218-7ef5-4c60-88df-bf2a6c8ddd43", "value": 982016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676971505, "uuid": "1a2e7bda-b762-43e8-b18e-b43177e20e6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676971505, "uuid": "f3f89d33-ce53-4541-8cd3-7d790cdb1d7a", "value": "prosperzx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "987de31b-b1ea-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676985665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985665, "uuid": "f30d4ddf-845d-43d2-b6e8-fbd7e3b28c8f", "comment": "Malware payload (AgentTesla)", "value": "9f6ced9ad495662132723d995330222a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985665, "uuid": "012bca8c-4f1a-4b14-ba8d-572a8458edbf", "comment": "Malware payload (AgentTesla)", "value": "7870fc0f2fdeb1a6d5c5a713da63a813078d07e49d55adb031cc6bbda41ea9a0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985665, "uuid": "2d8c5bc8-0fbf-4c93-8014-771596ed3bbd", "comment": "Malware payload (AgentTesla)", "value": "e8f9ff244dc47a7276f2e2edb43d84f8c36fbbdd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985665, "uuid": "4f57b861-a4fd-4c4f-8f9a-33dff0638f68", "comment": "Malware payload (AgentTesla)", "value": "cdf563057e8d7eb6f43456598db633892601f1cf97fc09a09d5748de484d0b96307bca04be0c6efc536d8ffab3542733", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985665, "uuid": "31b78be3-ccf6-463e-b1d4-8b2fe153c446", "value": "T17125BE9977B46073F5CB01EE1C38278C2E2026577519E26F9B77BB92A274AFB7284101", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985665, "uuid": "febc8459-e656-413b-923a-8608015263e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985665, "uuid": "bc814323-514d-48a8-b3e4-67794128e8b7", "value": "24576:Dky9IISnCgw7eYBgCtGjYxIH9KoMaQCcpekyIzJ+Hl:Jgwy2gCYUx6KXZQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676985665, "uuid": "af9814ff-d362-4fbd-b30c-334b20733cf6", "value": 987136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676985665, "uuid": "34baf601-be86-4140-bae6-b1a2d17ed9c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985665, "uuid": "7ac4fee6-51f2-496a-a3e1-400e9621c6cb", "value": "RFQ 1918000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c223ed6-b1b7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676963579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676963579, "uuid": "e5771093-f9ec-46f5-ac87-f92079a91337", "comment": "Malware payload", "value": "94d3ed8f240ed67551879fc0c2734eb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676963579, "uuid": "cd28a983-b71c-4e48-83d5-f457f28815bd", "comment": "Malware payload", "value": "7a104ae81acddbdc5a68e27d4eccf16765f9fc11ee45bf85541600cb61fe6830", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676963579, "uuid": "dc88f967-1983-4297-949b-62614cbd8eb7", "comment": "Malware payload", "value": "bfe4163d6387d5a773a9b5f737b42a6bc7217d72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676963579, "uuid": "f1867afb-421d-44dd-93b3-906cc5dbd519", "comment": "Malware payload", "value": "b9bed2a97f1b6fcf10cdbe07fef126788d47ef5ef9fe7592d6ab5850b40008231645c220861f27f0a509e244b74a4906", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676963579, "uuid": "17ecb6b0-775d-4018-8419-15ea80efb29b", "value": "T14935125066B8D74AEA9E83F54463808117F8A13B9561F36D2ECDF2CF35627608121FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676963579, "uuid": "896d32e2-9be7-43d0-bc6d-32aef2ddba7e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676963579, "uuid": "6f362e7e-f442-4455-9e1b-5a9eb15d666b", "value": "24576:d1Qwx9pjLUw3UPIX+ExSasVQarC54nOjc1o85mQVvV1FgrYE:dxx9tLzkPNXVpEY1o8AEvvF/E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676963579, "uuid": "5b291cf6-380d-451a-b6d1-b0468a622301", "value": 1094656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676963579, "uuid": "f7016550-b9aa-4d51-9993-7bfee423a758", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676963579, "uuid": "a8b1cb37-b26b-465b-a581-6007c98ad930", "value": "Payment Copy of $15,000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21698629-b1e5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676983318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676983318, "uuid": "92342520-2482-45b6-a8e2-bb7f28f3a8a8", "comment": "Malware payload", "value": "fa850dac17799e4b5c82ba1adf2071e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676983318, "uuid": "d47fd297-f7b5-4a1e-a726-7c6f8d49a639", "comment": "Malware payload", "value": "7a28526e7105b4f90065c480779e14ddeec9c55deaa854a25d26b9e9bcef3d85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676983318, "uuid": "698ad120-91b2-4c47-a1e0-04097f81a65a", "comment": "Malware payload", "value": "95d4c7395219151057d1a454222a1be378c1c746", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676983318, "uuid": "108e5e62-2a0a-4e5f-9dea-34cbf1defa11", "comment": "Malware payload", "value": "243886fec2ed5e5a5cb0c1d8bdef3beac7841348b4aedcbfb4639d0d38d6eacc434198bd0e7eb95bd22ffb65930f88a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676983318, "uuid": "06ebf71a-bcb2-47b6-9c06-5edf55e9418f", "value": "T113435B1237A1C03AD4A302345D74C6520B7F7EA29EB4C2473BE41B5E5F721D6AA293A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676983318, "uuid": "437d2eac-6c3b-45dd-86b9-3bea623147ab", "value": "e660360e9b49d39062886798924e4f6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676983318, "uuid": "5aa7c9e5-25f5-4a2e-b6a6-542a3c6eb794", "value": "768:LHahwAwLz1dXmpCL6eTdG5eVP5ubYAOEjYMNWZDiSrr2INKoWTB6Y/famem:LHt1GW6eTd2eV5kFmdoqme", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676983318, "uuid": "72f2cd6f-a384-41ef-894b-3b2ac5363707", "value": 55808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676983318, "uuid": "29e9f5f9-3703-4f3d-bd20-6214f2cefc3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676983318, "uuid": "09eb3a89-4a24-4808-8cc2-0b61f377fdfd", "value": "SecuriteInfo.com.Trojan.Loader.1312.23310.28726", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83b6b459-b234-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677017413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677017413, "uuid": "5e9fc9ec-9118-44f0-9804-03da63a21a06", "comment": "Malware payload", "value": "7e9a207d762d92de5d226e684a644008", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677017413, "uuid": "90b422ba-7c52-4fd2-b187-378e5d700f32", "comment": "Malware payload", "value": "7a51c9c3a7b0fd2514c4e774f623c59c2fe305a0f8d75ab8c51005bbc6deea52", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677017413, "uuid": "492d98bd-a869-433e-b5b6-a92cf083e3a4", "comment": "Malware payload", "value": "d93117e82a9a9e9d8c6fa6ef9ce7ec6a27c3cab5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677017413, "uuid": "d2e37c1d-1bfd-449d-8d54-d2d4c4ec93f3", "comment": "Malware payload", "value": "592011b8095d2f5db03e724f65cc04e4d7744f0f5edc598f90c7b485ad99ade48ec20d9224d229d104ad05e21f143d2a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677017413, "uuid": "1c388fc6-88f0-4ae7-9551-e1ed7ad1077c", "value": "T10124011236A09031D0A7273584B0D6A45FBEB932297045DF7BA8263F6F303D15ABD7A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677017413, "uuid": "35780a37-5e6e-435c-a72a-4bd8ae89b790", "value": "efd9cdece4321cb4de4c25a0cfc748b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677017413, "uuid": "8747ca27-711a-4712-bd16-caf6b729a559", "value": "6144:TOKDL7aCwhtqX+BJLiIReJUsnnZwQWnB9nSFJ:TOK7aCwbrB/eJUEn2nB9n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677017413, "uuid": "66e8ba0e-a833-4ffe-8578-ce4a9be0d1fa", "value": 215040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677017413, "uuid": "b7057bbf-ef75-4cc9-a7fc-6801a137452d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677017413, "uuid": "c7b42cfe-b3a6-4196-9e72-b77496726b86", "value": "7e9a207d762d92de5d226e684a644008", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6834e76-b1f2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676989232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989232, "uuid": "2e41ce1c-63a0-409f-bc11-30602ddc4458", "comment": "Malware payload", "value": "83d743e6efeaa7b32bd40d9f1ad067bb", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989232, "uuid": "217e9443-5090-4048-87fa-5ee48dfc3a80", "comment": "Malware payload", "value": "7a5e7b16f22d3407f31da3de8480c51864b7e91c7b21196bf7020bb96038ce7b", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989232, "uuid": "20220d8d-250e-45d7-bbe0-e37630c1eb71", "comment": "Malware payload", "value": "186f3b1aafcc4a8dca83c73ad7803c3ae7f30401", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989232, "uuid": "bb62f915-f80c-4f8f-98a8-0d7ff2ec4835", "comment": "Malware payload", "value": "9a0a4095a8655d98ac1157c0db3ce9ea3ecc8bcd4d5ae9f2371d297105dad25aeb07d9bdb7911b72bdce47476a315428", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989232, "uuid": "85d726a7-9633-4669-be79-a2bb6ebd6201", "value": "T18A250106E285D92BDC769530A887248382158CBDEC55CB4E32C7B32F9B32BF14E76D95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989232, "uuid": "e42e8125-8dd8-4896-89ce-c05f9ff91baa", "value": "24576:DFeHxzF82mPFeyc0hkHmJRTZQIRYBxI6qzy3LXXXXXXXXXXXXQXXXXXXXXXXXXX7:ByzWDfZ1ZKW6O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676989232, "uuid": "23a30f4c-3d98-4a44-ad84-10c5aa631d93", "value": 1020928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676989232, "uuid": "ebdfa3da-081c-4276-93f4-fe015ce1c84c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989232, "uuid": "98d8ce10-d967-446c-8e26-1761b2e86ab0", "value": "CWB_21.02.2023.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fed78500-b1f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676989273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989273, "uuid": "14f1f91f-f5a0-41a1-ad9b-b4633dbd172a", "comment": "Malware payload (SnakeKeylogger)", "value": "6442e892ff0e31df07469224655ea46e", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989273, "uuid": "61aad752-6a61-4c61-9e8c-4a60c8f8a51c", "comment": "Malware payload (SnakeKeylogger)", "value": "7be95ee6c7e6300e0668e3371b417c572cf9f7a2536a8b3babec05937a131362", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989273, "uuid": "57e51e90-887a-400e-8944-0700c39b335f", "comment": "Malware payload (SnakeKeylogger)", "value": "ad038f24f801acc4e905a31983d9108d64c0591a", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989273, "uuid": "7cc6eb53-7834-4345-97f3-605ffc068291", "comment": "Malware payload (SnakeKeylogger)", "value": "0a5d6eec3edc6b5f876dcfb1ec55ab2ee65a65b66faa5a73c9c96907d52a62ede7ab8892c52847742c37938ec9aa4ea1", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989273, "uuid": "84c7693c-cc9c-45eb-b0be-39d930e3dfcc", "value": "T1FE13D41AE78F02688F911277171B1A89AAFDB63EB35150B1345C933433EDC7D4266ABC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989273, "uuid": "00c18e9e-05ec-448a-9438-5b776b395ef9", "value": "768:jFx0XaIsnPRIa4fwJMfBU/lj6DDG5NaqFSd/CN059MxS9:jf0Xvx3EMfBUN8D+nA94056S9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676989273, "uuid": "8cbc8507-0b79-4bd6-af10-9ff320203e39", "value": 42946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676989273, "uuid": "43c355d3-5398-4fb7-9285-184341144868", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989273, "uuid": "51c73899-8573-4d4b-92d7-2eda56afd2bc", "value": "ContractID79754529001.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "929978e4-b1c7-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676970623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676970623, "uuid": "10194853-6840-4756-a9cf-6fde4a2d03b3", "comment": "Malware payload (RedLineStealer)", "value": "4b6b6f576d6834b5347630391e2805d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676970623, "uuid": "c04a095f-1531-4d68-a2fc-af06b0d61e50", "comment": "Malware payload (RedLineStealer)", "value": "7cefc4b4fb5d2232b288e03587adf6f1a171c8ab476a4f635753ae114dbb3005", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676970623, "uuid": "15ed7e90-b50d-4214-ad66-4fe30ed48ba1", "comment": "Malware payload (RedLineStealer)", "value": "814e366d46131121ed1da5b4c805ede534847697", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676970623, "uuid": "5b7cb428-7e88-4996-934f-5e9d481076eb", "comment": "Malware payload (RedLineStealer)", "value": "0fb7553df0252683489a0daa3ec4b1600a7eb9bf661144c7664f0d71bb987fa6e1319f247e65958e5774a7ffeb1145d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676970623, "uuid": "8b2e11fd-6740-4d15-b6ec-2dde3c46516f", "value": "T15285D049BBE5DE67C6487B39A0E213043730EE187B83E7138564B63E1DB33AA2D14957", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676970623, "uuid": "f24b2721-75bd-493d-bf0a-b31aebcfb491", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676970623, "uuid": "6c05e50e-351a-4215-bf49-882ae37e4866", "value": "24576:m9NMf7eAZcDPvazyT3LzeK9WCkAtJKPRwiv2hM7/zqVqS+DLMggzLItfx/7n:SA+Wz+339oui3sYlDLMBzMn/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676970623, "uuid": "ae20982c-55a2-43c0-ae88-e5f2a01d1b03", "value": 1844112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676970623, "uuid": "67443f96-376a-4adb-9f83-53873ba63dd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676970623, "uuid": "76119b5e-f51c-4b49-bf34-bd66e7a373f6", "value": "4b6b6f576d6834b5347630391e2805d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eebd84f5-b1de-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676980656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980656, "uuid": "34951ad1-d252-441a-b8e8-49ff63932c3d", "comment": "Malware payload (Smoke Loader)", "value": "7bca122d162ba47d561be706aa9a6b55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980656, "uuid": "5014c287-53bc-4935-9117-f35ec181af93", "comment": "Malware payload (Smoke Loader)", "value": "7e34427c5e75c608f0dab76a16cda2cd905ca138d05cfde4b544b9f7b1d55da6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980656, "uuid": "37851bab-691c-49c6-b7ae-4d72add92fcc", "comment": "Malware payload (Smoke Loader)", "value": "09a5432e7cf16ab7fa722cf22edd27a9532d3a92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980656, "uuid": "d351ed14-8f67-4cbc-a931-8abcfa457e92", "comment": "Malware payload (Smoke Loader)", "value": "95140bd38ef6a184540cb5b81b81b243c659eb9278ca59eeebc021e4c0dffc519bd1b53aa3dcebcc4ba59c47933eddb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980656, "uuid": "8fb3b57b-bf60-4a5f-8ee0-4da10d5f136c", "value": "T138F3D03671E08031D1B766F068B0C1B55E7E78211A354D8F3BA81A7E7FB06D15ABA363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980656, "uuid": "74a2d1e7-7419-425d-b753-e073c221a91e", "value": "f2d6b2352080e69423e108f0f791087d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980656, "uuid": "2db312f6-c350-4f22-a8a8-86af514d27cd", "value": "3072:RiJ3dDhCOABmRrcRIF2A5ik11azqCKCxGWVZa:EJNQOABmRrIY5ikebl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676980656, "uuid": "6a901327-8a4f-4169-93a9-a70e82c05a3d", "value": 158720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676980656, "uuid": "045f32c8-4f8c-4422-a57e-fa3a6d7c2f6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980656, "uuid": "726c84f6-359a-4b78-8cf4-1c39c51b7625", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fb22040-b1fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676992335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676992335, "uuid": "130069cd-b02c-4910-8c88-74bb16e70463", "comment": "Malware payload (AgentTesla)", "value": "b434d5088a51654c6341b6122c8d5240", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676992335, "uuid": "5ef38336-be3c-448d-a8cd-e934990035b9", "comment": "Malware payload (AgentTesla)", "value": "7eb652a8ae8849d8b7fb0f2cc9a0b6a591874c564c7ab275fe519ba37895a43f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676992335, "uuid": "4cae1da3-3376-4fe0-82ce-d91cd54a01a8", "comment": "Malware payload (AgentTesla)", "value": "22779548c825b6eb11ccaede05a5ab6cdbf3a602", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676992335, "uuid": "f6392f91-35b9-40bc-b966-3e2fe3f6d8fd", "comment": "Malware payload (AgentTesla)", "value": "b2c6af056c9357c294fccf58a8f864c9b2d6ec4e5bfc0586a194c9d932626462bc2ee4834b10919719c76352274094cb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676992335, "uuid": "566bee22-4ead-44ec-8ee7-29fbfbfab470", "value": "T10715AE9977B4A573F8CB01FE5838278C2D2075477509E22F9B77BB91A2709FB7289102", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676992335, "uuid": "45bbe95e-a7f8-441c-b145-ffcd06550b1e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676992335, "uuid": "87a5b341-91d1-4f41-b334-287de0f19d20", "value": "12288:rWWxXkyLr2ayjh1eNIWl9S7acAEsGbhh7kOYFg/I8LMzK3vF2ugsKcSsQcfYbdfD:xFky9IISVAX6I/FgN6OdHgsKrLdR+6j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676992335, "uuid": "8a3eef23-9774-4c59-9201-d013fca3d51d", "value": 909312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676992335, "uuid": "45c0344e-7bff-4990-b366-2e15abe5a1f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676992335, "uuid": "8ffdfa4f-6281-46c9-8e1a-286f018055c8", "value": "s20E3B4mgAYD64k.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6056280-b226-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677011565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677011565, "uuid": "7e1b3dc5-dd36-42bb-9a9f-b682c47a3798", "comment": "Malware payload", "value": "ce25348ab2dbd2ab0faf8ade1ce8fcc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677011565, "uuid": "1727441b-035d-493e-be46-fec0fc91465b", "comment": "Malware payload", "value": "800984ebc948ae625dde4e27388148a9e05a35200388efa75049810a42acfdd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677011565, "uuid": "2c9043e4-208e-42c4-b235-9ffe804154b9", "comment": "Malware payload", "value": "da0b603697782c336b4e30b5a3331aa5310bd77d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677011565, "uuid": "329d52de-27f2-46df-ba5d-a2174e4a397b", "comment": "Malware payload", "value": "45ee7e2365366f102c8ac732ef84f4ad2735430ef699876ad19732b19dbe75ccc4bbf3c8f7916aa925443a9f2e675151", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677011565, "uuid": "1684c1a0-dcd8-43b7-a9bf-7dd5d1bfa507", "value": "T17CE175233B544EB6D87C063C06E3FC67755C9F293F6B82758A281317393222479B4905", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677011565, "uuid": "b08718c8-b88c-4814-ae61-785b24c99bbf", "value": "b4c6fff030479aa3b12625be67bf4914", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677011565, "uuid": "ca575342-1bf7-4c08-9578-e0467214e6a7", "value": "24:eFGStrJ9u0/6E4nZdkBQAVX1Ox+39KZq0eNDMSCvOXpmB:is0BMkBQggx+39+SD9C2kB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677011565, "uuid": "3d66c905-a5bf-42cd-b6ab-2a1fb50d5e51", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677011565, "uuid": "034a42cd-a2e6-40d0-9edb-8d7bfedb58f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677011565, "uuid": "b080a4f9-0663-4d92-96d8-c31bb8ef2d50", "value": "bJM6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7c06335-b1dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676980188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980188, "uuid": "b199aed0-797f-41b2-ab13-d96bbe9a1ed8", "comment": "Malware payload (Formbook)", "value": "41cc45fca60b81676b388acf1774f9ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980188, "uuid": "0ecba756-94ac-41c5-b7f5-9660fe5b7721", "comment": "Malware payload (Formbook)", "value": "804b5ea31eb2d266580093c2a144a1f62ef1ba88e39d2de9d79bbad405408197", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980188, "uuid": "1f5358cc-65ae-49f4-af50-d5671a1ac210", "comment": "Malware payload (Formbook)", "value": "f1cf65e4de4366be876a234efd80b064e00586c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980188, "uuid": "de1ec203-fc33-4acc-9952-152bf154f272", "comment": "Malware payload (Formbook)", "value": "671ba4ced1a24f8fee79091485e2efb6e51776254b60b8ecbdee72c65571c17109f530293af05e651a1c92af65e2eafc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980188, "uuid": "f31a2714-b359-41ce-aa5a-3d78588c32c5", "value": "T1AA8423827346A46BE8B31E326D358B528F9EF0352CACE75F33205A5079A62418F5D373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980188, "uuid": "04a8bee5-bb06-4e99-8cf3-d422e3004a81", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980188, "uuid": "768aae34-baf2-4448-94fe-3c9ad23e8655", "value": "6144:/Ya6v9jrqHqKGeIh2cvLmCrMbuspatJxQcV1RGJJtH2TJ5OSnzuQFtBMbWPlN2:/YVtrTKG4cjmCQav1hGJy3d6Q/A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676980188, "uuid": "f6dd6982-88b9-4901-9d27-e1dda2a2a8b6", "value": 378476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676980188, "uuid": "ad4e7516-27e2-48f7-8897-92d63a919a89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980188, "uuid": "1e69cedb-4cbf-49d0-bde6-66f710761897", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9268ae37-b1b6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676963321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676963321, "uuid": "6789c98d-8e74-433a-afba-d30eee01a988", "comment": "Malware payload (Formbook)", "value": "3b4e07213628f95241dddce8ae45d9e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676963321, "uuid": "f06cb596-ff43-4fc8-ac1f-bfa91fd3e804", "comment": "Malware payload (Formbook)", "value": "82d448cb2461440d0ab1777690a41e228118c36961d8ee506ce94a9622b8af5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676963321, "uuid": "8baaeb49-3cbe-40dd-9fc3-e0b7b9599ede", "comment": "Malware payload (Formbook)", "value": "bee025b982f809bcc685ca4001e8ec11030a56f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676963321, "uuid": "4326a8ee-501f-4793-9558-1f67cc7ccdf3", "comment": "Malware payload (Formbook)", "value": "22076e6055c99d407f4d827219ede5c275b03e59e46660729ab87129eed35314d47cfb538013e59d3173852dcbe8367e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676963321, "uuid": "069d0d72-8eb9-45da-800d-474cd789f8fa", "value": "T15B54128523918053FAA365725A31231797F5E92730E9DC6F27A09F9E3B6B300592E337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676963321, "uuid": "1c901355-5fd2-4836-bdb9-b725bec11191", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676963321, "uuid": "ef99bd4d-4ad9-4de2-a279-1b2f8c8c65cd", "value": "6144:PYa6mOlq4reUmCNYzH85jml0DFjqwf/7hWx0V9P17ILLH5owr69SHC:PYoQq4ZNmHAql0ZBWxeP1k/5oQ69SHC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676963321, "uuid": "3c11bd85-a05d-435d-a913-5f504daab150", "value": 279684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676963321, "uuid": "baba58ca-0ed0-4999-8d70-09996f545a89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676963321, "uuid": "b002f1e1-d4a8-4700-b1f4-86be376c0066", "value": "INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9d6a5ea-b20a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676999438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676999438, "uuid": "88f546a4-ec35-409b-bb22-2ae833f3c023", "comment": "Malware payload", "value": "7225fb116a2c5d42926564eaa4fddbad", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676999438, "uuid": "e5342dca-a0eb-4efe-9498-7c3b3c9b9219", "comment": "Malware payload", "value": "863db7119cf7e33c6e4731b92f84c0a0262009c195f655cd113729e2b259ca9a", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676999438, "uuid": "b3f128a8-fb6c-4896-9afd-18106756624e", "comment": "Malware payload", "value": "79bc30b22345043ad4b764c8907b23aebb8fa421", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676999438, "uuid": "101c7cab-d8e6-46d2-a94d-064bac7d5c0e", "comment": "Malware payload", "value": "cc0f4abed58db2a97f9ab984dd41d844147c5773f2b1f25ed2770511017f75aaeae3f63e4e1f4465f3b5a238ae91beb3", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676999438, "uuid": "62cfdf4e-1dca-46c9-a999-acfebbab4185", "value": "T16D4512216652D527FC7647703A3A1B5AABF8CC0304AB0A1B779C4FA87B33652D41AB53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676999438, "uuid": "6c2a8eec-48f5-404f-8628-7e9b552f5a6e", "value": "6144:zYa6SJT1vaUlHVCB27z0k8SOUpAkIrlcjXZorsQqxVQ9q8jdwW:zYsJTxHIMf8S1tIcbZUs9xoq8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676999438, "uuid": "3534de29-048b-43ac-a85f-3ed5f80db758", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676999438, "uuid": "f2c28076-1bdc-454d-a32d-3981fd7710e0", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676999438, "uuid": "0939d893-e6d3-4ffc-bf37-32ffd9341c69", "value": "RFQ 00071900-312_1.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c59fc4d7-b18c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676945368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676945368, "uuid": "f90456f7-1f3c-4a4e-9d8d-5371be574da9", "comment": "Malware payload (Mirai)", "value": "5cfc9d1e0cd06af812f6c9c325cee759", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676945368, "uuid": "46fe0210-b61a-4a0f-8e0f-d948426246e8", "comment": "Malware payload (Mirai)", "value": "87c0c70a86167ad7d846985398fdb479a9a6a59e2c27fea4a8ff53c48a00a381", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676945368, "uuid": "40edd958-c794-429c-aa80-93dc46af38c5", "comment": "Malware payload (Mirai)", "value": "d85f7efc392e2b158c98e67826d68a8280d63985", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676945368, "uuid": "cb226848-181e-4439-a299-764f68689848", "comment": "Malware payload (Mirai)", "value": "d27336a240334326703f9a2ef58486eab9baa4aebc02d8931fdb1d96fbac38e90cb3c092283fd421b1c766efe402327f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676945368, "uuid": "13887c32-f3d8-4a12-9d75-22dd10fcb383", "value": "T1EA73F74AF8818E11C5C512BAF92D158E375257E8E3DEB2239F106F6037CA42F0E67D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676945368, "uuid": "190df608-30ff-4218-ab4e-5b5f2c98f4aa", "value": "1536:rNniAuzCUjX7m8u/WcoRErJKxWrRLkHZvcohq4zeITiUZ9OuN:yzfjrmv/7oRE1WWdS+oNZ9OuN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676945368, "uuid": "d2266ed8-3e2b-4bf2-ad94-58ab747086a3", "value": 75056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676945368, "uuid": "0e54918c-4950-4690-85b2-3e16870ea71e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676945368, "uuid": "83cb7642-8e52-4ddc-bcc7-c44450fe2a28", "value": "5cfc9d1e0cd06af812f6c9c325cee759", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7a6b865-b1e9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676985261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985261, "uuid": "927d439d-7c71-4695-ba85-0b3dabe8c6c7", "comment": "Malware payload (Formbook)", "value": "17fbfa2805b6deae6b93596eb05e79c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985261, "uuid": "4c02e40c-c942-4c3b-bdee-ed4cd676de06", "comment": "Malware payload (Formbook)", "value": "88043d723394b97599313522b0a2f599f8678529ba0febfebb6642cc966bde94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985261, "uuid": "ffc57615-d35f-47af-9c33-5e2c3617ff0e", "comment": "Malware payload (Formbook)", "value": "627a3f2e35c8e550bc7cf2d56f99465140769e74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985261, "uuid": "d2183ee1-d462-4168-90b4-c1258b9cb61b", "comment": "Malware payload (Formbook)", "value": "b2e79dff3cb8190704fd60780e8f050db26a2b8cea246cc03d911e24f8b1aef83b29e16b00b669d7ca98cea7e879fcb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985261, "uuid": "4adba887-dc14-4fb0-a88c-257e4ecb3b5b", "value": "T160441258B2B4E4E7ED7848B61E7E4D0AAFF4E921016A070B5F10658DBD35362E58F703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985261, "uuid": "33b8163b-9bde-4424-a161-724408e10e6e", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985261, "uuid": "5717a9d3-d8ec-4047-8324-d493fad98384", "value": "6144:/Ya6uyt65+KGSWser7nmagsaqBQXeDCawbUOlLeLNkfz:/YYyseHmag9+3VQLAoz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676985261, "uuid": "f3638852-dc5a-4913-a372-c62c68dfcb6f", "value": 277737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676985261, "uuid": "2d2c6098-2728-4c87-a7a9-5e42b0d5a5a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985261, "uuid": "fbac43e8-f92a-4b5e-baec-8a0b8e97fcf5", "value": "Halkbank_Ekstre_20191102_073809_405251-PDF.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a6a183b-b1e6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676983950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676983950, "uuid": "0f56102b-ca04-49a3-a74b-b89d5c4348c1", "comment": "Malware payload", "value": "4fadf0c42253188e155bc9fabec5519e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676983950, "uuid": "0a5d1a4e-834a-4fe8-ac65-988c2da52beb", "comment": "Malware payload", "value": "88436ab4ae696b2580569a9817bbd00cb4661f1c6823a992dc2dc709f96e81c4", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676983950, "uuid": "abf8b1de-082e-4f3c-abde-f465bc020d77", "comment": "Malware payload", "value": "c8cb2a9342b4cb465982694d0766a56f79becca5", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676983950, "uuid": "fb67ef9f-3e2a-44d0-8074-9c7a69c88aee", "comment": "Malware payload", "value": "2b4cb42c987c51f86a2746be9500f1b84c23016e447b749982778c9df381713352e1473f513cb01fc000620d96dfcc1c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676983950, "uuid": "50afa335-5257-4b88-8a1b-a54f206a9773", "value": "T1675422F0362B1596EAF01AB56D3D38229C6FCDFFC48C5BA50280E0611F4756A9A9D0DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676983950, "uuid": "8527519b-1712-4397-a681-9f94ba3c334b", "value": "6144:Ynih70i8IpwQNAeZcdgHA99imQARdXRho1z/bZVYEvImcdwdqL32e:Ynih7FpwQNcEA99WARdBOz/rxqrJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676983950, "uuid": "4bb03161-5327-405b-a975-fc104f911943", "value": 282388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676983950, "uuid": "2e81e020-31a1-4ae5-971a-567be96b4947", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676983950, "uuid": "bcac0a58-b77a-454b-8690-c2df24323154", "value": "Shipping Documents.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae66e289-b1dd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676980119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980119, "uuid": "fc1e6e98-4665-4c23-9d09-07fa4e669a23", "comment": "Malware payload", "value": "1937d5a853734874a0ef18d4acc43113", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980119, "uuid": "8909902d-a021-4f06-82ce-5cadf10beed8", "comment": "Malware payload", "value": "88e6238b9329ac7eca5ff20016f896c4869760a44e2da20cfd070bf83db52d64", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980119, "uuid": "cc2da984-b64b-4304-87e2-feca41ce223b", "comment": "Malware payload", "value": "37c4f8d0c6fea50f836c0a308b06de910205189a", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980119, "uuid": "ffae2769-ac43-4da9-a4ba-cff7c9e4669d", "comment": "Malware payload", "value": "afead47d0310d857020c7a1f755257c2d6c9d426a124466023bac38e31adf4a690bfe3d37f88790ddba854b3efd45a37", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980119, "uuid": "cbbeb049-049f-4f28-b844-7a2fdc63e94c", "value": "T18462D71437E08772D87ED9B888F279052771A60B1826CD5A1CCCC59F14B17E98AB3E7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980119, "uuid": "631c0995-9901-4095-b6e6-231cc6b59d82", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980119, "uuid": "1aab9ab0-92f3-4c7e-93b3-7ea5d610e739", "value": "384:J0qeDq8sGk+MGqf5feStn8/XZzVPWjpbW:JiDHs6sNG/XZA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676980119, "uuid": "9d7ebda7-829d-4fd9-98b9-2dcad0e190d8", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676980119, "uuid": "6b87f89a-f0b4-4d18-ba72-8fe103ffb90e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980119, "uuid": "caedb22f-5e8e-455d-b9af-4a4ef03c6d4f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "accdb4e1-b235-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677017912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677017912, "uuid": "f447dda5-b475-49e1-becc-96776d974512", "comment": "Malware payload", "value": "6e4e21b15f5c27ca82b7934fa6544c5d", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "DIGI CORP MEDIA LLC", "colour": "#FCCA64", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677017912, "uuid": "45aea26d-3cb8-4ecd-8729-ebd0cda9bb0e", "comment": "Malware payload", "value": "897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "DIGI CORP MEDIA LLC", "colour": "#FCCA64", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677017912, "uuid": "81657af2-a107-4d00-981c-c7c6aa64b632", "comment": "Malware payload", "value": "f78efb588be3ca19966f3b46dbdb2d98b44de408", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "DIGI CORP MEDIA LLC", "colour": "#FCCA64", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677017912, "uuid": "84aba1d9-d47e-45c4-8d7b-03cb8b25eae0", "comment": "Malware payload", "value": "ddf03836cea63aa31a3b2d2f34b5215985eca7062379f390b1b9947ab9d0a55c37fb6644768a826ffb0e683d8b3a2f6e", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "DIGI CORP MEDIA LLC", "colour": "#FCCA64", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677017912, "uuid": "c197cd5d-56ed-43c4-b6f7-b39a894f8c8a", "value": "T15065C0A203E9C3D5F2F94D7418F30ECC943E6C52D6A6C92B1D45A434E96329B1FA1B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677017912, "uuid": "9651f7cc-7fb3-4971-8ee3-7cb23aa83a7b", "value": "d896fbd44874f6dc349fa19cf7d92573", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677017912, "uuid": "c38e78aa-685a-4966-b060-de42d6ca65e0", "value": "24576:XrmJ8nj4+I2lkxeUHhb7o8728eU44yDjQNBmTW7MKfMhk:iJ0hEeuxu2zfX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677017912, "uuid": "89de58d6-8835-4254-8d10-53085d3d8cde", "value": 1502360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677017912, "uuid": "bd764124-20cb-40f8-a25e-005643991cfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677017912, "uuid": "ae67a355-874b-482c-a5d4-57b45511c1ff", "value": "Contract_02_21_Copy#32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbf0352d-b1dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676980141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980141, "uuid": "d3c27601-8311-4236-9f9d-0b733d3e7270", "comment": "Malware payload (GCleaner)", "value": "4a9c478915d8836d152b41f8f1a05930", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980141, "uuid": "50f594b2-6045-465f-8042-37edf8ac0dd5", "comment": "Malware payload (GCleaner)", "value": "899d409c8baf0c5b6ab18f435a752d4ab4749e628c4fb442edfe22fae5fcf073", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980141, "uuid": "ca176aa3-836b-4bb0-bddd-b565ee4cc50e", "comment": "Malware payload (GCleaner)", "value": "959d322ecea15a5cb53149cf612f8cb60c50bacd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980141, "uuid": "2263e29e-0c41-4bc0-9c03-8da4897ec58e", "comment": "Malware payload (GCleaner)", "value": "ef02fbde5f225795aa92257e3a59213fdb77e819482aac089c045a6a31c624bc01de438c68b0d642a775bacbc07f6d2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980141, "uuid": "94e81d0a-5aba-4414-b61d-5a24d4229df2", "value": "T12775E110FD73B39DC6EA727C16CEE8D10C45252483C36E4B6320A96A46E75B7342DADE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980141, "uuid": "88b4b8d1-4ef7-4eaa-a86c-376989994115", "value": "4a43ef13050d45ae61812b2997033821", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980141, "uuid": "a317757e-a914-4ab9-bfb1-604c74da6cfe", "value": "24576:nX2/eCdWM37RmDHT5Bb4oKauigB1UvSUhpdOA2p6Le7KOzqLCuFgStx6v67UFd98:XGlsbFhqtbq6A2p373zJSH6UW9ZZEhgM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676980141, "uuid": "9f072ef2-c057-44c0-8405-08bddb285383", "value": 1641504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676980141, "uuid": "7ac7d279-e5b6-4949-a3be-817376afba6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980141, "uuid": "ecfc5980-c30b-4195-9fc8-c967ec3badf1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "115d8f74-b1fe-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676994028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676994028, "uuid": "d5d7259a-7377-42bc-ad7d-83f343e65e5c", "comment": "Malware payload (RedLineStealer)", "value": "2ca336ffac2e58e59bf4ba497e146fd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676994028, "uuid": "7f34c0e7-cff5-4927-9aa4-2e2f3218a398", "comment": "Malware payload (RedLineStealer)", "value": "8a07fc51578589686a864b2d74ac3c1b02a9ceee8f8a20d432832228d9665459", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676994028, "uuid": "8e334b2f-6ccd-419c-9c90-fd3a4415f42a", "comment": "Malware payload (RedLineStealer)", "value": "ab8ebd53709abd15fd7d1df9dd91cbfbecb3ef14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676994028, "uuid": "c75cba31-370b-4c1b-a599-fcbcc4b5e589", "comment": "Malware payload (RedLineStealer)", "value": "6d5d725351f3e66fbbd343ea54f2470522e1a4196abf64528ae25f63428c9cb27ce1a9779da0270048ba7157b7d80b84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676994028, "uuid": "b1b4cad5-adf3-44ae-96e8-f21afa6612dc", "value": "T1C304C51437FCDD11E5BA1A3F6921A05086BF98026852F75B76C367CD0E32B40FA57AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676994028, "uuid": "bf9e6eb9-9b64-494b-ace0-e3d32bc8c797", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676994028, "uuid": "d7a5e08b-a450-477b-8318-20956293bc1d", "value": "3072:HxqZWjfa8oty3M1OhTJemkFUhgrxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOu4:RqZCM1OBuUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676994028, "uuid": "4bf7134d-5b5d-472b-8847-8e5885c19e13", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676994028, "uuid": "4faa6158-5b19-4b2d-867d-3ca4f0bb4c33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676994028, "uuid": "0580c84b-f4e4-45e9-bc43-c266ba6aee2b", "value": "2ca336ffac2e58e59bf4ba497e146fd7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75105208-b1da-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1676978734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676978734, "uuid": "3f79f2d0-325d-4f92-b0f0-a78bd3491556", "comment": "Malware payload (DCRat)", "value": "1657245ca625e9366724a89a4cd5a501", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676978734, "uuid": "26e4f6f2-7d10-42f0-938b-b1412cde5079", "comment": "Malware payload (DCRat)", "value": "8a2ab0fe753a2921634d4178b70a5223a5de1fee2088ffe82c7b7157c18c72cc", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676978734, "uuid": "738202eb-b2ec-419d-ab2b-74556d17d202", "comment": "Malware payload (DCRat)", "value": "5712c0b310182dd63e5ae3ec4b6c2f4c545945ea", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676978734, "uuid": "4517dd28-78f5-4144-b1e8-8a4072d97fa8", "comment": "Malware payload (DCRat)", "value": "ec5360138df406ab3a6227424e49425688ed0aa64b106b13f7d485911e43ad275b6f707a5d62fb045e422cc296bf4c74", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676978734, "uuid": "04e38935-af8d-494c-b069-bef463e150c8", "value": "T159657C027E44CE12F0081633C2EF454847BAA95166E6E32FBDBA376E55523A73C1D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676978734, "uuid": "e5d39cfb-ed27-4f8f-a957-a2cc03d98f87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676978734, "uuid": "7201794a-6362-45d9-b4a2-81b369640f2f", "value": "24576:OaUXpnk3XIiz1GRXxvI7+L5hRKlOS6kWWMoEndmYImVYE/DUf:B2VknaxQKqOSrMoEnImVT/o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676978734, "uuid": "d7be2c10-b437-4010-8ae6-a0d68f1aca43", "value": 1430016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676978734, "uuid": "85bcefdb-2f83-4d8e-a9b4-5872a696731a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676978734, "uuid": "2df92522-583b-4ffe-a28e-a458188f1f13", "value": "1657245ca625e9366724a89a4cd5a501.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22236816-b1e5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676983319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676983319, "uuid": "9c34d610-e8f8-4831-9517-db53c86185dc", "comment": "Malware payload", "value": "15ff2fff664e6162fe28003d89fec98d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676983319, "uuid": "b9d28861-9bea-43a0-a94f-d3958895da14", "comment": "Malware payload", "value": "8af8911846a277798968f3b36b967339e0987209ffdd5d19b6a82f958aefd288", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676983319, "uuid": "94070d70-656d-42c5-aeb2-cd5b6a87e753", "comment": "Malware payload", "value": "5a63e33287571420ca776c8e931ca0a95300f2b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676983319, "uuid": "0b6275ac-99c6-43ef-838d-a67341feddce", "comment": "Malware payload", "value": "723e7a0f64faa0b0e56d078464e487b6203b5e3a023b269a066f98a2af75d493e638f5b49963c28236771db054c31ade", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676983319, "uuid": "d2e32c8b-c42d-451c-bd4a-1a0157cf9cdc", "value": "T132435B1237A1C03AD4A302345D74C6520B7F7EA29EB4C2473BE41B5E5F721D6AB293A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676983319, "uuid": "a6f778ae-b71d-42cb-a0ec-611ebb847d51", "value": "e660360e9b49d39062886798924e4f6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676983319, "uuid": "f08398fe-6678-4bfa-9145-ad333b8c3e5c", "value": "768:qHahwAwLz1dXmpCL6eTdG5eVP5ubYAOEjYMNWZDiSrr2INKoWTB6Y/famem:qHt1GW6eTd2eV5kFmdoqme", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676983319, "uuid": "9dda9eea-3bbf-4bee-8659-b6f4cf61fbc2", "value": 55808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676983319, "uuid": "6478e1e6-5759-460f-9845-00e072c5611e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676983319, "uuid": "e8629f31-cda4-40d0-b1d5-fdb1b4531fd4", "value": "SecuriteInfo.com.Trojan.Loader.1312.1407.31208", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bc080ea-b1f3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676989295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989295, "uuid": "3491187f-22dd-473c-904c-c71196ec8fc1", "comment": "Malware payload", "value": "5d49d66c63fe0341b876eea066d8f67c", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989295, "uuid": "3a4493ae-5f7d-41a5-a888-a24a9c218400", "comment": "Malware payload", "value": "8b3d9d3f59843c560f8eefefaa26f2d26b4b85480c81198d12ccbd067f8886d4", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989295, "uuid": "cf6705f9-9a51-4757-8dfc-4e951bfd45c6", "comment": "Malware payload", "value": "35313aa0ec7c944a518ff34b62755cbfe2d17f78", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989295, "uuid": "5085aa63-2d61-4c3f-992a-cefb50189a0b", "comment": "Malware payload", "value": "245401c2c57919950702837e6540cd4ae96b407dd8e96bbeb397ff423739449f040c8b0c44b043b562387dbc4ef6f475", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989295, "uuid": "882cb042-c958-4cd7-81b6-4774602f1c8f", "value": "T1DD95AFB876047DD6267F536BCA96ACDD03B626639ACBA4CD8064B7C305A3375FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989295, "uuid": "8e1c53e7-ae60-4b3b-8909-f0014c2c84c1", "value": "24576:EUG96XNEU/mHVY4Ovy01IUd6w3m8uKXTD1mF8nMTMflJKcGIomPFzf7GvfWjOZdI:1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676989295, "uuid": "3b82c5c6-ffe9-4453-8165-23fcd2c4fbdf", "value": 1926363, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676989295, "uuid": "17935d37-101a-4365-b60c-e7c102bcd003", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989295, "uuid": "94610570-508c-4207-9d4a-d0292bd92404", "value": "Purchase Order.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "131725ec-b1c4-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1676969121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676969121, "uuid": "731eea1b-dda7-41f7-a211-00837e353058", "comment": "Malware payload (njrat)", "value": "4738dec6ed90975288b6a84e2e971886", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676969121, "uuid": "3afd83c0-b277-4aa9-ba36-e73c130ec5aa", "comment": "Malware payload (njrat)", "value": "8b6bf8131466585c8a6e41722765c0d74ff2298e4e0e4e19f783be476f43ee26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676969121, "uuid": "2a593727-175a-4046-816e-1c2849965aae", "comment": "Malware payload (njrat)", "value": "641b28cdcc0c95e7c071a0070a08716c63ed83e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676969121, "uuid": "5c25db06-bf04-4f2c-ae51-0d7560fa48ff", "comment": "Malware payload (njrat)", "value": "cd3f2a42ed3d8bfc644f53fb6dc0fa0e2c75f03701c682c900576d5d5655b2be501d7ae163b833f062fc5b029306d0ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676969121, "uuid": "cff652f0-972c-46c0-b2f8-28fad52887e4", "value": "T10B35F51F8D3801D5DC68C3F54C4A3A6AC77ED8AE5331495DAF42AEE3483D794D63A2A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676969121, "uuid": "974476b4-95de-4d3d-81a3-5add39e8f5dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676969121, "uuid": "a7ef82bd-3f14-4285-b314-88a8983218b3", "value": "6144:9PodRe4hulosISYKzc5JB+C83ckvIdn0/z6ZHR93cbjVaISDyhAUjFXlECH3WhTO:faPKhAUxlECHGhxcCrO3t0x+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676969121, "uuid": "d83cdc06-b633-40bd-be48-3a7512e91f31", "value": 1081856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676969121, "uuid": "38c13fb1-ae18-4a21-97c5-dfa1936cbb79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676969121, "uuid": "e7b943b2-c427-4fd9-af44-dab7234ab659", "value": "8B6BF8131466585C8A6E41722765C0D74FF2298E4E0E4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "956528a0-b18e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676946146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676946146, "uuid": "6ecfe391-065b-4e4b-b7a8-cb9852ecb34c", "comment": "Malware payload (Mirai)", "value": "a8dd9ff7bffd7a6eadeeaedd72899a67", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676946146, "uuid": "3be69ca7-3e7c-4d9f-b771-0b4e6d79d55d", "comment": "Malware payload (Mirai)", "value": "8bbd7fe9d2bacdf62c5759f7eabe15fd815fdde8888860e1b24c72ff1d5b4c33", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676946146, "uuid": "d1911465-61e3-4d5c-9c6d-e076c1d04cce", "comment": "Malware payload (Mirai)", "value": "950fddcdb66a9ea2ec56e04be0f7e660d6223066", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676946146, "uuid": "354ef3ca-d2f1-4f7e-8a0d-c614fa0e8e56", "comment": "Malware payload (Mirai)", "value": "2ba892015fed7adb7b1474b56b1fd220ea85dee922916fc33a21cce78901a6342bc01dbaade202514ada21bd21f64656", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676946146, "uuid": "6e8b332e-0327-4781-ab11-c685c4ea4690", "value": "T13A330895B8819A16C6D412BBFB2E41CC372663F8E2DF3207DD212F15778A82F0E67645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676946146, "uuid": "208bdde3-045f-4fdc-916b-aea054cee51a", "value": "768:I7ESRTjRb/yezw7bWq1iPCRMTIJgeo9IZRTcSPvt5Ip/NPeBgLKTzh:9StjUbWVaRMOgvIRTcavt5IpwBT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676946146, "uuid": "a6a543ca-5298-4aa2-966f-18c7cd089913", "value": 52964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676946146, "uuid": "1feef326-80f8-40d7-9012-9708bb6e2955", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676946146, "uuid": "390f4e9f-5723-4d96-bea8-3db06b680caa", "value": "a8dd9ff7bffd7a6eadeeaedd72899a67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c12aaef7-b1f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676989169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989169, "uuid": "cf21cea1-6cf6-4881-bc5e-e0de4173d3dd", "comment": "Malware payload (AgentTesla)", "value": "7f20c68103a9fa462ebc41919fc72e67", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989169, "uuid": "32783d3d-bf34-4913-9540-51c3a1595426", "comment": "Malware payload (AgentTesla)", "value": "8ccc911fcd00d10fbaabd2df15d2f36a1f53dc385f1c8df0bb58587b0b3b75c7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989169, "uuid": "49955181-38a4-4948-8465-55f5996f61ed", "comment": "Malware payload (AgentTesla)", "value": "25955aadc80bde9ac006c8d3f626991b01321231", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989169, "uuid": "14c6debb-01fe-476d-a5d3-7df9a4f769ee", "comment": "Malware payload (AgentTesla)", "value": "30b0e0235591dc56c9ce1f8e16cb59c1ff23782e6fc7cf2d36c538df476d2a6a8cf7aec0442becc98b7184bca2bbdf05", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989169, "uuid": "c51aff55-faab-4372-a6d9-8015a8c62a11", "value": "T19425BE9977B46473F4CB01FE6C38278C2D206A477508E26F9B77BB91A274AFB7294101", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989169, "uuid": "57b36f04-2a5c-4484-8e88-c130dacfff4b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989169, "uuid": "64fabfc0-d534-4e79-b484-8adb5fbf394b", "value": "24576:Pky9IIS+J+HlHMDA7xnjCN2iKDJHKQDalx4I7a8NHOmyY7ooJTWJ:GKDAFnj8KDJqgaliI+0QY7oG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676989169, "uuid": "00bb0d5c-d09f-48c6-8a11-cd61fe705ee8", "value": 987648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676989169, "uuid": "5347f6be-77dc-4eff-905d-02306a68bf33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989169, "uuid": "076f0783-18a5-4a4e-9d69-8ca44e8524ab", "value": "INQUIRY DATA SHEET.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3282372f-b19c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676951993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676951993, "uuid": "e4a4f92b-2e95-4104-a9e3-5aa412fb6b9a", "comment": "Malware payload", "value": "dcd26511183f2d7eb30678661a88b765", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676951993, "uuid": "7f785180-013f-4cb0-9556-f69e42fa337b", "comment": "Malware payload", "value": "8f0d2909498e32a88ea7a3873958edd5456e0d9d3e766ce7c8bcc303f67d8984", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676951993, "uuid": "45f7aa77-9694-42da-b265-9f41fbcc5a82", "comment": "Malware payload", "value": "37157d94c22ddb5be80fb164fab68faede2711e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676951993, "uuid": "c74aad56-482f-4d96-8aeb-eb27faee1fe5", "comment": "Malware payload", "value": "48ce30dc011663bd33d3da63f0056b2426f255ae08cdf8680bbf68b8d10241b25587a9d64a97db3ccacbfa2b8a2ceae7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676951993, "uuid": "29399f51-9df5-4cd2-b2c9-f7676e819af4", "value": "T162A4E022A38904A5F364EAF2CCB2BEB044AD0479559F717AFF7C8B9017A43D6C791187", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676951993, "uuid": "b680b930-c824-431b-ba7f-9a897dd48ffa", "value": "b5a3fed1fa478a521df07472d5a7b200", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676951993, "uuid": "96cec95b-8567-4147-8f46-6a3bca97a09d", "value": "12288:LscjpZYrzMP41INt4WxGaZG3oBHgOmZndxwUnM:LscVZYD1iGWxZiQcrxHM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676951993, "uuid": "2897723e-bb9a-4cf2-be8d-3bdc0ca1df58", "value": 475066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676951993, "uuid": "0d6e0053-97d2-42ec-a75b-1f780eeee4eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676951993, "uuid": "2ee15ccc-e230-4781-a243-9ac702d20304", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad1f3465-b1b6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676963366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676963366, "uuid": "f13341ad-ab4a-4570-8228-815c96d24819", "comment": "Malware payload", "value": "d0302bbe943014c500de79dc7bb4e2d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676963366, "uuid": "5a735eba-cfd1-4be1-886b-a950b17c8360", "comment": "Malware payload", "value": "8f81fd0cd66548518e82ab4238cf83a55989de7b1ab9099ef43892d0272b41e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676963366, "uuid": "ecb3d65a-9424-4927-9753-7ce3a4d81f26", "comment": "Malware payload", "value": "df0c7eac95d73258e7d304c9353ea26dc39ff38f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676963366, "uuid": "95153496-8cde-4342-a72f-26bcccea6020", "comment": "Malware payload", "value": "46c103adb883624854e7876f5505f8dcd3b9ca8d1fc00c7375339b84372b2e1aa890155f1f232859b677eaa33e7f29dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676963366, "uuid": "c410ee8a-05f7-4e0f-ac6a-630305ab6ef7", "value": "T1305412216552EA27FC7747713E3A4B996BF9CC0304AB0A1E77984FE87832652D01BB53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676963366, "uuid": "be455f6c-deee-4611-8922-afec4357b276", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676963366, "uuid": "c8bd8c66-eff0-4405-a799-e5a7add9eba3", "value": "6144:vYa6SJT1vaUlHVCB27z0k8SOUpAkIrlcjXZorsQqxVQ9q8jdwWN:vYsJTxHIMf8S1tIcbZUs9xoq8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676963366, "uuid": "f93df1a0-5c28-4690-8ca9-40d869cd9537", "value": 299367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676963366, "uuid": "d4eb6e2b-7dd4-4bea-ad08-7b73b26e011b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676963366, "uuid": "b8e716ea-c4c4-4e1f-822b-93e961d84c1c", "value": "RFQ 00071900-312.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d2442a4-b228-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677012060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677012060, "uuid": "de583d1f-dcbf-4abd-9b39-68668aa2ca7c", "comment": "Malware payload (RedLineStealer)", "value": "329175764910a012a35cf80b41bd1e15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677012060, "uuid": "eb7a3497-fa9b-488d-b0ff-f8f3256d3022", "comment": "Malware payload (RedLineStealer)", "value": "9068c85943e9aa7c9f5e81b8d3ecfc5c626b393bb41a3cf491d79df8266741c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677012060, "uuid": "3aa8f91f-3539-4966-99c8-e2349c4b9d7b", "comment": "Malware payload (RedLineStealer)", "value": "7473b9bfe9549ff0d2945d6d424856e5dd321d01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677012060, "uuid": "6c788399-6628-4535-bd24-80017d4b38d1", "comment": "Malware payload (RedLineStealer)", "value": "3bfa417728bf10995f07e1da05662930096f9458bc3cbc6832a7a1d36e78f82e13dc056826e01d6a5c21ca6c74ae7682", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677012060, "uuid": "038aaa5f-cfc7-4378-b9d6-58b160fec23e", "value": "T1F3E4BF54B8C9CC10DBF05BBAD47411F9E63EAEAAE644C64B108ABEDCF27D65C01E4253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677012060, "uuid": "7d5fbaa5-d241-434b-938c-81ec02846660", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677012060, "uuid": "ebc5c1d7-09c9-4013-a32d-9abe93d720e0", "value": "12288:jToBaDaCKKKKKKKKKKKKKKRTfRQnKKKKKKKKKKKKKKKKQKKKKKKKKKKKKKbKX0p5:jToYDHC6KGH8pB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677012060, "uuid": "6c27211e-bfc7-4bf4-abda-8bb20f803bc5", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677012060, "uuid": "8d3f4806-b0ab-4326-b5a7-b453c9844ca6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677012060, "uuid": "612886cd-0bca-492b-9d8c-6b4d0bebfbba", "value": "329175764910a012a35cf80b41bd1e15.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c76daa9-b1c5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676969566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676969566, "uuid": "9935223a-c128-4d42-9c85-8085decaecff", "comment": "Malware payload (AgentTesla)", "value": "3b68d6819644f2b0584e5aed75085e13", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676969566, "uuid": "b837ce9b-233f-4269-a47b-6a80ae0f700f", "comment": "Malware payload (AgentTesla)", "value": "90c76ac96216dd5602cd8de571aa36b42653e000e7c8c2535a02219128cb64ef", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676969566, "uuid": "275a6fee-214f-4171-84dc-e64298bedb1a", "comment": "Malware payload (AgentTesla)", "value": "1a0059739568e3254fef3c605817dfb0787e61de", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676969566, "uuid": "645b93b4-6ad3-45ec-b43a-dc751b562eb4", "comment": "Malware payload (AgentTesla)", "value": "4c62ff683332444e5459ed4c06f467f67eafd7bf9340b1322a3c4123ae10ecca420ea32482c60afbece1c8db9f5aff74", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676969566, "uuid": "e1614109-0a25-4c9b-9803-2ca34e29ae47", "value": "T18D5412487794C133CCA286711D79B71679B2C8290A74474F2B205B2DB532BE6E67F3B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676969566, "uuid": "211f1373-5720-49cc-8353-33333e99a23b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676969566, "uuid": "002826a5-20f0-4c76-b23d-2e50449d2242", "value": "6144:/Ya60GkLeS3XalLvnwxLd5R9ILo0mDh980CRlxMP8SgdFUFiI+:/YqGkLetlbw9dTKhmP80EMPEdGFiP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676969566, "uuid": "ea997c37-bfb4-4904-a22a-b2277de157e9", "value": 302378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676969566, "uuid": "f8505983-5dab-49e2-8f2d-4c75f991f141", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676969566, "uuid": "07c6cf26-ad17-4375-ba4d-0fe08b9d7172", "value": "1026 PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "715132b6-b1f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676989035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989035, "uuid": "bb9f8cd5-bb52-425c-9d22-f49a201b0225", "comment": "Malware payload (SnakeKeylogger)", "value": "47f2f1b7e3158610a93c45b75d7e9e4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989035, "uuid": "a22f2e87-765e-4faf-b164-5ec9de9a89ce", "comment": "Malware payload (SnakeKeylogger)", "value": "90dbe727caa8557cb4d67c58b52194324ecb9496d80b33ecf776ee19e650e6fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989035, "uuid": "efc8764f-0074-4500-95d3-0bf64250a81a", "comment": "Malware payload (SnakeKeylogger)", "value": "2905893c10edbb9164b3f7725b591cfbe667b53c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989035, "uuid": "2b0497bd-dee9-4f71-9ae1-7e639748099d", "comment": "Malware payload (SnakeKeylogger)", "value": "10d577e15335dfdf106df840ff11f329b79d91c5dad1ffb06f9f54dcf0df7bb73023fdd17ba2542ab27aca20cf242328", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989035, "uuid": "f48d34de-7342-4f36-8721-df1f4f77f13e", "value": "T19265B7223EFB501BE473FE76DEE02996D62DB6623B07D348145A03460F62B11CEE517A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989035, "uuid": "7d7f59b1-1363-4e30-af4a-6689b53a3295", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989035, "uuid": "a5b1b03f-5ebe-4799-b8b4-5506bc0cac46", "value": "12288:T06q1A8H13l0pYHNnOvylleR5hsbMgpRsumFBbF4yoi5fZQuqm2aEArj4gg83E2V:T0p1A8HrnMgpjiEyguoWpjj/5cYOdue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676989035, "uuid": "ced392c7-998b-41ab-8756-c27b1a4e675d", "value": 1505280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676989035, "uuid": "f4a37c22-796d-4db1-bab2-b83fb5f4a131", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989035, "uuid": "5f041efa-b208-497b-9418-b847879a0a25", "value": "SH098765435678-0987.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93c11808-b1c8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676971054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676971054, "uuid": "0348b615-f9ae-466e-878f-8d0648491f33", "comment": "Malware payload", "value": "dde875f40a8d461f4b98281fa085f7a5", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r22", "colour": "#2C7EAE", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676971054, "uuid": "40c1e0e3-d886-4f2f-bc69-f89d517fe4c1", "comment": "Malware payload", "value": "91575ca8cc53d6615bfde566d5d19fd572ad37892faaa55ee2c659ae9ac6bc81", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r22", "colour": "#2C7EAE", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676971054, "uuid": "c8618f2f-c645-4503-be44-26f83b3c453e", "comment": "Malware payload", "value": "7cd4c7b5cf32ffabcca3bd93322244cae5b81ba3", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r22", "colour": "#2C7EAE", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676971054, "uuid": "1864572f-b4ba-4e3a-a9ec-e71802bc5993", "comment": "Malware payload", "value": "fd7675fd0da45a66e2c024586cd726438a487597e8bd0d2db68306304e5d96bdf3982012dd5a4abac80010686dcd5901", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r22", "colour": "#2C7EAE", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676971054, "uuid": "a62fe94b-e9ac-4997-b4a6-b70232e4abc3", "value": "T18294238BF6D1AA5C7BD043C9996147B785326C8A9731E38F15035C52CD78D8ABB6CB02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676971054, "uuid": "00661094-aaa6-47a5-8248-15ca2851f5e7", "value": "6144:cllEFZlJ4k1hL6f8M8t14kVIGsY+ALV9KTKCQeOGJw20kPgyU+CI1uar/PJ:jFDJ4k1p8xAvvsf0aQeOIrvgP+CI1fPJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676971054, "uuid": "c857ffa3-4b33-4d68-97b7-43f1272b2495", "value": 411490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676971054, "uuid": "3cf7af25-a6c7-48d2-b8dc-09cd29aaa180", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676971054, "uuid": "1717b2be-0ad0-4f32-aa7f-7152e6c0d307", "value": "CSP Proforma Invoice No 20221220197231 PO CSP20221220101.r22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e12d0e5-b231-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677016169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677016169, "uuid": "a0651ae2-7032-4fee-9aca-7de2e6e4e56c", "comment": "Malware payload", "value": "323ee7e3d79671befe72fe6f79f0f6b3", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677016169, "uuid": "8ddf8c10-f552-4051-854d-76c95e65e016", "comment": "Malware payload", "value": "91e43c044fdcad13a25d772b91065f78ac7a809a57ace84a4606c4c3e92afaa2", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677016169, "uuid": "e8f9aba3-9547-417e-b4d1-4ab25b5a8cce", "comment": "Malware payload", "value": "2442ca895275f9a4bda44c18273ad6b8d6815780", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677016169, "uuid": "d68d0350-c52c-472e-9373-3a924472676a", "comment": "Malware payload", "value": "c41ffa73c20b2d33a540b3bfa66c7b49d4ded37ff5b445b5e7abb9eb51bc3d6fe9ba2a67f72b2f72ab17324546cca5a1", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677016169, "uuid": "34b18e79-3b0d-460f-905c-fbef827a28fc", "value": "T12AA3026AC9858549E9DC0C70FC3E2EDDF972B179CA5A76A4365DAED38308F76F401012", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677016169, "uuid": "6274b92a-fe2d-4634-868a-6879c02b7186", "value": "1536:0vxQOx1paEAUHpWKOUuH7v+B1tGRnr/spRre0pRI3dz+3WTzuS1/GJJ5zUpxc8+q:01J97O7v+B1tGRr/KRy3x+3z7H8AK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677016169, "uuid": "f1dee1b0-654d-4965-8f87-ff4dd5a15f28", "value": 104543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677016169, "uuid": "0556c3f9-47bb-44f4-859e-3356fcb2b2eb", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677016169, "uuid": "10548e6c-76fa-4252-8418-2328d35965b6", "value": "Contract_02_21_Copy#101.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c5bd520-b1d2-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676975337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676975337, "uuid": "c3d500df-6bc3-4f03-ab7b-d5b7175bec0f", "comment": "Malware payload (SnakeKeylogger)", "value": "a29398c70f212f31359f4f009f2e65d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676975337, "uuid": "f7721a4d-659e-414f-bc14-8541295d44de", "comment": "Malware payload (SnakeKeylogger)", "value": "9346fab19e5aff450bbe116e328d6fc71f90d6864813474a45d8f11f94f31b6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676975337, "uuid": "d36602d0-3da3-4894-862c-0a8889ad1eef", "comment": "Malware payload (SnakeKeylogger)", "value": "af73822773545c0d7e4d67dcfe0a01889853e1e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676975337, "uuid": "9c4fadba-5b3f-4de8-80a3-d7f10e313348", "comment": "Malware payload (SnakeKeylogger)", "value": "21f6462685ee5d45f1ee6cca306aa0c12580909e9b4d165e496f814ef9c9bee9816a8f1a3ca58f84157a48d09a3578b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676975337, "uuid": "3b263415-d89e-408a-9f9f-6c322ed9a4f5", "value": "T14815BE9937B46173F5CB01FE5838278C2E2036577109E26F9B77BB91A270AFB7294112", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676975337, "uuid": "fef7fb97-3bbf-48b6-b828-cfa42e7ce294", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676975337, "uuid": "f6627304-5d5d-403a-83e7-f8ad15a52c70", "value": "12288:nzXkyLr2ayjh1eNIWl9S7qGLEIpOoYyVD5yPw2r4h/Du23/+sppVj8JMTj5XB6Jd:Tky9IISfLEF9yVD4khC2TkoX6CJ+Hl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676975337, "uuid": "155dc337-afb0-43a3-867a-75bfd6797fb0", "value": 950272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676975337, "uuid": "87a5383e-0cad-439c-b1ed-567d8364add6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676975337, "uuid": "a38a85fb-a08b-4a3c-be7d-6cf8aae3ff0c", "value": "SecuriteInfo.com.Win32.CrypterX-gen.22350.31686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e48c451-b1e9-11ed-88f6-42010a9c006e", "comment": "Malware payload (STRRAT)", "timestamp": 1676985031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985031, "uuid": "d0ccc156-051e-4ae4-b976-17da529f7ce8", "comment": "Malware payload (STRRAT)", "value": "76128a1dc594cabfedd72a6889c233f9", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985031, "uuid": "9d7d28f5-68cc-41b3-90ef-c11499128cc0", "comment": "Malware payload (STRRAT)", "value": "94ca9b551dc7ca5733e3dea8efa7fa11caa7feeb794eeb994a8ac411d0a8cbbc", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985031, "uuid": "5e6decbe-e64f-4614-ad93-2b0f95412edd", "comment": "Malware payload (STRRAT)", "value": "def56c4c2ef3f24702ac6d0da4acec57f7c9e38f", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985031, "uuid": "7b794110-3ca0-4343-afd5-ee7d48e1cb48", "comment": "Malware payload (STRRAT)", "value": "f7b2a0fa1f600c0c4163c6ada6fed20e160645736e734fe699eeaab133f8c6dccd27be956b4810faf632a9acbdbf0c69", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985031, "uuid": "128f6540-8f74-44f4-aa82-b47ce3003a24", "value": "T136240256AD9E91B8F40B993B18CCD235F71C418DE106563F22FD848A2CB2C5D5A87ACF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985031, "uuid": "363a52a0-d9e4-43e5-8097-9eb6ef85f562", "value": "3072:wg/Xi40lDfcMRE7iFW9P74hxChrwkpAg7jVoobvHBGgRqz9vLe57WTVxLwFn:dsREmFqP7ExQr8g7BHPBnAzFi5yTVlIn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676985031, "uuid": "9363566f-5ac7-4372-9c87-534ece24ed7d", "value": 224224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676985031, "uuid": "e793c760-f72a-4b50-b04a-7f3813976ce7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985031, "uuid": "9cdbd465-b375-40c8-b337-465d0178ecec", "value": "Pedido n.\u00ba 00835500 - PTT_pdf(104KB).jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf5312e7-b200-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676995206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676995206, "uuid": "d8709298-bfeb-408e-bd39-34594baf91f2", "comment": "Malware payload (AgentTesla)", "value": "7af0fe7fcb8fd50dbbe2b1020e832bc1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676995206, "uuid": "efa3bc2b-18fa-4286-8761-43fa37be4d6f", "comment": "Malware payload (AgentTesla)", "value": "94ef52c48230c64c143c42109622d0423e742428609718d4a2405fcb000a7ed1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676995206, "uuid": "3740d25f-9345-4851-8391-caecb7ec52e4", "comment": "Malware payload (AgentTesla)", "value": "566d3eaeff1288e8efc6d1b54f09a6f4587e25a2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676995206, "uuid": "4fcac006-3b7b-49d3-9574-43b4b2cc8f0a", "comment": "Malware payload (AgentTesla)", "value": "f1fdfed29f10dcc42d9290c7243f5198a9be95106780a42f1de77d1368042611a013289350113691f3470809cf5326a2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676995206, "uuid": "e250918f-3218-4bae-93de-79e62c69e3bd", "value": "T12B25BF9977B86073F5CF01EE5838278C2D3036477549E26E9B77BB91A271AFB7288101", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676995206, "uuid": "13d9432c-913a-4071-8801-092b3b6930b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676995206, "uuid": "07ab2af3-5cbf-438a-a1c2-207712efbd4f", "value": "24576:2Iky9IISjJ+HlYOxqYHr1oWUGPDo7Yn+4/X7582pUdPHt:FKOxnHruWZr8A1bpUd1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676995206, "uuid": "72d3a9f2-ab0b-4947-9a5c-be37be07deb5", "value": 992256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676995206, "uuid": "92b04fc9-e847-48c5-ae86-012d26d1d272", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676995206, "uuid": "1ee4ec11-aff9-4d00-97c0-b87504d5b238", "value": "RFQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06c85547-b21a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677006037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677006037, "uuid": "1f4763ad-5e03-49dc-bd0d-0cd7a9c9d696", "comment": "Malware payload (RedLineStealer)", "value": "3dc73b0ff0aaf109a9db86d12d839b0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677006037, "uuid": "c882eb0a-802a-4227-b151-eaf728ddcce9", "comment": "Malware payload (RedLineStealer)", "value": "96367578de9eea233fe132d6ec683bf0df1929d30d4570c59fd409822d7a9421", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677006037, "uuid": "507348cc-c22c-401f-9619-8322e09c9592", "comment": "Malware payload (RedLineStealer)", "value": "2b52d742c5189253005b6082a2b2bba549a8fc83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677006037, "uuid": "4a87ab98-5c96-489f-ad31-ac2e0cfe6952", "comment": "Malware payload (RedLineStealer)", "value": "b7ca7198dc6ebec1fa5e73f92f0bf0a10df76027d8e0a56865cfd5ca5c3c3247f5694b003004a5a9e6769d519b702d8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677006037, "uuid": "ca8fd6c4-42d4-412a-95de-978539cfa317", "value": "T1DFC40207A7EC8072FD75677058F602C31B3A7E501A34C25A26CBAD5D18B2694FA3277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677006037, "uuid": "fd988dc3-8177-4379-a20c-9db59daf5a2a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677006037, "uuid": "a87c8520-ee95-44e2-bd47-0fa3344ef0b2", "value": "12288:iMrWy90wvCwsGzF0VJitZBpjUDRjT43kBDm+UZ52c:8yswZF3HgtY+0J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677006037, "uuid": "b167fda9-7eb6-40b1-8ac3-a890cabfd09e", "value": 578048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677006037, "uuid": "123cf5d3-83fe-4210-8218-bd5357428e49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677006037, "uuid": "7a8a1dc9-e370-403e-92ff-b3e3590575d2", "value": "3dc73b0ff0aaf109a9db86d12d839b0b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "671dcedb-b1b5-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676962819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676962819, "uuid": "c3a5d1c2-9bd2-4444-8219-a186efe28842", "comment": "Malware payload (SnakeKeylogger)", "value": "18b34af678c5cbbea62b9244911a68e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676962819, "uuid": "7cf4fc5a-0705-4d56-85ad-88fd77c91e89", "comment": "Malware payload (SnakeKeylogger)", "value": "966f70ca4a0e6c7fa9108d7e06f2d6f9d0628e51fd8ea63023b446595832ff6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676962819, "uuid": "a382c37f-00d1-401d-ac0f-fe1cbedb70e8", "comment": "Malware payload (SnakeKeylogger)", "value": "f567948cd36bf0528c9879d19a4e941ba616f23c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676962819, "uuid": "2a7a0386-304c-4022-bdfc-a9c1ef02f803", "comment": "Malware payload (SnakeKeylogger)", "value": "be57ac5e3809305bc116172c129c0f7cbfdbcc1ec0a403ed969343b79c491b8ae2e22b36accac901ead0312195d86d44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676962819, "uuid": "0e7a3371-d84a-4706-ae2f-350b485f109e", "value": "T14835E61563E92A48F4FA6BA9A935658447BB3DDA693DD30E08DC90CE1F73F108851B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676962819, "uuid": "da8848f2-9b4a-4a79-a885-d610fd5d5af2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676962819, "uuid": "63078a77-1df3-494e-b692-ae756c762aa7", "value": "24576:HEc0KU6/34slfrAK243St3qIfCXtVCnn+K:kc0KU6/3DDSJnfstin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676962819, "uuid": "186d25f1-c247-4e42-92de-d78317cd760f", "value": 1108992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676962819, "uuid": "58712598-76fb-498a-986c-e42eb4a334b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676962819, "uuid": "75a2f44d-2e52-49f9-add0-5ce33cddabb8", "value": "18b34af678c5cbbea62b9244911a68e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b635ae1-b1f0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676988167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988167, "uuid": "33927e5d-7b6e-4bc6-86d2-1a0f89d844db", "comment": "Malware payload (Loki)", "value": "3aa80e1a543ec14f7f02364f11283919", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988167, "uuid": "ff8a0b5e-e33a-496c-a366-6c71d437c20e", "comment": "Malware payload (Loki)", "value": "9676e0dfd871bcd179a949d12c019df326309211abc729ff9ba77c3021c5bf93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988167, "uuid": "0794d57d-a431-48d0-963d-cc329b123a0f", "comment": "Malware payload (Loki)", "value": "31ad7e1ee7d15c7571bc00ceb8ff3870d0466931", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988167, "uuid": "b2304e5f-0d06-4a76-9ac3-71cb796f92b9", "comment": "Malware payload (Loki)", "value": "f3fed207682312ab02381cea561e7b749e47d3b6a1eeb81b7c8967bb14be5609b4447cd9ca70fbea9e70e692b279f9f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988167, "uuid": "3f5ac53f-01d9-4f1a-b363-6a33f352c28a", "value": "T101159C8977B45073F48B02FE583827CD2D2165537619E22FA77BBB81A2719FB72C9201", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988167, "uuid": "f96a9829-0651-4aeb-8924-e248d3d842a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988167, "uuid": "294a544c-9e1f-48f7-99e5-f156521f3e68", "value": "12288:lGnGr2vwGqKFJr93P74AqIhjHD9HYG6qj6xhjcROXbcqjQeTfU31gWybr2ay4eaW:lEu2Drx74kjj9lKJvgkTM3mWy7IL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676988167, "uuid": "f3519e34-2526-4a5a-af37-592e16ca9a52", "value": 922624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676988167, "uuid": "79b19779-8985-48a8-a6d9-eea890d8737d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988167, "uuid": "f2d95ea2-cd80-4d7e-89b0-707c065ba643", "value": "swift copy_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54dec5e1-b1f0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676988129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988129, "uuid": "0a24c5a3-1221-486a-a40d-17175a0ad500", "comment": "Malware payload (AgentTesla)", "value": "0c3cc321842c0053e42df0d624ee6df5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988129, "uuid": "03225462-401d-4231-b0c4-26b7350e494b", "comment": "Malware payload (AgentTesla)", "value": "96c1f2e81dd6ac90324fe3eebbbd592670b5769adf64c8a73fb345d1749d4b02", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988129, "uuid": "3b89bd07-f42a-481c-b63b-831246457369", "comment": "Malware payload (AgentTesla)", "value": "e16718986ae1b524b495bf8760b4162d9e2c80a5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988129, "uuid": "9f72571b-21cc-4679-bc17-b5fbb416903a", "comment": "Malware payload (AgentTesla)", "value": "b7c76176455575b1ad7a7021d095a466b99cc8f3257779676cf28faffa8bd08309c9f38b1b37a7d397db70e2d4240656", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988129, "uuid": "3331819a-89f9-4807-9868-c5c71681ab9f", "value": "T1EF54124972E1DC77EDB30A301AB663626BF9F50560548B431724BF89FC29982DA0FB35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988129, "uuid": "8918f9e8-7489-45cd-833f-7b4393ce710a", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988129, "uuid": "54aa0cc7-b3fc-4907-81cb-34943ddcc043", "value": "6144:vYa6g1uz8Mz1KaqwoQtUIzgIAQSZH5k+xLSv65Y:vYe1uz8MolcSIzgEEZk0SIY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676988129, "uuid": "a2631500-c636-4683-b89f-912d2624c82f", "value": 298740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676988129, "uuid": "1314a890-cdb7-4992-a2da-0d8d8cebbfd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988129, "uuid": "111041ad-e149-4d91-9cf6-a618adc6a879", "value": "TT Telex Balance Payment Copy 230223 PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0598ebed-b1b7-11ed-88f6-42010a9c006e", "comment": "Malware payload (a310Logger)", "timestamp": 1676963514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676963514, "uuid": "e31676c6-3959-41ea-aff8-35f07400bb26", "comment": "Malware payload (a310Logger)", "value": "c6479e3bcb864d87e5d93ff06ed15c60", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676963514, "uuid": "85287784-1428-4647-888e-ec8bb38eab5f", "comment": "Malware payload (a310Logger)", "value": "9842d23cef4dc305ab6b8cd1ade477e1186d94cfd18861e1c87a55aff4d04c40", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676963514, "uuid": "2ff21066-a74e-4fd2-887e-2a8fe6f9ecb3", "comment": "Malware payload (a310Logger)", "value": "af08bbfe61178ee821e85b1f09be975b732387aa", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676963514, "uuid": "305c687e-50ca-4818-ac77-d2e8b8682663", "comment": "Malware payload (a310Logger)", "value": "e4fee272f8b0470f174e00d19c66585b2662d92bd6fdb623aae8e63541e52e1ecc72fe93debe4f22061e69f223d954ad", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676963514, "uuid": "fec6d5bf-4338-4781-a8d9-f26ce8352c7a", "value": "T137B4230697ACC49DE99406354E6D175A2CF46C321CF8AF4BF3211B6F3F52691892EB23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676963514, "uuid": "05350603-8bf5-454b-8a24-bbbaf0a41b7b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676963514, "uuid": "18bd6c3c-ee8b-4d5b-8507-2c27070267b9", "value": "12288:/YmibSNNCgbjT5hg1s5PiA8C58tpxxqVTEp1B:/YmQoz5hgSN8tpxAVEp1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676963514, "uuid": "3c000b40-8a63-4884-ba0a-5c263c2d7d04", "value": 513408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676963514, "uuid": "7c78310e-d04e-4d36-9beb-5471747c0d45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676963514, "uuid": "da9647f7-a92d-4f79-b47a-81735ea48728", "value": "Quotation Required.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41db577d-b23c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677020739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677020739, "uuid": "0f594e58-013d-4e92-a726-a5998063c569", "comment": "Malware payload (RedLineStealer)", "value": "2b89b0313a1d0a4e65bfb1473359484b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677020739, "uuid": "d0580e39-5c7c-4865-ac85-d49790079b8b", "comment": "Malware payload (RedLineStealer)", "value": "988881d6b5554563391986f4cc019b18e36274597fdb3bd54ef7c5603a516bdf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677020739, "uuid": "77d19d85-2dd7-4a14-a18c-9df37cccf6e6", "comment": "Malware payload (RedLineStealer)", "value": "a0f14ba607856a9ca814290a4a72259cbb1d753b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677020739, "uuid": "b714ce98-b6fa-4284-9c1c-4f20b0b5ab51", "comment": "Malware payload (RedLineStealer)", "value": "530f336f527fad52b093d8f48c421b237ab6466d1f8ebb326e6f4976571995d72291cf10b0cc71932feb1e448d7789c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677020739, "uuid": "f53df409-f404-4333-9154-eeb68c79905a", "value": "T149352307A2EC8025E8B4577018F312C31F367D421A74D7AE2B8FAD5A1CB2275A17679F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677020739, "uuid": "1af29ac6-4c27-4280-a43e-ab3973684951", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677020739, "uuid": "3384f220-54c5-4017-b753-207e676d3f02", "value": "24576:Hyv5Q9s+UGZ/nLIyaeCu+MJ6ZB9vJHNBtyWG7Bo9:Sv5ANUGZ/nLjamKB9vJHNLyWGN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677020739, "uuid": "83de5739-80e8-4caa-9810-f8c241d50be2", "value": 1098752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677020739, "uuid": "7bf864fa-59b7-4e8a-a624-db1d404683c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677020739, "uuid": "eb830a9f-3ba3-4a49-8256-d69b2bd262df", "value": "2b89b0313a1d0a4e65bfb1473359484b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5e9495b-b1dd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676980238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980238, "uuid": "30bff046-3658-42f0-af4d-99a9b5ff40bf", "comment": "Malware payload", "value": "f63d1177b27d49722a2e797a78e48c93", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980238, "uuid": "3e7b3e23-15be-4a5e-932b-edf7b14fb6ac", "comment": "Malware payload", "value": "99cf88c829d3c072a3ed4cdd282d9876f4bc32fa3ccfa12180910caa15ba351e", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980238, "uuid": "d23df907-1341-4000-bb7f-b49ac21bfcea", "comment": "Malware payload", "value": "9368992b4e2f116ab78b1c15c7d381372ed32b56", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980238, "uuid": "37e05a5c-6e85-4799-91a0-0794cfdb30e7", "comment": "Malware payload", "value": "3ac7221fb7ea2560ee2eb5227f7f70b0b5de0bb8a30e3d1783b793b6a2717c7556454882fa27a4cdcfaf4f1c3e8246c8", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980238, "uuid": "e3152457-9f7d-486e-9c68-299467b2f1ae", "value": "T1B8D55E243EFB501AF073FF669EE47996DA2EB6733B07E559105103860B23A41CEE153A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980238, "uuid": "1723d818-3cc9-4b12-834f-a97673e8eccc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980238, "uuid": "e79be1a0-b2a3-42ab-8961-48314658ed91", "value": "24576:F0s1A8HoNMgpJXtLi4A0GKtHpumB+9a9JyM58DnB8eDDz73COrJcaTYOdue:r1A8HoNMgpJk4bGePUBFrHTYk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676980238, "uuid": "bd104906-7065-4daf-aa0b-37c8f3bc69a9", "value": 2762752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676980238, "uuid": "9189c42a-ca79-4fc4-af37-0ade69dc493b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980238, "uuid": "ad112a9b-1391-453b-85fd-773da5331858", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38fbed93-b20d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1677000537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677000537, "uuid": "6d3116cb-14d9-4f39-9ee7-c9a70d97f95d", "comment": "Malware payload (Smoke Loader)", "value": "41ffdde185cbbc96bdc317c70753c28e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677000537, "uuid": "0277ea0d-d194-4558-8bb1-90d908ff42d7", "comment": "Malware payload (Smoke Loader)", "value": "9c0b09a6e1486495472b4ddab3cc9f9e362ffe1843c2f4b40b1174d7b0e85110", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677000537, "uuid": "1be0c280-4f9b-4971-aa11-06d0b28dfcf2", "comment": "Malware payload (Smoke Loader)", "value": "b389c5ec874618d5fcaf44ccac35faa963cb2a27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677000537, "uuid": "85c2ec99-4b20-4d2f-b18f-9fff93dd102e", "comment": "Malware payload (Smoke Loader)", "value": "5bbebbc845d58a3ecc854a1aed18476364717a9d0ac195aab4eaf9c020345b4d0573c1cb80153a5901d08984a01917ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677000537, "uuid": "ee01b70f-cb2b-47c6-aa8c-0c29584b28df", "value": "T186F3C02276D08031D3B36A35D470C6A65A7BB91321758A8F37A8173E5F307D29EB538B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677000537, "uuid": "5da48b91-252f-4aa6-825d-51c305cd5a33", "value": "1c7565cbbc7ffada58fbd5240403c775", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677000537, "uuid": "300c3abb-efb2-4a99-a46d-f1bf0ca6609f", "value": "3072:y3H1u9MgnpoUkK0h0jCOki/RbIL9VtS4qF3l1fSK81OpmUYabp:GH1WMgnpoUVfCKbILSj1ft7Hld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677000537, "uuid": "bc73d3e0-6cd5-4194-82df-cdf00b6fbcb1", "value": 161280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677000537, "uuid": "465f7098-d238-4580-bf3d-e6fe488604c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677000537, "uuid": "79f35d93-2cc6-40fd-ba7d-8916833754dc", "value": "SecuriteInfo.com.Win32.TrojanX-gen.15063.17682", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01c8df84-b1f3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676989278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989278, "uuid": "ecbcc22b-1984-42bf-98e6-999099449f23", "comment": "Malware payload", "value": "5b657208245ba354da2a90ad6bc02cf6", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989278, "uuid": "06886c43-1ee5-432b-b968-920a732d67af", "comment": "Malware payload", "value": "9c1014d8c296749e1442ecd5c7585d730db9bcaeb0cc99bd44071b784954cce4", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989278, "uuid": "0374232e-b229-4107-bb81-3366ab1d86c8", "comment": "Malware payload", "value": "1a34ca79f7cfaf59354026117c1053865ce0960a", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989278, "uuid": "8778b778-7bbb-4c58-8ec2-6e4e929c4469", "comment": "Malware payload", "value": "87088aeb2850e657ccc8631fe3250e38851decbe31056865625081ddb3c8f0194504826b49e19c6a0b8c146213cf672e", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989278, "uuid": "8e2cd7cc-396c-4c68-ae09-c6af415e3a59", "value": "T1C713E44AE79F0264CB411273671B0A89A6FDB73DB39155B1785C833433EDC2E42A66BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989278, "uuid": "229924fb-6322-4cd5-908d-7a696db88ca8", "value": "768:7Fx0XaIsnPRIa4fwJMZ+DXzv+h0LGgtovRYD22Ov9:7f0Xvx3EMc3v+hTdZF79", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676989278, "uuid": "7401f24b-795b-431f-aaef-44e4a35e9dde", "value": 41437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676989278, "uuid": "2440be53-4f28-4c91-8f98-2b5b07356a92", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989278, "uuid": "ecef85c4-2f49-4127-ae0e-1be039c1db7c", "value": "2023DHL.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cf26a04-b184-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1676941837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676941837, "uuid": "33d29c2c-23f3-4668-91f4-d545d2af628b", "comment": "Malware payload (DCRat)", "value": "020a91052b7e90badddd683b25cb61c6", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676941837, "uuid": "3918d1cb-c21e-4a4b-8912-85b2eedfef82", "comment": "Malware payload (DCRat)", "value": "9c249472061b3f9a3530a1af5024903ae6bd981fce9f637bc6bc91051263094b", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676941837, "uuid": "01441569-6793-4f94-b1c7-5a673119298d", "comment": "Malware payload (DCRat)", "value": "8d56ea98fe817fc77af154103c4405b03507b09b", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676941837, "uuid": "e1ed4fbb-ab1b-4295-aa0b-49d252b84e25", "comment": "Malware payload (DCRat)", "value": "f0e473e2e2842432d7f647a82af94608b83156028734118a926e6610835941063da76369f84f79c21021281d2ba5f258", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676941837, "uuid": "74d30a53-f0a3-4bbe-a645-fd62049f136e", "value": "T129F5333375D148B1C4716831479CD7B2273DBD211F2A568FABE4356CAEB8580AE243BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676941837, "uuid": "6e6c6b2b-f00a-4235-a1d0-6411331a8da6", "value": "73d12a96fab08773e2657237992c3c27", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676941837, "uuid": "5b3f10e3-1c8e-4731-b27b-7807b746bfde", "value": "49152:FS7qzHBl3OI6bdO+l90239W/mV8/2eZxsJyZvsEUDpuXz8X67q5N8gxcFsDQsee8:kcdOJhDlq239C2eZGyCT+8qHo4c16", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676941837, "uuid": "dd6c9d16-0ee6-4aa3-85cb-a8df00fe389b", "value": 3504993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676941837, "uuid": "d24c1dc5-8049-44ae-afc1-b0430701f068", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676941837, "uuid": "772e2797-c61c-4449-bb27-6273930cfa52", "value": "020a91052b7e90badddd683b25cb61c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa509d3a-b232-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677016753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677016753, "uuid": "2cb45423-fc47-4176-b6a7-e00ef74b20f6", "comment": "Malware payload", "value": "5f4d630ef00656726401b205ae4dc88f", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677016753, "uuid": "8b080217-1092-404a-b13f-470d95b15582", "comment": "Malware payload", "value": "9c337d27dab65fc3f4b88666338e13416f218ab75c4b5e37cc396241c225efe8", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677016753, "uuid": "562541c7-d93e-426f-bc49-eb752fff66c8", "comment": "Malware payload", "value": "aa8f2d6d98aa535e05685076ca02f781c2aa6464", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677016753, "uuid": "fb4e4292-56e5-4f33-8cc4-8c974cd7e42a", "comment": "Malware payload", "value": "b31d81e378a9bc7efa48013f3b631553059c2a761af2eb6c785d29a1d6eae1fdf17f377c7fe892813b5dcf122b8606ad", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677016753, "uuid": "7fcbaba9-5502-4b56-b08b-24a03bf16c6a", "value": "T18D3402F3A7DD5A60CD7519B290FB4453E707D92721FA8E2D3A02B6DCDE94780D90842B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677016753, "uuid": "0519059b-5f16-4d2c-90ce-80dbf1fa21bf", "value": "3072:a7BwlhZUTlqSJpicuvOp93DA6VDIxITa1lNSPKJ+3VUdqw2rDjY+V15SNnO4rxpb:aAgDuOpt06l9Ta1l4/p3HaNOyN1wf0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677016753, "uuid": "d8844978-5ad3-46a7-a9fb-fec95f05a9ca", "value": 245664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677016753, "uuid": "01484d79-9b38-4128-a18f-e4f86ca6473e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677016753, "uuid": "2816b69b-ee88-45e3-b95b-525930ba9043", "value": "Contract_02_21_Copy#909.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76f8a9ff-b1f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676989045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989045, "uuid": "ed368b76-9f91-46dd-b2bc-0d060975f936", "comment": "Malware payload (SnakeKeylogger)", "value": "40e350c2892c4529292b931852fd8780", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989045, "uuid": "731ffb1d-d944-4d4b-a015-d7c68ad9a25a", "comment": "Malware payload (SnakeKeylogger)", "value": "9d4bb6ad1ecf6354fa3839fc9ae30f458bfb8a4dc0c1b99ad024108113afa833", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989045, "uuid": "94ab204c-2fc0-49a8-8ad0-7310b4cbf09a", "comment": "Malware payload (SnakeKeylogger)", "value": "d57fda2c7231dbc5f8166f3953563b8321b1ea8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989045, "uuid": "7e61ee64-5565-4041-b9c2-902d6dfbde2d", "comment": "Malware payload (SnakeKeylogger)", "value": "7238ad658e9fd009c704fbf60dfdbda2c329aae0f2fb1d0a739055e14f05075700cf53a7476f89358b7e204856aec000", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989045, "uuid": "575eacec-7641-4a48-9088-d26842e7211b", "value": "T1F1D42314E3E811F7E90651736F33817A3ADE4D1809B9A39F67A10BAE7C20782D52B747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989045, "uuid": "d1b85f9e-161b-4917-9aeb-023aac11de30", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989045, "uuid": "651703df-18be-45c7-b797-5610543d7c54", "value": "12288:/YNRsileoC5DklWqthoLr2LZ0IQiKdy4vc8m9U7+yV4Qx:/YNRkytyr290I76vc82U7+y6Qx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676989045, "uuid": "f4c83fde-eeac-4dd9-a33a-82c7e76a86c7", "value": 618801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676989045, "uuid": "e3abdb6b-5cfc-40bb-b918-0ae367000365", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989045, "uuid": "ab2f30af-fca3-467c-b964-9209a72a27f5", "value": "File No65482 Rfq..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a61065aa-b19d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676952617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676952617, "uuid": "84047fcc-616e-47b2-8e3c-b50d03712ae8", "comment": "Malware payload", "value": "75d4b3e031408cece4a2c075dfe2238b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676952617, "uuid": "843e0a40-b4e2-4c58-911e-421e82856c00", "comment": "Malware payload", "value": "9d72fd84b0588b32feac9ee57a4a6a8fd88d3783a4a1f2232f910dbb85e5df27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676952617, "uuid": "561b405f-3166-4ebe-ab07-72e4620a9ff9", "comment": "Malware payload", "value": "868255ac0d539b3f21bfca4e93477d493f997640", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676952617, "uuid": "69ca93cc-41dd-479f-8a10-45e386cedc6e", "comment": "Malware payload", "value": "fea1faa11e98a9d4de1fe3bdb8ee4344eb867e8c5f3971a4e707355e0725a1efa3fcd1ef5e48f2d17fc7b8e9d8149ddc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676952617, "uuid": "b4ae56eb-e4dc-409a-afbe-15d64bd7f380", "value": "T1BE3633D5F5214A03F93BC13CA92488D9FBA959387198A4BA2BD9D9771B70FE002DC41F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676952617, "uuid": "583ceffe-6085-43c2-aac4-e96b675a4f14", "value": "c19c5a27cf193c3f49f1a5b91054e502", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676952617, "uuid": "c0e3ec9a-8b90-4a18-a62f-7d1bfe550144", "value": "98304:olrK3end+a+I6j/YmZk0tKGk5mUoyLA2sHgUzQk+9bW1WxwEWOXOT:olrK3yo7PcmLzUoQGkaiwE7OT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676952617, "uuid": "412d56fe-ff32-4a94-aad4-93436ed7e4a4", "value": 4971848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676952617, "uuid": "e38914ae-16c4-43a1-a5a7-755b6b933043", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676952617, "uuid": "3733d3a1-3d32-405b-9989-15f7cd16d4a3", "value": "Lightroom.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "462761c8-b190-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676946872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676946872, "uuid": "83038436-f2d0-44b4-865f-c7c9859699ba", "comment": "Malware payload", "value": "436746f0a89aa35bc1e3d653532634a2", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676946872, "uuid": "b314c7fc-e945-422e-86a4-9fd672d42349", "comment": "Malware payload", "value": "9db0613dbe5f58f8c71cec8f4970764aa5182b387aa83613095cefefdc72fdcd", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676946872, "uuid": "b455af66-543f-4d0f-8e27-6d7be7a66c00", "comment": "Malware payload", "value": "e343a7037850d2dabc27563cd67cb569ef33ed74", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676946872, "uuid": "cbfc869d-899f-4c03-98c7-14edf779b5e8", "comment": "Malware payload", "value": "aadc13b6ed3a96410f25dd3b2fd5f0d4f0082d147b9534d707b03a4c63562f4bbace4334babd84e6a1ab5bb8544f537e", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676946872, "uuid": "68f0ed11-5c31-4422-bd59-90b8450a6762", "value": "T1F516F143F348952FD477D1360ABB0776A1965C0A8A43D7473A28B26C5EBBAC05F85FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676946872, "uuid": "d745fd6a-08d3-4d14-b951-15239145b573", "value": "98304:0uf7khimLWc1GaV/wGlUPoc36TQ9ue2ePdlSmAW0:0uwhac1Ga5z2PNmW9H3SZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676946872, "uuid": "819a3b0a-c6b2-43da-8861-d63d8cc0365c", "value": 4042328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676946872, "uuid": "2a4d570b-5985-48f8-981b-dd6c8a5927ab", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676946872, "uuid": "c928bdc8-910c-407f-9ec2-2ff6b0d1dd1a", "value": ".apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1459c111-b1c5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676969552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676969552, "uuid": "d3996b01-da5a-4db1-b263-b527a916ef87", "comment": "Malware payload (AgentTesla)", "value": "dd5b2db08fb4c5353dfd4edb8b636647", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676969552, "uuid": "93b1b1de-031d-450c-a7d9-2d6ae75ebd3f", "comment": "Malware payload (AgentTesla)", "value": "9ea088337b6bf5f10380643b211ab858b4b3223eb81961a6f52e4c7bbe5db355", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676969552, "uuid": "ec71779a-0df9-4535-b5b2-f03c68bd6256", "comment": "Malware payload (AgentTesla)", "value": "e888948fac020e36b5ab9ce86ce87e873449f384", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676969552, "uuid": "717d7b82-bc1b-4893-894b-5572bf16388d", "comment": "Malware payload (AgentTesla)", "value": "9c517d9bf5543f9215f21e602207043fb9916ef45b0eccbd917d9d394563cf24f09b09f8c0e106f050ab4733e56bd304", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676969552, "uuid": "a2ca0a34-9968-4970-99a2-5acbd954df5d", "value": "T1B5542386A58777948F12FDD85F7B747CE8C83196B7995323DAA02C0D0E285A8C7341BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676969552, "uuid": "ab5bdafd-a232-447c-9964-eed9dfbc4bf8", "value": "6144:sBj8FyEXgqgwOGlr/+YqYVxgYIQ0cuvwN4nP0evcdK3cjlWRm:u8U8LFPi1vwudcMssm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676969552, "uuid": "7e16e74d-d823-48f4-83df-55f91d146d43", "value": 286622, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676969552, "uuid": "d44f9599-2aa4-492e-ae3f-6c926e9f5083", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676969552, "uuid": "0011dca8-0c0e-44c2-93d6-cfba9ab6e3a3", "value": "1026 PDF.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef761c45-b20c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677000414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677000414, "uuid": "af8376d7-bb2e-40e5-bedb-056b06d6be70", "comment": "Malware payload", "value": "d0b000750c6a902944468b25e1ff691e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677000414, "uuid": "3fffe763-5e13-4f95-8a1b-31c4853a6196", "comment": "Malware payload", "value": "9efee2d57d835c791d0d02054f78a246f2a789e279aa586f16819e438fad9c38", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677000414, "uuid": "d884c02a-e48b-45bd-af7f-ee4fc05367a3", "comment": "Malware payload", "value": "3faa62ce1071c6f6a9e6bdce09f100a5490a8263", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677000414, "uuid": "df91b5f2-728f-44e2-84d5-3384d48329d8", "comment": "Malware payload", "value": "9a73f71dc5e118528b26f05d444aa67da2afacfa564b530d4f7ee030fc4da0123d1c70a6471fd6409f841900a1e45ea9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677000414, "uuid": "ba9b0f68-c257-43a1-8233-436b3f95011f", "value": "T1EBC41247F6E88032E8B01BB05DF207D3053A7E915B38879B675A5C9E5C726A063317AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677000414, "uuid": "0d3f6279-15ea-46e6-83fe-b8d1dcc5288f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677000414, "uuid": "1a172bbd-0de1-496e-8199-31cfc2cbffb9", "value": "12288:yMr4y901JXUqeip7SxAztvpudRrGczjDid6Esn:yyakqeiMxAVpMRGcNEsn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677000414, "uuid": "9d6be803-bc59-4def-ba37-47c400044e09", "value": 579072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677000414, "uuid": "53b37db4-0761-4409-be66-b0715e1cef98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677000414, "uuid": "379d29c5-049c-4761-8676-fe8dae8de6a1", "value": "d0b000750c6a902944468b25e1ff691e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbc20f18-b1dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676980168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980168, "uuid": "0d65027a-3af7-4de7-a071-a553ea9cddf8", "comment": "Malware payload (Smoke Loader)", "value": "8869ffc5911bd3d81e4daab700d644d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980168, "uuid": "61eb65e3-b036-40eb-96bb-8a32273944e0", "comment": "Malware payload (Smoke Loader)", "value": "9f90b19d367015c5761bbcea789c99bb6499524fd1a8a47b77a4a47af32b9119", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980168, "uuid": "0e4e155a-704c-4983-8807-9b84316172f7", "comment": "Malware payload (Smoke Loader)", "value": "8715877d21c0306a8daf042cc1c7692b96e06111", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980168, "uuid": "c4605605-ea71-478c-b9cb-63b18f5d817e", "comment": "Malware payload (Smoke Loader)", "value": "2f5d1af5e70470e32e8bf14a2a55b974bfc19cba5a43f67f14901a935c9d8bc6e6a6845066c181629a3fdc42c8abe928", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980168, "uuid": "eb5bc629-8244-4d5b-b62d-4f2272523a24", "value": "T19C64BF03BAE83C53D9168B729E2EC6F8760DF5646F49376512185A6F95F03B2C273B80", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980168, "uuid": "532c9a66-b121-4ff4-9bcc-2ab2e6921136", "value": "8b23c6f110add61e2d6f38c3c2656d60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980168, "uuid": "efc59c51-5120-4067-9876-0f126a665802", "value": "3072:QZ2nLIYIOmODkKDLmEkCjGmU5gkp0m4pg4TFo2WgHKwodp9x2S2mdhiYOAzmmmiP:oQLVmQ/Wjp01pgrgAp9xpPiYOlmgNp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676980168, "uuid": "763f7315-34c8-4611-b396-9a28134f0cd0", "value": 321536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676980168, "uuid": "be07f6c0-66d5-4aa1-afe4-0de74e79ec27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980168, "uuid": "1dec8261-4ae5-4063-8277-1b44b4f69cda", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13620cd5-b226-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677011212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677011212, "uuid": "c39a562c-9ae6-48d3-ad18-4e129d9fc27f", "comment": "Malware payload", "value": "c3b58ced711567b33db3d17ecf6a4c32", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677011212, "uuid": "0a109a40-fe9c-4457-8a43-0b0a568a98c8", "comment": "Malware payload", "value": "a0df29850e5b36e8d787df718b9c261008e38e656de981fbb6f974dc85e6dfb4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677011212, "uuid": "d32f747e-e217-4c26-a166-2bb5c0dd91e9", "comment": "Malware payload", "value": "7dd3e64d4576bf4def0a07f3494342acf1a29624", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677011212, "uuid": "58043d73-35a4-49a8-a002-2378298df0a2", "comment": "Malware payload", "value": "25937ed3db88e6a6774f0f5a1a4a1a7dae0b3579fbe2120c921fef583269874e81d655f00448a21806179c76e38a79ca", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677011212, "uuid": "61ae9275-0706-4957-b6e7-5e343c64b9c9", "value": "T1ACF1A0759F0078F6F8A60279461D66C0A3A765B8814AF9C8D5805840A56AD1E3FF6C3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677011212, "uuid": "63b64482-3bbf-40b6-8e7f-cc934093a65d", "value": "192:eA7/AIwPI9xHUn0zRblHk33+/VGzZC3BUOhOOZKdz:l/vmaxNRblHOqmOpi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677011212, "uuid": "947b7576-3312-4330-ab77-b1ec8d77c413", "value": 7855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677011212, "uuid": "ff502397-b34a-453e-9d63-2cc647e5ff3c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677011212, "uuid": "04329363-78ee-43ba-a9e9-b708fc309d8f", "value": "malware.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83d958ca-b1c5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676969739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676969739, "uuid": "cba51bb1-c93e-41aa-8571-872d8666bed4", "comment": "Malware payload (AgentTesla)", "value": "07b0f1d0150f2e1fc833052cbbeb21fd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676969739, "uuid": "1ca3307d-24bf-485c-8e38-2367d696e911", "comment": "Malware payload (AgentTesla)", "value": "a116bf0fcb90808f31dbad60ea3618bc9d7d82529539aa14e0e03c00ae8f7244", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676969739, "uuid": "3707b975-0427-4d85-b89f-45f2a101cc54", "comment": "Malware payload (AgentTesla)", "value": "3456e4169efbe5123db8ccc85558673f2dc74013", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676969739, "uuid": "5ecea262-b40b-4615-bf6b-68fe92c41d87", "comment": "Malware payload (AgentTesla)", "value": "34b38a4eb2fdebfe066a3f5195419a496b3894c2664a2464e16a1dbf52aba75f94e9c34fa172fe4dc403bca4563e60d6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676969739, "uuid": "6ef9799b-eddb-4261-9adb-d691c0d7a487", "value": "T147542386A54777948F12FDD95F7B747CE8C831A6B7996323DAA02C0D0E285A8C7341BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676969739, "uuid": "b4a09ebc-e0cf-4cde-b284-8aa89e573cbe", "value": "6144:xBj8FyEXgqgwOGlr/+YqYVxgYIQ0cuvwN4nP0evcdK3cjlWRc:f8U8LFPi1vwudcMssc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676969739, "uuid": "35e1a838-c73b-4f97-9e4f-55e08c89e1f5", "value": 286630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676969739, "uuid": "f6418b7c-0cca-4cc1-a8c5-b2bd62e85105", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676969739, "uuid": "c5f43b99-c3d6-4376-80ec-c070eaa0576b", "value": "invoice PDF.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81243bc7-b1f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676989062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989062, "uuid": "0f42962a-e072-4ac3-8e4d-c10d69bfd818", "comment": "Malware payload (SnakeKeylogger)", "value": "703d136b07d2f1267fbf5afd4eff0751", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989062, "uuid": "25db5387-c24b-4b12-8c74-f8a5a32cb856", "comment": "Malware payload (SnakeKeylogger)", "value": "a2ef655224d3a7c452de3b7c6ba057e76272312266f38f6e0757804169d776b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989062, "uuid": "5badf59a-248c-44ab-9e81-3dcda557b2e4", "comment": "Malware payload (SnakeKeylogger)", "value": "d61871e01ac97e1d4a07291e6c3f953b28ffbdc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989062, "uuid": "8835a748-8e06-4669-810d-f8e43cc2caf8", "comment": "Malware payload (SnakeKeylogger)", "value": "5b5643f34c92b1be129978a13e8a095fe403bc2587dceb3c6b2a703fd83712dd4dbb97685012b18ac9a498db80bf1659", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989062, "uuid": "c2c1dc51-466c-4afe-a74f-7d738280a8ed", "value": "T13F15BF9977B46173F4CB01FE6C38278D2D3066177519E22E9B77BB91A270AFB7288101", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989062, "uuid": "a6d93f54-809a-4706-bceb-e42d0409eb91", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989062, "uuid": "ebc53d2d-1f16-4f09-9aed-a32c6f6b6848", "value": "24576:m6ky9IISaJ+Hl7GRHIsIE8aXXve1FbVufn8m4OmQDz:mzlGRHNh89Joj4U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676989062, "uuid": "052e740d-50b0-4912-91d1-675a921cd7e6", "value": 941568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676989062, "uuid": "1a6bda60-a211-4290-834d-18456a4f5754", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989062, "uuid": "5458e057-6e55-43dc-808f-3edcc4cf21a5", "value": "867F1E97-5DBB-4A87-A755-33D9012B05E2,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa441d51-b199-11ed-88f6-42010a9c006e", "comment": "Malware payload (NetWire)", "timestamp": 1676951040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676951040, "uuid": "2db4f04d-9b72-4843-b500-e4580a23abe4", "comment": "Malware payload (NetWire)", "value": "58d875ff734debcbc265a53820729770", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676951040, "uuid": "060f4dd7-ad81-4539-b21c-dd992accb55f", "comment": "Malware payload (NetWire)", "value": "a352b6008c6e33e2e10ddaed93d51cbab38bbf2993d503a9a9ad08e1fdc7797b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676951040, "uuid": "c4c32b61-7d9f-4655-bd32-0562d2a014fb", "comment": "Malware payload (NetWire)", "value": "3fad915ff84960aa40112cc2c185d7f60abf2477", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676951040, "uuid": "95c99f66-016e-48f9-b15b-2ec8408377a1", "comment": "Malware payload (NetWire)", "value": "752efd208d393293d37d20b7406b4874526d76d9e73b27b8ac37e513cfe7d265db0572d325a17cd55a15a8c14690b19b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676951040, "uuid": "0f746b15-7c35-40d8-949a-079144f4cfa1", "value": "T156C3C619FA0BE0F2EE4E1D7162CBF6AF0B786920D824CE41DF840D43EA53D576219B94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676951040, "uuid": "82be49e6-a2ff-4c50-b509-1123b0eab607", "value": "eaf9915d2b5730c3717ea003bd93404a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676951040, "uuid": "edaa226b-349e-4098-81d2-1ccd7a40b7d9", "value": "3072:nr/zIEyQIrPP+r4MrdN/086ibgqGWk1x:nrsEyQUPPGxFsYc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676951040, "uuid": "5948b901-c4f5-4d64-8131-8863cfee9d7a", "value": 126977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676951040, "uuid": "9a9ed957-5fa6-4499-ad95-c22d50736e55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676951040, "uuid": "e9c17ff2-f396-42bd-bec2-e32668863bf7", "value": "sample1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd5890bc-b1ea-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676985781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985781, "uuid": "fbb46bd7-db7f-4726-9110-c41df09c616b", "comment": "Malware payload (SnakeKeylogger)", "value": "5a4027334042b18b57909d017d013cfa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985781, "uuid": "60b47c6d-066b-464a-8e0d-a60ca94f1205", "comment": "Malware payload (SnakeKeylogger)", "value": "a5b6cf8784c7cbce70940978e61de4730b1b2fec3770596c6cf1c4087bd20b18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985781, "uuid": "08b667ec-2fc0-4bed-9177-939be1680b09", "comment": "Malware payload (SnakeKeylogger)", "value": "aaf59a098c278edb9fff5f2d02397034e0c90c98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985781, "uuid": "13d498a9-2a3d-4882-a512-f5719816e3e2", "comment": "Malware payload (SnakeKeylogger)", "value": "59433bce389dc4aa9ca912f76736ef9bd459af9ac51c22a5a1b42f8451c4899de4234652ea6cbe05fe78b8a08dc73c05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985781, "uuid": "f518e679-37e5-4864-b060-c6ba66c76991", "value": "T1AF05AD9977B46173F8CB01FE5838278C2E3065577509E22F9B77BB91A2709FB7298102", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985781, "uuid": "5594edee-49df-493e-81de-316b0db05e5d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985781, "uuid": "26b3fa8f-2943-4ba6-b1a5-93aa53b58207", "value": "12288:UWFXkyLr2ayjh1eNIWl9S77V3Q14MBBNltioIJGtprGZ/6/ofZwiwQXjnqk56LAB:nky9IISnV3Q51x/BGweZwBQXjqkx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676985781, "uuid": "a0e57247-53e4-4ddd-b6f4-1de4eaf132d2", "value": 818176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676985781, "uuid": "cccf5f88-6ef8-4060-89e0-d83d4cd3b2b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985781, "uuid": "9784d4bc-c9e6-4c47-88d1-5edbb217962a", "value": "BlG6DFILE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b70ee2c-b204-11ed-88f6-42010a9c006e", "comment": "Malware payload (BumbleBee)", "timestamp": 1676996595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676996595, "uuid": "8769300f-6c42-461a-a3cf-1796c98e995a", "comment": "Malware payload (BumbleBee)", "value": "1990576c1cc7270e841955ee847917ed", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676996595, "uuid": "b700bbd2-be76-4864-9368-9d0c79d78d5e", "comment": "Malware payload (BumbleBee)", "value": "a8a25ee71c0e8e4a06cd1573271672b871f78eba5f41803ffda6f14006c81803", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676996595, "uuid": "45e5a627-b175-4f7a-b42d-abdc30e42097", "comment": "Malware payload (BumbleBee)", "value": "6a1bdc104349419f7f103407ab43451f0d2e5db2", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676996595, "uuid": "71818147-7fc9-42ad-a530-8bcba54e1cb2", "comment": "Malware payload (BumbleBee)", "value": "ddcaa36a3db79ed9ab7ac12d88f9cab7c83d287d328b75441aa87df09c2f5c3f9d87bdc7fc33169758d342d39f78b6d9", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676996595, "uuid": "79aa1a40-3839-4af1-9d4a-a3dec34bf05c", "value": "T1DB25022467A005EFC43A4637D9925E36F7B07CD386328B7B1AA243261E1F3D55D36B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676996595, "uuid": "8c051fc3-7e02-431e-a1e8-169d68f146ff", "value": "9150a493893811d1b60f3559505479ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676996595, "uuid": "6a76c438-130f-4d5a-b908-30c24b59d771", "value": "12288:nwqAuOKfZ2j/7LB3qy/lj41q/ypBmP0WbLVgk/6oQZrvXwkr9kqTDPgTzJm:nwoOZl6SJ5vBbXit5xETzJm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676996595, "uuid": "3088d6de-3e73-4a31-ba67-379110413fb6", "value": 963224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676996595, "uuid": "016392e7-b912-412d-a261-e466d695f3e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676996595, "uuid": "f04b010e-0ece-4a07-81c7-507a1ba8b8b6", "value": "Setup_Win_21-02-2023_16-12-26.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "284fa3a7-b1c9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676971304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676971304, "uuid": "3fb8be19-4680-496c-bd27-503c338aeaed", "comment": "Malware payload (Mirai)", "value": "bd80030b7bf2556bd118f722b663d775", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676971304, "uuid": "f6036ba8-0cf8-4746-b470-7f5962ac3fcb", "comment": "Malware payload (Mirai)", "value": "a8a569ef07afe94acff4f7a929450f3ac64b5f9e8fc75deaa52ba55b7bc63f72", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676971304, "uuid": "68dff203-a084-4cba-bd37-c5250160c311", "comment": "Malware payload (Mirai)", "value": "b87d348f31c1797f02d9cec32659d2b108296c23", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676971304, "uuid": "101cd3c7-b40c-4bcd-b489-c09acbc1dd66", "comment": "Malware payload (Mirai)", "value": "bc995280f73526fa2361f0c2ebc2ce8f2b22c2d74bc4ff74374385799df6db8f04b51eb89b92e273527ef1d6e430986f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676971304, "uuid": "7f2f092d-b2e6-4732-8b77-24ec5e956f60", "value": "T137630996BC918B16C5D412BAFA2E118D331327B8E3DF7213DD106F24778A82B0E7B955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676971304, "uuid": "6706d721-9e63-4045-b668-c7ee3f8bf5e3", "value": "1536:l5nDTe7KayMe4+3z95xp83Xk2cD61kc4i3kMHiF+MbsuBNiHc:TWlyH3zEk2cD6if+Mbsu6Hc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676971304, "uuid": "beba5dfa-3b9e-4db7-9fb1-1db8a00e7e25", "value": 70992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676971304, "uuid": "217fb6f8-d5a0-4014-846b-1b89ae8890e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676971304, "uuid": "8a960028-9fb8-40e5-b525-ff995401c8e9", "value": "bd80030b7bf2556bd118f722b663d775", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1d16dda-b1f2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676989144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989144, "uuid": "989c2f36-5081-4598-b833-cf7d88a7fffb", "comment": "Malware payload", "value": "0942e8a989586b6252e404a9f45d5b1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989144, "uuid": "c1cf2c66-6d17-4efd-aada-fc2aece657c4", "comment": "Malware payload", "value": "a95030d4c3cde84da2ed749923bd904eae1a3a8573e7e0ab9dbe7f9ac40ad822", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989144, "uuid": "3e09f88b-6813-400a-875f-89c7815c7597", "comment": "Malware payload", "value": "b2ac5f2afbf933e29f7fa9b18e34504c2130b9f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989144, "uuid": "7f2c30ec-eaf1-4a7d-9454-5130ad7d6ca9", "comment": "Malware payload", "value": "71da50029449736c947ff44a2c3c0de41490ff987352e67ace12df9b5112259f2d7bf38a1d49263401ceab7d46da751c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989144, "uuid": "e6241cf2-3dc9-462c-affc-7ec38338ac86", "value": "T18C5623E352320089F4D29C3D8137FDA932F607A79B81EC7955EEADC036265A6F312953", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989144, "uuid": "46cbaaee-0b20-4360-bd06-2ec78270f3f7", "value": "895e5e6e037e9108574fb94ed614d804", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989144, "uuid": "5084ad9d-1058-4087-a003-14aa80372c81", "value": "98304:aPGUvRZDa67qg5px1ZFHV017ydNjv0ArSsNrampZbg+vmP29GjSCWAlofOdy:arn77dD/27yzjv0lmpFgEm+g57S0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676989144, "uuid": "c8fff1ad-fe38-4d25-8140-40e04079cdad", "value": 6315008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676989144, "uuid": "745b3083-bbd7-4115-ae6b-8832daff8db9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989144, "uuid": "d5cf07aa-28e7-48d7-9fbb-277f4c93f263", "value": "0942e8a989586b6252e404a9f45d5b1d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef04b175-b1f1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676988817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988817, "uuid": "ad0e815f-0bc5-4c2e-983d-3f21a5e755d3", "comment": "Malware payload", "value": "737b14b913a07f36e64b7bee88d123d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988817, "uuid": "d00cce50-b2f7-4d36-a777-8956dfd8c3cf", "comment": "Malware payload", "value": "aaa42d601537988070592398d386eb88b509862f2fb73d16378e3150e3fe938c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988817, "uuid": "461e9196-6e49-4b36-9a1f-f3cbf6f0be50", "comment": "Malware payload", "value": "412e6da61d549a8651f4094ad712630052897316", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988817, "uuid": "7a504e32-248e-43a0-8857-fd823a3a39c5", "comment": "Malware payload", "value": "7c449971d02b82633d016d357f2c812984870106f269647465450353ffdb1ecf95540629137d5a04399d4e892a18b3da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988817, "uuid": "367a9ce8-a17b-4422-8871-e554da8eb13c", "value": "T134C412903A58C53FCBC34571A6A2F72B0ABE6D64746047076B987F0D7E3E8C19A4E760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988817, "uuid": "cfbea672-58f3-4723-9a79-fae2c732c787", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988817, "uuid": "a644729b-9bc7-457b-b783-2698800cf71b", "value": "6144:qQ606x4fu7YaMkcZX4lBZ6ogLXCGiozRhH+gw4w+gV6wUZTZWxEdrBzH8fzVv/a:K7YaMPI+XCGfk2paxEdB8xHa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676988817, "uuid": "d318860a-6583-40f2-b8be-55ab1d1f1652", "value": 549393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676988817, "uuid": "0999a3a7-5b0a-44ba-9d5b-b4882dee6dd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988817, "uuid": "02a783fc-e91d-4762-8c0f-ebc14de2c2f0", "value": "234567896543456789098765434567890.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9f6a342-b1c5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676969803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676969803, "uuid": "e04e3ce9-3694-4735-a954-449675514806", "comment": "Malware payload (AgentTesla)", "value": "dfc4749b86cc28adcf79213218c05d23", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676969803, "uuid": "538e9db4-7cd3-4279-b7ce-0cf04b78d050", "comment": "Malware payload (AgentTesla)", "value": "ab39fb0221964aa2b481a4a1c92d1076d2b1e22afcae8d340dabae039fff9ed9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676969803, "uuid": "739ba573-1d27-46e2-bfab-22024653d0a1", "comment": "Malware payload (AgentTesla)", "value": "912a4a556be33ba58358a751e3b52bfb733e57f8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676969803, "uuid": "a0fe731e-991c-4b42-bafd-4d638429b947", "comment": "Malware payload (AgentTesla)", "value": "633336f47dc84375fb0bfb257285c54fda3de9798e251aca0ab8b77ec2a2e49f4e977d17d6448a05fa64a945ccfd961b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676969803, "uuid": "c0301a58-cf04-48c2-b2b5-d8c0f6aedc46", "value": "T10B542386A54777948F12FED95F7B747CE8C83196B7996323DA902C0D0E285A8C7341BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676969803, "uuid": "a3258372-0343-45d7-bbf4-2b6e3c4ac4a4", "value": "6144:3Bj8FyEXgqgwOGlr/+YqYVxgYIQ0cuvwN4nP0evcdK3cjlWRV:58U8LFPi1vwudcMssV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676969803, "uuid": "dbcaa23d-1f2d-4721-837e-3db8ea3018a4", "value": 286620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676969803, "uuid": "35781d7e-723f-4342-a212-6240113802b9", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676969803, "uuid": "20585965-1bdc-4e1b-b57a-55f4dbd21ff7", "value": "SCA2788.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8af37abe-b1e9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676985213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985213, "uuid": "ea6f51ed-86a9-4039-8ca6-12ed8cafd38c", "comment": "Malware payload", "value": "31120b3cff41aa469eeab7f3b8592010", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985213, "uuid": "ee4ad5e5-304b-49f4-a14d-e32f9601080c", "comment": "Malware payload", "value": "ac51aa36d4e6d6974b7ed89ac9c75258578fed36bc18e8a69af91e1d7e494f2f", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985213, "uuid": "14acf9b5-1b47-473f-8363-ec9c8799ffa1", "comment": "Malware payload", "value": "ec996389bbf24f81ff0d5187e1f5fa5c7632d392", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985213, "uuid": "e9ef7876-b645-47f0-93fc-249d3161d186", "comment": "Malware payload", "value": "bb4587c2f7b62834879af6b8b4b55184363c3f5ddf396a59995fd338fe724ebc19a56c298eb64903726c057f8b90fd4a", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985213, "uuid": "b44b7e36-67ba-480b-a002-bd3cad71a84f", "value": "T1AC238F6DE38F0265CF810277531A4E899ABDB73EB35150B174AC837433ADC2D46A66BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985213, "uuid": "04e6558a-3fd0-40c6-9206-95a658f41b24", "value": "768:qFx0XaIsnPRIa4fwJM5A21t3aN3UzbpFwHYA/XmVj1+GR5XmjpDB:qf0Xvx3EM5AE3AkZCYrjYGRQ9DB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676985213, "uuid": "71a67fce-bf1f-432c-b210-8185da37cdc2", "value": 47832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676985213, "uuid": "537addf9-5036-4e11-9ec5-83a14bb45dac", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985213, "uuid": "ef86b23e-015d-42a7-8a1f-57b61065b068", "value": "new order.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f60e8d1c-b20c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677000425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677000425, "uuid": "72888a3d-8bc2-43d6-8b6b-a9f6bb9bc8c6", "comment": "Malware payload (RedLineStealer)", "value": "0caf1bdedb65e0968b85f65c80da5594", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677000425, "uuid": "8368945e-bdef-40e4-bf4d-5733d56cfa3e", "comment": "Malware payload (RedLineStealer)", "value": "ac66dc201f99b597ee2e1927a3e8f1667bdf7705f2c8ac9ada9b04118d3a61f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677000425, "uuid": "77c8e712-d536-47d0-94ca-4a11feb1346d", "comment": "Malware payload (RedLineStealer)", "value": "36be55b0f729e3d9496ed67ad6cf5c3ca9f1c148", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677000425, "uuid": "0af3b6e8-d7b7-4a6b-824a-8bae16f12953", "comment": "Malware payload (RedLineStealer)", "value": "f8d9e17ca89bfb63a790c3631fc47ae54e5d8c71108236ca58baf0986d72130812db31b35edf84f6da63e8d3cad50811", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677000425, "uuid": "12d1e748-11c8-4182-a8eb-1f07573100cd", "value": "T112C40247E7E84033F8B007B09DF202C31A367DA11B78879B275A6D895C627A066757BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677000425, "uuid": "a93bb772-040b-427d-840b-dc034f60cb6c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677000425, "uuid": "50383608-9d83-494b-b786-7616fc0831a4", "value": "12288:fMrNy90kEWX207hInP74Ivpu+RrGXImYjEAIkB/xX:2yOWX207msIp3RGYqkJxX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677000425, "uuid": "ffd702ad-ab01-4b90-abf7-ef2077b47879", "value": 579072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677000425, "uuid": "75a737df-c1dc-4a28-8e4d-5ec2afd6cdce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677000425, "uuid": "c6fb19ae-926c-474e-ac0d-85d3bddc48f8", "value": "0caf1bdedb65e0968b85f65c80da5594", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "669ec742-b1d9-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676978280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676978280, "uuid": "b91c2325-6df1-4e65-a768-e31c2dbdce99", "comment": "Malware payload (AgentTesla)", "value": "2807ca09bccc9a67ac008d66803b546c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676978280, "uuid": "022e61a8-ee28-4b5d-89ec-2a9c3027abd6", "comment": "Malware payload (AgentTesla)", "value": "ae88e8fbf32acb0fbbda8f2e43e2e32e2e2a8d3d56af6b008f9dd58f59eb2b32", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676978280, "uuid": "a06398b5-472a-454a-9b8e-dfdf116ec389", "comment": "Malware payload (AgentTesla)", "value": "d9e80d62b39d5936bf6235c64eef68d3a95e127f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676978280, "uuid": "6b2d8d58-b8eb-42b0-80c3-c242a2837cf5", "comment": "Malware payload (AgentTesla)", "value": "b13e01bec45eff37ab1220edafb7ab6724b7ff931fd6f402becf17d92a62d65d7c321cf5ad37a7d6a05c1825e75fd9fe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676978280, "uuid": "42f356ee-add4-4bf7-884c-a4a3da7b0975", "value": "T11BC423B94D81CCCE51FAE83EC322155EDF21745F223183B5AB9A215C96291120E7DEBF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676978280, "uuid": "64078ecf-c459-4f35-be12-f85b8d200b6a", "value": "12288:fCYxYZjToRwjTeAFe35lQn2VyZCuOcQgoYf5op4r3jd:6QFRGThFe37hVy8npY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676978280, "uuid": "fcb29077-c2e1-4d0f-a558-530a5a640a1d", "value": 552020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676978280, "uuid": "a55c9281-3fd7-4278-bfce-9164121ea002", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676978280, "uuid": "8f424f2c-601c-4be5-b432-5222411c371e", "value": "doc 001.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "599a463d-b214-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677003599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677003599, "uuid": "30d9f3c7-9775-4030-b915-a46b215ed370", "comment": "Malware payload (RedLineStealer)", "value": "73206c954e82c2185dc7c76eab5df112", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677003599, "uuid": "4e85996e-7fed-40c5-b609-08f6e4f5e199", "comment": "Malware payload (RedLineStealer)", "value": "aebc5c902881430e65694e5ba2c4121b05b38a64a429cf8f7ec0757ebcf396bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677003599, "uuid": "e79991a1-0734-4284-af5d-4965607be466", "comment": "Malware payload (RedLineStealer)", "value": "b1774f15eb39dcc6b2ad42b979307e2faf9dfe66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677003599, "uuid": "8ee0592a-ec3a-4ab6-ba25-f8c13954d807", "comment": "Malware payload (RedLineStealer)", "value": "ea70958264e5144777fc1e86ad1e9f50c321c301d68ee8e8dae8ac446e16c21ceb346a2ac8936c84e513ec6cfb40c31b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677003599, "uuid": "a7752ef6-449f-4011-bef6-b1f125e24e10", "value": "T1CDF68D8797D58F9AC2613737A222C24466E4D7016347F33BEA2F13A71F83B39A5851D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677003599, "uuid": "306b7a59-f6b9-45bf-a3a2-3f35d17fd9dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677003599, "uuid": "e8cad538-97b3-4a48-bc36-c9b81f16a70c", "value": "196608:xkx9RHwbq+9QJGC018ev0Oo0wLzifJfaaSBgkONwDG/EHQ0wPm28lJ:mxQdpmev0r0DfVYgkwp6QnPeJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677003599, "uuid": "a2e5f453-4244-4437-8228-6c826dc934c7", "value": 15605715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677003599, "uuid": "2fbd576e-245e-42f3-9389-6e0b5ec18b2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677003599, "uuid": "e9ac0638-7609-411e-9bee-3442f1bb0c75", "value": "Discord Nitro Generator 2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "172159e2-b1f0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1676988025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988025, "uuid": "b3c56edb-25af-49e5-8bbc-b66c29d414e9", "comment": "Malware payload (RemcosRAT)", "value": "74be72dede1af186dc10a3a9ed75a8cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988025, "uuid": "25ac995b-39f8-47a6-8ffd-7690585ade31", "comment": "Malware payload (RemcosRAT)", "value": "aefce2215c6d2f0653119ad36953fe2dd9de3d6ab03670b68c14adc8921c9d94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988025, "uuid": "4b2c90b2-e788-4ec4-86bc-e32e0df35b9c", "comment": "Malware payload (RemcosRAT)", "value": "6c7ff56d6ce4026ef6e26062848874087c0ed6f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988025, "uuid": "32cacde6-784d-478a-9196-ac37a07908a3", "comment": "Malware payload (RemcosRAT)", "value": "62a03016ed08b17b36a379c07299dfc30c2718f1b9920f2e79dc4bad331c3e922ba5b5998a40931800ff100f42f65adb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988025, "uuid": "2ddbaff4-106b-4539-93d5-bb1d62c3560a", "value": "T11945DF9977B86573F4DB01FE6C38278C2D3066137609E22E9B77BB9192709FB7284502", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988025, "uuid": "5bc8540b-d431-4863-8800-a8249ba04f74", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988025, "uuid": "61544814-b23e-40ee-99c8-e9ccf338646c", "value": "24576:rky9IISacuYL8/MHpWsIIvo7RH57UxEyoitnAUEAM:LC8/8pFNMH57UaitnPEB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676988025, "uuid": "3e476352-bdf0-4665-8428-37ba60367632", "value": 1167872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676988025, "uuid": "019d7af7-cdbb-4751-a215-028f87fc2f96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988025, "uuid": "3eb99c6f-0954-47cd-b49e-f2b4d0b00bb0", "value": "EBB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c85b135-b1c6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1676970130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676970130, "uuid": "21135678-9702-4453-9608-8227bb39db5b", "comment": "Malware payload (RemcosRAT)", "value": "4dcfe85e647781aa52af2825f44beabd", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676970130, "uuid": "a4e39fc9-47cd-4f07-b1fa-0ccf7714285d", "comment": "Malware payload (RemcosRAT)", "value": "b121d9b4950ef1d71a99bbd8a0f93e71a150ec01f7986b1eebc1c557e9810819", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676970130, "uuid": "dc56a67b-c236-48c0-a807-2a7e2fb66c64", "comment": "Malware payload (RemcosRAT)", "value": "9e90576c8b3cd8c33afb9ee02b999142c9d8daa8", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676970130, "uuid": "05e7564e-eac3-4196-a896-947948beb177", "comment": "Malware payload (RemcosRAT)", "value": "f81585a8c1a055190bd34b994b66cfdb3db2ce720f1bc65b16ecc219e855a6c141865fce05f48e35339dc83cff8d7bfd", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676970130, "uuid": "bf3ed228-aaf6-4d0b-8f36-c72650766686", "value": "T13DA423BEAF8DF78242A86AFE9D6C7DA154E6F422E61F957711D47C16800F830D1ED022", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676970130, "uuid": "8d1ecf79-8d84-41ee-b874-0a5be8e5cbe1", "value": "12288:fwnSiNvaSaepfVA998rc2J7+yE7LPjaA29d:InSHI+9svJ7wLja19d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676970130, "uuid": "c2dc7d8a-022b-49e3-95aa-63a04ea34d39", "value": 492147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676970130, "uuid": "1c008d96-bbcf-4682-a382-3068d5801dcb", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676970130, "uuid": "7525db6c-6c30-47fb-9de3-e836f250b2c4", "value": "IRD-N.\ufffd 8800.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21caa7a4-b1f5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676990191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676990191, "uuid": "a1706121-87e8-4560-8ad7-dd6c97eb1ce0", "comment": "Malware payload", "value": "5d565f505d3af684fb135514bcfc34e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676990191, "uuid": "d799e1e0-9ec1-476d-8452-a0d5db928987", "comment": "Malware payload", "value": "b1648b9f8c9aacc1d9aaf5e3fea50f35fba0ac08086f79fb9c1a53d82fe15866", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676990191, "uuid": "9aee6d4d-6907-45ed-a8e4-90fe3cbe79ff", "comment": "Malware payload", "value": "3cca7815a02e56973e3b4870a8a6c3e28b4bd16e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676990191, "uuid": "d2cee97d-f6ec-42b6-bfe6-c7e1210e7438", "comment": "Malware payload", "value": "58cad0376bdc1a248dc2dbac97911c61d77eb827aa83a851ff66604d6fdfd57da5de48568b79136cc3aeb55f9f8a7dee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676990191, "uuid": "76e8f054-5d29-4ffe-9639-ba15588b4405", "value": "T1B0C45B9977B46073F4CB01EE5C38278C2E2075477519E26F9B77BB92A274AFB7284102", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676990191, "uuid": "105af90c-0feb-4e96-9e3a-b584d57c948b", "value": "12288:PvzXkyLr2ayjh1eNIWl9S7gghC6TLw7dsYByQWz+tGjYUk1IH9KoQEcItQi:Dky9IISnCgw7eYBgCtGjYxIH9KoMaQi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676990191, "uuid": "e9e21121-d5c2-4d48-a4e7-7e8630e87248", "value": 557056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676990191, "uuid": "2c44f4cb-f89c-4ca9-82d7-fc97f01c3376", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676990191, "uuid": "a49eb8da-6cfe-480f-8fc9-27969ac4e845", "value": "SecuriteInfo.com.Trojan.PackedNET.1850.30051.25046", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ef14f66-b1f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676989058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989058, "uuid": "fc7e5fe5-b3eb-4981-82a0-f7b8b187cb3b", "comment": "Malware payload (SnakeKeylogger)", "value": "f410fd50dd14cf9d1ae8adf5f9e65b8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989058, "uuid": "9945e5c1-2eff-434f-85e6-e20863bdb6eb", "comment": "Malware payload (SnakeKeylogger)", "value": "b3a8ac538be0b9db84f62a419be5bf4240293a5c90dd1cb8fb6cfd1f86356207", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989058, "uuid": "afcc17d6-3c67-4ea4-b485-d04d062c0b24", "comment": "Malware payload (SnakeKeylogger)", "value": "4bcc32fef974bf9989036df97612fbed4c72b52b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989058, "uuid": "58a5ee1b-15ee-4fc4-ac53-d02d3c6a72ca", "comment": "Malware payload (SnakeKeylogger)", "value": "bcfcdac21d52b153398bf06ac9405308589b98fbb78ece90ba07c63f01688db589fe9d8f06581232153d5f20e9fed7b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989058, "uuid": "724db6e8-9e0d-46ac-9c1b-6876460528fe", "value": "T1B794D5C118CFC40DC35E3633A5A1C52968D4CE32645B632E771AAF8EF43B74A574E6A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989058, "uuid": "10c98091-e13a-45ab-8c7c-6fcfb4a02aa2", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989058, "uuid": "45029bb9-2d98-4250-8e7c-921d3c307ee4", "value": "6144:sYa6dpFXx6gb5JRVYLBZqPDLPJMChArHUjRNeV2fJWICi:sYXpFXxxbr3mBgPXPJHAr0feohWq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676989058, "uuid": "c1d79e6a-a7dc-4f93-b2d9-5f202c9aab8f", "value": 429523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676989058, "uuid": "8182d660-66a3-4c46-be88-910dd9adbd60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989058, "uuid": "58c27a14-e44f-4d97-8ce5-2975bd0db8ed", "value": "PAYMENT SLIP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a9c32a7-b227-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vjw0rm)", "timestamp": 1677011761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677011761, "uuid": "75f53d6d-112b-4dae-b2cd-150985978b47", "comment": "Malware payload (Vjw0rm)", "value": "6133488aa55c35b2b8f8f5e987f2ce27", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677011761, "uuid": "280b1eb1-4787-4467-b7ae-226d3c1354c0", "comment": "Malware payload (Vjw0rm)", "value": "b3c5a0a3ac206fafac0c872021eb6b540942f301c72b2e09ad48d2e1c6ee679e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677011761, "uuid": "4bd05f84-a8cf-4e77-a57d-f98b6ac1020b", "comment": "Malware payload (Vjw0rm)", "value": "a288f7774abdd0c1f337fe25259d6432b08e8a57", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677011761, "uuid": "ebed46a3-d2ac-4851-924d-02e058248cf0", "comment": "Malware payload (Vjw0rm)", "value": "01e47b38b1d83107514f40410dc4177dbe017aae7c89efaa11ed206a54f875637ddd9d7d25e7e97eaf31bcfcb098ff75", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677011761, "uuid": "d519ca33-5e28-4f4f-89f8-ba2d28b6977d", "value": "T16002B0759F0078F6F8A60179461D56C093A765B8814AF9C8F58C4840A35AD1E3FF6C3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677011761, "uuid": "ffcd7d8a-fa0c-4325-aba2-f2c42f7b6867", "value": "192:MA7/AIwPI9xHUn0zRblHk33+/VGzZC3BUOhOOZKdR:b/vmaxNRblHOqmOpW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677011761, "uuid": "d5998fe0-8416-434c-bdd8-8bee4c72dec7", "value": 8399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677011761, "uuid": "ad7877dc-3270-46b9-b42e-eb06b0fca7ce", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677011761, "uuid": "250f2314-5bd6-4768-a265-5cc27185a348", "value": "malware.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cd7baac-b20f-11ed-88f6-42010a9c006e", "comment": "Malware payload (a310Logger)", "timestamp": 1677001349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677001349, "uuid": "eef00dbd-babe-4eb8-aa95-ffed76af573e", "comment": "Malware payload (a310Logger)", "value": "32d53c26b439754a3bd184a82652676f", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677001349, "uuid": "5faaad4b-ef68-490f-92b7-8929a7b30e77", "comment": "Malware payload (a310Logger)", "value": "b520c3f9254212589ec7da68647cebb4fd8cc2390aa90febf51c76dc8af3985d", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677001349, "uuid": "332d84fa-857f-4332-9fbf-4822b88dc24c", "comment": "Malware payload (a310Logger)", "value": "0d2576fa008ed063817c214466695b87073380cc", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677001349, "uuid": "7f5466ca-d77b-42c4-92e0-ab877b694f20", "comment": "Malware payload (a310Logger)", "value": "77d994685582dad1c76ae1ffdc2c147c751d468f3d62af132cceb370f63da1d53a39bb0fd71aca3fb357533784e7fada", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677001349, "uuid": "c01e032c-c3bc-46e4-9fc5-802b0b361b0f", "value": "T145B423156AE92267F4BE9F35AA15F73A3DEE08B753EC10C55404EF810F8618A473C17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677001349, "uuid": "7fbe6a95-e46a-475a-8bf9-ba250fef65ba", "value": "12288:N2P66djpK3vhdjsqPx4j6tLHbPDEx5dwS2:cP66dEv5x4SHXq5dwH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677001349, "uuid": "386153c0-fe3c-4221-a1f4-8a5fe33b70a9", "value": 497862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677001349, "uuid": "19f941c4-6cf4-41e1-a822-ea83f397ec84", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677001349, "uuid": "e3e4c78e-89cc-46a8-a0d5-6a5253156bd4", "value": "PO 152421.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4474abd-b1bd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676966492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676966492, "uuid": "d75f64d5-02fb-4d44-b1a8-3acdb076b16d", "comment": "Malware payload", "value": "7d1ce1cd3753114168b21a51f0a1f0b1", "object_relation": "md5", "Tag": [ { "name": "tools", "colour": "#C786B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676966492, "uuid": "9a53ef78-4474-452d-ab39-918212d7746f", "comment": "Malware payload", "value": "b62cb4a4fe1e2a932dc7d0bf307fe4d655ef045e44cb3c24be24fdaaf1ed794e", "object_relation": "sha256", "Tag": [ { "name": "tools", "colour": "#C786B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676966492, "uuid": "5603c557-b8ab-48c2-a270-7490d34d7aa8", "comment": "Malware payload", "value": "042e94c85de42689e1cf2309cadb0ce21fd564a5", "object_relation": "sha1", "Tag": [ { "name": "tools", "colour": "#C786B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676966492, "uuid": "70dc3fdb-5886-48bf-a974-e4d04fe54539", "comment": "Malware payload", "value": "abf96a7379fa403fbafb29b5b6de5ac8a426dd43e0c4c52c753cb42df10ec7646f26013d85622faff7e73480a82c23e6", "object_relation": "sha3-384", "Tag": [ { "name": "tools", "colour": "#C786B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676966492, "uuid": "2432aa04-bcc6-4661-a789-ccdf4b9cc074", "value": "T19AE3126586798D0FF150CBB5E1807F376E6B6D68EA303E6F052D014B64A1E052FAC36D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676966492, "uuid": "821e823e-9ca5-4c74-8726-89962b03c1f2", "value": "3072:jhaDx5iGIZMOb057ytx5SGfDPmJA7OenVEWokw/DB/92BJRrgTnjhY4qiGcxkiwM:oCGuMhm9SG7eO7jVEW+/9obrQjhYrinN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676966492, "uuid": "810ab1e5-4083-4e9a-9969-9781ffb67000", "value": 155668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676966492, "uuid": "e9f89579-70f3-49c8-8c01-3224024fbdad", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676966492, "uuid": "7840c4dc-f1ac-431b-8f50-4a1a8f24bdc6", "value": "sample", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5005ee45-b1c4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676969223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676969223, "uuid": "4003d91f-9f36-46f2-ac50-2c9e03e51908", "comment": "Malware payload (Formbook)", "value": "95bba62f525d875ef361e143af7c7e18", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676969223, "uuid": "813174e4-6592-4638-9045-1c63285b3b7f", "comment": "Malware payload (Formbook)", "value": "b77d7e3f55d98f60010d5ceadfc90f0f4058db7a12955e2b9f093e953e4a3f90", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676969223, "uuid": "0451c842-5461-409a-8eab-cd7f040dc38b", "comment": "Malware payload (Formbook)", "value": "39bdeeeb885d62df584e97765fb9943984ea1b13", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676969223, "uuid": "9e546eb9-f2e7-48a2-8ec8-2f1d7aea8b99", "comment": "Malware payload (Formbook)", "value": "93ed492d538956bea4226f2873b7760d01eb1791631cbbf108222f11e900bc0773e31f64adfb8ec86de1e3fd86cfca29", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676969223, "uuid": "db7bbf46-14b9-44bd-bffa-9deb6ccd4fb9", "value": "T1212533C3DD14187E3E5DCDA5A849B00E36D8C8F6CEA56706E05AFC4379583910FEACA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676969223, "uuid": "da4d8323-880a-4147-80c4-1e351e1625e0", "value": "24576:EcLZ7mxqefbuKlApJOJgGVfD/syQIgHzPVpCKq46vQx:/L0DHlA3ygGVfDUTIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676969223, "uuid": "60362f07-1dc5-4e82-87d2-0f3a0d691a69", "value": 1040539, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676969223, "uuid": "d45f0004-b817-488b-9da1-72440005b4df", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676969223, "uuid": "5fd5d1de-8033-482d-875d-cf3eeb6ebf5c", "value": "RFQ.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "576ecb03-b1b7-11ed-88f6-42010a9c006e", "comment": "Malware payload (STRRAT)", "timestamp": 1676963652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676963652, "uuid": "396a2101-4209-4852-bf8b-db0962390d79", "comment": "Malware payload (STRRAT)", "value": "5fb00035fe7f02e3ff803a9c93ab0d2b", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676963652, "uuid": "8b082971-1e76-4281-bf8a-b260f8b013c9", "comment": "Malware payload (STRRAT)", "value": "b87aba5eb58f6763328382ac5b9a1ed66d6501d02a613b830cfa4285c3bda8cb", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676963652, "uuid": "d103f746-dcea-4883-8cda-70e85ec5a677", "comment": "Malware payload (STRRAT)", "value": "978f93f781be8781c5ac8a7f82ced6e8939501f5", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676963652, "uuid": "9c1eede3-f36f-4c39-b9bf-bd795d4e7a87", "comment": "Malware payload (STRRAT)", "value": "c0ba800f4ba622f571948de0214dc066b94992456dddbd98868faaf25b92adf2e939c1928fc3ef2ed82c1dd6866792af", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676963652, "uuid": "1f85d71d-f8cc-4f63-9cee-3bd4236923ec", "value": "T1DF24F11BBFBAD4BCF003017320D49236271DC19DA254D11B75FDA9A92C35DA90A63EEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676963652, "uuid": "9eda2e9c-585c-46ce-9680-f6f6aad629b5", "value": "6144:Xnvb0M9lNQ9B7gnJ0EUghzT+7u+WJfexbiXYq:XnvYMm996aO+7u+ggk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676963652, "uuid": "a09b1cfa-177c-4233-931e-32c3fe84c318", "value": 214662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676963652, "uuid": "0ec9133f-dbe9-4bc5-a444-beb2a99f2599", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676963652, "uuid": "9460c8c2-a39a-453c-afc4-d86a239f4eab", "value": "Pedido n.\u00ba 00835500 - DGM_pdf(83KB).jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf326e32-b18e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676946216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676946216, "uuid": "a0aa22dd-3d9c-4b24-a1b7-1d159065297c", "comment": "Malware payload (Mirai)", "value": "3a8dd11f285a345906b33d32fec329e0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676946216, "uuid": "8746eb86-07d9-4422-bcea-f22876ff4b90", "comment": "Malware payload (Mirai)", "value": "b980d4baf74e828f994cef76d15e9e98a96f81b5b4bf7576f74013263e79d888", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676946216, "uuid": "f3ff5f93-051d-4736-bc59-b4f694d3fa95", "comment": "Malware payload (Mirai)", "value": "2f30e81fad82eb7801730f6bd2ceca68cdd989e4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676946216, "uuid": "a733d73c-d121-46d6-9206-2bb148b53976", "comment": "Malware payload (Mirai)", "value": "94dd5d98370b5e00ce226600b06b0b1000f07f482f090045dfaedd92057373db583f6cd19ba66ce7181feafe98e9d70b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676946216, "uuid": "bfa2b3e6-4b67-42fe-a023-0caac931a257", "value": "T121333B96B701AD3DF99BEA7F84134A0AF13077950093073A73BAFD935D322949D16E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676946216, "uuid": "f46eea01-bcfa-4479-b02d-313715404d92", "value": "768:O2e5jusHZxI/uh72tovRrpwCQyYcvbI8uCQwrxhbBwJG/cT88b80R7:z0jpI/KocR9r7I1CQ6hbBiG/O885R7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676946216, "uuid": "79b4c824-d00b-4680-a136-30c16a8a1bd3", "value": 53164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676946216, "uuid": "8f214bde-8c4d-4fb0-a8bd-9e035bd17ec7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676946216, "uuid": "4ef7cc2e-2c29-448b-bc68-ca2e88a3f02d", "value": "3a8dd11f285a345906b33d32fec329e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cc689f0-b20d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677000544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677000544, "uuid": "88ab85a2-1fae-406a-af00-7f3a3688fd4f", "comment": "Malware payload", "value": "708a76fc1cd8fc725557a8d1dd78f47d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677000544, "uuid": "e3eb71b2-6ce9-44e6-b897-e3c4189cab06", "comment": "Malware payload", "value": "b98aab78e5ef705e67a1f2ad79d1c66cf7360e0be5a843846e5ec402cbd07c21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677000544, "uuid": "29f48ce6-d6b7-44aa-b48b-e4f78b1db34e", "comment": "Malware payload", "value": "6385c78cba215216f97ff5c21811da5529d71f5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677000544, "uuid": "3a6dbaae-208e-46d3-bf0f-0f3b52201685", "comment": "Malware payload", "value": "f00c56c3ab43026b9c6a8a97752c432ec798744f0ea3b1cc555cb831e38df94cbb323ae49175f5951ed7e88333019c8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677000544, "uuid": "cc67fb93-9634-479d-96ce-500171fa5e88", "value": "T1B9F54A05A3FC0A94E1BBD6B8C9771212DA767C5A5B3092CF1150C47E1F73BD1AA39B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677000544, "uuid": "5277328a-45dc-4100-927d-7ced6e4061bf", "value": "9d22b658f9fde8f8fcc101dbaaa5aeab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677000544, "uuid": "29799f51-8ae2-4f23-9f21-8fc8a82a4427", "value": "49152:uf/p/xVFonmXux8IABZaOk6r0AVPuEKrxqTvR4dke0o374dJKMkRCHT2++kHw24O:XPORK1qjqzX38", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677000544, "uuid": "1c87be0c-2396-4555-b6cb-1ca438d2b650", "value": 3518464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677000544, "uuid": "86242a5e-bbde-45c6-a893-60a1c414705f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677000544, "uuid": "d0886d1c-5005-41e0-9a35-f842f1329b76", "value": "SecuriteInfo.com.Heur.20464.903", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5a37562-b1cd-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1676973339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676973339, "uuid": "bed5c606-20d6-4d5a-a7f0-e6adc62c5fe4", "comment": "Malware payload (RemcosRAT)", "value": "f1092f888dc95a3afa0be98685184ba2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676973339, "uuid": "4dc2d4f2-86d0-4042-9651-704622674089", "comment": "Malware payload (RemcosRAT)", "value": "ba159c0db403bbe2f0279d6a73342b8213ede878f0674025c57d73c4cb238de3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676973339, "uuid": "ec3662f6-e92e-4370-9242-5320139380a9", "comment": "Malware payload (RemcosRAT)", "value": "6ebf03699b16ceb2bd704f4c4dfa51a59e4305ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676973339, "uuid": "ef6a1e52-4243-4037-8e62-bdd2b1d1e60c", "comment": "Malware payload (RemcosRAT)", "value": "9896200364d385bdd66832dae66ece6ab22a162c68dbed4416a0f3ca1ee6cebb4dee692321f3a904385e3346abe74e69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676973339, "uuid": "42ecc279-24be-4a61-beb0-6a0478104eaa", "value": "T108A4AE01BAC2C072D57524340D2AF735DABCBC212925597BB3EA1D5BFE70190A72A7B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676973339, "uuid": "4ba77be2-eee6-4eaa-8c24-e3f03ab1e77b", "value": "b1c8f7572a6db205362528e88fd3ff32", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676973339, "uuid": "b8d62817-b1b0-4dbc-ac5f-29f8fe3648bb", "value": "12288:PjdAK8wxqkXuxOqLXO3X2orpbKs/Z6jYBRq:pA3wxqkXuxOq+rpbRZ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676973339, "uuid": "c60f8b8a-2081-4cae-b595-d47040bc8fb0", "value": 486400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676973339, "uuid": "5f35fc0f-7caa-4e3e-8046-9ab9331c3eba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676973339, "uuid": "294221b5-25a2-4587-bbbc-f821b7ffecde", "value": "1st.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fbee3ec-b23b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677020440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677020440, "uuid": "ca742722-80ad-47a9-a609-1dee2d6a910a", "comment": "Malware payload (RedLineStealer)", "value": "bbbcdb501f4259f0cadb63b498971ac2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677020440, "uuid": "33d890a4-f738-4528-b2ab-958b726992cf", "comment": "Malware payload (RedLineStealer)", "value": "ba696597b9fff0a8682b340684f4eb8e5c829462009b26517ae28439ae12018c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677020440, "uuid": "6a108512-f328-4115-8983-c3eb8f3d7ac3", "comment": "Malware payload (RedLineStealer)", "value": "9b4ff2b733b8722400103872a44b9ef44f969597", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677020440, "uuid": "20345e48-50d2-40f9-b060-684e7d9f53d5", "comment": "Malware payload (RedLineStealer)", "value": "782a2c8e2a8894900a6aa966688805bd3892a844b2482eb7d25ce0817ac5515eca8545f16a18e6d02ec773ac38e9278e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677020440, "uuid": "58eba5aa-0b5b-4a66-bbd3-c7c86fd268aa", "value": "T126C41207FAE84023ECF917B018F603D71A76BE656A388756138E6C5A1C723A4B271777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677020440, "uuid": "8e39daf9-8982-4a85-8dd1-083c21e769fd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677020440, "uuid": "67fb103b-1c50-4043-a63f-06a50dfcbb9c", "value": "12288:gMr8y90MhbNukwio12qqARzHl///vaZOrwPdS4ycV7jpa4BBTaYw91ouX2hdi:MyhBQbiogczF//qZP0JeVaCBTaYwnoSV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677020440, "uuid": "ab48900b-d98d-49dd-ae0b-12ec9479cac0", "value": 578048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677020440, "uuid": "03aa5d50-c982-4870-a3b5-a19a2c45397b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677020440, "uuid": "52f8910c-25c4-44fc-8908-0f82d4833283", "value": "bbbcdb501f4259f0cadb63b498971ac2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d4140b0-b20a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676999417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676999417, "uuid": "ba43ac71-d862-40b9-8e46-0a60c968dbb5", "comment": "Malware payload", "value": "ab65d502580e916224daab76b4aa3b93", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676999417, "uuid": "407fcf2e-c215-4ce4-98f7-45d6a8b9e170", "comment": "Malware payload", "value": "ba76846fb203b0886ab6cbd842c1ba30a42d778261a4928ad6d231cea1a89295", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676999417, "uuid": "b0d5ee0f-0c92-4700-8a1f-14b564c2b74d", "comment": "Malware payload", "value": "da9fcdf53c07732df9cecea66cbc66d77672eba4", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676999417, "uuid": "f175a12c-bf54-469a-94fd-67bb98ee8e66", "comment": "Malware payload", "value": "74aef10ec06c99b252942be3640c3597731408def21ab0af3726d0be5a63b081a6c021a9efa1d7dd532e1b13847cf2b2", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676999417, "uuid": "b64c33f6-84d0-4e2a-b7d7-04006c014ffd", "value": "T1A0A423B7D65C7D2B0B6C8ED608863E49F63E94D686E07C5609493D0F1823C065E67FAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676999417, "uuid": "28e475d6-a3f3-4cd1-9545-dbc9250ab8af", "value": "12288:d68DbmR+sJMiEnswJgTQU29jcprrkvCcoMEtcv4:d68nmrJMiEnLJg929jZkM004", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676999417, "uuid": "8c662472-7caa-4397-8f50-7a553060902f", "value": 462553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676999417, "uuid": "5dda95e8-affe-40a7-8340-5d6026e0b068", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676999417, "uuid": "9e512015-98cc-465e-b6e7-ff06b3471f04", "value": "1082300000832_1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7297b370-b211-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677002352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677002352, "uuid": "3dcbeb6b-195a-49a9-8a71-4a0a7acc5087", "comment": "Malware payload", "value": "072729a7ebf5f668d26c6fbe8b946be4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677002352, "uuid": "42311640-12d2-43d2-8200-5c527dce0eb0", "comment": "Malware payload", "value": "bab8a2a0f1ab5cf415fe8230b4c5d9f5b51bde2e60d1c142cb88a78fbdddcf9c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677002352, "uuid": "295634e7-91b0-4ab6-acf5-818c3494ae45", "comment": "Malware payload", "value": "074f4efb7ee6564c007bafdd50d88fa16fdb9435", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677002352, "uuid": "4d24eee3-ea6b-4391-8a4b-83ce7c81a157", "comment": "Malware payload", "value": "9ceb206a7ab5938e31a11db69f1e3125b06584a65716245a27ecbee4d22a186f3ebef90719d634ab5bb8830a2e9377e5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677002352, "uuid": "76bcab7c-cba4-4043-9161-97c8ab49d66b", "value": "T18CC4021BF7E84033E8B117719EF703D30637BE615A74879B638B684E1872A94663136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677002352, "uuid": "3f240c98-e629-48ae-8726-91ce87b9c4c8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677002352, "uuid": "f7879384-dfd2-411b-864e-2c784444d470", "value": "12288:vMrGy903T5GFVjpHSFLNAaiOQ9VFuvpudRrGAeIDXf6VQ0r:tyWTYVVHSFJAYuVFKpMRGNhtr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677002352, "uuid": "a9bd8ac5-7984-4ff5-b647-84e3b0f371e1", "value": 579072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677002352, "uuid": "b694bd62-77fc-40f8-962c-50f44eb1300f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677002352, "uuid": "e53d8c3d-13f2-4413-9b2f-983fb6d772f9", "value": "072729a7ebf5f668d26c6fbe8b946be4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fe37ea4-b1cd-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1676973034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676973034, "uuid": "8341f891-b4a6-4531-86f5-e37d9977cff8", "comment": "Malware payload (DCRat)", "value": "24ff46360f380141523398f1d59d9e0a", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676973034, "uuid": "bf268e8d-2496-4510-9f3f-85113a2c9d7b", "comment": "Malware payload (DCRat)", "value": "bb95df37be69e6b1b662a1a5936a77da4e87ec1a16bfc108919ed7eb836f0f80", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676973034, "uuid": "c0d1c7a7-87a5-4f96-b4de-b4dc9a54b0b1", "comment": "Malware payload (DCRat)", "value": "f7ab280a16decda5fb0af4715f6d77dc6c88d55f", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676973034, "uuid": "2fe4338b-7908-48c3-a873-5732e68025cc", "comment": "Malware payload (DCRat)", "value": "1760ac1137a5b48f7bc2e1fef878326c04217a3e03b9d8d91a5191a324724aad14a7a37262c9a4b7dd46176648a0634f", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676973034, "uuid": "a2e713b1-db5b-491a-a718-2be1a9c7924e", "value": "T158A6335953F00CEBCC38D538D8E19A24E77578A24BB88387436442762F635ECBD3B52A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676973034, "uuid": "ccaebc70-94de-4803-a247-cb1153c0a7c8", "value": "ba5546933531fafa869b1f86a4e2a959", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676973034, "uuid": "7bfa121c-8c2b-4f4b-98e7-4bcdf1baef78", "value": "196608:AMnzrcHc26BDd8GxbAQ5owejuJDUX47dwdW0LBTYPERR:JnzYHW/xCaUX47d4xZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676973034, "uuid": "98b12929-b1cb-4e2f-8937-147d92d27924", "value": 10335240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676973034, "uuid": "c776c323-b39d-4d3d-b059-e8dbc41752a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676973034, "uuid": "26ee68ea-0f0c-4bb4-8781-eb1435b49c21", "value": "24ff46360f380141523398f1d59d9e0a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29fab0b2-b1d7-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1676977319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676977319, "uuid": "46ab9f6b-5d4e-4779-a770-bc5795782f02", "comment": "Malware payload (AveMariaRAT)", "value": "5e2125e7debf343516ae7e16b1035438", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676977319, "uuid": "d19ff2d4-3e3b-40f5-9853-639c5e9e6e01", "comment": "Malware payload (AveMariaRAT)", "value": "bb9b22e3fe332e02a1b311385dd75248019458449f32b4a3def4d9ed5fb7b14e", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676977319, "uuid": "c6909713-6068-4a7d-9ca8-6256d2df19c2", "comment": "Malware payload (AveMariaRAT)", "value": "1fc44ec6f88b96db693286daa3b546927513e8c9", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676977319, "uuid": "7ee9f256-b908-4a11-8480-fcb6ed751b1e", "comment": "Malware payload (AveMariaRAT)", "value": "7db95404df358f38c9a2e1c1605a2eef549ed9a2beec93763e8ea33bd55e512b1d312dbad7c979d4722831ff5f17b72a", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676977319, "uuid": "28f64bf1-a8f4-4fd9-bde9-d001225b0ec8", "value": "T1F694237C2A2FF872BEF83F465A4D98237993FD041B982BD8BC9381C779458B847445A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676977319, "uuid": "f8cbd96b-70b3-4ef3-8deb-442ba47a0493", "value": "12288:9MlV2BskvAi/KkyDfBMdfbfvbyoLMuAr65:AYVvdvyo2e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676977319, "uuid": "5e046a36-07a4-494f-8caa-5aa70d46c987", "value": 446687, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676977319, "uuid": "e4250ce1-3f7c-4624-9ea9-65551f4655a6", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676977319, "uuid": "af774fd7-df64-4db7-be86-a4553256e0f2", "value": "Eigenmann & Veronelli S.p.A. PO.77210008.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f0d74b8-b1cd-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676973194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676973194, "uuid": "4ae6d99c-d605-4149-95be-782fccaf0ea2", "comment": "Malware payload (AgentTesla)", "value": "93a41bdf1e19321e51965918a1339b08", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676973194, "uuid": "35053382-e94a-4ae2-9786-c1130f4f8c1d", "comment": "Malware payload (AgentTesla)", "value": "bbf7b8c0c3542188f9a8b62cd3c096ce43d9536b8a635c350c9e16e2ee6a0ead", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676973194, "uuid": "769a42fc-19af-433d-b744-cc9a1a562319", "comment": "Malware payload (AgentTesla)", "value": "b843f0fde8f544cde99e7e408c8562bc86f4a2cc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676973194, "uuid": "94e710c5-12f3-48fd-8579-b03c93209174", "comment": "Malware payload (AgentTesla)", "value": "0721c9f345f81b014a180eaf8e25ec85374584c019a8308abb55444dd0c99a6fc294ca81aa30f17094852ec75f8dd305", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676973194, "uuid": "578b2053-5f4a-468d-8410-de6c250acd8b", "value": "T14FF4053D39B796D2C239FA3386D7E130B6BD80923303D95999D61AC04F426827DCEA5D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676973194, "uuid": "7f458daa-6e4f-4625-a9b7-44f5cabd147a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676973194, "uuid": "14c5e513-a77e-47d9-bc17-e783ac6d7eb5", "value": "24576:bHTsIBMNjnNNOhAe/S0fj1FSQNyTihwGQBI:bzIihwGQB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676973194, "uuid": "20621129-f8e7-44e3-b832-9a0fdc431cbc", "value": 791040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676973194, "uuid": "554dab3e-4040-47d3-8e2c-8cd6d7ab5b50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676973194, "uuid": "5b170a69-7b12-4574-8c66-495334ef326f", "value": "PAYMENT INSTRUCTIONS COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8109f7f3-b212-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677002806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677002806, "uuid": "e30a9299-388a-431d-90af-a84b7ae5c51d", "comment": "Malware payload", "value": "42a84eff31b1cb7bffa7af5fcfd15332", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677002806, "uuid": "5a5d7b4d-da03-4ce9-b8e2-46926563397b", "comment": "Malware payload", "value": "bc4cb9155797e5ad46807e162bbef33fadd1bcc7a6375cfc911bcaa0b24aa87e", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677002806, "uuid": "822a4e48-3ffb-486e-ba0f-87d7315bfd8a", "comment": "Malware payload", "value": "1f728aad69055467e9c0952fab4dd94c59209e13", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677002806, "uuid": "d0a42e9c-010e-425b-be64-289e843c2fdd", "comment": "Malware payload", "value": "17a60a31a3804839fc60650fd091c8c134014895c931a142cadaf1e72f6f157ffeb575bafdb6b3f1fbd82270e80e4824", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677002806, "uuid": "b8bd1bd0-8057-4253-bbce-f4c076b43222", "value": "T149E433308B87436473876C3053D8A0F096A7F1BBDCD7620422F75BF6FA2A669529DB05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677002806, "uuid": "5e8bf9dd-4674-488c-ab05-80a3944c5e62", "value": "12288:jxlNs4xXG6hYIVRKXL1VCRx+dPTsiBf/SGYgt61jzBc0NSpfF0Vkrn+qR3bS8:FlN26emkXL1VbtTNSGYT1jdc0NSpfFuU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677002806, "uuid": "37fa1299-a80f-4583-824f-e9162523a5f1", "value": 680821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677002806, "uuid": "6879074d-9da3-476a-910b-66fef46e7652", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677002806, "uuid": "b83209fa-3b42-4b92-860f-e4ccf6bb2d70", "value": "AWB 5331810761.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b124759-b1f6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676990689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676990689, "uuid": "be1862b7-e4e5-4ef2-9b5e-b49b088011eb", "comment": "Malware payload (Mirai)", "value": "996f1bc0c5711988ef6636828c72179b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676990689, "uuid": "85690749-0f8b-4096-9131-cdd82a8e6dd2", "comment": "Malware payload (Mirai)", "value": "bc811dd2923e592e0bdd132bde22dc24e1938ac1df0ddf858b436411c9b3e8e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676990689, "uuid": "bfc9db8a-1280-448c-a800-91cf844f2b51", "comment": "Malware payload (Mirai)", "value": "8c629ebd89a3095cb2e25443b969bccf73fec7df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676990689, "uuid": "0e3004bf-546a-4317-89e7-9b095e990f86", "comment": "Malware payload (Mirai)", "value": "6a95b48d54824863aed623c1cee4a250608c63af9ae068d731a1d5b2197bc5342abd8815292daf5d48f6d600114fc660", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676990689, "uuid": "70d17ecb-b5ef-4647-8ae2-5b2edbef1bb4", "value": "T1E6235BC49A43EAF5EC120A7420B7FB335B37F07A5159F987D3659932AC42B11A20B2DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676990689, "uuid": "560d37ed-f203-406b-9f2e-d04e7626ae2c", "value": "768:c8/MjSNW4GBs82WELXamRfWzqNYeZj/QaFEwaK3g+ZdG:c8/MjSNW4GBz3ELFdNYeBxRaK3hZdG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676990689, "uuid": "3282ae1c-ce29-4a1a-9206-80b5040d4c51", "value": 46640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676990689, "uuid": "bd2c5b11-7771-4a96-bc0c-23bf772ae57b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676990689, "uuid": "d8748699-7d4f-491b-844c-aadb7dbb87ac", "value": "bc811dd2923e592e0bdd132bde22dc24e1938ac1df0ddf858b436411c9b3e8e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cabff68-b231-11ed-88f6-42010a9c006e", "comment": "Malware payload (PrivateLoader)", "timestamp": 1677015952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677015952, "uuid": "76e90f12-32c6-46ba-bf8a-b5f3fd753007", "comment": "Malware payload (PrivateLoader)", "value": "6e5d25dd8b374199ddab6f8cc9e0afce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677015952, "uuid": "5e421d5d-e595-41d6-ae97-0f7268c3fe8c", "comment": "Malware payload (PrivateLoader)", "value": "bcab7d41e580d50925de89ec5beae1e2fb863b102b51ff412afc67bf4d3a156b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677015952, "uuid": "2c2d650c-85f1-4554-9120-d626998ffa8d", "comment": "Malware payload (PrivateLoader)", "value": "f6eea04803f7ceace11e9a3117a417eb8780411c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677015952, "uuid": "7ac9e17a-b95b-4aa3-826f-44e00b2528e0", "comment": "Malware payload (PrivateLoader)", "value": "e7ce97803f4aa2be3db5a9a203db8a9fb1f3da3d1fdd6d7783a4e76084c097094c1ddc7803969c8db6ce2e4bd8b00ebf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677015952, "uuid": "b2417eb5-d95b-41e7-a547-46898a54f0a4", "value": "T182F36B197AD0E0B2D671153138E0DBB1C52EBD304B6059AB37862F3E5F312D26E65B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677015952, "uuid": "6508b98b-4310-4186-9ec1-e8cd6dc9d574", "value": "1a7ba06c87bade3693958d0e4d963b91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677015952, "uuid": "89230e89-a3e0-4e04-ad6a-3ab77951f5c5", "value": "3072:UiGND+65HyDtVAU43j6eYqjJWOeG7h16L+4DMJuvAS1rKP+6o9JmYo7h+e:g5rEtVn42eY6ne06LDYJuvASEHDc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677015952, "uuid": "a7938c5d-1aee-4b25-8898-ef60785cbd43", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677015952, "uuid": "227b34bd-91ed-4616-a933-08c7665d14d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677015952, "uuid": "bad14363-3605-4f75-b0f0-cb70a3bf79de", "value": "BCAB7D41E580D50925DE89EC5BEAE1E2FB863B102B51F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b7eda9c-b1b7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676963551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676963551, "uuid": "e5452ab8-ee6c-4b64-9af0-f9c1622b8198", "comment": "Malware payload", "value": "0c9db2fb3bc302c2815fac8de29c57d8", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676963551, "uuid": "ce8b2350-c9fd-49b5-b669-973f8d36b86d", "comment": "Malware payload", "value": "bd091a42459e714ca321b5bbbe2cff6240fbbb6dc2cdc3319cdddc753909adbb", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676963551, "uuid": "6c4222ad-e933-477f-9093-74af5ca49609", "comment": "Malware payload", "value": "f37ea095c934e7ff39de985e25282c198469f473", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676963551, "uuid": "1cb8b94d-8399-49c7-bc49-9984d068478e", "comment": "Malware payload", "value": "6b5180ef2db7a1327f3b70c67aa96d740e92635aadf3dfcdadc7a64acf1894c1d8f844d35df77857dc9809585edb6b9f", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676963551, "uuid": "67ae0532-bd93-4d24-a5f4-3f5103f6e4b0", "value": "T18A350205E251ED2BEC625A30E8537582D223AC6E6D15DB9E21C3732F56327F20E37E64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676963551, "uuid": "b9e0c727-7c8e-4da1-b344-5a1636e080df", "value": "24576:aFetHLFRRQFeUNEezjhVm2m2bCVpGotOqG8gSRXXXXXXXXXXXXUXXXXXXXXXXXXt:a6hQLSODCVpGo0qGx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676963551, "uuid": "dc1023b4-0e30-4afa-98e6-f5087887be77", "value": 1163264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676963551, "uuid": "99bde31e-40b8-4b88-91b0-9c8cb15e4ada", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676963551, "uuid": "5d23931a-1547-41dc-b1fb-babfc05b260e", "value": "swiftXUSDX661.12X.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30463979-b226-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677011260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677011260, "uuid": "c41dc30f-e5b6-4339-866b-bf109cfb1e5a", "comment": "Malware payload", "value": "3797a1dd86bf2e8879d02cfc7c9fa601", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677011260, "uuid": "9a17b4ae-7f5c-4679-8e65-894397e40219", "comment": "Malware payload", "value": "bd210c5759b815a64b7166aceae471ef622bccdde3b46fc971aa78bcb73f08f1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677011260, "uuid": "bfeb2fdd-da92-4f0f-81c5-f78537f36c2b", "comment": "Malware payload", "value": "3df9dc4e19b52e449708bcddc3939ce662b69674", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677011260, "uuid": "ded63edd-0279-4af0-98b9-d6f3e5458799", "comment": "Malware payload", "value": "235412d69ab9bc88ac6a75ac1d9dfa457197b4b324c26868ee58e2d07e1b29060f30b326f7535a63ff2bb24bfd770b3b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677011260, "uuid": "c78c3ef9-45f5-4494-abb0-603e246984cf", "value": "T10A939D29E431D139E8A350FF8BF686BDAD644B201307D4D797C02E8A9B865D1F932633", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677011260, "uuid": "b216b311-06e8-4994-9fab-110945a450ab", "value": "f86dec4a80961955a89e7ed62046cc0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677011260, "uuid": "4cea9ab3-7126-4a77-82bf-e657c95f1da9", "value": "1536:mBwl+KXpsqN5vlwWYyhY9S4A6CJyQHFEH1OKZ3StXZsGXxq7y4PX:Qw+asqN5aW/hLoCJy6qV5ZigGhWP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677011260, "uuid": "f4f73071-fd70-4858-93e1-73a5c2fdd422", "value": 94720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677011260, "uuid": "e53a743d-1026-48a7-a08f-19df3c4b2a5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677011260, "uuid": "c17a8720-16da-436e-a29a-bd7f8e3d3d07", "value": "2023-02-21_3797a1dd86bf2e8879d02cfc7c9fa601_crysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec1d649e-b1c5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676969914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676969914, "uuid": "ae898bb1-2b4e-4617-9312-df3149c20dfc", "comment": "Malware payload (AgentTesla)", "value": "a914c1db2c3a2d0728f4728911a2e4a5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676969914, "uuid": "ba547322-fa87-4238-a01f-e9c9216781d0", "comment": "Malware payload (AgentTesla)", "value": "c01f1d833bebebb74b248ea0b0c23abc1a70269f62513b1a8a0d1d33a4922d56", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676969914, "uuid": "67801f25-d13d-4e8e-97c4-24c68f81b7be", "comment": "Malware payload (AgentTesla)", "value": "c3bfe27283a96743353aca0e517340b7a99d5679", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676969914, "uuid": "0bb69ae9-f57e-41d9-957d-86f228efa18d", "comment": "Malware payload (AgentTesla)", "value": "3aeb80f780e63a26b7d3a9a3e4a26e6cae3edd90c1a7d0b40e5e263471791e44fc9f3cf05de8d8f847aebac42818b667", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676969914, "uuid": "0faf2d91-4709-46ae-84e3-162296206c12", "value": "T1C25412B432D8C99FC9F303309AB246636BE5DF127625571E5B90436A3D73A40AA1E70B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676969914, "uuid": "9adb62bd-d23e-4c5d-b835-f5aea5bcbe82", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676969914, "uuid": "365b25ca-9839-4b9b-8a52-1dfa612ce7f8", "value": "6144:/Ya6KmSOwsPOa8xiu9p8iqXa69jnmHzTqFI3FNCxo:/YknOwsPv6j8vsTTqOVNEo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676969914, "uuid": "4f4857e9-5342-4b36-a54b-7ebbe165fdd2", "value": 296455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676969914, "uuid": "dd6153c2-783f-4131-8399-e3eaaccbe856", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676969914, "uuid": "e81f1667-31c8-452d-a120-1c251fa8dc39", "value": "shipping documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfa75c57-b1de-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676980577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980577, "uuid": "5c2ecedf-e0f8-4919-84e3-7f494570f6db", "comment": "Malware payload", "value": "f57b047fb51f66a8f4d3efaff4d46822", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980577, "uuid": "033deab2-5a98-470e-b741-a7be79c9a73c", "comment": "Malware payload", "value": "c05e258218a9ab6ab7f0f4e4477e243d982f0d90556eb456d4b047696e2aefab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980577, "uuid": "225090ec-ed57-4dee-8ac8-634d8d96c72b", "comment": "Malware payload", "value": "678fc3aa02f40a2af0114942365a441cdf21b551", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980577, "uuid": "10d278ac-57e5-4b41-b357-47f2c2c2b075", "comment": "Malware payload", "value": "a5f64e1e773169b344ab9ef9e79e7b13533ae6f7ee0551db7fd7a14009b4f3fc7a4199c0935907f40958c1f374ac8301", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980577, "uuid": "809e2000-6651-4d18-a999-4d7ca4763d94", "value": "T1F1C4F111F15590F6E873137008BBDCA329ADFD24A960453E7296B7BA7AB3F43031B54A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980577, "uuid": "82b3e976-8523-454d-8ecc-9248f5f82f8a", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980577, "uuid": "a89d95c1-bd6f-4b77-b945-c88f736e4d35", "value": "12288:gTMjg4wizoFjU9cOfpT/rOFvlzT48rOdoTBPlcrdHjxjCgl:CF4wizW+cOf5/ElPvOOTBPl2pl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676980577, "uuid": "d83ea167-e1f6-4b1a-a54d-3aaf95fe1d55", "value": 578792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676980577, "uuid": "4fc53cbd-5492-409e-9f98-8578aa8420d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980577, "uuid": "0a59d808-fbd7-4d77-b6ed-c6bf08af414a", "value": "1082300pago000832.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db97e61f-b1c6-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1676970316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676970316, "uuid": "ef773557-dab0-4308-b777-167c767d830d", "comment": "Malware payload (LaplasClipper)", "value": "b63f8a61fb95a0186241e5fcf517434a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676970316, "uuid": "94f83feb-e063-4cba-b92a-14855b9bf079", "comment": "Malware payload (LaplasClipper)", "value": "c06a5d2a048c41ac4b03f5fd47131a9349dedfdc266a2859c400e9f3a5f0315e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676970316, "uuid": "f3ccea70-8352-4b10-9a07-7940ef92d981", "comment": "Malware payload (LaplasClipper)", "value": "7e8bc5300560f9b0614a96b33016ff3dbb389b61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676970316, "uuid": "52e56562-8453-4de4-a068-e31f9b099e40", "comment": "Malware payload (LaplasClipper)", "value": "9b4b1db3a22e7cad3de13298e861973438ccb6a84d56596633555c13465c7e355658ad79fe94b9a05024afefe12f7862", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676970316, "uuid": "0a644a34-1020-4dfc-902d-737f9448a545", "value": "T19624E011B9D1C0F2F9A245744874EBA06E7EB8225779C18B33B817BF1EA03D1977631A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676970316, "uuid": "791e40a9-f7da-484d-baf7-170454ee7c18", "value": "565a7f11947c135731067a3a5f8e1519", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676970316, "uuid": "f0af9bf0-a709-495a-bff6-fc140df8d87c", "value": "3072:YGRR//qmLQbWUkJ0i7Ak8FIliXwOr4L5U3rWPdVkTVwIXCV6Fk:F//xLAkJiCig1i3rWPkTVwACh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676970316, "uuid": "5cdaa0a4-3ea5-41f6-a06c-eaea1aa391ca", "value": 216064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676970316, "uuid": "5ef2888f-7485-47c7-8975-894d5b47f1d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676970316, "uuid": "92216529-d0c2-4e36-b0ac-4e78ece574f3", "value": "b63f8a61fb95a0186241e5fcf517434a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44ebe869-b1d9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676978224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676978224, "uuid": "1a0ceb7f-5aa0-4702-bb78-e3cd866379a0", "comment": "Malware payload", "value": "16274daca70d541c57399c2156360124", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676978224, "uuid": "1aad82a1-f8fb-4c64-941a-5cc540e55326", "comment": "Malware payload", "value": "c0bfc01fc145322a9194eb2ca9d75285312805b577bcf8e6ca510d59389f4ab3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676978224, "uuid": "67f07fbd-3858-4195-90ef-572823868571", "comment": "Malware payload", "value": "4e5790cb7dbb3714d26140bd319410a90352c340", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676978224, "uuid": "5cc59085-328a-4085-9e8c-a218ec5f68a9", "comment": "Malware payload", "value": "a670feaee30acca0cc30a20e74eec9e8cd66980f56c9c1dffc727c94829a661ff0337635c22460a114f4bcc5d6643432", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676978224, "uuid": "921acab9-ab6f-4006-ae3c-81f601a2c03e", "value": "T1DBF53325B704E9B6ECAAC6311FCAE2792D31D8272CA52A2F57957ECD81233413713E4D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676978224, "uuid": "35722622-c8ee-425b-b2a5-fac28a016af5", "value": "217a8aab82f71d21e974d382c2b6f3f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676978224, "uuid": "e3125bdf-3589-4143-ad24-ae0270127b1b", "value": "98304:6CDrrzdb8PIJOvYWrn/LjdPUmTgebZ9X2IXd0v:zDvzdwgJhWrdxtbZl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676978224, "uuid": "a85e8888-d6d8-469d-99ed-3fbf85e655c0", "value": 3373056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676978224, "uuid": "30b130a7-07a7-4b1b-8680-c4526a99336b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676978224, "uuid": "aedee1c0-812f-4f28-8d07-4adfa1ecdc68", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79696ef7-b211-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677002363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677002363, "uuid": "ff6acca0-e65b-4849-8bbb-c6c7899f7454", "comment": "Malware payload (RedLineStealer)", "value": "5646ecf5ec52edb28421c512a734a812", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677002363, "uuid": "51e56b47-9618-484c-9b18-736b75945b90", "comment": "Malware payload (RedLineStealer)", "value": "c120e00022d8d427c3bbc86bfb7d1a3da8a04b19df70e971293f22d30238624c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677002363, "uuid": "62495a05-7f32-448f-a546-84cdcb9210d7", "comment": "Malware payload (RedLineStealer)", "value": "b04149eaa4a2b67e5cb21d8259cf456c67bef5a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677002363, "uuid": "83705004-fc17-4317-bede-d3c2a17799a1", "comment": "Malware payload (RedLineStealer)", "value": "f48986c7be4afff4785731544e95ce34ffa8fa683f73813f6ad77bd225ff5c3d3313644ecd44e60e1c70838725426d48", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677002363, "uuid": "5fc11cad-687e-45aa-86dd-82942f8f2049", "value": "T1E0C40247F7F88532E87017714DFA02D31A35BDA15B38875B639B6C1A48739A063327AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677002363, "uuid": "c5048fdb-7ef9-45a9-82a7-7c0b5db3f3f4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677002363, "uuid": "d97915e0-9413-4909-8216-a49874626af1", "value": "12288:7Mr0y90yXXLTeLV70goVRpxpPvpucRrGL1NYfEja8AUO:3y3nve570npxp3pNRGZH+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677002363, "uuid": "a3f070c0-950d-439e-ad2a-056037f75313", "value": 579072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677002363, "uuid": "3de40cb1-a8c4-43ac-88ec-f60621712c28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677002363, "uuid": "19f3c71a-d1c3-4cea-84e1-7912ed4586c7", "value": "5646ecf5ec52edb28421c512a734a812", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "575a2cc4-b1d2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676975248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676975248, "uuid": "98b32f29-dff6-4e86-977b-c0ffadee0b66", "comment": "Malware payload", "value": "4a771688864b87a40a5d9d0aa64d5fe9", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676975248, "uuid": "bfda0594-42e3-4c04-b050-a415776bab65", "comment": "Malware payload", "value": "c1da0ab115ca1f341e89af595a1e4a3bc28d7fed17536b377c969d85ae0529d6", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676975248, "uuid": "fb92d041-dc21-4cb0-bfb6-3be22629db7a", "comment": "Malware payload", "value": "e1143f5b24fe75e75f730c40f0cc96e410611548", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676975248, "uuid": "0a8507ee-6b4b-4868-b938-146c7053b093", "comment": "Malware payload", "value": "bd3a96accbad8ef62289a9b27b1dec5108cec2daf315982f499a245fd589c8b52c02c8ad37777ad391591b58ea7543c2", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676975248, "uuid": "37ce1611-0fbd-4825-a2fd-f7514ba6dbe3", "value": "T151350205D151ED2BEC365A70E8133183C2279C6DA959DB4D21C2732F9B32BF21E77AA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676975248, "uuid": "c0e3bc6f-46bc-404a-830b-ba85228937c1", "value": "24576:BFeEFvdmNFeoEezjEPmjbnDby1X3btnvsLzLs7gXXXXXXXXXXXXUXXXXXX7XXXXp:z9AUOlbnDb0LW/L4X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676975248, "uuid": "f8fb6971-dfab-4201-aa75-e2e4168e2426", "value": 1153024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676975248, "uuid": "d8dd73c8-56ae-4986-806a-9616b90ebff1", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676975248, "uuid": "69338baa-5d8d-45ce-a9a8-46024ec424c7", "value": "Quotation.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2a3059f-b1ec-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676986649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676986649, "uuid": "35cfe78b-a16a-47a6-b8e0-1072df85dba0", "comment": "Malware payload", "value": "971a0513966be0d9636dc0ee5950d103", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676986649, "uuid": "453aac6d-47b4-4dc3-a21e-2ed507d11543", "comment": "Malware payload", "value": "c27e38d55a4d9ada7e23e4829c034c36b9e735d26f53de44f70c6f5786736144", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676986649, "uuid": "c689c95e-7080-4e01-afde-287b8eb04039", "comment": "Malware payload", "value": "5382f1a9ece39f900b84611396e77eba248b9301", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676986649, "uuid": "80447cec-9a24-48c5-b087-7fe0a2f4b5f0", "comment": "Malware payload", "value": "c9cbc0de7aa0e981571bd07aa279b3017929ffad73f5d18db98540d4e42c651205f55a57591fbbb49ebd5c60bdb14518", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676986649, "uuid": "f257dc5b-b3b6-4a75-94e6-fdc6847c9401", "value": "T16C05AD9977B4A573F4CB01FE5C38278C2D2066477619E22F9B77BB91A2709FB7284102", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676986649, "uuid": "4f670d0d-4483-4638-8187-b2de37ea7c38", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676986649, "uuid": "881d63bb-2a4b-49ba-801f-72510e61385e", "value": "12288:eAdXkyLr2ayjh1eNIWl9S7K40Pjb3rNUF96aG1aSZRy9pN0hb7sbyoNFDFYcoB2Y:nky9IISWZj+63aMRwjU7sbbNVGcLS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676986649, "uuid": "0b1e0907-2b89-4ae4-8839-5d93f6560887", "value": 820736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676986649, "uuid": "73d2b322-a36e-452c-839a-e9bac25cd490", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676986649, "uuid": "3a0b7811-fc0f-408f-865b-26fca42db161", "value": "rAWB5331810761.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52167700-b1f8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676991560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676991560, "uuid": "d536b645-1040-4f3e-b5fc-1127ad68b3a2", "comment": "Malware payload", "value": "404d04f9f0ee3cdcd50d36aa7f4b7df1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676991560, "uuid": "46e2d541-4034-4a25-8798-34b6c4399f4b", "comment": "Malware payload", "value": "c41cacb7516cec6aa59d1a5e274de00c0ad6f86a9a0a1be8e45c7641e1ac4f55", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676991560, "uuid": "7fd86117-3b3a-4e14-991f-3ccffd9469b5", "comment": "Malware payload", "value": "147ddb48aa36cfad348c5f15509c7d1d1687f351", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676991560, "uuid": "ee9a71ba-5aef-4a18-bcbc-d98519d9d630", "comment": "Malware payload", "value": "c80c7d27271ef312459179eb2f964c7d628a2d6ce04e447a31150c72f60775a75dc8f697fd6fe5ead8153cc35ff2f8b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676991560, "uuid": "28c5ec91-dbaa-4c21-849c-c830b5ebe9f7", "value": "T198441264A7E0D8A7F81357301D7A1311AFB9A21A5DA08B9B1F509F8DBE31590CD0E7B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676991560, "uuid": "e61d2813-75f8-4eaf-abb5-fa0b93b2df3d", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676991560, "uuid": "34413ceb-d5c0-46d7-b0b0-d27c725f0b49", "value": "6144:/Ya6VlYuat/1dcd7mWeln6gsNWcu4f+ptd4JURWa5:/YfRu/css3NWclf+pP4WR5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676991560, "uuid": "873a35f5-586a-4820-9128-4f3dd3bd1fd4", "value": 259005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676991560, "uuid": "e744d219-0f02-42ae-9b64-c8b3da4b0eab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676991560, "uuid": "1270fa28-e431-4264-8994-37fdbae19243", "value": "404d04f9f0ee3cdcd50d36aa7f4b7df1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d6f0a22-b219-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677005726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677005726, "uuid": "3c2e3823-bfc5-4743-bd77-aa5cf6dd6bd8", "comment": "Malware payload (RedLineStealer)", "value": "7c95faea3e24fb64466d8d925f95c1be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677005726, "uuid": "330b8115-ee55-4eec-bae9-0337c57f5e3e", "comment": "Malware payload (RedLineStealer)", "value": "c43843275c563c3f8e31ee39a2a9ef867959593caa581a73885d0cbb0d61e056", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677005726, "uuid": "0e43ecb3-a0d9-48db-abd0-dc13e8bc8615", "comment": "Malware payload (RedLineStealer)", "value": "a8d171864adcf6974b0b2c43572362300e41e5a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677005726, "uuid": "364bb290-d6b5-4942-8b1a-c798cdb7625c", "comment": "Malware payload (RedLineStealer)", "value": "4e750ce8eebf9bb83b131beadc81ab9fd9f8955495d95fac8a961f3ed1a2e7adf124f70015ef73c90d872558df15526e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677005726, "uuid": "9c836e8a-16b9-41da-ae5f-6434dfdc4701", "value": "T117C40207F7E88037E8B557B08EF703D31636BDA12B74478B675F985A08725A0623276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677005726, "uuid": "440d2de3-8f47-436a-8568-f586cdcec5ed", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677005726, "uuid": "a6df5021-dd4e-43b2-95e6-af94ebbafac8", "value": "12288:sMrKy908oVj/Vnp4X6MfUj1vpucRrGHecDeL6E41KaV:Gy7oV7VCXtUjxpdRG+UEiK8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677005726, "uuid": "430d50d8-5abb-4e56-95cf-c6cda3b05636", "value": 579072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677005726, "uuid": "8d3243fc-0285-484b-b093-fe688b610cff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677005726, "uuid": "b3b6dced-d5cd-4f6c-b2e7-255967b3c2db", "value": "7c95faea3e24fb64466d8d925f95c1be.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea4e050c-b204-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676996969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676996969, "uuid": "a454e955-3124-4a69-bab3-2f721398bf07", "comment": "Malware payload (RedLineStealer)", "value": "6043571a63d5cfceed629f40eb18a183", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676996969, "uuid": "21eebb7f-5bfe-439a-b90b-31db09e35f37", "comment": "Malware payload (RedLineStealer)", "value": "c457e98c81f2d1f86a9062b8f7524d1f496d0d71da2c4213b5992a6d6544521c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676996969, "uuid": "b8ac5ba4-ffad-4a80-a856-9d8683cc8abe", "comment": "Malware payload (RedLineStealer)", "value": "89b184338bc0880d28bc32860fa278d8d87b3901", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676996969, "uuid": "54804803-ed79-4551-b3c6-a40af481736b", "comment": "Malware payload (RedLineStealer)", "value": "ea7077021c31c4a4a342230e589fa6f8a45349c40391d9a52089d8cf5f53be9bec4a85ea4b4b023305a2fcbaac8001e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676996969, "uuid": "f1233d48-6f60-4b87-b4c6-d37faa1b795b", "value": "T181C4120BBAFC4071E979177055F643C3163A3EA01A34865B238F6C5A18B26B4F6367B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676996969, "uuid": "aaaf18f1-f801-4a30-a59b-b7299a9bb897", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676996969, "uuid": "e6ba482f-2cf6-4476-8e58-cba74a422e59", "value": "12288:QMrOy90ChBWkGHdhduXFr4rpZBX1UDRe443kBumsJ:OyBWB9Cr0Tg00sJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676996969, "uuid": "c21d0ea1-3eef-477f-9d4b-4c6ce8b9fecd", "value": 578048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676996969, "uuid": "49447a05-4bea-4860-be50-3d3b25f2fd13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676996969, "uuid": "8ac5f4dd-18ca-4040-8793-e3fa3b12aa6e", "value": "6043571a63d5cfceed629f40eb18a183", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b6cbbb4-b20b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676999736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676999736, "uuid": "d9b178d5-a6e5-415f-84ee-55abc1835cc3", "comment": "Malware payload (RedLineStealer)", "value": "1d4e32342fa8f49457db23f9c0ecccd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676999736, "uuid": "5bf4547c-45b3-434c-a8a6-f23b58fa9301", "comment": "Malware payload (RedLineStealer)", "value": "c4ef1228abcdda75e41654382f23ea8ad5cc63e8dd36d0050da6b75c69b3901a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676999736, "uuid": "a95fdc8d-d008-4bae-a284-6001a705e326", "comment": "Malware payload (RedLineStealer)", "value": "c72c4df7bcaaaba76c996410db9a9905867eb525", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676999736, "uuid": "0c8e878f-97c8-436a-aa98-a84a80b9bc58", "comment": "Malware payload (RedLineStealer)", "value": "ef1ba554433776779c4fef5cd427710eafdea0f21834d8749d404e77786d5df4dd37b7b15f74b31538a4d522c68a080d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676999736, "uuid": "1c239348-c1bc-4cda-8ee0-1edb84375b4d", "value": "T1F3351307FBDC5476E8B027F019B606C30E377E619B38935B670B99660C73668A63136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676999736, "uuid": "f1ab8f86-6673-4669-ac74-de70154771ec", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676999736, "uuid": "d7597d2a-6673-4e18-92ee-40d7530a7017", "value": "24576:uyGcvVe497p8wuzEQA0V2vbctOLFxptFIh+/+Xy:9Gcvw4lp9uz+8+bLtTIh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676999736, "uuid": "31e4a93c-2b64-4c64-a433-c46be7d7cd1b", "value": 1099776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676999736, "uuid": "480cfc61-29b6-4429-a788-eeca6d264267", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676999736, "uuid": "d6c89752-ed47-482a-a7e2-f32a2ab676d3", "value": "1d4e32342fa8f49457db23f9c0ecccd7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b818cdc1-b1d9-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1676978417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676978417, "uuid": "f36994b8-20f0-4183-96e1-8af2f7d769fa", "comment": "Malware payload (LaplasClipper)", "value": "46be31fc9c8e72c15148145e04694436", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676978417, "uuid": "66ff0ef1-9b8f-41a0-84ef-0d93756e5808", "comment": "Malware payload (LaplasClipper)", "value": "c535fd319925a0afdddf1167ddc91ce1416f2510f9c4768e601b2913569a62d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676978417, "uuid": "287ab16b-a3f3-4abd-b9d0-c232be8a0724", "comment": "Malware payload (LaplasClipper)", "value": "a820d2e760fb9b5983ec4d40883be9daed9d9fbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676978417, "uuid": "fdc4e269-ed2e-4f4b-a2e7-ff08a597abb3", "comment": "Malware payload (LaplasClipper)", "value": "7fb7e934a1bcf286a87ed96f56dd80e8cd6c16553460bb28f9b91d0341ae5ee4633a62075dfcbf6dc69006d3c6765e9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676978417, "uuid": "8709dcd8-2513-4d3b-ba8b-1d074c777342", "value": "T182F3D0F235E1C0B1D1B7273058B4C5A56BBA78225674854B3BA8233F6FB02C19E76397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676978417, "uuid": "2b20ed78-98d4-4281-81d4-9e17e63a7a3d", "value": "3b9c426a6fdec2cb62dc7c138a0d2616", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676978417, "uuid": "56439919-f35e-439b-9f53-d3940a805c98", "value": "3072:JVr0W/AHfgGC8NwCbRuLI6oFGKKNU3PXuc2:Jx0W/AHDCewCNu0XE4Puc2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676978417, "uuid": "9ed7c29c-7454-4b44-a310-01fddefe6849", "value": 171520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676978417, "uuid": "618506d9-1ed0-414d-975b-9aa8283ece14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676978417, "uuid": "cf1edff2-38a1-4e3c-bf9e-9fc827be74cb", "value": "46be31fc9c8e72c15148145e04694436.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da884738-b1ea-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676985776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985776, "uuid": "663e2bb5-bb3d-4262-8151-020ed61a2dde", "comment": "Malware payload (Mirai)", "value": "2ee806b8da2e44ae86ec291699bb848c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985776, "uuid": "6dc10cd7-d547-4dd2-957b-d623de83feca", "comment": "Malware payload (Mirai)", "value": "c640bb4a9f3296aaa783f2970bbfa37ca7bdda1fdb90b1ffdebf7e3cd7c9b66a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985776, "uuid": "c7f48d6c-7470-400d-9116-60b48294f70f", "comment": "Malware payload (Mirai)", "value": "b523ce888fc71b53924c8b124c8cf6f006255f09", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985776, "uuid": "3fdb9f34-3727-4dd9-8cea-4f8f25b6d301", "comment": "Malware payload (Mirai)", "value": "f8906e4293ed86049d284bd469005bf1a492e2cb44ddeb2dcc67014e7e845afa27031d3803174e84e0fbad8ee523451c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985776, "uuid": "b327d614-aa50-40c5-9ae8-9152fda16f6e", "value": "T16773D71ABF650FF7ECABCC3709A91B45298C591B21A93B357D34D818B64B24F05E38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985776, "uuid": "3ce7068c-f934-4bef-9691-8efc56dba75a", "value": "1536:2M1MlC1iIYPqRhY5OMYJrOIWvazFpsok65jDdH:2sUC1iXOhhpBVdH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676985776, "uuid": "3ca2fe66-c8c6-4124-86bd-78769b2b4535", "value": 80264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676985776, "uuid": "fc62cab0-5d25-4555-b7fa-e75deeab6ebd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985776, "uuid": "67b8a27d-e3ec-4314-99d9-03c072bfbcaf", "value": "2ee806b8da2e44ae86ec291699bb848c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a0bdc92-b1ca-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1676971817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676971817, "uuid": "13874736-f204-4fcc-953d-a13b22d7129c", "comment": "Malware payload (Rhadamanthys)", "value": "45f9335fcefc8ff05db68a33b618b079", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676971817, "uuid": "a19935c7-5d76-485c-b796-a48ff4c0609a", "comment": "Malware payload (Rhadamanthys)", "value": "c643bf0ee1e9eb912839de73bd1c1876ce8786c80d5dfea99d4fb064bd98a244", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676971817, "uuid": "7330a8fa-d2dd-4c42-b25e-a62b7cbc17fb", "comment": "Malware payload (Rhadamanthys)", "value": "1928b38120ab18f78619fc4b2b477e406bfb10cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676971817, "uuid": "9febb1e8-cf59-4cf7-8a88-ad64ae15cca5", "comment": "Malware payload (Rhadamanthys)", "value": "53c0fa4207b1ac6f816761ffb01506fbb37f0ddbd60d6cc91c2cd6038034fc11a247606d17b187a385d7fbe9248ba10e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676971817, "uuid": "e4adb873-84e8-44df-8a02-410a52da3edc", "value": "T164F3D02236D1C072D0B7973018B4D7A56BBBB8122578848B7B98273E5F707D29B78393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676971817, "uuid": "23f83578-a4db-4fe8-8ea5-1cda520d43b9", "value": "3b9c426a6fdec2cb62dc7c138a0d2616", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676971817, "uuid": "40da46a1-61ab-4dff-8450-3dfadc251b8a", "value": "3072:7VrZn8X4GjWWXN5P1Xq2b2c0oOMRjNlYj+wupJHvXWKcW//Us:7xZn8zN95P16u23ujH0cpJHv/R//U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676971817, "uuid": "bc20e800-855d-4f71-a9ca-7711d5e42f98", "value": 171520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676971817, "uuid": "e0b38377-4348-437e-b088-e8c1cfbe9095", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676971817, "uuid": "e05771e0-5996-4f8f-9c1c-74cb1b630854", "value": "45f9335fcefc8ff05db68a33b618b079.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "863064b2-b1f0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1676988211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988211, "uuid": "cd42acff-2376-4254-8482-0ee39d986e83", "comment": "Malware payload (RemcosRAT)", "value": "71ab7196e639e9900469c836eb456a6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988211, "uuid": "a66fa7ce-a509-4d1e-ae2e-e92d01a388c1", "comment": "Malware payload (RemcosRAT)", "value": "c6aedf693ad6b497e5f18f5d7f600461a4b3d9b399d47f5a0f0ba9599e42e7c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988211, "uuid": "9002a8d3-d894-4b60-8dff-2049fa8bbc86", "comment": "Malware payload (RemcosRAT)", "value": "489fa8f8e9a79ffa812f913a7e5b4c45b2adc843", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988211, "uuid": "317f0acb-2d2f-4425-9c8d-b07669ff4855", "comment": "Malware payload (RemcosRAT)", "value": "60fb14dadaa1ad56cb1026c15b244fe882cdeb2942fca3c14a4ff2f880c26af82bcb4c6718995c8c7940d56a176fa73a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988211, "uuid": "4292e8a4-581d-461e-afdf-fd6a6d4df68b", "value": "T15A157CF210037EDD9B672D85E55422328C5CFE239A058114FEDB3EEC167E2189E669F8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988211, "uuid": "0e2b8651-e5dc-4c7b-8f2a-6861ee07711b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988211, "uuid": "397452c5-a239-4077-80d0-fc799aebcd7f", "value": "24576:dqdM1EmZHj0ZXSuHFBN+ga2iNMlRBRAAZj4rLsDzOUUE+wL+wUGNMH+:6BVUE7UG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676988211, "uuid": "a0f47d0f-782d-48fc-91ad-c0be9c1bdae4", "value": 939520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676988211, "uuid": "0b7c6354-0d41-45bc-b72c-a347b2347504", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988211, "uuid": "e03da2b0-0115-4270-8623-97b02e0a90fc", "value": "Sgawlzmj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca2b83ce-b1c5-11ed-88f6-42010a9c006e", "comment": "Malware payload (a310Logger)", "timestamp": 1676969857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676969857, "uuid": "a60a2fde-04e1-4282-9ecb-d6691dc772df", "comment": "Malware payload (a310Logger)", "value": "83d89fce1bc18eb8f8208007f39cd208", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676969857, "uuid": "803b925a-b7e3-4712-8250-c269f5af4add", "comment": "Malware payload (a310Logger)", "value": "c6bf68a560620fb785c27e00e1695406e86d25c656f6472b3a6886a710aeb238", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676969857, "uuid": "e59a0613-cb4d-467a-8b6a-a054fb46cf3d", "comment": "Malware payload (a310Logger)", "value": "e0b13be8e38b0b52a116fcff9f369306e9206cc5", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676969857, "uuid": "13d0307d-73c0-47db-a0ab-8dfc02c47b89", "comment": "Malware payload (a310Logger)", "value": "ecef181e64eae747a8256f5f26c4c6bfef411cad4fbc814dedd60ecaa753c4ca9cbe0075ded81a5e88c763bdd2d7768b", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676969857, "uuid": "54de4afa-f710-415b-a5c4-fb6aa7440c10", "value": "T189B423F3AE5B4A3BD06DAA4C2903D8C0383504D3DD8D536006457A7E9F2AD9EAEE7C15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676969857, "uuid": "128b2464-cf4a-4bff-a5dc-612e03169544", "value": "6144:xrQf6x6ql0qT58PgcueVFZEOCh+hZARZEKh63rZurK5wIHV1Dcu/5QM23nxlQjT9:efAl0qTODARDh63tFxcdM2LQ3t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676969857, "uuid": "ebdc7874-3f92-4d17-83fc-d46c6ff799ab", "value": 498002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676969857, "uuid": "7a37f3f7-ac72-4afb-8d1c-c52f5ba8273d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676969857, "uuid": "b9ca7f10-73a1-459a-900b-1e6aa76c268d", "value": "Quotation Required.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f944ab41-b1a1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676954474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676954474, "uuid": "f3d706d5-5bec-4c65-b7d4-9cf9cbf0aa55", "comment": "Malware payload (Mirai)", "value": "60de95171dc117c21265f7488ae1f06a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676954474, "uuid": "5099682c-e8a1-464f-b82c-87f0a99a07e1", "comment": "Malware payload (Mirai)", "value": "c732f3f8274cb5ebe25f46cece3b5f087d94af28706c9a6827d57a2adb810385", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676954474, "uuid": "28f53d72-a201-4736-a19a-4b957674898e", "comment": "Malware payload (Mirai)", "value": "e12be615b66b7d64a967a26a9a5fc53bed1bd8ab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676954474, "uuid": "d5f199f4-97aa-408d-90d7-94d24693737b", "comment": "Malware payload (Mirai)", "value": "e074703326f2b56e5e277c55b0819af87bc8bc7b80755cd3f3c5bbfee422dc821058203835166493cfcc132009d553f7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676954474, "uuid": "88ce0897-e1b8-4b2d-ba2a-1994c7b45ce4", "value": "T15083861A6E229F7CFB9D823447B78E20964823D627E1C545E16CEA011EB034E745FFAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676954474, "uuid": "c98ee2a8-15f9-4005-be70-991223db2239", "value": "1536:fEaxABjkLxIeSYptLZsb+5uj7qgbOTdr+I:caam1IeRLgXj7qiOTdaI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676954474, "uuid": "68ed0534-4f4e-4fba-8302-ed19c48554d6", "value": 81004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676954474, "uuid": "06bbcffa-b045-42d8-8f0a-4402d0f805fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676954474, "uuid": "8ea1f15d-387d-404f-9406-ca305c73f160", "value": "60de95171dc117c21265f7488ae1f06a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0946e45c-b1de-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676980271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980271, "uuid": "0446e074-84fc-441c-996c-684ea84c62a1", "comment": "Malware payload", "value": "30dbbd24d984ce40562182761dad3471", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980271, "uuid": "41e7f3c7-e3b2-4a3c-8b24-df0a101b0cdc", "comment": "Malware payload", "value": "c88c4dd94d554a430dac2c5d0c2cb7fb0eefe33608b39cb75d900570394e742a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980271, "uuid": "d61d37ff-a4b2-4ac3-9cb6-154c63eb15d8", "comment": "Malware payload", "value": "3641219b8b5b284f24f4ff63a5f201a68cba6dcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980271, "uuid": "1593b1f0-1176-458e-ad45-4ad6e23e55f3", "comment": "Malware payload", "value": "2c60923d508fc7d17895c5ff791436c36b1b615fc15a352224f5e9f0c8de4cccb56b4454174c5fd666d48c900b10d586", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980271, "uuid": "9e083f68-e22b-4755-8777-67df05e960b5", "value": "T16B16336B58210176FAD85CBBDB83173F5938FDD2806A629CB595E6CEDCFB28040658C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980271, "uuid": "ca11bb48-1ab9-4090-bfd0-5c34a8527313", "value": "9ce981287240fdb113aed53e842cde51", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980271, "uuid": "794b7958-c32d-4004-ad26-ab6b57e29ffc", "value": "98304:fwwJ+es/3RT8tALKR1fFWIdXk3COE5epP+LGDIXAcvz2rfnE:fwMs/3RDS1fXai5edUXAcvy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676980271, "uuid": "a57fd2b7-3199-4467-9d51-048222a6f2e5", "value": 4171264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676980271, "uuid": "83f959d1-406d-4fec-8564-2beed90a1f41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980271, "uuid": "0fced737-e84d-4497-9d12-1c3dcd40acfb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f9c0cec-b216-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677004360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677004360, "uuid": "d7fd9c9f-1451-46ff-9f10-ed9410bdf185", "comment": "Malware payload", "value": "1febad49985923b55240a27ff5e4b626", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677004360, "uuid": "2defb8cd-bf33-4b9f-ab94-aef9b09dfd61", "comment": "Malware payload", "value": "c924e8905688ab755ebed9bad8d0a64ec44d3116f53161fb145753ed246e0fa6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677004360, "uuid": "e1bc5d11-2b1b-4a8d-ba69-4b8cb81789dd", "comment": "Malware payload", "value": "03fa6828f5b5cf7b72f26948d8c0ad08b3873612", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677004360, "uuid": "b04c30e8-aca1-49ab-b595-55fed92057a5", "comment": "Malware payload", "value": "667f8fd434211d1349ccbdc21dde062efb38749387b686f0cc634a6b291120d83e08c60f7de8e3c24492504040bbfc3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677004360, "uuid": "b966558d-5228-40b5-b0fb-068d80f5d663", "value": "T11515BEB133B050B3F4AB46A6C019238C5EBD70537616E27A9F7BF9C196029FB75C6602", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677004360, "uuid": "d33e3180-5f15-4e2d-9f72-bfc472965157", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677004360, "uuid": "d0961458-1343-4c63-b93d-5e18d25180de", "value": "24576:MpM5K/uBw8zdXlTrsRtrJ+HlT9IExKMa:0qK/uBw8zd9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677004360, "uuid": "80177e72-d7db-4a21-a799-0a4f31c6b928", "value": 956416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677004360, "uuid": "2bd837ce-0297-4f99-b361-cb1382810b2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677004360, "uuid": "2752e630-b089-43b1-8270-ea3c99b2d163", "value": "arinzezx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "696a6c86-b21b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677006632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677006632, "uuid": "dce94093-aa48-4033-8548-f5f4c4ac578b", "comment": "Malware payload (Amadey)", "value": "5e7b31ef4be668d9d7586d5d0e75a49b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677006632, "uuid": "eff5e6b2-2c25-493b-92a0-9c2b08684521", "comment": "Malware payload (Amadey)", "value": "ca02d7d9ded6d35965b5eae79da178fbb884c9002ae33b342a689ee8842990dc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677006632, "uuid": "17d2f5fe-ec02-4c25-ab60-7df2ae36c30c", "comment": "Malware payload (Amadey)", "value": "546a58600b183ff8c9c4740a577e93dcb02a0c9f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677006632, "uuid": "b3b56efb-5923-4ad8-994e-8aeba6fdf96a", "comment": "Malware payload (Amadey)", "value": "e809c5abe69655f82516631a840be872bacff6d3813635b403595bce8f58695ab4e0f3b86f55a35d46763a09de845e54", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677006632, "uuid": "c9697f6f-50bf-4bef-962c-12fc262c4e2b", "value": "T177352347E7E58036E475037488FA52D3063A7E506A38478B539BA96E0C62EF0D73636F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677006632, "uuid": "f1eeef8f-c60a-4314-951c-89278cb04310", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677006632, "uuid": "9b274886-565d-4568-928d-38f6f493a026", "value": "24576:MyxPxCrR+rufKvb0i8Gxjh4JGe7eNco1hZ7UfiOfO:7xPxC2TljhcGOvUh6ii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677006632, "uuid": "f58bf0a4-e47a-4d29-a2be-b22459ba716a", "value": 1087488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677006632, "uuid": "0603df89-6c04-4a31-b66c-1b9c687c1983", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677006632, "uuid": "487348f7-658d-44a8-bc5b-51c9398458ed", "value": "5e7b31ef4be668d9d7586d5d0e75a49b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8d93654-b1c2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676968513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676968513, "uuid": "4ab7ac9b-7559-4b00-988c-d9198751d513", "comment": "Malware payload (RedLineStealer)", "value": "1562a62f5664dcba230861ddd4add165", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676968513, "uuid": "0053a293-c126-480b-8b5b-32a872a07ae9", "comment": "Malware payload (RedLineStealer)", "value": "ca10c218c7ed12f56148c11d31a0698c8d232064faba12402c16b70f7e34bf55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676968513, "uuid": "1243cd01-d960-4a68-b4ba-eb58708207a1", "comment": "Malware payload (RedLineStealer)", "value": "abadfdbb1bdd501d9b1bdc1ab121d9c0c4e69ace", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676968513, "uuid": "fd7d8062-1009-40c6-a5f8-3ccc4f8105c9", "comment": "Malware payload (RedLineStealer)", "value": "6bf9ca4f65a28b9240ca0cf8781c48d4bad3218b1a9ff926d91a63ea6437c468adc5db4c9d441445acd4871c87af5ff5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676968513, "uuid": "b46fe3f1-323d-4f1f-9160-dad6df1b5a43", "value": "T16D46233313294005E0E98839CD2B7EB535FB1F3B8BC298787596B9C629716F1E51BA43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676968513, "uuid": "a88e7c37-1c53-4503-bf47-386fb401edfd", "value": "b0a438491df559e2ae875aca71787ff8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676968513, "uuid": "11f11509-9601-409c-8f72-18888dbba824", "value": "98304:q8DHRN3EqJHIOgX5c6Voph+KeVpUkRksrDUnX7+7aVJtBXSfB:NUMHyX5mh+Dfss8nXq7aV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676968513, "uuid": "4ebf56df-86d1-4e4e-83aa-1ad76d85cfc4", "value": 5382272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676968513, "uuid": "8cfd4747-319c-4f6c-9384-cfd03664b902", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676968513, "uuid": "b0e9bfac-dd6d-48de-9bd3-7701b91944cd", "value": "1562a62f5664dcba230861ddd4add165.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3073e21-b233-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677017144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677017144, "uuid": "58a3b0a1-da7a-4bbf-8c56-2fed2f96b797", "comment": "Malware payload (RedLineStealer)", "value": "6d2f8ffdf67fc78532f7d2e50c322a5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677017144, "uuid": "f94c261d-586f-4fa3-a45a-01d3822103b9", "comment": "Malware payload (RedLineStealer)", "value": "ca654b07426265ae38f8b5894060102dbd3d4ffd65460a13d5c53dcc39ff2cfc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677017144, "uuid": "25225e3b-f4c3-41f9-b413-5472140685ba", "comment": "Malware payload (RedLineStealer)", "value": "59fc06b996b169e367aa2818d25d763ec21066ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677017144, "uuid": "6146dca6-4342-4cf3-88c9-202c74429c79", "comment": "Malware payload (RedLineStealer)", "value": "224eb31518f4fce254b44afaadf644df67b3330fd067b01765208ff1eb94219aaedc413d77308cd4bea3544267d9df6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677017144, "uuid": "aa1b3dcf-7ab1-4f0c-a00b-4e7ab09632f0", "value": "T182556BA7C381511FF2673032C25DC66A921637316A4F78AFB708ABEDD72B1D05A25B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677017144, "uuid": "650559d9-49bf-4095-b41b-fe1ff9558666", "value": "95c60137b5c1bf3b2e377aefce384dee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677017144, "uuid": "7dc3d19e-f057-4d2d-9c43-e6f67ed67798", "value": "24576:43ZhubGtuOCRzNOQIU1rMA/BiJw+yG1+uT2NYi0zy7ErmE7cBh1f7/d2oslu+YWP:4Jh9FC5NOQIqH+yG1BdlA3p0AOo02og6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677017144, "uuid": "1aae95f7-be24-4b53-8067-8a18e9bd1ddd", "value": 1389608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677017144, "uuid": "235f5ce6-61e2-4de8-9ca9-8734493f0bcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677017144, "uuid": "5093856a-0546-4bae-9645-0a9964202f71", "value": "CA654B07426265AE38F8B5894060102DBD3D4FFD65460.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e16ba2ef-b1c6-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1676970326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676970326, "uuid": "8dd640dd-33ec-4aae-995c-01d2e982a00d", "comment": "Malware payload (NanoCore)", "value": "4b38d49136c4ec9af6d29d07bed5f428", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676970326, "uuid": "a14542de-65c1-4a79-9e7b-b52ea914494a", "comment": "Malware payload (NanoCore)", "value": "cb5a3edef941f770e70d5938bb2c5bad7f82892884b73b0512f76a0be0e8b692", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676970326, "uuid": "00d5f17d-62c6-476f-b78d-fc949196807e", "comment": "Malware payload (NanoCore)", "value": "474f0ab46c1904ee6b77da7c2c571046175048d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676970326, "uuid": "8890defe-00f7-4b7f-abfa-8f3247fc6368", "comment": "Malware payload (NanoCore)", "value": "3d29f144d2b6940a6ccb3950a215ce0df75d7a4b7f7348585cebab3603d95d85096526be6cbb9818c982e21df44bbfaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676970326, "uuid": "ea3972df-8b7f-439b-9178-ad01c9fdf107", "value": "T1C914CF5637A8493FE2DE8678602242539779C2E3E8D3F3EE18D855B35B127E50A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676970326, "uuid": "a4773c77-6ed7-43ac-ab10-2e52c45cf612", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676970326, "uuid": "93e6deaf-3780-4295-8b17-66668f6e9e7b", "value": "3072:QzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HI7Bskdn+BJCnryIwzt4LLOcs9:QLV6Bta6dtJmakIM5IskxrgztsLPm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676970326, "uuid": "84703145-eec0-4093-a240-79b83e8fcb9f", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676970326, "uuid": "8ab952af-b77e-48b0-96ab-139d0cd5000b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676970326, "uuid": "c884d1b9-c9fd-4e20-95eb-a6cca7eb707b", "value": "4b38d49136c4ec9af6d29d07bed5f428.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c074d2f6-b1ad-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1676959533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676959533, "uuid": "05d59ed9-0853-4c01-96f4-d943af7e719e", "comment": "Malware payload (LaplasClipper)", "value": "58885234030befaf37c4717dbe7ab666", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676959533, "uuid": "bf6c5bfb-e4e7-4e81-8014-e783c90cd16e", "comment": "Malware payload (LaplasClipper)", "value": "ccba7cab6d1d8c65571e58ef1074c474086dc4ebb0055a33cd5c8895724503f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676959533, "uuid": "c5012673-58ba-4d37-8066-91d65144579b", "comment": "Malware payload (LaplasClipper)", "value": "2ee8029dd25f07ea46961513e1ba7b3f87532cdd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676959533, "uuid": "210f9fc7-cc50-4e9a-8c99-bcc44b6ef75e", "comment": "Malware payload (LaplasClipper)", "value": "2a76747757545561908bc1e3a00f24ab7b5e3ea5a03f01c004e0b3d2e3080bb91d831781e8643d330be7478dfd4139be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676959533, "uuid": "778aeda6-a277-4901-a283-08b17a1ad9ad", "value": "T17976236719194088C9ECCC38D137FDB931F4177B8DC4ECF898FAA6C90813698952BDA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676959533, "uuid": "03b0c715-845e-41b6-96c9-2999a6b04c31", "value": "08d169b004df9f27316eb1fc746d93f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676959533, "uuid": "ee01226e-0efb-4393-81bb-3d6693dd3ad7", "value": "196608:mJE2TeKa5BPQjoK+IAn2Jc/WXBF8L3bDFQlLvKRYhF:ma2TeLBIj+euWRF8Tb5IL1hF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676959533, "uuid": "a7e03814-48ac-4c4a-bd1f-781c019d560c", "value": 7162880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676959533, "uuid": "02807c34-9321-493e-bfba-84bc1b24b34d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676959533, "uuid": "83836f0c-a5d8-426e-a0ec-ac9c31980676", "value": "CCBA7CAB6D1D8C65571E58EF1074C474086DC4EBB0055.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "704129f8-b230-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677015662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677015662, "uuid": "3bae2e7b-2801-40d4-93e2-1eac933a3b10", "comment": "Malware payload (RedLineStealer)", "value": "199cc76eba94d660bfd6017278f7d604", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677015662, "uuid": "ecb68253-c854-411d-8664-8868f303a2bb", "comment": "Malware payload (RedLineStealer)", "value": "cd290df81e4bc1c2d7fa0c3debf353ee844fa5400544b586bef492ee3b6b184b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677015662, "uuid": "43bf7f77-79fe-4f3e-b110-3aec6ec4d911", "comment": "Malware payload (RedLineStealer)", "value": "8103aba6215a0dde631e1722c0a3b9f7d69b2daa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677015662, "uuid": "350c4099-d863-4a55-8038-1bcda8615dde", "comment": "Malware payload (RedLineStealer)", "value": "035232f8aa675b8bd48e975092bb5d41e91ff718c96344a024ba780ef3d182261ca0ad8391f4b1011783f5e98e28bb95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677015662, "uuid": "65287568-af62-4fc8-ad49-af4f6e33b631", "value": "T1EFC4020BBBFC4071E9B5577054F703C31A363DA06A34829B22DB9C5E19B26A5B63137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677015662, "uuid": "822c3586-bd0c-4b28-91ff-aa9fa6501fc4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677015662, "uuid": "f30b99ed-0ea5-4f25-861d-9c621ffe2984", "value": "12288:wMrQy90+ZXLSVjgQpjM/vHdDZBd1UDRoQ43kBnmI7D:wyrX2VjPOdXgGbo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677015662, "uuid": "ac2cc41a-1a05-48e5-a720-8ea77b3d426d", "value": 578048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677015662, "uuid": "fdbdbf04-c4a8-4657-89aa-b2e6f2a7e5f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677015662, "uuid": "0fff3731-d609-4da2-92c3-e97f865e9237", "value": "cd290df81e4bc1c2d7fa0c3debf353ee844fa5400544b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e53c8fbf-b204-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676996961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676996961, "uuid": "df0762e5-6ced-4888-bb31-ccc466199d6c", "comment": "Malware payload (RedLineStealer)", "value": "d5900a8f083024a0b2df01ba08ed17fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676996961, "uuid": "989875b5-2459-4b43-a06e-ace444a90d12", "comment": "Malware payload (RedLineStealer)", "value": "cdeba0eba80bbae86bb235e1c629c707127654097fd1624ba6f21da81e557a33", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676996961, "uuid": "d5bb71dd-5093-4577-8bda-7ff0e7e720dc", "comment": "Malware payload (RedLineStealer)", "value": "b135ad35a06cd61568d82f155573420e6b7068d5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676996961, "uuid": "f27f311b-d991-403c-ae13-a5085935ef82", "comment": "Malware payload (RedLineStealer)", "value": "9a8b7654955628b9c7c08da13da1d5932c0d4469c7b54f3b2ecebb6859189043423057f65592b8269245b85c23560d10", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676996961, "uuid": "b43c0cfa-1a54-44aa-a83e-23174163c033", "value": "T1C3C4120BF7FD8071EEB6577008F343C31A367E501A38815B268B6D5A19B26A5B2353B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676996961, "uuid": "882ff302-d1e9-40af-8180-a4b7754e18e2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676996961, "uuid": "9b2443aa-e952-4668-9ecc-5d988e265d31", "value": "12288:7Mr6y90TT06Vjxu2YoEpIXVZBLvUDRgy45Z8BDOsS1bEu:1ygvVjLVxpgWODOsS1b3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676996961, "uuid": "a697da83-e692-4e76-9c83-684ee3b098f1", "value": 578048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676996961, "uuid": "9dc70f82-69a9-457e-83db-97ae25e966e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676996961, "uuid": "a06c5726-3781-4562-bf4d-55bdecc7b138", "value": "d5900a8f083024a0b2df01ba08ed17fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef0892bd-b1cf-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1676974214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676974214, "uuid": "d15e5d99-3cc5-48e8-aec8-f55e3f4cc4f0", "comment": "Malware payload (LaplasClipper)", "value": "57bea51fa7d68734cd7d73f4adf78995", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676974214, "uuid": "e90a30a0-f231-4aa2-bfc3-e0e764656429", "comment": "Malware payload (LaplasClipper)", "value": "ce8a9cbe602335348265d3657c611c3559a4a5b2af69aca3f5b5add584f756c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676974214, "uuid": "fca9f34b-f235-4939-bf97-6fb8681f537f", "comment": "Malware payload (LaplasClipper)", "value": "451b2cb0928cf1397b101954797d6a714bba0359", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676974214, "uuid": "848f2f0c-f76f-4bbd-ba96-8f6a1fdb1fbc", "comment": "Malware payload (LaplasClipper)", "value": "462812a88d5a8b2fbb334bf7a0e774198db2686b24d28650106bd97271d76060f5d0c4ad8e6395e720d02bc1d8612548", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676974214, "uuid": "5574c4eb-4f46-4798-ab95-2095d36c3520", "value": "T19B24E010B9E0C072C85F84745870DA916E7EB8715AB0C9AB377417AE2EB03D16F7A35E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676974214, "uuid": "d4c8015f-ad02-44a3-99e8-fd6933c904b3", "value": "5b5cd0be7c7d3fd97ef45ae33cdff77a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676974214, "uuid": "e8ae1535-ed3b-44f5-bfea-7743d6ee2d5b", "value": "3072:epcIPMpfLRbWjXaJdLC7ASUIYsTnjlw2qRhKBBVMj7KHNiI6u/PFoZzuZIK:KPM5LcXaJd3IYsn/qukOf1diuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676974214, "uuid": "f9dc1783-0c51-4e63-ac05-7c1b2ae19f4f", "value": 216576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676974214, "uuid": "fade4dba-d061-4279-955a-8083c3914496", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676974214, "uuid": "f38b4619-db89-40a3-a5e8-44a50a06b79f", "value": "57bea51fa7d68734cd7d73f4adf78995.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "750825eb-b221-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677009228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677009228, "uuid": "6e0ab446-f717-419b-8837-7ee48a2ccbd3", "comment": "Malware payload", "value": "20cfe34238c2f785ffb72345f4b394f6", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677009228, "uuid": "bde8076b-cc84-43c2-b650-1817227b33f9", "comment": "Malware payload", "value": "cf5654c1855a8619814960871e10931e9933ea45270f3aacd75345acf4c1a1af", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677009228, "uuid": "9b9aa424-3dce-4a83-891d-522426715206", "comment": "Malware payload", "value": "1de1750f1f5daa08572bc56b11b1022383a9f1e6", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677009228, "uuid": "7f8e591c-3196-4edd-a8a3-9c3dba81595f", "comment": "Malware payload", "value": "d7905a355a9fcbed6ab9d7d79d73ac98fb0b2cf4142df6f2e7b1f579fc28e2a6a3df5df088c971004cd339c381563649", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677009228, "uuid": "15b4ef97-7544-43e4-b5cf-137f9fe4aaa1", "value": "T1DAD5338AFEED1804091755FB8B456BE2E00D90DED8FD84C7BA53F3966746C0F2CA14A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677009228, "uuid": "644bc146-8bfd-4908-ba6f-396312a43c96", "value": "49152:sK2S6b4JOdVEPZiK1MGuwtdRdHh3o44rN5JFwnpGNN3OkO3adIq7Ydc2lZZk/K:R6bi7Pk/nkHh3YrNNwq5O3CcdNbCS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677009228, "uuid": "46ddf870-0d7e-4bc1-9bb4-d5aba5d36581", "value": 2980926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677009228, "uuid": "6b81e935-831b-4c20-a2b7-b00119482ea2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677009228, "uuid": "e7352c7e-21c3-47b2-8dbf-28a3d3e55a95", "value": "9213773435.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "814dc82c-b230-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677015691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677015691, "uuid": "b339bca7-fe24-4383-a4d2-897480564fee", "comment": "Malware payload (RedLineStealer)", "value": "ab77084584952061103cabfd2e23700d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677015691, "uuid": "0fc253f4-3923-4358-a2de-e83e730fe56a", "comment": "Malware payload (RedLineStealer)", "value": "cf755affe24a7e970b02ffeceddce25f80f94c4b4cc547c8b5cd03493bb0e557", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677015691, "uuid": "78d2f76d-8028-4f9f-b818-ef64c0190d8b", "comment": "Malware payload (RedLineStealer)", "value": "69907156c3e1b3dc76de80764112ab82060be07a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677015691, "uuid": "597bd65b-3f94-42e0-babb-6c80428e0e07", "comment": "Malware payload (RedLineStealer)", "value": "0b3dbdb6e71f2115002356ddedac3fc1e031ad9a3bb901c1f96e2bca003b24aa0fc1ec1b2c369ecd1e56003e6cccef4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677015691, "uuid": "50ac3cca-06a3-4776-9205-67e4ab2919a4", "value": "T176352343A7E89035E8B01B300DF506D31A367E929B3AD79F578EAC1508736A4E632767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677015691, "uuid": "36959a63-0b77-4bc8-91c4-aacfe45ba8c1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677015691, "uuid": "9a85b1d2-e597-4f9c-b664-1254546f0f8a", "value": "24576:1ysppNJ1WVPM/geB1rWpYPdChjNoLwQ7JRQyuUz:QsppNJ1wM4i1rMWQNoTt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677015691, "uuid": "2dd2d119-5f53-42d2-9be5-2512d7024aa9", "value": 1091584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677015691, "uuid": "90f89fe1-c385-4d8e-98d3-cf2f25a132e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677015691, "uuid": "5ec951d2-3700-46e7-96ec-7c92dd493354", "value": "ab77084584952061103cabfd2e23700d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c7f4485-b197-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1676949863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676949863, "uuid": "f5d167cb-5865-4414-ad60-a84fb3fa359a", "comment": "Malware payload (RecordBreaker)", "value": "1aa4f37c461ca22fa518c032e67739df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676949863, "uuid": "9a5a4220-cbe7-466d-8a77-a9b14cf4c9cc", "comment": "Malware payload (RecordBreaker)", "value": "d034c82de08e2aabe9f27089610a46d42fa741cfcaedec06a016810c660b402c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676949863, "uuid": "0f93a2c5-7860-402d-9a1c-f15b7eea384c", "comment": "Malware payload (RecordBreaker)", "value": "892671ee0891a557f69d37a950e179fecb3c05ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676949863, "uuid": "83c3f583-2c42-415d-b0fe-4ca2d096ac83", "comment": "Malware payload (RecordBreaker)", "value": "7d1c0860c78f5e94b2ba1414e0499eda317664481209f32a356e269a461d9442a36550a3966985c984406878faa6620d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676949863, "uuid": "92e5c592-f7a3-484a-aa1b-0c78b39c5093", "value": "T1BA6623632137514EE0F6853D402B7DA571F63F520EC2987CB4EABED924728F5A307A92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676949863, "uuid": "614fd01a-5a57-4084-935b-aac9a2c599ed", "value": "161839a78ef6f07a30d3f07895f6fe23", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676949863, "uuid": "57750342-896f-4780-8244-f480569dc6dc", "value": "196608:wy0w8mRdALuABSnzSdUbiEQt9nSXMojADLgO+xKl:yEMudzHOEQt0jsgOaKl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676949863, "uuid": "6124bd98-995e-4495-952e-883a8760cc61", "value": 6954937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676949863, "uuid": "1f50b6b8-3c1d-442b-8b1d-7d478988dfe3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676949863, "uuid": "b385faaf-a78c-43df-9798-4fa0d8e753f4", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73e6ed64-b1f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676989040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989040, "uuid": "dba02fb1-5ac4-4a7a-bc95-dd256d487c7f", "comment": "Malware payload (SnakeKeylogger)", "value": "54aed2595a4e86d7dd4f54a136edc736", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989040, "uuid": "ac2ee9d6-dcfb-4b5c-9b5f-8145524dcf07", "comment": "Malware payload (SnakeKeylogger)", "value": "d156d6626e85584270b990b2b53c325a53be473e21c6fd32e1ac4e50301ee165", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989040, "uuid": "f9e42d22-0663-4aa9-9543-6032ec492a67", "comment": "Malware payload (SnakeKeylogger)", "value": "d7cfed8d51971f786d497cdc94c98a00287ed65e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989040, "uuid": "5698ff7c-65d6-4fed-a0dc-173048a7dba5", "comment": "Malware payload (SnakeKeylogger)", "value": "dff6b026d26fabbf5f63cf89bca01fc27ad594e474cb65833e1fcd52115e18be74c2d0252a5c836423168a3ee2553f9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989040, "uuid": "7da50287-587f-462d-b422-9a865d2103e3", "value": "T14405AD9977B86473F4CB01FE18382B8C2D3066537519E26F9B77BB9192709FB7288142", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989040, "uuid": "02e68554-63fb-4aaf-bd8f-4fd8ebec57c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989040, "uuid": "9bb57006-15f9-41bc-b414-48896abd0158", "value": "12288:gAraztXkyLr2ayjh1eNIWl9S7qNq5pMcnf+SVtEx7AJHjReMVOK1CUr6nj5Syyi3:Iky9IISAqTMcfVz/d1u1ObB+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676989040, "uuid": "48cf6dda-403b-4fd3-b331-8b33de054a8f", "value": 822272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676989040, "uuid": "2c412371-2983-4a25-bf29-2221968f0aca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989040, "uuid": "893c7c3a-869e-4e61-9cbf-30809c8ecb13", "value": "PO No 00012.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a662566c-b1d7-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1676977528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676977528, "uuid": "e8b533ac-f4d4-4815-92f7-74a2612f75e5", "comment": "Malware payload (DCRat)", "value": "02c55aa0748e1adfc20931911ef5e089", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676977528, "uuid": "8b8cfe7f-a41f-4a64-9477-b68dcf2150e4", "comment": "Malware payload (DCRat)", "value": "d3eb754c422c3081bacdcdccb2651838903e04623b6c143c880299533307d97b", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676977528, "uuid": "10c799f5-a97b-4265-9dbb-673a5bdf9663", "comment": "Malware payload (DCRat)", "value": "5686b1fe2c43fa63f3665e9265e1dd447d1bef0e", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676977528, "uuid": "ddc343c2-f78a-40a8-81e2-723a41fa3430", "comment": "Malware payload (DCRat)", "value": "d4a7f44037705d73d0310841e8d566bf75bbccf0368874cfc215e3c5b1a65e70c92f44c47ed01d0886d32a1689d5f3ae", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676977528, "uuid": "40fa47b5-2427-4134-a0c4-07c0089ddc91", "value": "T19E458C067A54CE02D1699733C6DFE01843E8AD626EB6D71A7E8A33AC21453E71E4D1CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676977528, "uuid": "ee718ce8-4404-457a-a242-ef78b5c5707c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676977528, "uuid": "d897f6e8-e378-4c0b-99cb-ce844651f29d", "value": "12288:lfxxer+ULZF+rNMz49cwNL1l4Medd0JslvER+39deSee2mAg5QR80tSPi1IrSPvo:lp8rfqr+zTg4TdLE+XeOQRlQa2rS5Fk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676977528, "uuid": "76b1bbf0-7996-4a7a-887b-ff862f0f40b8", "value": 1279488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676977528, "uuid": "a174e096-0581-42de-a671-52349e6dd656", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676977528, "uuid": "20296d9d-f4f4-46d2-855a-03e35a9e9b42", "value": "D3EB754C422C3081BACDCDCCB2651838903E04623B6C1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17dae960-b1f0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676988026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988026, "uuid": "8e83f61f-fb84-40dd-8655-d4897ae6b94d", "comment": "Malware payload (AgentTesla)", "value": "782c55c65b9f3e969050257c2fbb4315", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988026, "uuid": "6dd9cd09-3d83-4266-80e3-86bb69271ecf", "comment": "Malware payload (AgentTesla)", "value": "d54a54565504ecc31741ea95d9d8ef1391b3fe8bce47fe774c91cc60eccbbb18", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988026, "uuid": "1cef1e5e-814b-4d0a-bf96-6bfdfa5ce3f4", "comment": "Malware payload (AgentTesla)", "value": "6b77bf056ab9bbc9fc644c8e36b0ff7f2c5c6ee0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988026, "uuid": "474c1c89-353e-4f2d-aac9-9e5f9d91e233", "comment": "Malware payload (AgentTesla)", "value": "f37c86ed7d26700074f29e62b8bd9c3d42dad7a08c6577aaf0fcc8cb9b0bf71cc9d5308372553e8bc2879ac352b2587d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988026, "uuid": "4910f142-38a4-40e5-848e-ce0f9bffa167", "value": "T10BA423C2382C47B3D57907FCC4AB80D5A3F661B19240F6465EC9E1E53DCBB9882B961B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988026, "uuid": "c46ce9a5-af2e-4500-a257-2d31d45c69ab", "value": "12288:4je06/FkYV7mkXfZkRAxu05YE4WPHxtsruhgJt:4y/FkqqRAxHqE4ccD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676988026, "uuid": "a18dd49c-26fd-4084-8b47-36c94c584d49", "value": 468344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676988026, "uuid": "764c3528-730e-4617-b75e-ea2dd3186d30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988026, "uuid": "675883df-1a18-4836-918e-96689cbdd71b", "value": "PO-000001306.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "362f971a-b20d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1677000533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677000533, "uuid": "d3afb17a-f51b-407e-95f0-10600a6c2752", "comment": "Malware payload (Smoke Loader)", "value": "4d45728ed39db7a757f42551dc788935", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677000533, "uuid": "44142f91-4bde-4993-8314-80f3413b16f9", "comment": "Malware payload (Smoke Loader)", "value": "d7af0e72cf1229d0b6012ca312ae05c3d96e31539ebbc6125e7cbac7a5ec0704", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677000533, "uuid": "8f28543a-f06d-454e-b884-6574a298a44c", "comment": "Malware payload (Smoke Loader)", "value": "c0a3e4a2d2dc54bb14f1beb9968254e1a43a8c04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677000533, "uuid": "41370a43-5c5e-4432-aaef-336c13e20cf9", "comment": "Malware payload (Smoke Loader)", "value": "2883e6cd9ebcab4c1ff2b0e936ecc2db784d294fd31b80127471286d4bf03740caa849b6297f17fcd1cfe7fc3fd88ed5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677000533, "uuid": "a11e82d1-51f5-4500-b3e4-d936c71cd413", "value": "T1E3F3C0227EEDC072D0A71A3514B096A12EBBB9133679498B2BA4173ECF707C14E71797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677000533, "uuid": "92a31e52-06ef-4ed5-9ab2-496d1e7f6510", "value": "1c7565cbbc7ffada58fbd5240403c775", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677000533, "uuid": "bda1c7f1-4295-4b5c-a4a2-131a77d563dd", "value": "3072:juC1gfJWxPBFxC0epre7DAVadDrinuZPA6G:KC1KJWxPBFxpepre7DEFuB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677000533, "uuid": "57cddeef-fb9e-4aa5-9a9c-c6d3a96c9e26", "value": 160256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677000533, "uuid": "d35de6f7-1b56-417e-a8cb-5989863d5851", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677000533, "uuid": "7472b423-3401-4c58-a0e6-1ade79b044cb", "value": "SecuriteInfo.com.Win32.TrojanX-gen.27372.25236", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d769f027-b1f1-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676988777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988777, "uuid": "93c00468-1dfa-4e2a-a042-5fe442923527", "comment": "Malware payload (AgentTesla)", "value": "0ad5f09b242a0606e12c70df87b60e20", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988777, "uuid": "14738a8c-fce0-4cd6-a8cf-803e5851967a", "comment": "Malware payload (AgentTesla)", "value": "d975348bc9e2938f9bbb8f8c96f20cbc74c0241ef9e0847a853233fd962f73fa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988777, "uuid": "a144686d-3852-4c62-9630-c0d2e158e067", "comment": "Malware payload (AgentTesla)", "value": "0ffac097abdb16b4c8e7dc83ac1e63de46233b3c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676988777, "uuid": "4d961385-51ab-4b9a-a0df-f9be762e3e70", "comment": "Malware payload (AgentTesla)", "value": "5c8eb10be105a10329406efd09fbb67c24e77342f4e3a8e498310f317a53df1a9e8f40ce4acd168d19511f92397ec21d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988777, "uuid": "52adf4da-1e72-4146-a01a-510fda8e6a5c", "value": "T1F8257C7113037E8DAB6F2DC9E94033724C9CBEA75B1D8254BED80FEE1265918DD588B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988777, "uuid": "a89f6a29-f593-4c7c-a578-f286d78921cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988777, "uuid": "59c480d2-3a95-445c-ab7a-dfcc127f3750", "value": "24576:GOnD9hh7bnab+5/mEYsrgtVS719y4UPe1DutEySDDqFcIEPR/PsG:Fz3cEB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676988777, "uuid": "b842be5b-0437-4338-ae5b-1dcb502bfad8", "value": 966656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676988777, "uuid": "ef1bc285-b0f9-4fc2-bce1-d3e9370f8628", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676988777, "uuid": "57c9929b-fd3a-4740-a7f7-68c8fdd0888f", "value": "0ad5f09b242a0606e12c70df87b60e20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07675d50-b1f3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676989287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989287, "uuid": "8df1ae9e-53c7-490b-9079-25424100f7ee", "comment": "Malware payload", "value": "6f8fc2e8cf82cbf36ddd5de654d43160", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989287, "uuid": "d28f3d14-493e-4efd-9451-66f4f7bebd59", "comment": "Malware payload", "value": "d99dafdde1e21caffc752ab7a16faf7ac27611f175114f68da40f2cafd59b13f", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989287, "uuid": "9673700e-f1cf-44fc-9dfd-3d5ec5d50125", "comment": "Malware payload", "value": "4c9e58eb1b944b9952d02957ca801c4cac171e8f", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989287, "uuid": "604a3496-e29b-4a65-a0dd-7063597abb36", "comment": "Malware payload", "value": "c33389d08c66cf2ea625c13b35d548f2570f2deb71908eec5e76d5a6cb06fdc61994a8fcdd7e5346ad8e424b6a88bc21", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989287, "uuid": "822b2ef1-9e97-4e9e-bf8e-a33c420e6aa4", "value": "T13923395AE78F0268CF512277531B4A899ABDB33EB35050A1386C933433EDC3D46666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989287, "uuid": "dceb4410-772f-4b5c-b4a5-26373dffdd36", "value": "768:VFx0XaIsnPRIa4fwJM1ayJ5FN3yxr52TdYXR+v73GOVTsW6o6:Vf0Xvx3EM1ayZN3yD2TdYh+vqOVTshR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676989287, "uuid": "ced3f88c-f686-4de9-8be3-61a6dd539e93", "value": 47633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676989287, "uuid": "281494e6-ffa1-473a-a34f-8eea2dda24b2", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989287, "uuid": "80537b2b-2861-4bea-b3d3-96e24ccbeed0", "value": "Contract ID 79754529001.doc__.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69d0516a-b1b5-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676962824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676962824, "uuid": "fd136806-b158-4798-8257-5093eb3ad68d", "comment": "Malware payload (SnakeKeylogger)", "value": "1a985f61faf2c358a394bf8ad414cfce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676962824, "uuid": "f4edf5ad-535f-4fb5-90b0-4ca9d2f6bcff", "comment": "Malware payload (SnakeKeylogger)", "value": "dafd3ed55d5c4319b8d0efc9f2c7c65ecbb042000438c56deadf40d33e580a05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676962824, "uuid": "f2a01fcd-832c-40b8-ada3-3c9e44d934d9", "comment": "Malware payload (SnakeKeylogger)", "value": "677406fde1a5e05f6877b3547e7ece0382df946f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676962824, "uuid": "bc759b7c-9075-49de-ae26-26c6f23b3701", "comment": "Malware payload (SnakeKeylogger)", "value": "6e29259f42515ef2239099f8a768c3db216c1ff1ca5138737679846b30edeab879deb65307800f6455b64e08d6ce1db9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676962824, "uuid": "24e78e48-a92f-4153-9f87-1266e6c7f806", "value": "T1ED25AD09A7B0D6B7C58B01EF18385B4D39A435437619E22C8FB77FD292749BB35A9203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676962824, "uuid": "cecf557a-3070-4960-98de-c35779525a39", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676962824, "uuid": "2cb6b9d6-4061-420e-b56b-3e5487551202", "value": "24576:D+j4yZ1DsXbe17r8NXRsgbnVB27hRrYE:yLNd1nmsgK7hKE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676962824, "uuid": "cd6d0713-b50d-4d74-84cf-29eb52db13c4", "value": 1009152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676962824, "uuid": "02d7fbf1-d458-4220-bdd8-195287548669", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676962824, "uuid": "51d02f99-1c41-4aad-ba8c-00245526960f", "value": "INVOCE & DELIVERY NOTE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b85aca0f-b1dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676980135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980135, "uuid": "368ba616-3264-4da2-9a02-7926ef2eea33", "comment": "Malware payload (GCleaner)", "value": "2230b3da5397b006441d2ce88f9c7978", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980135, "uuid": "33cb1eb1-b415-4ab1-a66f-1701c12d9fdd", "comment": "Malware payload (GCleaner)", "value": "db9c2f019ca91a2166740431d64d02bfff97a9638e68e9858fb9616f2df371ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980135, "uuid": "ec657d51-c6c2-42c6-aa86-3786e4ff9e2b", "comment": "Malware payload (GCleaner)", "value": "c3fbedb97a1d2204d001e23184df6705726444e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980135, "uuid": "a2dffc63-9b47-406f-8ef7-f3d8ce3cbb75", "comment": "Malware payload (GCleaner)", "value": "48637990f1a8d88bbfbffbef4ce5706fd4dce35c109835f4b2e067bf63e40aed82d3aa4b8b6f0b98249bf607cc154d75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980135, "uuid": "3b2228cc-2e66-4c5a-934a-f38c35e6d7ec", "value": "T1D875021DD85A9B0DC177577DAC20D1B200ACCFE093A050BDF3E8B96255FBAF241A4B69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980135, "uuid": "7687a341-326d-496e-acf8-2af3724093dc", "value": "4a43ef13050d45ae61812b2997033821", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980135, "uuid": "535a9a2c-1c18-47f7-86e1-94bc7599d8a0", "value": "24576:407QP5MoR1eMmJgTACO0Z/iAC8qOAduOg2ofaKfCf8NOQdqxCpDU0w9nSV:4iq5ggTA30ZTC80Md2LKKf8NORsdbV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676980135, "uuid": "6571b539-14a4-49dd-af1c-c42f2d762ec1", "value": 1662696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676980135, "uuid": "d1e8323e-2a00-4acd-82c1-e8f83e462aad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980135, "uuid": "85d5dc68-9069-4936-80b6-0760fb3c4bde", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84845e70-b209-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676998946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676998946, "uuid": "ed9a8c87-2cc2-4c57-a733-3c524d962a9d", "comment": "Malware payload (Formbook)", "value": "0826eb10e9ae9f889d28176f112c59aa", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676998946, "uuid": "e8b5ab4b-654d-4834-b779-28acf04417a6", "comment": "Malware payload (Formbook)", "value": "dd6e0fe82cf0c76f22c32a80dd697405c253f9a6896f8a2d2cd4901f9771565f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676998946, "uuid": "a1cb0861-7f35-4c11-b518-f9c18e6170e7", "comment": "Malware payload (Formbook)", "value": "967110f7c75e1ce9816270eb400d1d9adaa6beae", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676998946, "uuid": "c25e0cfc-d127-4865-8842-b1983415843b", "comment": "Malware payload (Formbook)", "value": "59ff8b1e8ae95e5abffb36199c037181bd6eed4661489e562ce00497642836f3ac72d28708cb631f11ec6fb5ff193d80", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676998946, "uuid": "65ea03c1-6b9a-4329-a705-a83899723a8f", "value": "T18A44238A88721BC6AB99D7F69888394924CF3F599D61C5B0F712D1293DF02DDEA44B04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676998946, "uuid": "3a1032f7-b990-4be0-90a3-7d6fe9a48616", "value": "6144:I+np0s1NAA4yO1eAhcVP+vl9Xb2XwkfNjWOOJ7A1a:IhJoAhcx+vl9XbzmNjDOdA1a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676998946, "uuid": "485c630a-ce9c-4f8a-8471-cb08c7d5addb", "value": 265717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676998946, "uuid": "c33e2b76-6b80-4575-a440-a316a1e32401", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676998946, "uuid": "4fe89d8e-9fa1-42e3-9e7f-b0d77f984b03", "value": "New Quotations Request.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13ed91b7-b1f3-11ed-88f6-42010a9c006e", "comment": "Malware payload (NetWire)", "timestamp": 1676989308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989308, "uuid": "742aa28d-b9cf-442f-bc8a-eedaaf853ca5", "comment": "Malware payload (NetWire)", "value": "2f33e743eb105ce162a713b1b21e429d", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989308, "uuid": "b2ffe5b4-8b1b-4dcb-a4e8-4fd5bd5abf02", "comment": "Malware payload (NetWire)", "value": "df770aabdc39c9255b2eab82391b1246ca57f2108c670fcba0f40b7c46c7ddb7", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989308, "uuid": "b5be7f64-8287-48c5-a94a-94f528669781", "comment": "Malware payload (NetWire)", "value": "ba35963190d4f31ca073682f412849970ad7019d", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989308, "uuid": "b6c94376-254a-4b38-915d-8a643428030d", "comment": "Malware payload (NetWire)", "value": "e95ba3b6268540770d7057a86f7a456546aa0dab03155bb63605434c2fc9c9b4d5d6cd5695ac67718c836bc435d74aec", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989308, "uuid": "053cc3d6-23e3-42f4-a11d-9d2b0a290553", "value": "T1B1037D4AE38F0268CF511277531A4A899AFCB73EB35141B1786C833433EDC2D4666ABC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989308, "uuid": "b2306242-30c9-43f8-b0f5-8afda2e3f18b", "value": "768:5Fx0XaIsnPRIa4fwJMGNH2YRrenTu1HBO85sH4mY6u:5f0Xvx3EMKHFR/HBO85sYou", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676989308, "uuid": "54d63e0b-79d8-4ea2-8805-fb5e02a82127", "value": 40501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676989308, "uuid": "3dd380ea-ced4-4f2b-8905-849560516796", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989308, "uuid": "741b6063-dc81-442e-a607-da75830de6f4", "value": "Vestel Teklif talebi.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f54a9d67-b23c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677021040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677021040, "uuid": "7f66187f-6f3f-447c-9ab6-0195c8c11b68", "comment": "Malware payload (Amadey)", "value": "501fb097ac4f6cac3351d419fa5c1f74", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677021040, "uuid": "f5d8580c-931c-48cb-ade3-e0c8df68ca36", "comment": "Malware payload (Amadey)", "value": "e0379ac34b43ab263dbd2e7ad5121ebcfd9f68ce19f4deed8fdeb980d77c56f3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677021040, "uuid": "3331af43-afc2-43ec-a5e2-1883e84a0400", "comment": "Malware payload (Amadey)", "value": "73783d380e3e36a5c0ee748942172af4f33721ee", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677021040, "uuid": "0bc7f264-a488-4715-b2ba-eb437c532d82", "comment": "Malware payload (Amadey)", "value": "66510b00ae199ced6d2fbee0f35f23097ba188d1d7e5f7ca0bb04f431af2cbd70195d2853c0e09c399d1eccb9fec71b8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677021040, "uuid": "08720bd8-a55c-4b08-aac9-6b9afed63624", "value": "T14D35230BE7EC4032D8B4AB701CF643E3063A7CA16629D38E27496D651C717B8B175B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677021040, "uuid": "ec67325e-1fd7-44b1-bf7a-c68c3171eb77", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677021040, "uuid": "e66270ca-a63d-4009-9c16-3de8cddd0637", "value": "24576:/y/zIPc3B/gDROjKzn6gHU8YYuZh+Y3i90XhdNXF+LCH4HT:K/zIM/gDROjY6gHFjLklX/NXF+Kg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677021040, "uuid": "0a831cbc-97ab-47f9-9ff4-22bb5c8a6e6a", "value": 1092608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677021040, "uuid": "b482f016-6f6d-41e4-8b9e-45f869f93c11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677021040, "uuid": "bb9e2add-f6d0-4bed-a317-03c58989332d", "value": "501fb097ac4f6cac3351d419fa5c1f74.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff31fa66-b1da-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676978966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676978966, "uuid": "cd83089a-5575-49a0-9af3-4f151caecfff", "comment": "Malware payload", "value": "1f53f7ab6993730da38d6fe9abde44b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676978966, "uuid": "c15f60f5-b81c-4f61-9b34-ff6bc48685a1", "comment": "Malware payload", "value": "e0a16eb388c61667c6d7510bb2fb18b3bb1b0e1a875dc198b55f35f41ec553cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676978966, "uuid": "5a820ee4-c6e4-48f9-a06d-b446bedff788", "comment": "Malware payload", "value": "211cd1ea116a7483fb94508d0194c3a772556741", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676978966, "uuid": "12861295-4fdd-41a7-ad12-f40839717f18", "comment": "Malware payload", "value": "58afa5b28648274eeae6bd335dcbbf5141eaa1f5d80516ec1d2ce47199448b3370a620832dc9a2ea3689b51bba117857", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676978966, "uuid": "adaf028c-2035-4096-96fc-d4f9bff4ee55", "value": "T1E424EA75B200C0A9C9B81275DD6BC5F112507C19D8F01A6F39AEBFAE7873326421B39B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676978966, "uuid": "b5024ee6-c0d9-4b1f-9a77-215a03e29649", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676978966, "uuid": "858065ce-1ad2-46f4-9da2-0c1376f46723", "value": "3072:gewKdeWeL/KkOFf54ADF+q3ks/sowKdeWeL/KkOFf54ADF+q3ks:gewKdvsxKdvs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676978966, "uuid": "2b4bf429-5460-48b8-af94-bbe7327a94e1", "value": 220672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676978966, "uuid": "ad47ae99-5fb3-4b9b-a7f0-313847fbeb3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676978966, "uuid": "5cded077-8936-4cf0-a2ef-0594a512d4ca", "value": "SecuriteInfo.com.Variant.Bulz.410361.3014.31006", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5956638-b231-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677016181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677016181, "uuid": "1140aa01-6170-4ac2-96d6-36aed06f5f76", "comment": "Malware payload", "value": "dbc9ce12c0a0a7ec17c70c63161155d0", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "pw-02021", "colour": "#C02EC6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677016181, "uuid": "c1bc45fe-bd9a-47e9-9d31-540cffd4ef03", "comment": "Malware payload", "value": "e0ad94230528acf966cab6ad797aa2839eca2c783889edb79a76bf5df01d0e1a", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "pw-02021", "colour": "#C02EC6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677016181, "uuid": "8064f4aa-5c2b-4986-a898-174dd4428b1a", "comment": "Malware payload", "value": "e58ab881e38a988d7c997a29bd0c1fb4ddd1ccb6", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "pw-02021", "colour": "#C02EC6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677016181, "uuid": "1fd10ae4-8173-4563-9b85-a2da7e1c47fe", "comment": "Malware payload", "value": "ecbadaed5f4983d244ce3f2f1fdfb1024383e61b89c114b48974c01d98ea6b2c2e6b8375cf4295f6e5b6a1fd774b5f8d", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "pw-02021", "colour": "#C02EC6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677016181, "uuid": "f209fc05-b6c9-40cb-bb1b-be9faf4161ea", "value": "T1071523827FB7285098303AE171BC4E05570A11CFF49DD7EA63EBC2E8C5A90C6B55C6A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677016181, "uuid": "101bdee4-8c40-4bde-90ad-ff850a5ff648", "value": "12288:P5PUHa+qdtAIlXdDRBwKI034PjuISPoE1PmroK1jkcEd98qjdSBnsrPnQcuNItxo:x8H3qFlN0KIK4KvoymrlyLj84mnsVuY8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677016181, "uuid": "52198bd6-fa27-46c1-ae47-f66de9dcbac1", "value": 930522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677016181, "uuid": "56d2c4a9-7a20-480f-9ff5-b795a33147c0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677016181, "uuid": "212de1db-7cc3-473c-b1f3-df542dccd83e", "value": "Contract_02_21_Copy#32.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fd47edb-b1ea-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676985543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985543, "uuid": "3363e3b6-0957-40e3-afe6-07a4bcf2b0a6", "comment": "Malware payload (AgentTesla)", "value": "ab0a939aac293ff144f9896bf75e6f2e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985543, "uuid": "850647db-7a11-45a5-8e42-8f914291186a", "comment": "Malware payload (AgentTesla)", "value": "e1a66f390e76e30596af270ea6a93a585f5e5f915df3b164a39d0325464e1d12", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985543, "uuid": "16f70c24-cc78-4b6b-a35d-c79d89d38c1d", "comment": "Malware payload (AgentTesla)", "value": "ae00d6a4bd1038f5a7d6da8d053069547dc45179", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985543, "uuid": "1ab3a7ad-8a69-4587-b224-12f9c265b245", "comment": "Malware payload (AgentTesla)", "value": "f9c655b8fd7a7de5742251722e00feee9c94c0dac18c730810edc4f0bf1e8654964d23f265ef89239d0d3eea57c96434", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985543, "uuid": "ff1025f4-d2e1-4858-9f32-4f6a3a50be5b", "value": "T109A41990B1549883F82771F1AC1FD620210D6FDE522DC71E3253FB2A9AE7356206BE1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985543, "uuid": "59ccd6ad-e003-4135-aa46-dca52b62ed38", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985543, "uuid": "f323be29-9ea0-462c-ac7b-2e90ece1a329", "value": "12288:IYcDqxbo9CeCu2iOtnnyod33QnZ7UTOzx6R:IYKmoYzuBOdqnN4OzgR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676985543, "uuid": "c34eced5-3537-4eda-9597-0bbbb9ae4941", "value": 456722, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676985543, "uuid": "90975f0d-f1e0-4e92-b5fe-c97b679cbb15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985543, "uuid": "29b1a15c-02fa-4b2f-998d-1d6822d328e8", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd88ecce-b1f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676989271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989271, "uuid": "1adf196b-2164-434e-a529-b8adf6b671f8", "comment": "Malware payload (SnakeKeylogger)", "value": "de6bb2926e9739421103d3e62d7c73af", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989271, "uuid": "b9acfdf2-17f3-4fc7-8e2c-614c398d901d", "comment": "Malware payload (SnakeKeylogger)", "value": "e39f7a6a0d3fb6c7ea42d62fb3fb74dcfa3cb3e4ca4766239942fbdca03b2699", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989271, "uuid": "c8e04fdf-5920-4379-aee3-1789a03ada53", "comment": "Malware payload (SnakeKeylogger)", "value": "8361cc42db32e824fcd43c57ddb7999bf5bf0ddc", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989271, "uuid": "7bdbb6e9-c375-48ee-9a7c-e3e6576136b4", "comment": "Malware payload (SnakeKeylogger)", "value": "9557e1bfc6f3a22bb31ff16e48b895341b8f07de611eeada344056eed32d4a9c3364004df32f1829245803102db23f84", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989271, "uuid": "80bb42a6-977e-4be3-ac52-a59e7273df09", "value": "T15403065AE78F12A8CF511273231A1E89AAFDB33DB3105561746C933433EDC6D42A66BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989271, "uuid": "c5292f1e-39c0-4c5e-bf8d-55babe08745a", "value": "768:ZFx0XaIsnPRIa4fwJM5h959R8YqsQl2yrDKl7ykH5iXUTF1TauQ:Zf0Xvx3EMFR8FR3KkkAUTF1FQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676989271, "uuid": "81bfaa7d-5e37-4339-b28e-9dbd8cbb0bd4", "value": 40731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676989271, "uuid": "7ff13803-f0aa-421a-b4e0-240add6ab7f4", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989271, "uuid": "a1a525ea-f85c-4674-99c2-d7a1d6623227", "value": "2023DHL.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cc9ad77-b1f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676989055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989055, "uuid": "f47ace82-f1cd-40a7-aac6-e21bb1687143", "comment": "Malware payload (SnakeKeylogger)", "value": "658ac670d089b98cb5f8de3d287299e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989055, "uuid": "6160203c-783a-42de-a6cb-0c6d1656d8c4", "comment": "Malware payload (SnakeKeylogger)", "value": "e45af7f5388dd4a3dedc03eb45e0323604259960647e68d2c3865d0d57e04163", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989055, "uuid": "35caad2f-99fc-4738-bd8c-aae84099141c", "comment": "Malware payload (SnakeKeylogger)", "value": "4cd5054d6ddad66eb742119de9cfc3173d51ce8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989055, "uuid": "78b362a0-11d4-4098-8221-0533e31ef3ac", "comment": "Malware payload (SnakeKeylogger)", "value": "0d26b875f7597e541ff6563086c1992efd5941024de4a518eb591cc783d9ad64627dca1118bfbc55b1541257ffd90adc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989055, "uuid": "97c1593f-4279-4c6f-9da2-557a264c60d4", "value": "T14315BE9A73B46173F5CB01FE5C38278C2E2036577519E26E9B77BB9292709FB7288101", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989055, "uuid": "8fbbfffa-3ff9-428c-aca1-6783aba2e212", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989055, "uuid": "e5389a9c-2871-4197-b4d6-9c4584e8d22c", "value": "24576:Tky9IISFn8qLOnqv0zaZI/IJeLuJ8vIYl9THUJ+Hl:ghOnqv0zb/n9Jpb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676989055, "uuid": "c219e0f7-bda5-4402-9fae-1d9d7811a5c1", "value": 943104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676989055, "uuid": "c2ec6f70-be91-4f20-a228-c4fbe612b1d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989055, "uuid": "5937d3fd-6789-4f73-bd28-3b030f96b8e5", "value": "658ac670d089b98cb5f8de3d287299e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e2c80eb-b1e9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676985138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985138, "uuid": "c095a0d8-8638-40cf-b2e0-4b969e9f7d34", "comment": "Malware payload", "value": "6735d0c45ca69ea598bda6fdd9c2cc62", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985138, "uuid": "b4d0120e-1fab-4cce-85e6-f1998bb85f3d", "comment": "Malware payload", "value": "e4dc9cb9964c7f525c257d9a56c3e2f0774d14b0ae9f2df7b49ae1293016d6e1", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985138, "uuid": "fce3e57f-d3a6-46fb-9d67-d8ffb62d111d", "comment": "Malware payload", "value": "7ef80d7b65e5c30517f1b5c8f7e1be00bfa6f461", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985138, "uuid": "e222ac72-d7f5-408c-a75f-1b06504ce163", "comment": "Malware payload", "value": "3402f15ff5cfeb62f7fd5cdbf341e50b57ec0d29f3bb4e81dab18dae59e928d840c3fbfa49cfbb6ee147ed42e8a1a493", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985138, "uuid": "0afc9c38-efa7-403a-8700-84c2ff3402b2", "value": "T152227D2CD102BA1AC171407DE11846F4F72F40AAF692BA3B304577DD06A13D757CAFAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985138, "uuid": "5a380530-2146-4444-aaf0-12717cd70a28", "value": "192:ScIMmtP0xfUW70vG/b3kgOi4OU7us+1pReDnc37f0F:SPX+si10ni4OIyeDnMr8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676985138, "uuid": "3d37649d-0f2a-4ef2-a32a-9458c76c68a8", "value": 10372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676985138, "uuid": "d5493af6-8bd9-4df3-961c-f253819fc63e", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985138, "uuid": "193364cf-44c1-499a-868a-a1754f68b931", "value": "USX16,082.10XSwift.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d4723d2-b1b1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676960977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676960977, "uuid": "d5c7a08c-f826-4724-a4df-8177e363e5c1", "comment": "Malware payload", "value": "be01e89ef8b2db3e979deec601682197", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676960977, "uuid": "1416162e-a88a-4192-a228-71576be0b2e7", "comment": "Malware payload", "value": "e503b2c57f92640d26d480ddf8e185afc25fdf2b4ff579770da266d19962bdcf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676960977, "uuid": "d1ca4037-b4e1-4e5c-827e-610ec2011ea6", "comment": "Malware payload", "value": "573f541acf1a937aec4c8e1040f46e3e11af5da8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676960977, "uuid": "830b8e85-f5f0-460b-b1ee-ae62fac0475c", "comment": "Malware payload", "value": "31345387f9c32d0970521a0d3cbd8db098d2ef2af253eceb6206b77d8c88e8e19cd2aa047bd18bffc1c27256707c984b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676960977, "uuid": "f7c3486d-b218-4364-a113-844e790f66b0", "value": "T1AC530205AF14ED46DF100CB329CD9A9C8D7BBF5A469BB0B188E1E84F97E21D6AC57300", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676960977, "uuid": "ad63b941-9d3e-4bdb-8f24-031941ddbe2d", "value": "1536:pxpJNlEYvXndUt/afLuZmVelu9eoCtcCCzNbC45:phNlHuBafLeBtfCzp9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676960977, "uuid": "13710c6c-4987-4598-a1b5-2aee4950768c", "value": 64704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676960977, "uuid": "31387973-b256-41e8-8dce-b1dd27fe77e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676960977, "uuid": "057b7015-1c23-495d-a80b-cdae4d65145d", "value": "SecuriteInfo.com.Trojan.Linux.GenericKD.50294160.22240.16351", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c79f8d7-b21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677006932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677006932, "uuid": "d518d2be-07aa-45dd-89fa-1ad0f681f193", "comment": "Malware payload (RedLineStealer)", "value": "5c95e1356b158b8f7101c1ed0b5ca0c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677006932, "uuid": "b428755d-0d85-454c-a3f9-b589fabb905c", "comment": "Malware payload (RedLineStealer)", "value": "e5642d5842867e0544eb5cf2d31b8970ad464fe431b40b598b69bb5386b19a1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677006932, "uuid": "110a04ce-9ed7-444d-bdbc-3cb286885309", "comment": "Malware payload (RedLineStealer)", "value": "fa5bd1e797078ef3ad094879657aab80d4d339bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677006932, "uuid": "c07e465b-5d8c-43e7-9465-2ede0cf0876a", "comment": "Malware payload (RedLineStealer)", "value": "ddf70743427a3551d6062305660e6eba3a18be40330aaf6131e22dd83af8490b711295ce6ff959003376a97e3765aba9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677006932, "uuid": "f5f19283-1223-408c-b732-d30ab08733e3", "value": "T13144012272A09431E6AB66314871C5B159BE7A221239848F7FE4273E4F706C2FF35757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677006932, "uuid": "083c2419-030a-4280-81e0-08aa0889d9f0", "value": "1c7565cbbc7ffada58fbd5240403c775", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677006932, "uuid": "e3a67897-e998-4981-8a0c-d9a6e346f8e2", "value": "6144:ItA3rLY8ZS0XnjQNZTVh9w9DT0R/jzUB3KUDe0n1eGeCN0D3eXJjo5kJi:ItAnY8ZZnjCZBbDUDeA0D3eX5o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677006932, "uuid": "f8137a13-4487-466b-9ed9-dd8c7af079fe", "value": 273408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677006932, "uuid": "c1167f49-826f-42f2-8bcf-1a3750d1fbbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677006932, "uuid": "d629bd74-061e-4804-9690-fe726340acf5", "value": "5c95e1356b158b8f7101c1ed0b5ca0c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afe8459d-b18e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676946191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676946191, "uuid": "92681154-5dec-46f6-b5f5-830a86566829", "comment": "Malware payload (Mirai)", "value": "e6f4003f4e25c828dbe52ef0eab6b24b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676946191, "uuid": "2c7e00f0-9420-4478-b657-1b52dbe7d4d7", "comment": "Malware payload (Mirai)", "value": "e6b539732b81f0726a65e361e2a98d00ea1b0abf05f52c9aa3de278cb92892fc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676946191, "uuid": "9af4c73a-bab4-4246-b834-0ca5f3c38be3", "comment": "Malware payload (Mirai)", "value": "82d1c16480319a8f25e7b6e17b5985d00827adcf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676946191, "uuid": "bbd1adea-92e2-469e-93f1-a47dce35e036", "comment": "Malware payload (Mirai)", "value": "d609fb9ec25b01e33e0f875bfc1b18c1281af00144cdc406959381cec4a169896a046ccb7ca701666dd08bb3c538c796", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676946191, "uuid": "d80974c2-4710-48c0-bbe0-4d8dc11655ba", "value": "T128334A21AE7A2E27C0D1B57A11F74724B2E6174E35E8C71E7C720E4EFF1468051676B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676946191, "uuid": "4124ecef-1358-4bce-b390-e656f41704f7", "value": "768:axDo91q9zDNslPE0vwaxmGGAQkclFVYpfRQR2O+hGuqvU:axD+1SzDNsZJvwaxm/1lctRQRU+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676946191, "uuid": "73a3d7c5-bb1d-4420-867a-f752a497caf1", "value": 54584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676946191, "uuid": "d972d57d-58ea-463a-b640-417eda471f67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676946191, "uuid": "8efb9ae5-89b5-4dec-a7e0-462d0ba54dee", "value": "e6f4003f4e25c828dbe52ef0eab6b24b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e095cda4-b1dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676980203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980203, "uuid": "60b5a3a3-6c66-4b01-9b7a-f719f91095a6", "comment": "Malware payload (Loki)", "value": "34a708035661a0cbe4d4bfe9eca3b1a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980203, "uuid": "03641f44-67dd-4962-a7af-af89c60e660b", "comment": "Malware payload (Loki)", "value": "e931bae765d215ba33f7f7057a19da0a3e8da81d22af920f7d9687ab56fc73fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980203, "uuid": "758aa1fb-f1fc-4f81-b5fb-1ba5ff890b62", "comment": "Malware payload (Loki)", "value": "b103c471d6b2767d4fcf37f8ade0f1a5bfdffb26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980203, "uuid": "58f5f4ff-525d-4938-a9b1-434f11fe362f", "comment": "Malware payload (Loki)", "value": "5edfb72d502d5d3c62f4b4d5f8c4b12981bdaf92ec8b7e43643aa40f3a1371a1e3a2c8f6292b435a3d2cea6b110eb81e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980203, "uuid": "22206982-9a06-40d2-afbb-8f500212ec36", "value": "T1D204125C7BE9C6A3F4E30B715E7D23279F92C83120AA870B53602F4D3921592DA4F762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980203, "uuid": "786d8894-5e2a-4c99-89e1-1a557b867521", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980203, "uuid": "d82ce2ee-0017-4877-8a13-201f167cdc58", "value": "3072:XfY/TU9fE9PEtuNbkasmYe8/PAV0ctZf9ty6U5tFVOt4+AuAQa+qf:PYa6DXqc4RFVUsuva+a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676980203, "uuid": "d243e2fb-626f-48d1-af8a-ee01d33ea961", "value": 175670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676980203, "uuid": "3bc40462-2a96-45ed-a637-bf58c0ee2e3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980203, "uuid": "89d0a92a-1ac8-4b8f-8ed6-3c755b1790f9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a578b95c-b211-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677002437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677002437, "uuid": "654eb19b-f7e9-49a5-9ac8-07b52336ae40", "comment": "Malware payload (RedLineStealer)", "value": "a40d45cb13ef5efd40842e2230dd0e29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677002437, "uuid": "0265bba1-ec9e-4192-9cac-4e318ce67f6a", "comment": "Malware payload (RedLineStealer)", "value": "e9544006dca36ca79094c4bb17ebcea6d29a040afca043b247feb533a85847f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677002437, "uuid": "09885969-3526-4b52-a16e-2e3144a1c8e5", "comment": "Malware payload (RedLineStealer)", "value": "ac24428147843a04f691273726cb1476bf0d4cd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677002437, "uuid": "f5883508-3b56-4138-90b5-4fb866d80de2", "comment": "Malware payload (RedLineStealer)", "value": "179ae579f813af721ce6b5a65f05bd44dbc25dfd9e67a3254e4e97f517fb5ef34859a167d702df1bfce86ed25a981a30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677002437, "uuid": "2d58714f-3569-45cd-9896-4ced025a6360", "value": "T1E2C40207B7EC8031EDBA577404F747D31A3A7DA01A38825A26CF6C4A1873765A63637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677002437, "uuid": "537c9d30-ba7b-4f2b-a9d2-14b7cf99b878", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677002437, "uuid": "d992a414-903b-4883-aefd-7844d494fe60", "value": "12288:BMrry90AGVVeR4yi2PfZB7jUDRge45Z8BoOQSiflt5j:uyqVVQ4yiGgWKoOQSyln", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677002437, "uuid": "1704595f-b938-46c6-9f33-0c8316a46eaf", "value": 578048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677002437, "uuid": "1ea93028-c4c1-4b6d-b54e-edd8dc1f89ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677002437, "uuid": "9be59638-33dd-486b-8399-9d14556bf1ba", "value": "a40d45cb13ef5efd40842e2230dd0e29.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3e5668b-b211-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677002435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677002435, "uuid": "fd27b6c0-7e5b-4f1c-a836-dfcd6f9af3bc", "comment": "Malware payload (RedLineStealer)", "value": "b097e9e8ba00491672d7c588f5a1dc6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677002435, "uuid": "8b8c0dfa-e8c6-4b4e-a756-8b7f5a9cc3c4", "comment": "Malware payload (RedLineStealer)", "value": "ea09554bb47d16149144d42b26d9022cdbe753b6026626ebd3ba99be8511777d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677002435, "uuid": "8d0c52b5-8490-4547-8dd5-cfe234d86e14", "comment": "Malware payload (RedLineStealer)", "value": "ca40fc57327e159e7f9ab633c492191896a2db6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677002435, "uuid": "fcf4dda7-6974-455e-8135-afb85c5dc300", "comment": "Malware payload (RedLineStealer)", "value": "c458b08a6512e3f4745e0b985d543c07b460f80cffe3cb0afebd24a0c4f7eee61df40e677d712bda57291f06b4803021", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677002435, "uuid": "7a958f2f-bb69-492e-b952-80f438e229b6", "value": "T112440122B6E0C43DE4A3A6355C74C5566E7B7A422575868F3BE4222E0F705C08EB7FC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677002435, "uuid": "8451f1f8-1ad2-4f0b-8680-aa70236c91ec", "value": "1c7565cbbc7ffada58fbd5240403c775", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677002435, "uuid": "e0989d59-d7f3-4279-a2bd-3e448e0e4bd5", "value": "6144:60CfgP6ogSF3gb76iSJH9CD+2BZaZ/ilNsrRy22v5B9jb1yFe:60Ck6ogSFwbWimdb2BUBqNsty2sv9jZl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677002435, "uuid": "0a716472-8790-418d-9f4f-f6930f9cc188", "value": 273408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677002435, "uuid": "c43db607-37cf-46fa-b2ea-33e793beae1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677002435, "uuid": "c1f6e8ea-6f1c-463c-aefc-1ceb81b22439", "value": "b097e9e8ba00491672d7c588f5a1dc6c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a87d63ef-b18e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676946178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676946178, "uuid": "f18acedc-bbf8-4ed6-88b3-e5e19546e227", "comment": "Malware payload (Mirai)", "value": "3c29f916f63ce2c61364949e25ca3a36", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676946178, "uuid": "2dafe932-3b37-4c09-b123-1751bd56c62e", "comment": "Malware payload (Mirai)", "value": "eb1ce8b0fb981ddf41a5f3133e337ad171d59a9dd0f24abe29c28b136da75740", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676946178, "uuid": "04146909-f89e-4106-8050-7ab4fbed0155", "comment": "Malware payload (Mirai)", "value": "6e820e72c31e33d176df9fb43d0a5f916e551451", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676946178, "uuid": "cef622fb-2eaf-498c-9974-64edc1d9e069", "comment": "Malware payload (Mirai)", "value": "1bbcb962d281631b86d7138c443ee92a0e355fef306c3e1d1f9494f72ec9167bd4906712eec0cd0cc76dc95fce7a3470", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676946178, "uuid": "1bd077fb-e88b-45b9-897d-265063fe67db", "value": "T143335B02722C0A47E4575EB0653F1BE093BFE99021E4F688680FDB5A8676E771187F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676946178, "uuid": "5ce76934-4280-47ef-a131-bd360995164e", "value": "768:a/KLu+3c+x9MRtDfZq8dxprqk6bDLgWJVOpDC+U+CaX:H3rDMdqYnH6bDLJQpDC+vCo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676946178, "uuid": "040e5649-27a7-41ab-be3a-f5750d1b44b4", "value": 51048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676946178, "uuid": "4b946025-f65d-4e9d-87bc-eb7139d62840", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676946178, "uuid": "734c821c-57bc-4161-a36c-556f7b6f34c5", "value": "3c29f916f63ce2c61364949e25ca3a36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d0caaaa-b209-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676998934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676998934, "uuid": "36deff55-4d36-46e9-a28b-49f46e4d0c35", "comment": "Malware payload (AgentTesla)", "value": "16590656405e250e6530890981849def", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676998934, "uuid": "e7984d65-69ec-4bc0-83b4-87063fdbbd63", "comment": "Malware payload (AgentTesla)", "value": "ecdfd7ad19c37fcfebb876a9c64c47030e6369bd81676df58fa9e7c2ce9e72e3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676998934, "uuid": "3302f98e-2178-4fe6-8759-e1e3668c17f1", "comment": "Malware payload (AgentTesla)", "value": "6d8b5f11a2358b144c5f22fc5562625b7c18e049", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676998934, "uuid": "7d00b96d-8c76-4767-8607-1afca71af8bb", "comment": "Malware payload (AgentTesla)", "value": "b23b4884ffcd1505ffb67327b8318e80f7f72fddd0775aec577149611754082c78244c180d21c3587c8e72443b583444", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676998934, "uuid": "fb0de8a4-6302-41c9-9cbb-a338af570399", "value": "T141F4D47E29B657E2C238FA2346E3E520B6FD50923317D958DDE61AC04F424427ECEA5C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676998934, "uuid": "52bf6a57-298d-490c-a6ea-b939216c58fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676998934, "uuid": "ef8b756c-d92d-4e4c-9f52-f9fd24814dfb", "value": "12288:8zwlG1wFK2R8wXcPdwb4k9F5FFCrYdu5d+Ind/qwvQ9Zld/5FPAF+awddDXC+yZV:4wlG1wF98wXcPdwb4k9F5FFCrYdu5d+l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676998934, "uuid": "5277b594-d3db-4328-812f-63b3322858ad", "value": 778240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676998934, "uuid": "9440613f-1a3c-48eb-984c-dfcfba831fb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676998934, "uuid": "cce6dcd1-accb-4116-8b29-0e2ec82ecc62", "value": "PI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eb7315e-b1b6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676963234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676963234, "uuid": "afd6c4a2-e6b3-47e1-ba2e-d5bd997e8dbc", "comment": "Malware payload", "value": "fa3dccd03641996e6ba1d034656e6053", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676963234, "uuid": "9737b72e-7902-4968-8953-f7a2965e2c6b", "comment": "Malware payload", "value": "eda76d518118e4843804277202fb22ac8239f7231775f411d0b36c2980919786", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676963234, "uuid": "fc6b19c7-74ab-4443-b5cd-463df9d7a53e", "comment": "Malware payload", "value": "3aab3d9c645ed1f83304b7c2853324996fcd7a53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676963234, "uuid": "d57e0b94-9fe1-44cd-9c4c-a349452df1d2", "comment": "Malware payload", "value": "a41988894aba4d351215b6b4f4f33a1618c1b71f24bb8d9dd4d7a065f2af70f4aa939d40a6787a85044ea478d892d0e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676963234, "uuid": "c3c49221-7c39-4bd4-ba5a-3e7a80e802d4", "value": "T1F3542304BAB4C2A7D5D30BF24FBDA7961BE9D92106AC878B9750125CBCB3D01E507367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676963234, "uuid": "01ba7c20-dd1d-41ff-b1db-ee68618b18ff", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676963234, "uuid": "8e2ecbe9-691e-4a9b-9bd4-3d7f80ba7465", "value": "6144:vYa6ZECYWa0HPyme3XfCM+HOrwNYGr9McodVVgR0Ox208uoS:vYDTYWif3XfL+uroOVgOOx2wb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676963234, "uuid": "1c2f6e73-8307-42a1-86c4-f9f53fa2ed39", "value": 298383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676963234, "uuid": "a96a73c9-46e2-4fa6-a10c-4cc4bacba753", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676963234, "uuid": "03cbfd55-58c1-4fc8-a287-c4e9086097ed", "value": "Revised PO-2023217___________________________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "230f7e9c-b241-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677022834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677022834, "uuid": "105b3e3b-86f8-4903-9d86-416fa27db142", "comment": "Malware payload (RedLineStealer)", "value": "e819cea063072e8aa685e36121adbcc6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677022834, "uuid": "d66d4b7e-6da4-4c23-81ba-b549afc2119c", "comment": "Malware payload (RedLineStealer)", "value": "eed0b3a6fb74e267169fb3e613e39f9d7fd1b815270985e6af6512ceb0e173da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677022834, "uuid": "08e0233a-c606-4224-9b59-15f6778749e7", "comment": "Malware payload (RedLineStealer)", "value": "aedd25448cb2f3552d00994b06f797d828fe4ec4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677022834, "uuid": "103f842f-9639-41e1-92fd-5fff4b40bedf", "comment": "Malware payload (RedLineStealer)", "value": "5043809f491485a5b5389e85cbb1b02918dd9b7856d80b86a0a626484da9a3546ce038b74735f03d3a40d0a0383a0436", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677022834, "uuid": "0b79fbd0-db96-48ce-940e-b3a36a059b78", "value": "T1BD35220BE7EC8422D8B0177059F203D71A763D905AB4835B33DF6D5A1533660AAB1BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677022834, "uuid": "b91b45f9-cf37-4963-95b0-8820189c5b70", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677022834, "uuid": "f8db36e2-32d8-4ef0-959c-0aaf780cde93", "value": "24576:KynVfG2eg/0btfntAs6Oqn4FuaV7EkR7cTOESiwcYBpyFdw:RVfGNgMb1Czv44aV7EkR7YOESHNIf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677022834, "uuid": "33a1c25c-7b9b-45fa-b62c-6904b0de5a2f", "value": 1101312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677022834, "uuid": "33c5c19a-85e4-48ec-bcd5-469cab6fd9c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677022834, "uuid": "fc0a3d13-3a05-476a-aa23-bc45df898986", "value": "e819cea063072e8aa685e36121adbcc6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "125ac804-b1de-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676980286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980286, "uuid": "fb13432e-5ac1-498a-ba19-7112ee7b0637", "comment": "Malware payload (AgentTesla)", "value": "b9342185e8a91d705e5cd025a2d75a7a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980286, "uuid": "c8370ccc-428c-4b8a-b978-2c13a82cd2f4", "comment": "Malware payload (AgentTesla)", "value": "f07e48ea979743c38e1531d1b9b66585956d3d204546958b45fb7aeba189ba96", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980286, "uuid": "ad91ca61-1fbc-4bcf-9cd1-3f87f8af5a12", "comment": "Malware payload (AgentTesla)", "value": "926d015e4cc242e9d9b0bc7394309802d89fcba8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676980286, "uuid": "ac959e71-9b74-4ce5-83b8-4af418e4cebd", "comment": "Malware payload (AgentTesla)", "value": "ace675486fda3d8b20c206d2f80cd06741f1bf07ba1f7efd6d9425f278fb5d98766fc0af5070d9cb1701f4f5eb818d3b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980286, "uuid": "dedaea40-f65d-42b9-8aca-7791ded5b4fa", "value": "T1595412443AD08463D5F247F39C75AB6A6EF1AE101D549E2B03502A85BF616C0B72FB73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980286, "uuid": "10acd409-d89d-47ef-bdb8-89b155a97239", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980286, "uuid": "f01139e0-29d4-49af-903a-ee4307e2f9ea", "value": "6144:vYa6B2EceIi8uetWK+eP++8KN4OVCvxO0te7YUaDptNHqAzVflB1j0CA5bbWmKBi:vYzgLVtWKh84svHqYVd45biVynRNUa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676980286, "uuid": "10d01262-2807-4256-8471-d120b8969e8f", "value": 295067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676980286, "uuid": "50d3665e-1874-4bc2-83d4-900f18a873aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676980286, "uuid": "e6438c69-a7fd-496d-9fc7-c37eebdafa82", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79c8964f-b1ed-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676986902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676986902, "uuid": "5d28b188-ca12-4940-acf1-9eb63af1f2ec", "comment": "Malware payload", "value": "760554116710e4a8e358991dd4c3e593", "object_relation": "md5", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676986902, "uuid": "27f23ea4-ae57-4b64-8aac-b0d37c9e2be0", "comment": "Malware payload", "value": "f1d545ed6ad2433790b985ad84d102f937b16f44c09f32d9be33f95ef80b7d4d", "object_relation": "sha256", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676986902, "uuid": "ba323627-e77b-4758-bad4-d05825872001", "comment": "Malware payload", "value": "236b3bae61751cea6b41c24a17236f96f21c5446", "object_relation": "sha1", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676986902, "uuid": "30f2cc5e-e091-4a33-aa7a-260307a82606", "comment": "Malware payload", "value": "ef43ed1e67306a96aee80e9d88b1212ff1ee545a42a0a2465119a0dbdea67416cafa25a137449754ebffbf497bbc598d", "object_relation": "sha3-384", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676986902, "uuid": "06603492-6826-4cf4-a36a-6505943dc25b", "value": "T19DD46C21BEC3DB68DE0F90BC69FDC3578BAF75AD8D434D0263156168EDA58AC390142B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676986902, "uuid": "7e811830-7901-4f86-9709-0cf04ef45991", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676986902, "uuid": "50310bf7-6190-41c4-9f1e-a348df4c2359", "value": "12288:OXoFiKCv4IJpjEKTbuDWrHayuHj3619hbFNAtSdvHuq:OXosKvIJpjE8buDWrH1ST61TbrAgdvH1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676986902, "uuid": "bc1d0367-05d8-4493-9010-c1dc63a3e219", "value": 637536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676986902, "uuid": "a7f1b7d5-8051-4b18-ae01-1bb8d49ed785", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676986902, "uuid": "c2ee215b-f9d0-4198-aad6-645bc46f4817", "value": "WSNMBRTSK002023.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1350eb0b-b227-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677011641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677011641, "uuid": "daf80f5b-a669-4db2-a42f-263692dbe13b", "comment": "Malware payload", "value": "4db3a24462e5484fb82f62e259ab40dc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677011641, "uuid": "68d51f81-5f54-4dcf-a82e-64a0cedd5444", "comment": "Malware payload", "value": "f219b560d0cc05bee67263bd7902abf6fa6537e7f42852ba48de4df362f96f63", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677011641, "uuid": "00a8a957-ac16-40f6-a31d-36c91061f02b", "comment": "Malware payload", "value": "1857ce10019aa28ce4cb9b7962f84450062593c4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677011641, "uuid": "811be0c5-5986-48e8-9723-01291badd6b1", "comment": "Malware payload", "value": "934e00dbb035d5aaa455ea0399042faf030446947036cbf66772dd08efcfc3cd5e5c2417baa5dc22c1cdc4e9284e8966", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677011641, "uuid": "bf940a44-c960-4375-87eb-76f548687d97", "value": "T19182F8071FF80D66FBF2DE7014FA6846C17B782AAB39EACF0A14580819B15A0D57C7B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677011641, "uuid": "6848a03a-8cf1-4ad3-bcc2-8ed442bce9c4", "value": "745d7f50636fb2b25f5ec7f180ef6ab7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677011641, "uuid": "5dad2805-9ec1-45c2-a263-9e18ab23f38c", "value": "384:1NuTZHnVcaI2r4BCTXZhtam11fTgC01p1Xx99zQsWOhWoWZQhWi:1Nu9CaxEovcm/BCvXQIBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677011641, "uuid": "84bdd7ba-7b6a-4172-af53-40f48a3788a7", "value": 17920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677011641, "uuid": "583c3803-08f1-4bf3-9938-385b0d84e8b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677011641, "uuid": "820e3892-14d5-4702-8b85-b807b8260200", "value": "2023-02-21_4db3a24462e5484fb82f62e259ab40dc_destroyer_kangaroo", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db9ff5e5-b200-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676995227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676995227, "uuid": "a056d644-868f-44d2-8121-b3136d5ebfe7", "comment": "Malware payload", "value": "84b2d029e2a897eadba595041ec63375", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676995227, "uuid": "4a449561-6520-4b74-bee8-450a5dbcb509", "comment": "Malware payload", "value": "f21fb6e4e18c0e52b032275713829657e340d8312fa759fd1c7805f3b7b08655", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676995227, "uuid": "33c7626c-77af-4f63-a6f7-05d1020104ea", "comment": "Malware payload", "value": "d46dee9e1b57e340095a407dafeea5d6207b9187", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676995227, "uuid": "f15fb31d-83da-43e1-bac5-7f880b3934e0", "comment": "Malware payload", "value": "9cddf3475e42bde9b6793ed2809dfb6b9961d63856564976344eb5663de86ff4dcf8b261451c6c9cf4d75aaecda824ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676995227, "uuid": "bbbb837f-f94c-4d16-ab47-5adefca458a3", "value": "T1DCC4F141B66550FAD87713B04477DDA33679FD28A821463E729AB7B93972F83030F90A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676995227, "uuid": "1e8949d4-59ed-40e4-b457-260c196d1535", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676995227, "uuid": "b5741f74-fb81-414a-a12e-4615dd25e6ef", "value": "12288:lTMjg4wiz6XB5gg/i4sVoQWD5qXFoTBPlcrdL9NxZohgF:FF4wiz65geyIoXGTBPl29NxZ3F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676995227, "uuid": "237ed259-ad1a-43f7-bd6b-bdced1b0538b", "value": 577144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676995227, "uuid": "8c90b2e6-cc61-4a25-9cfe-177d31a08cb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676995227, "uuid": "32ff2e63-9324-437c-9a7a-04d733709eff", "value": "DETALLES DEL PAGO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e932b411-b213-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677003410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677003410, "uuid": "cfefb28e-2e7f-4a4f-bd9a-d65afc3b8cbd", "comment": "Malware payload (AgentTesla)", "value": "d7af2712cd0ea847a9f9ce315b65e07b", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677003410, "uuid": "bd33e036-dec9-444b-9d10-78a8a13ac91d", "comment": "Malware payload (AgentTesla)", "value": "f2fdbd295bdcd56f035176e67c6509590e08a14ecf30c52832b0d582e202fb0d", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677003410, "uuid": "4f00d26f-7162-47d1-ad98-f47f792217e6", "comment": "Malware payload (AgentTesla)", "value": "a817cfaf5b08a7f24951171deb071b0debc5f812", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677003410, "uuid": "3862280b-99c4-4b2b-b40a-5b9e2dd22206", "comment": "Malware payload (AgentTesla)", "value": "c4d4d67df4e29b35da3b50c094f32442622a45e8c371974967d472d9ea3af2f567b450ad400b29862e749fb007b754a9", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677003410, "uuid": "37c90eb2-b81b-408c-ab99-4b10b2c70147", "value": "T116C423DB319E4DDD6C2BF52BED20944AE24BFDCE14A85B3B5925A45C4182143483F8EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677003410, "uuid": "7216a6ea-0ce7-4b9a-97d4-735816a1c75e", "value": "12288:khliwfmwgXrHx+dKuHtBOftDHtn7LmnG5rZeNDfYvo:miwf/gTxekpN8GUYvo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677003410, "uuid": "b9b2464b-62fd-4f79-9df9-28eef5807d41", "value": 554863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677003410, "uuid": "1956b70a-2232-4872-afdd-b53ac8bbb7bb", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677003410, "uuid": "87c8c02e-864c-4c6f-8b2c-ffea3d8ee815", "value": "payment.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82c7589b-b1f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676989065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989065, "uuid": "246b7f41-b1be-45f3-ac6c-33a395bfa6e1", "comment": "Malware payload (SnakeKeylogger)", "value": "939060a89d02f2006fd3a369bff0d667", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989065, "uuid": "e3281bab-70a9-486f-936f-120bb9100737", "comment": "Malware payload (SnakeKeylogger)", "value": "f714d656ddfec2829d90068335ee63f14ac58e91b450598ebe20e0973f77e0b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989065, "uuid": "5564886c-86d4-4e77-8787-f9604f9b73ab", "comment": "Malware payload (SnakeKeylogger)", "value": "a280e80ae2794ff76b27d73121f9b63fa75d4391", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676989065, "uuid": "d79f7488-388d-46ef-bc51-4cec7ef5ab6c", "comment": "Malware payload (SnakeKeylogger)", "value": "b30255e0aa1c0c93f2606cc10f5942fd3668fd2856b7b52c885125185c31f16efbd60863cecea00a93b3065551017501", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989065, "uuid": "abc531c8-482d-4d86-b699-1fdc72224ccd", "value": "T1A44412553AF1D8E7D89186B16F7F1A3D47A28B052171CF070B101B887E37292EB1EB62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989065, "uuid": "db8405d4-8e69-454b-8677-c9bb3d5b7137", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989065, "uuid": "46b5955b-f6d4-4623-80a0-e8648d825885", "value": "6144:YYa6xDmz8TypdZkFhWMzG6Fe/4hQnAdu8gVQw0wJ2vA2gacy3gCroocgkx:YY/W8epYmMzxI/E1iQwGAoRQCrooxkx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676989065, "uuid": "d700ad5e-e685-43bf-85d9-0d2825387c66", "value": 275617, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676989065, "uuid": "9cb4bb62-75df-4196-bb0f-d937c48e2977", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676989065, "uuid": "9b557ba2-ed41-4cb4-be0b-b6a17521a64c", "value": "Products Inquries2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a8ec1f5-b1b7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676963657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676963657, "uuid": "f0847907-7ed7-414d-a2e6-aa3115b4b7bb", "comment": "Malware payload", "value": "d6cf93b031f2e3b8758c41f5ce665a1f", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676963657, "uuid": "7ab68786-ad2e-4893-88c4-f4bff767c615", "comment": "Malware payload", "value": "f77205a9238a123b74b764be6e2132777e1f3eda9c515f31219387c45629e3ea", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676963657, "uuid": "05234122-99fd-4c27-9b80-e139c5654994", "comment": "Malware payload", "value": "dd3040f2b246bf729de40573721442d8efd4e070", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676963657, "uuid": "091c4a28-1e82-4ee5-af69-7e30f1ab5375", "comment": "Malware payload", "value": "ebe55ffe65de076eaba2d5639f6f67987065cec6036c1327ca2f7a9c425be2f34d12858164ec1b358cde2f4f6a606568", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676963657, "uuid": "f076a29f-f71e-4694-876f-9d74d55f167d", "value": "T139D31262DD5C8476CAB684F800290522E44DE7E32A77C29F9C9519ED2F964BFC30B9D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676963657, "uuid": "2628d277-eb1e-43f5-91b9-fe366c061745", "value": "3072:FyZLYyIKIfKTzY+J4WRyasXGcSOv+zb4coB168mOKIGuH+dyRwKyR7Ep:FMLNWK/Y24WK2cbv+ol03K+qwHY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676963657, "uuid": "744d7f5b-2721-402f-836d-928419e59c78", "value": 132354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676963657, "uuid": "352324ce-404e-471b-b07a-d9f44f1d5fdf", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676963657, "uuid": "c015a22a-53e7-4869-9ffe-bbca789d01da", "value": "f77205a9238a123b74b764be6e2132777e1f3eda9c515f31219387c45629e3ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "492ec238-b1b6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676963198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676963198, "uuid": "2da91525-487b-4ff0-a3e4-aae5b0c532ae", "comment": "Malware payload", "value": "680f9f4846c034654541b07f3a015c27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676963198, "uuid": "df2443c2-428c-40f1-9c4b-0d80efffc58b", "comment": "Malware payload", "value": "f8179961c0c0302c8c3b2a6ae0b5e5fecba8eb68dd2c29b4fe97c015fb488fc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676963198, "uuid": "4cbe3970-432a-4467-90fe-7ef9f9484f2e", "comment": "Malware payload", "value": "31851602249ad15990e23cdb28c8709d77b32472", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676963198, "uuid": "9d003f4b-22d7-4be4-b104-e7c43a10fd31", "comment": "Malware payload", "value": "d184dfa14b5c2543eeec78eb42b26a2bc17abd50cf81c50246187a8cca97fa90c71cc360455eb38b3ee0579d0b1865d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676963198, "uuid": "f8b46e17-1e54-4860-be29-f4c8c33961ee", "value": "T180721E20BF48A223CD66B7F2AC63C6D02574BE705952762A60DD33CB6972F44DD73660", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676963198, "uuid": "f2c87ea9-d4f8-4c67-8edf-858589f396eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676963198, "uuid": "22eecfab-ac69-465f-8360-0af33178505b", "value": "192:i4rK2JV7sQtR/LTgTApTub6ktDOp+4Fm4Twkz:i4rKGVdBLsTAlCtDcPRwk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676963198, "uuid": "4bbdec4c-0523-47af-a165-4e003ab99044", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676963198, "uuid": "86bb892b-1976-4895-820d-0a8c67662899", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676963198, "uuid": "86483670-e288-48e8-99bf-a53e444ef292", "value": "SKM_C308Cen22092912580_pdf .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e906a6dc-b1e9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676985371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985371, "uuid": "f97c463a-0041-4a6b-bfce-312b891ca907", "comment": "Malware payload (Formbook)", "value": "20965e23197df28704bab1cb2ca58a4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985371, "uuid": "cd3217fa-5c23-4b2c-a950-ae7e00d1a6e1", "comment": "Malware payload (Formbook)", "value": "f863d6f9552aca996768b5d21f3a51ba32b0e918295102de475dd16562ec08c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985371, "uuid": "e4eaf66a-6f74-4039-840a-d0f4c2aa2cfa", "comment": "Malware payload (Formbook)", "value": "f67e168d80f8189da5c95bdf70ff05cac6f0a4e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676985371, "uuid": "06469441-e35b-497a-80c7-fe54d1408fe1", "comment": "Malware payload (Formbook)", "value": "dfb904029c5c13a22e8bb2e484d424f245576637c8476d8004a4a73e1e453fc4a47a52da3214a74953004ac6751efd4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985371, "uuid": "e8f4cd1a-e008-40cd-ad54-b475fda6e49a", "value": "T17444121C53E0C5B7D9E34BB2483D165A6FF5D623089893BF93218F44BE25A90954F3A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985371, "uuid": "c94b9c63-1d12-42fd-a102-cbe9eeaa0b70", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985371, "uuid": "455f8e43-56bc-4fdf-8efe-6c7b3148723f", "value": "6144:vYa6qHhyFSuxUkRJT6OfS8N+4K6OoVoNPg7XHY3B8IXsjEWHrSXnl:vYkHEFnDaORcH6OoWgMaIeFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676985371, "uuid": "712d847b-51ca-45ca-86a3-27b45d1b1b9f", "value": 266826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676985371, "uuid": "dd5dd13e-2929-4205-ac4b-6fa7ac36b94f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676985371, "uuid": "b4f262cc-74cc-432a-b974-71cea8b7d905", "value": "Bestellung Nr. 753.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d346220-b205-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676997189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676997189, "uuid": "720a7c3e-bc04-4e25-ac50-4eb3c324a07d", "comment": "Malware payload", "value": "12f71e5c89f2829b6ed92e6396a8b7c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676997189, "uuid": "a043628a-f18a-4287-afaf-f871a4b4a54d", "comment": "Malware payload", "value": "f8ef3fcfba41573fac115af669c0b712dcdf2d38673fb62abce850fa63ac8b83", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676997189, "uuid": "3c64ec86-efb3-4255-9a8b-83c406448bdd", "comment": "Malware payload", "value": "e161b7b78727e5cf91d98fcf5f6878705c38b537", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676997189, "uuid": "1611dbcf-7ac2-4a21-acc5-68e06cb57eca", "comment": "Malware payload", "value": "6438271fb7a1557ef7efbe4df3913bd122487011a0abd76c46bbc1e473553aed871046f66ea49d324d493d14258321e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676997189, "uuid": "45c416f1-cda2-405d-82b8-00d43405ea66", "value": "T1B8431819FC809B01D4D521BAFF4E028E33635B6CE3EE72019D256B2527CAA2B0F7B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676997189, "uuid": "9eb74930-476b-49ad-b8fb-4eee105af12e", "value": "1536:nQn7XriaW7ss2PDvamqzJS+9zga979lArife7j0:aeaWavvqzJS+9zgfCe74", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676997189, "uuid": "b65c1942-6822-4011-a13a-06748e24a89e", "value": 59120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676997189, "uuid": "0fc03d76-5dfc-4c20-bc48-dc35fd01abc7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676997189, "uuid": "5a026c31-45f6-4d6a-98ce-81604621974a", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef499049-b213-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677003420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677003420, "uuid": "f6022a46-d616-4e33-b8b5-863e65a5620e", "comment": "Malware payload (AgentTesla)", "value": "3c084dc8dfd271c0c0d5a395e20259b4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677003420, "uuid": "7e324647-9680-4516-8d7a-625ea25c2f22", "comment": "Malware payload (AgentTesla)", "value": "f9c19f6fab392f8a9fc72e130be89468f5a1e6a5bd9bd76e4af198b58ec3e3e3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677003420, "uuid": "0bb32b83-0608-44f1-9a58-aa7f8812727a", "comment": "Malware payload (AgentTesla)", "value": "8439a2808fa6c558f7711b1f7c3a2f3ec3dd0296", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677003420, "uuid": "181729a7-502b-43b0-b74d-19638dc4660d", "comment": "Malware payload (AgentTesla)", "value": "78bc891f75146d1df64ee7fb378173c957b2b76693e6ce6c732c5e50bd0c8144332335f0db692a4afdf31b0e0634146b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677003420, "uuid": "1de81aef-a2bd-445e-a771-72a7cf397db4", "value": "T1DBF4D33A29B657E2C238FA3346E3E520B6FD50927313D958DDE61AC04F425427ECEA5C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677003420, "uuid": "4163c890-20f1-410e-9308-e30ad5c6874d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677003420, "uuid": "00b89b93-f040-435f-a8a3-42a49e3dc844", "value": "12288:pzwlG1wFK2RSwXcPdGB4krFtjFWVOPMBd+KXd/CwvQ9jPd/3FPeFuUwHdD9CBjpq:BwlG1wF9SwXcPdGB4krFtjFWVOPMBd+w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677003420, "uuid": "ab0d7c8f-de5f-4ff2-8c4b-0cff13247802", "value": 764928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677003420, "uuid": "0ba1b0bb-9725-4911-82f8-540c05659a92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677003420, "uuid": "e77082b2-1f5f-4ba1-b02b-cb67aa722390", "value": "payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57adf5c6-b1c3-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676968806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676968806, "uuid": "8dd1a458-dde9-4260-a02d-45162cb89c3a", "comment": "Malware payload (AgentTesla)", "value": "389ec337333a214e99459df3ef128c58", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676968806, "uuid": "9ea94dd2-0ea6-4ff7-9092-7100514ef482", "comment": "Malware payload (AgentTesla)", "value": "fc3dedd53b18e4d9881af0e1b9ac4b2134a8693e8e98f40c07c771918d3f57ca", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676968806, "uuid": "4e3810e0-989c-4a8c-a090-156abd193a5d", "comment": "Malware payload (AgentTesla)", "value": "e4234a95a0676a540e316ebafedf267c8770b5ce", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676968806, "uuid": "4e45989e-e8b2-4ef5-a7a8-33c81d4304a4", "comment": "Malware payload (AgentTesla)", "value": "e7a5e9b206030b39697a88cac090735d258e4523cd083e89ff5c05b1a7d426e96cf1b779c5149c1664babc41a756ff54", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676968806, "uuid": "ada0d061-0efb-481c-9f3f-b860ea8fed54", "value": "T13F4533EBAA09CDBB1412DBF3765363B7FB4845CAD243807EC6A45B378449C6866D3407", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676968806, "uuid": "aebb0561-1c7e-44b7-998c-40a519bd57fc", "value": "24576:tgeMxuvNnUl8F7KsS9WZeocGEa1DUGAFkA0DoMs0BXAl+cx65deQE:uehvlUvsScorJGWhLM3B2oLE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676968806, "uuid": "887cca1e-7626-45ff-b769-5db7cf1d75f0", "value": 1223391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676968806, "uuid": "d743c610-211a-45d3-810f-e36c39242f35", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676968806, "uuid": "8d167d72-6c4b-4a81-8065-ffc682319701", "value": "Invoice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07ccddfe-b227-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677011622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677011622, "uuid": "2e658073-e2e6-48df-ab14-fe5424be7337", "comment": "Malware payload", "value": "014d65c52b2cc47518966ba8635587dd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677011622, "uuid": "6eab02c7-bc00-4016-b6ab-7cb33ad36d93", "comment": "Malware payload", "value": "ffd092dc3217cd9a47a9d1fe7172a0f9b8ba81a652815011082ecc197d44551c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677011622, "uuid": "c4eaab80-a54b-4633-bba5-47ead626f117", "comment": "Malware payload", "value": "fbe8995bb52525c4e5cf2ffdb5287fc039da7a33", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677011622, "uuid": "de0f9a1e-8240-4d9b-bf17-1fe6cdeddd20", "comment": "Malware payload", "value": "8f7b70a90e03cda1cf5aa47c86953baab250b42b2a9a5b3cb0d7996dc67ad90d1b316aa3fbf3ecbe4b227f8fbb80480f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677011622, "uuid": "b1204f31-79de-4947-a547-913975793181", "value": "T11582F7071FF80D66FBF1DE7014FA6946C17B782AAB39EACF0A14580819B15A0D5BC7B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677011622, "uuid": "369a20fb-0584-4d52-b57e-60ece9b494af", "value": "745d7f50636fb2b25f5ec7f180ef6ab7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677011622, "uuid": "b6c85fe5-e21d-4d69-ad34-d86d75aef16f", "value": "384:1NuTZHnVcaI2r4BCTXZhtam11fTgC01p1Xx99zQKWMQhWbWZQhWi:1Nu9CaxEovcm/BCvXQvUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677011622, "uuid": "bcfac805-c61a-40cf-97fe-8cb43dfd45a3", "value": 17920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677011622, "uuid": "26a122af-5aac-45ce-8342-14d0c4fd04e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677011622, "uuid": "7974d126-fd05-473e-8480-5ff1649a7720", "value": "2023-02-21_014d65c52b2cc47518966ba8635587dd_destroyer_kangaroo", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }