{ "Event": { "published": true, "date": "2021-10-22", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-10-22", "timestamp": 1634947381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "a911744d-62c7-4431-ad91-ad04779037ff", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28afe927-3308-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634887067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634887067, "uuid": "26eed11a-b56a-47a4-b384-68cdf8432247", "comment": "Malware payload", "value": "31d87e1ea472702b679247a61d095753", "object_relation": "md5", "Tag": [ { "name": "mac", "colour": "#285994", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "UpdateAgent", "colour": "#B10D2A", "exportable": true, "hide_tag": false }, { "name": "WizardUpdate", "colour": "#5BF7D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634887067, "uuid": "7596761a-cb81-4fc4-a3ff-b4676fb75e04", "comment": "Malware payload", "value": "00f78d0981f72d957946d6349ab87e9be22988418e15a870200f9adbe1384ce9", "object_relation": "sha256", "Tag": [ { "name": "mac", "colour": "#285994", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "UpdateAgent", "colour": "#B10D2A", "exportable": true, "hide_tag": false }, { "name": "WizardUpdate", "colour": "#5BF7D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634887067, "uuid": "a0807d1f-7305-4f61-bc80-253667a83064", "comment": "Malware payload", "value": "8b7811ed94c21ed88e9a5f7dd552d527b83642b3", "object_relation": "sha1", "Tag": [ { "name": "mac", "colour": "#285994", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "UpdateAgent", "colour": "#B10D2A", "exportable": true, "hide_tag": false }, { "name": "WizardUpdate", "colour": "#5BF7D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634887067, "uuid": "333e349b-66b1-424f-8112-6fd8a8b39ede", "comment": "Malware payload", "value": "9a8e29f7824064255e2dde6583e6fdf71a41ff375d21b94182836a038ac671172e88ff466810be6a61590ad93393fd36", "object_relation": "sha3-384", "Tag": [ { "name": "mac", "colour": "#285994", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "UpdateAgent", "colour": "#B10D2A", "exportable": true, "hide_tag": false }, { "name": "WizardUpdate", "colour": "#5BF7D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634887067, "uuid": "20c31fab-f16f-4be0-ae8c-c250e785ef92", "value": "T18E21B7E4060083F1DE272A3142279F730B060510DCF8473AF7D6F148B0C88C086350C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634887067, "uuid": "c118999b-ef43-49ef-8953-3764b8c5bdca", "value": "24:9dxfyibpsrSA+cMd1cS/gkFM5le8tMQTAraWORQF1XYUarfy9PSI:9dcibpsrRcRg5le878raWuQn1Afylx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634887067, "uuid": "38eac46e-063e-428d-8183-2e38c8ed2c7e", "value": 1291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634887067, "uuid": "381b3ab9-a6fb-443c-a836-d109201fccc1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634887067, "uuid": "caffba09-f132-4e8f-ae45-61cf2f49b7a5", "value": "OptimizerStatusAgent.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccd52509-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928145, "uuid": "2071aa3c-d807-4d1d-8840-ac26252c9734", "comment": "Malware payload (RedLineStealer)", "value": "cf288fa5764ae438795dbabe2d061659", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928145, "uuid": "342f01d7-6eed-416b-8b84-09a7a29c1cf5", "comment": "Malware payload (RedLineStealer)", "value": "016e8767850dc59e5d761b685e0c696819ebd40e5b55f6c42ce55a8095ab38f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928145, "uuid": "0b20367c-8585-436a-8ac0-9bcb717043f2", "comment": "Malware payload (RedLineStealer)", "value": "90c39d1c27121823ce2d376acd1a624cca82f101", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928145, "uuid": "33e6914c-7d4c-493b-b9c6-7e3333e790a8", "comment": "Malware payload (RedLineStealer)", "value": "14ef2576093a95048d62c8546e05a930be5517aa4fbbc63b8fad29a1bb6ed6e2f40585400dad4887a809e3cfee693958", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928145, "uuid": "61e7a933-2f8c-4bd2-9022-24d6b1954585", "value": "T1ACF4D000A6A1C03AF5F322F849B59368A53EBEE15B6494CB53D517EE47349E1EC3132B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928145, "uuid": "c571862b-6f9d-4aca-ae6d-6253debef34f", "value": "9cccee30870eeeef9fd80f169e4bd55f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928145, "uuid": "5ed7bed4-5d8c-41dd-9520-3a19a7ca9332", "value": "12288:ISAcVwC4KlEEtb8XTzR+g/fU0JwMlwhAz7RBYf4IyrwKnRXzZuKUnTtpkz:IZcVwCdTtbw1+g/fUXAvxzQKUTI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928145, "uuid": "01240d52-4041-401d-b1d7-f24072e5cf57", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928145, "uuid": "f9f2b222-598e-492a-937f-6f0e1ba172cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928145, "uuid": "c24e641a-5f98-414e-a351-47e5a605981c", "value": "cf288fa5764ae438795dbabe2d061659.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7d45813-330c-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634889133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889133, "uuid": "c8b5eadf-10bc-4192-a380-d6443014a033", "comment": "Malware payload (SnakeKeylogger)", "value": "b053441618809b9dd77c5ebf50239c3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889133, "uuid": "0023e4e1-bb9d-4f8b-b513-e8b9100a67f0", "comment": "Malware payload (SnakeKeylogger)", "value": "01828be39e9c87bcfe2f59374c1dc5e9fb963bffcf3bf5a3d0bd3e82e6c27c32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889133, "uuid": "656b0914-e708-4670-8da6-e942d3fac551", "comment": "Malware payload (SnakeKeylogger)", "value": "69fd352d0bfd639bee79691bda6428c0476c497b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889133, "uuid": "7cff40a0-aae7-4887-8715-1fff02bf3d11", "comment": "Malware payload (SnakeKeylogger)", "value": "56e3a4782f9dc975a7f8998a9aa5cd87846f5bb9caa05f7ce0978035fe17400a971fa31fa2146cbe67551d230fd613ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889133, "uuid": "0ad6b9a1-9857-46da-bd3e-0a441631dac0", "value": "T144D4F7082255C243E1B43BF0C4251FA043636E6DA436D75B6D9939DBBFB3F880952BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889133, "uuid": "ed8b342e-9bca-43b8-97f4-bc0270f333f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889133, "uuid": "5b1ddb6d-fc9f-4158-8f83-2343012e49e8", "value": "6144:pGxhLzIXav5wzU3oHY59KCvkg9yDUo1BfcnCMk+DI3D8+4Z2wwwxItGrKsPE7G:YMeis5X8gchB8CQGA+8OtGr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634889133, "uuid": "ce3fb3ff-2526-4dc8-9f1d-a0415737c947", "value": 649728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634889133, "uuid": "e0618da5-4d98-40aa-915d-53631ad5f20b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889133, "uuid": "bd49380a-ed0b-419c-9a7f-dd9e9793cd22", "value": "DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31474415-3342-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634911992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634911992, "uuid": "e65445f6-a416-49cd-9dce-f5da1fcc3f5f", "comment": "Malware payload", "value": "b590d49b24af7a3fb1ffe7d18712b2d0", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634911992, "uuid": "61964a1f-61e6-4871-9cad-daf6dea00ca7", "comment": "Malware payload", "value": "027b04cca32527c35f3fda244e92c1f7ad68ad55281cf1f3e644bd4731b49e76", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634911992, "uuid": "18cd8d4a-969e-43b3-8984-92f12c88bb0e", "comment": "Malware payload", "value": "62aeb4fcfed7e9d36c66fd528d244c256b5c8361", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634911992, "uuid": "c7c311f2-417c-4d6c-b9c3-57222354eb04", "comment": "Malware payload", "value": "cf512a0725022c453a4d627906832295f306f3f945d28c6924b25a0e6f1664eefdbbf3ba0c2e902272560e73dcd85630", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634911992, "uuid": "81d21dd9-977d-4677-a38c-5d3259d10663", "value": "T1FD5423FC6BFCE0F5C607BC7B70CC8096EA1F2A6490896E9596CAAC53CD85F54490E14C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634911992, "uuid": "cc4630ac-53c1-4aac-8f19-73844d95da3e", "value": "6144:W8J4tqZ7lBIMClvC5gTKmHfBdDqBpxzeYIZrE6aWAQHxlbYz9PMP35:hJ/pIMCVmspdWBpluE6aLQHxxYps", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634911992, "uuid": "a0731b7c-6d5e-4185-ba67-bdc155612f9c", "value": 303044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634911992, "uuid": "f4565b14-b2ea-417c-976f-9ac8ebd80344", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634911992, "uuid": "3e21b4d0-e8bf-4bab-b98e-c8ecaf489d08", "value": "5638270655561728.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc11eb5d-3357-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1634921298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634921298, "uuid": "25ad7333-db93-4820-b26e-d5673c191fb7", "comment": "Malware payload (Dridex)", "value": "9c2bc7ccdc66cc3dad587e05f668b9aa", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634921298, "uuid": "b307cfa6-f75d-4e03-8430-a5b8fd99bc91", "comment": "Malware payload (Dridex)", "value": "044dba2cb102eb631f8bb519b483e6c5b640e2b3e542053f29949e13bb142df2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634921298, "uuid": "9f6b7210-205e-40fa-abf1-c0dae3ad1f7f", "comment": "Malware payload (Dridex)", "value": "f5c7c0d639dc90aaa42933e8709269dd96effd71", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634921298, "uuid": "faf86828-3857-4af0-9f37-149357bc3845", "comment": "Malware payload (Dridex)", "value": "11cee9cdf741e733c409f8e86258b3d07a4b0e548ef2d0ab14127108374d817a9f446605ff960c9f0e79974fa43d6a87", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634921298, "uuid": "abea6950-99ba-4126-a1c2-a3e683e99468", "value": "T102E408013A40E821E7E55576CF2AC6E85B083D49EFB5A5CB78E17F0F2AA99F3D215301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634921298, "uuid": "c9bafd99-7176-4361-8fcd-9be558542fb1", "value": "575d942b23dfcc476865145b0dd6ee57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634921298, "uuid": "899fdd27-d088-4dc6-890e-a12a46da0c3b", "value": "12288:j/0Qzqf0eJi48WM+6TFKywVt6PbEYU0eyJTT/Mu9oV01uwoaEP:70zhJpn6TFKywvCbEOxDMu9oycaEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634921298, "uuid": "1ea616b8-07b3-48dd-a0ed-602facdd20b9", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634921298, "uuid": "6b23ecba-1be2-47f7-a6b9-7b027a89e826", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634921298, "uuid": "e48784cf-1e5e-496c-a44f-aabd34b56b02", "value": "f1j7m5.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "071ef101-3329-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634901184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634901184, "uuid": "b60aa3d0-8523-48ba-a3f6-e33627e91cb4", "comment": "Malware payload (AgentTesla)", "value": "634657bd61352689f76e1ad691f569f8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634901184, "uuid": "c18d0106-7ba9-4651-a106-9d1ae88624e2", "comment": "Malware payload (AgentTesla)", "value": "04c14c005ffff7fc3b47a608e6945310305d81958813b5e3552250e6823ff766", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634901184, "uuid": "546cdc73-d950-46b5-bcd9-b442f87d8429", "comment": "Malware payload (AgentTesla)", "value": "0c3a0c59080e59b29bee05fa871e77c5e5e221f1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634901184, "uuid": "a22169a8-ecb9-41b5-b71c-a8b931a2343e", "comment": "Malware payload (AgentTesla)", "value": "35a50a7ba559de05149b7c4a70352bc6488c24faf12018aea4cdf519adedcf84ff3cd19bd71077ecb7b91125219a661d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634901184, "uuid": "1932b71e-011f-4eaf-90fc-4024d8e6c397", "value": "T120C4CF72610AAE8AEF3A7FF9945027803FE4BC779B6ED64DAD89309611F7510CE30851", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634901184, "uuid": "9f8ef820-5903-4699-b287-2a4c3dc7d3d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634901184, "uuid": "51f8dd07-0e8e-4743-84dd-40c1d45714ef", "value": "12288:bbTiHR6Ibw8eGi/qOYUQmDDrfgM33b2jaVjzqh1Fuicr6XqJFTP:b+dbw8eGXe9b3rgaV3qh1FuiW6Xq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634901184, "uuid": "e28ca3cc-45e9-407f-a21e-67912d4a9870", "value": 551936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634901184, "uuid": "01905c22-da9c-49cb-a218-da7a8acae60a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634901184, "uuid": "9d2a05d7-b084-4c49-b473-0e85ebb3a336", "value": "SWIFT COPY FOR URGENT RESPONSE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac2e3287-3392-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634946558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634946558, "uuid": "98cfc961-80b3-4cb2-ab3d-d8211c409eb1", "comment": "Malware payload (Mirai)", "value": "85958ceda87c054b0a85ce4bed10b5ed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634946558, "uuid": "da1b2a28-41a9-4848-b950-1e7469c601e3", "comment": "Malware payload (Mirai)", "value": "05da8fa221e352ec2a9d21e10aec3f1bfc957572d3319d1836125ba6663c83a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634946558, "uuid": "5c48c175-9b1f-495e-9ea4-febeb5e4248d", "comment": "Malware payload (Mirai)", "value": "e43cc30a159ef183a1917a15c02dd338f76eea46", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634946558, "uuid": "51ec15de-11c0-441a-836e-2bf8742631d5", "comment": "Malware payload (Mirai)", "value": "17262225e0e0e3a352c29a6e36cbd0641a69b301f3785444acbe84762b04ddcebf4b1dfd75168982abaa8a7bab0ef002", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634946558, "uuid": "ca471bc2-7b3c-48a9-bdc0-79d0e6fa5a65", "value": "T19073C70A7E229FBCFB9846354BB78F159A5833D627D1D641E2ACDA001D7024E341FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634946558, "uuid": "ab9d2e9d-b53c-4b1b-bc43-e3bcff06f515", "value": "1536:bpxe5qoct9fdlQBI6r6EnUFndlBotYG9CJa101Dv:Fx3oANdNrndvomgC4S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634946558, "uuid": "8522feef-6ee2-4a42-8d2f-2419ab430a39", "value": 77288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634946558, "uuid": "cd95e4a5-083d-4e5d-9016-23b445736362", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634946558, "uuid": "c892bfa6-8c3a-4c36-b9a9-2a14f0f7aac6", "value": "85958ceda87c054b0a85ce4bed10b5ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89129ef5-330c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634888947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888947, "uuid": "d1f075e4-1809-43e8-8b38-59a82cc861bf", "comment": "Malware payload", "value": "d61b1bdd4f9257a122e2de82bebb77a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888947, "uuid": "355bc0e6-a0a9-4883-82a7-b03a5106faf8", "comment": "Malware payload", "value": "06526fdb57607c3a2f4cccc8e5f0b7fd149d405cba625728a307f090a31ef10b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888947, "uuid": "bf947e9d-61f3-4f44-9048-0ff1bdeff385", "comment": "Malware payload", "value": "015eb53960c77a393a680bdb2eea259fb866dd21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888947, "uuid": "609c9c45-c974-475a-8c39-912684129f23", "comment": "Malware payload", "value": "2207b78690174b1c1187c77c0d403a6e40c1fe8769094bc1c73f591154067eb70a7aa9e47efd2abceab9fba30c16823b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888947, "uuid": "709d0e77-cba8-42ff-a267-c354298e8808", "value": "T15D952A57B8E204BAC57EF13485529362BA323C6547323BD71F80A9AA1A75FD4AF3D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888947, "uuid": "6d566a25-be31-4826-b4cf-ae88b8503d32", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888947, "uuid": "cb924856-fdd2-4c61-b04f-404d527e286c", "value": "24576:22Fg0ISCtCrjLCssbHcpxyzgZNbtUVqE1iB:2uIS7rjL3MHzQbtmqE1iB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634888947, "uuid": "e23f2395-a826-4de1-9073-234e1feeb377", "value": 1976496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634888947, "uuid": "82705ff0-e848-4697-992d-bf8c71da5c1e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888947, "uuid": "eb886027-7fd4-4e48-b26b-826e81706f7b", "value": "06526fdb57607c3a2f4cccc8e5f0b7fd149d405cba625728a307f090a31ef10b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a6f09e2-335b-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634922879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634922879, "uuid": "106e6bfb-ed14-4359-8a55-dc9bd507e977", "comment": "Malware payload (AgentTesla)", "value": "e38c39929d384898ca31dce2025a5a5d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634922879, "uuid": "8aa909cc-ad65-4924-b820-27d5cd53090d", "comment": "Malware payload (AgentTesla)", "value": "071c2735b8c6d74c6a792f526a51c9cf33b736af9d5cb392ae36ed2d636b777c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634922879, "uuid": "aafd9eab-3cc3-42f9-a2b3-fcdcab31ea39", "comment": "Malware payload (AgentTesla)", "value": "d6cbaa65c555d812c8bb4fbd6b3cd96194c19e9d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634922879, "uuid": "44613475-e857-4ff6-8059-310421e3c71e", "comment": "Malware payload (AgentTesla)", "value": "db51d53adab490499e40261aa196e830411ac991d30ac93ef3a8a274c09f85619dd13acf74cd4a8a94300de905577c8b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634922879, "uuid": "6b81d7f1-d57f-4131-9543-28c8ec34ac9d", "value": "T14FD3264E3FC6F761C0E897B14455D3892BA3C31A260DC14A18F7C7E51EE16CA2692ADF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634922879, "uuid": "5bdbd78b-869f-47e1-ab70-0e450073a3c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634922879, "uuid": "dddcbc48-6bed-4b97-be8a-a5a8ccae0167", "value": "3072:0JbzozvuzS0h0CTXYmvFMQ4b1Lf/x6wz4oJnnsq2xc150:0OkS0hYmuQ4pf2oJnnsjxC0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634922879, "uuid": "4d1987a6-9716-48f7-8756-db4d3cce26d0", "value": 142088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634922879, "uuid": "f0fb3a7e-6c91-41c8-b8bc-30dfeeac0510", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634922879, "uuid": "5112e896-2924-4991-8d69-1cf88a7df321", "value": "001-Payment Copy_jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "719e2b8a-335e-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634924126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634924126, "uuid": "1805a662-938f-4c7a-b575-c643339d4e01", "comment": "Malware payload (Gafgyt)", "value": "972f767dea4fdc0097296e6182cbe39f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634924126, "uuid": "dcb64c1a-c907-4237-bcc8-195d49b51206", "comment": "Malware payload (Gafgyt)", "value": "084bd7f1ba6d065632cbc7b22681b2a6cc1030c68c8a48897572fba4236cb134", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634924126, "uuid": "d31594d2-c097-493f-acca-135ce943bfcd", "comment": "Malware payload (Gafgyt)", "value": "475e5b2cbebab4c47d621cb0fc8041d40319d31d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634924126, "uuid": "e6c6722e-f0c1-4e3e-99bc-551088063d1b", "comment": "Malware payload (Gafgyt)", "value": "52a596da4cf45a8ddac89f5eb0dbf684613e2a611f8e9e92eee0b9c318cacb948cb060284e0956acd4d556e71385d66e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634924126, "uuid": "bd99d806-543c-447a-98cc-a13279f7fbb6", "value": "T1DFA32A44F841872BC3D327BBE78E479D3B36569467DB33116A386EB42BC17C92E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634924126, "uuid": "2a830ec1-9aa4-44b6-b521-fe489e9a8d0e", "value": "3072:1Sl+W6maaWnINPXPxC5iKmZuqQ4DPwXXtse:y6mBWnoPXP9KmZuqQ4DPwXXtse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634924126, "uuid": "21df8c3f-45ed-4844-af01-581b05e6f764", "value": 100871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634924126, "uuid": "51cd94b8-f2dd-43c2-95be-bda8a79da7e1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634924126, "uuid": "1d0ba081-26eb-4b07-9a4e-2b2a7f35b8d5", "value": "972f767dea4fdc0097296e6182cbe39f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3640f223-32cc-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634861320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634861320, "uuid": "1cb9b9f1-8e2e-4886-a4b4-fef78114e6f1", "comment": "Malware payload", "value": "c0fd2bdc5772986959399b514d854a9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634861320, "uuid": "0c7d451d-3452-47f9-b981-339d04ec7713", "comment": "Malware payload", "value": "09304997df4fc7a39650857511a5dba7ffdd7deb92cca4befec239a35d232fc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634861320, "uuid": "ed2a0371-e02d-4fa4-a25e-da610abc3246", "comment": "Malware payload", "value": "e09e54e91c0436b5a1f5225b80bf82702d82fc51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634861320, "uuid": "de8bb720-708f-4490-baa2-2b20226a4891", "comment": "Malware payload", "value": "0fe5f1cf74c7ba957d00b8cf0e46d3cd9191a28fb1316f833a2066ec81d1be428c4158e108dc2c36001237bbd11d2eae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634861320, "uuid": "8cedc0cb-eed1-44d4-ba6b-fa5536f3e144", "value": "T1BC9533BA8CFC2012D35D5CFDAC9C7826152CC43AA4DC3C4B1AE6E695E6FCA735249583", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634861320, "uuid": "7bbe2795-5300-48dc-a86e-53960365adfd", "value": "02549ff92b49cce693542fc9afb10102", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634861320, "uuid": "b378df8d-54f9-4b79-8bf2-51314cb8b831", "value": "49152:NBoWYtR+cwjc6LmCovPZY8q9G1GNitOauQhVxsjlLfpH5K01:etRXwQGiPZwOuQhqRc01", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634861320, "uuid": "43893fb5-3f57-4aa2-99c2-4530fc9132b6", "value": 2006528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634861320, "uuid": "e5e8246e-e37e-4d75-9838-0626b4859668", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634861320, "uuid": "c2f96692-9071-4f07-b914-2699f8fa29d1", "value": "SecuriteInfo.com.Trojan.InjectNET.14.23574.18732", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b94b4672-335d-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634923817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634923817, "uuid": "fe46d6c9-5316-45f0-a3cd-a37703c6648a", "comment": "Malware payload (RedLineStealer)", "value": "83a3a0c2ba0bcfe480a9592c6affbf56", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634923817, "uuid": "c96537ac-3a03-4a2f-aa22-1d8e2dccc5d4", "comment": "Malware payload (RedLineStealer)", "value": "09f5c996d550cd310ffb0d76c649de96109a7039440d41e476234d52b8dc2f3a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634923817, "uuid": "b3a5d8aa-f453-41c4-89ea-09f1f243128c", "comment": "Malware payload (RedLineStealer)", "value": "6b68fc2564ecb8c68f3e5e946f83c8c4d5c124a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634923817, "uuid": "4c3941d8-ef10-4138-a0f4-558efb7b4e94", "comment": "Malware payload (RedLineStealer)", "value": "3ad257573f705d2ff730225099857e4247b40833621452ca991f9001d99e96d710cf08bdf0cd5a16669da87faee6d27f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634923817, "uuid": "56ad8671-8988-4484-8edc-b5c563063d32", "value": "T19A949D00A661C039F5F326F489BA9379A52E7EE15B2450CB53E52AEE47356E0FC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634923817, "uuid": "9ac47af6-2297-451c-a0c0-c68f6da532a3", "value": "9cccee30870eeeef9fd80f169e4bd55f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634923817, "uuid": "0120add7-679b-49ee-ad72-42ec1382063b", "value": "12288:bAdHH7N9oN1hSm1ynzlMDF7VPJBAotOB/j:b0HbNqhquDdVPzgj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634923817, "uuid": "c4126d62-8cec-42d4-8582-5a7491e505b5", "value": 429056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634923817, "uuid": "e4362ee8-76fa-4e55-99c4-433c26034686", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634923817, "uuid": "f1c0ba2c-3bae-4ae1-937f-866f50e6c372", "value": "83a3a0c2ba0bcfe480a9592c6affbf56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43ed245c-3310-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1634890549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634890549, "uuid": "78c436ed-22df-4d38-8847-30fe78d6fa70", "comment": "Malware payload (Metamorfo)", "value": "9a59c9ecab3431a27ae56b297387b4fa", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634890549, "uuid": "4f0037ac-d326-4a3c-a081-90dfc48b418c", "comment": "Malware payload (Metamorfo)", "value": "0a5de4c8ce5126b00e17f63cfcf359debd298911f096af46bb3ab382ab5b53bb", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634890549, "uuid": "920c2b51-51ac-4c91-bfa6-adf596822ee2", "comment": "Malware payload (Metamorfo)", "value": "5f018bf475eb1b211f3efb43df54db780f4ae899", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634890549, "uuid": "85d6acd1-899c-464c-828c-591d8e7d634c", "comment": "Malware payload (Metamorfo)", "value": "75b0ad77ae9ffae29fc6af4be723c2f3771024b07a9e5186cee313def6605b7c9ded3129e51439b4c0958e8b2dba193e", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634890549, "uuid": "c71656e3-31bf-4e14-a037-37401512fe4f", "value": "T11241F2141AEA0319C3B3CF3538FAB256897ABE429D835F5E808487CF1861150EC36D6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634890549, "uuid": "5359b16e-af3d-494e-9814-2fac69f402e6", "value": "48:8+uH+M+LB540dj48VEgCe1cIXv3KaIqiHkb6NS6:8+ueFLB5BdVEgF1cGvKdEbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634890549, "uuid": "b505c005-3d3b-4727-b091-f2ffdacc8b44", "value": 2052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634890549, "uuid": "011a997b-902c-47f4-874f-75d92efefbac", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634890549, "uuid": "59bbb13d-3dd6-4988-97f3-6272d8ba8f6d", "value": "foto.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60f5022e-32da-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634867405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634867405, "uuid": "d5f35dd5-dbcc-4fde-be4f-ec0c3647044b", "comment": "Malware payload (Mirai)", "value": "bc4e8e8a02322acf69e9d6c7aeae24ac", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634867405, "uuid": "2a32bb95-9cf9-4c79-b238-9adc54bf7963", "comment": "Malware payload (Mirai)", "value": "0bdea67ea6f0816620adc2c8a374c5801160f16c31c7d71d49ebb2167670bc65", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634867405, "uuid": "d7212e78-1f06-4982-9a70-d9597ed9302b", "comment": "Malware payload (Mirai)", "value": "655684bc391b770fae3e470eac7a333e93730489", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634867405, "uuid": "2a80769d-d278-4a6a-8086-4a40f7ce7206", "comment": "Malware payload (Mirai)", "value": "623fe68e05c33bfad0545d0b97b2f6702bbba86fc462cd1170a741e1fd7c5e14839785d1f5007c6c21978d41f11eba55", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634867405, "uuid": "7010f172-547c-42e0-95dd-8a5d4afbe4e9", "value": "T161C32B46EA408B13C5D61777FAAF41463322DB5493DB330689285FF43F87A9E0E67A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634867405, "uuid": "83daf79c-6e03-4b9a-bf49-4692c0cd590e", "value": "3072:v8PXmy9MVoJXM9fN30yDShgFKeqBNXCwrM/9Jwu/:EPXmy9MjT0yDShg4eQXCMM/9Jwu/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634867405, "uuid": "1a911447-9bbc-4bdb-9e5e-fb5f7841603f", "value": 128880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634867405, "uuid": "a61ebd89-c070-45ea-8736-c402bdca2617", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634867405, "uuid": "00448c7c-a2d8-4443-82de-04f87873068b", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "989d6df6-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928057, "uuid": "100cd601-46ff-4eba-881d-64f2addb9995", "comment": "Malware payload (RedLineStealer)", "value": "82c30c5245cb362a5a7145e8eb2129a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928057, "uuid": "a0cf77a5-aa5a-493a-afdf-aabab6086892", "comment": "Malware payload (RedLineStealer)", "value": "0c5226715df246c43e1abaf27854ccaa3db89e37c9d412f6d19dd14bf97c7ac0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928057, "uuid": "97d959f0-5351-4074-9a2d-602ce4bf0ae5", "comment": "Malware payload (RedLineStealer)", "value": "0d770542d1e7b24322703084e488a1d9b6266060", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928057, "uuid": "3d25c7e6-f4e6-40b0-a6f3-07a60d294f6c", "comment": "Malware payload (RedLineStealer)", "value": "4ad21c2ae621a36dc02285ed1dc3b9dded2c8b85bafc957181ecbc642603253833e19a341143ab7ce9f012d5452bd671", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928057, "uuid": "e3c36187-068f-4139-bb41-de88f75e069b", "value": "T113E4F110BA90C035F6B312F84A7A936CB92E7FA16B2414CB52E516EF5B346E1ED31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928057, "uuid": "cc35708d-5ea3-4ee9-aee3-8a611f5a71ff", "value": "0aa8675e96bbc2351e2af940f447c93e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928057, "uuid": "0996f9b9-2615-43a8-a9a7-2dfcff721550", "value": "12288:GudMLr0OYj0pSAAQr9jyJXZNknGFgzXSL7fFUXvap96usCOmz:pdY4OEarAQO/+PXeTKXvskm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928057, "uuid": "8513e6fb-f35b-4f36-a7fb-049e96fc7198", "value": 669184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928057, "uuid": "16e4136e-3fbd-4c8c-99fa-bd4d7fe1fa5f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928057, "uuid": "a7dada2e-1aad-477b-baf1-ad1e85703a3e", "value": "82c30c5245cb362a5a7145e8eb2129a0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "250b588c-3320-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634897369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897369, "uuid": "88d2076a-1dac-418b-b976-e51def8117f0", "comment": "Malware payload (Loki)", "value": "47043f8c2028666aef46e8964a21df7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897369, "uuid": "492e28fc-f349-4a6d-a75e-eec8ad8f5074", "comment": "Malware payload (Loki)", "value": "0ce3973ea9753623ddefa07e57ab2549971425741b7292675df1c093fffb6fc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897369, "uuid": "5efc2d8c-c0bd-4f69-b9b8-c80de2ae353d", "comment": "Malware payload (Loki)", "value": "859c5e83cbd2833024d479e6b50dd5c1ce139f1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897369, "uuid": "17208502-bad5-4bd2-9196-62423a9bc131", "comment": "Malware payload (Loki)", "value": "32d9a87239aaf1279f1f5f8ab825cfbdd6d74dc0bf0e17fc00c5a7a02e536b80de36a2bca472b19a1ba3fbb23c4b406f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897369, "uuid": "aebebc44-c884-4208-8ade-c2b86a9793d3", "value": "T1C7548D10BAA0C035F5F316F859BA93ACA93E7AA16B2454CF52D526EE47346E0FC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897369, "uuid": "9d2cf126-f087-42ac-83eb-cce898c3b327", "value": "0aa8675e96bbc2351e2af940f447c93e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897369, "uuid": "945a20c9-5113-48a5-b7b3-52b785bc7e02", "value": "6144:tn0rrQny760ttSGlvM5KvoDYlDpRkEH0t3vRis2f:t0HANkUwvW+Rk2S3vRi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634897369, "uuid": "0041f766-8013-44df-8c4f-3d0f14f2a8d8", "value": 291328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634897369, "uuid": "c5d31f83-f071-4543-bf0f-e9437a88b88a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897369, "uuid": "d1867bb8-923b-4eb2-8649-cdf43bc30fad", "value": "47043f8c2028666aef46e8964a21df7d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b7b0fe2-330e-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634889729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889729, "uuid": "f2809c0b-771b-428f-9b7b-abb62e37fc88", "comment": "Malware payload (Formbook)", "value": "7fdd0537a9ae0991bcc88f1f2dd00eac", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889729, "uuid": "1b6b5675-4fe3-49a0-bdaf-793119563b67", "comment": "Malware payload (Formbook)", "value": "0dbdef9174ac0c1e1667bcc6f207f7ff14f35889028e266a579745c5d6790e60", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889729, "uuid": "fcc9f2de-3e95-4130-9ff8-17104cb9b33e", "comment": "Malware payload (Formbook)", "value": "82e6cb68ff3c222186048c551d2908d2f374b40b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889729, "uuid": "a96bb753-cebd-4142-8d6b-8613cc42df18", "comment": "Malware payload (Formbook)", "value": "5cd1dd4a5fd6f199eca15b504c231bf0a1b23af8aa05e4469d9341c0591a6aa926b5d804fbb2cd6d2726aeb5b383141d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889729, "uuid": "faace638-d651-44f1-a7f9-3d955fc63ea7", "value": "T15874C0ED72D86D52DC61257AE58A8CC9BEA86C2396C01F7B5363BF63607E3040543E89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889729, "uuid": "d493b9ca-40d2-4a0e-b584-88812cff595c", "value": "6144:XQQt1sfSbDet+Xz+jZSZI3t0Nm4jiTawhpl1Qyg1SFlCiD3vNPLPHTpDNr/:6SnHX8ZS6t4hwzvQygwFlDDfRzBND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634889729, "uuid": "72d3b482-e9d5-4b58-a86c-8d162c1a5d53", "value": 369144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634889729, "uuid": "e5276c3f-e762-4d53-b52a-bc947479cb59", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889729, "uuid": "ea93e5dc-5c69-4d14-acda-d07b5a30c200", "value": "draft shipping docs CI+PL.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30183ac7-3322-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634898247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634898247, "uuid": "4404094d-98d4-46dd-86c3-3f848818e4a7", "comment": "Malware payload (Formbook)", "value": "d4be4730ee0e801938ae40b02b5ec346", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634898247, "uuid": "cd594a54-6641-4bbc-ac64-ed086b13d72e", "comment": "Malware payload (Formbook)", "value": "0e6c644f1252507e018b0fbe6b83902adcd2278a083fe1902092f627babf3711", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634898247, "uuid": "c367b01e-1db5-47bc-8041-72185bf9d54b", "comment": "Malware payload (Formbook)", "value": "5a36a50fe19f08f5c34db24127b43bdceb85bb42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634898247, "uuid": "cf409e4d-4b6a-4317-9b04-7fa66f0a9302", "comment": "Malware payload (Formbook)", "value": "b61dd71a725ccdca71b499ae579ccfbca580cdd6d6e30e642b284cd6ed8e6327e94b6c55d8eedda38625fef4517a695d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634898247, "uuid": "f8367348-1644-4d84-a237-e55d69535811", "value": "T12CF4ADB93111BACECA2BAD7289502D50BF607C77471FD20BA457319A99FE496CF304E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634898247, "uuid": "4811001d-dd17-40ac-b151-b256686b5f14", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634898247, "uuid": "3d3cbcc7-d652-40a9-adbc-c9401d2e2598", "value": "12288:FPIbw8eG5KB21407XO6mfhk3EfJbFZEHkRO6i8kzXqJFTPXWBJG5vaQAy:qbw8eG56214WYHEHY18zXqTo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634898247, "uuid": "bafd02f0-9482-4086-a2d3-98c0e6a1bbd8", "value": 724480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634898247, "uuid": "5103bf38-5f6e-468f-bd45-d9005a518cf4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634898247, "uuid": "dcb226f0-5075-4760-96d6-186720d9eda7", "value": "Payment receipt.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f37658e-332e-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634903560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634903560, "uuid": "d04fa018-8caa-4993-8712-9e1631cc436c", "comment": "Malware payload (Loki)", "value": "330613d5721a15d2651601e5e210c678", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634903560, "uuid": "0072d8a7-d146-4cb6-91aa-c458ebc6092d", "comment": "Malware payload (Loki)", "value": "0fa8577fe39341b7a5ee9c4fcb1e1b1cdef037fe71fcda4b03da5317f86b41d7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634903560, "uuid": "f0414770-cfd0-4e59-875a-94363e1cfce1", "comment": "Malware payload (Loki)", "value": "c66d23565c4308c5902e5b04cc7c4a014acaae42", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634903560, "uuid": "4859b984-7758-447f-97ed-29ef94d506a3", "comment": "Malware payload (Loki)", "value": "433d2fc00f09d1c9a4954d857e7d133e65dda356f2f90b97da72c24d783230974567e49943ee8cbad84dc4cc3ac0200d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634903560, "uuid": "5be5b7fe-94d2-446d-9a9e-9f2dd976f3da", "value": "T146746C00A691C039F5F316F48ABA936CA52E7EE16B2450CF53D52AEE57356E0EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634903560, "uuid": "32981765-276c-4246-a807-68d5e36122b9", "value": "4af4742906d30c7889c195169379a2f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634903560, "uuid": "47c31d88-6e2a-41ad-8899-86685de65961", "value": "6144:GfBdf0g1zuV0S/PChACRMTMMLVr6xgmmuYUdXu+4W2jDF/4cQpmhdlt:Gpdf0g1z7MChACRUdNKmuYUdXu+CjDFo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634903560, "uuid": "c2ebc40c-e28f-4d3c-9349-6633b8efa0d9", "value": 352256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634903560, "uuid": "55243c5e-077e-44c9-b1e7-f679232ebd3e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634903560, "uuid": "b5bbdbfd-2a69-4394-a9b4-55f32eee7384", "value": "330613d5721a15d2651601e5e210c678", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0642c2ab-3368-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1634928241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928241, "uuid": "d89c6c43-5b1a-4205-8250-7f99a14fedf7", "comment": "Malware payload (RaccoonStealer)", "value": "98b15cf42082a0f58b2e0183478b64a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928241, "uuid": "28500474-88e9-4e9f-8b63-1085da8d6318", "comment": "Malware payload (RaccoonStealer)", "value": "118d0ce35d4f5528b2883f244355ff9cee93dcc8ca25bdd9a121f503df979e61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928241, "uuid": "ea78c84d-4d81-40d2-b3a2-2ef097ab4369", "comment": "Malware payload (RaccoonStealer)", "value": "fa62eaacda5309a82f31c5ddcac8484ca361e787", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928241, "uuid": "5d7018f9-4612-40eb-a22b-3481b4e96160", "comment": "Malware payload (RaccoonStealer)", "value": "3968b64205910910937cbcbf272a9a01ff935bece6bfa9bec38d9a7a1c2e21dcea7657d168ff961c08b28cd4133172ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928241, "uuid": "5575f7cc-ecaf-432d-86ec-4ff25b85ffcb", "value": "T10B746D10B6A0C039F5F316F44ABA9368A52E7EE16B2450CF53D52AEE47346E1EC3171B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928241, "uuid": "5dd2f1ef-c1fe-496e-81b9-1566b070915f", "value": "85b11e7df91b461ff7ceddce26982802", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928241, "uuid": "bd7594cf-ea36-4a72-b770-0ae1d866b846", "value": "6144:Rpxb5EWvU3cOMNTzNSg/dGpjhV16iRiaDHPYCvNIYW4QfhOy0maqDNG:R7aWDLNTzNSg0FbJR9DHPYkK4QJOyLak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928241, "uuid": "6542d338-e2bd-4a09-8daa-54379df4f55e", "value": 352768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928241, "uuid": "d84d5995-6003-4458-a42d-6402a4e79754", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928241, "uuid": "6bd126d1-e6cb-49c5-8c0d-408439324363", "value": "98b15cf42082a0f58b2e0183478b64a2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d9e70df-3368-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928253, "uuid": "eeb17f8b-141d-4497-977d-c55d22c98fb9", "comment": "Malware payload (RedLineStealer)", "value": "fccc2d1f5a2a6798d57b3d469e2fca53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928253, "uuid": "f1cbb5a0-322d-4da6-ac4d-3930aa36269a", "comment": "Malware payload (RedLineStealer)", "value": "118eeadc553951941e5dbd7b4d62a19e3406491bf55ae44f27ce9e25f12b91c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928253, "uuid": "0a1b3b48-931d-4690-8eb6-8a1183e19371", "comment": "Malware payload (RedLineStealer)", "value": "362fcdeca96efbc579da45e0c4cbc562ec7f76ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928253, "uuid": "2cbea03b-3f24-4cd7-be45-d7643f2c0811", "comment": "Malware payload (RedLineStealer)", "value": "ccec166d6473c84b39e98a79c623f3cfe36902600e61fd04d7d4c8db36444669969d2b6148fb98b51fd1af6c94ed255a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928253, "uuid": "90e0f2fa-4418-40a1-81d2-1f507bdb132c", "value": "T194A4BF00A661C039F1B362F44ABA9368A52E7EE15B2454CF53E52AEE57356F1FC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928253, "uuid": "e34fcf12-4275-43e4-9541-5eda18f4ff59", "value": "85b11e7df91b461ff7ceddce26982802", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928253, "uuid": "4d2a9a8b-6be4-4900-8df4-8e8e4d322098", "value": "12288:iBm0n4cdPaRwpunDuD1mvG97jmR7MUWOzQ:iBnDdiepunggYjw7MZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928253, "uuid": "ae1ecdfd-64e6-44bf-885a-c67a1fe08a43", "value": 462848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928253, "uuid": "b963932a-bdb9-4b0f-84bc-3684f6499e00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928253, "uuid": "d63b3c43-8f4c-4f52-a4d1-4944b2546886", "value": "fccc2d1f5a2a6798d57b3d469e2fca53.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb408a5a-330d-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634889487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889487, "uuid": "bb06d4bf-07d4-4a4a-8ac4-b5dbf5be1dd6", "comment": "Malware payload (Formbook)", "value": "6723436f41c244e51c613bf9f894a7a2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889487, "uuid": "403635e6-f039-4183-9ff4-5ecb57c1810c", "comment": "Malware payload (Formbook)", "value": "11ec60047b8e150e808e77bd374fde3668bd0bca79008a443ce4272d0bcbf3a6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889487, "uuid": "a68ed2fd-8ba5-406d-ab2c-38c5cb95f7cd", "comment": "Malware payload (Formbook)", "value": "2505960ad7b906eac3759a579c1d827c32df7332", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889487, "uuid": "fef89350-8417-41cd-bd40-86b3d7920e52", "comment": "Malware payload (Formbook)", "value": "0eda0de5e2d956aff9d95c9d43ffa6dd3c3ece08c231679f11aaf1eeaf9ab28709e4a1076f621a1c9649c7f6e06da610", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889487, "uuid": "fef59a3a-e3b4-4657-a390-03462023cb9c", "value": "T17694E276185DE3B7E0B5A571B80FD27160AEFDDC2230E00B2A5C3E6505F83D8999A79C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889487, "uuid": "54dd735f-1bca-4df1-a6da-b6d2b1d1d34b", "value": "6144:PpaMCo3vdWV+1PJc5RwjtQrKRzb+j1Jd0jSLIiDlbKEzQLTeOp3z45gvC:RjCqvkV+li5RaO2lSj1DtJQLTesD45p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634889487, "uuid": "a0051937-3c11-4f43-b4cb-5054590a4864", "value": 417128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634889487, "uuid": "f49e3909-f767-4f99-a252-16b618ccc53c", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889487, "uuid": "e0268e99-b9ba-4060-ba07-1d3037f4908b", "value": "Copy of Packing list.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7b6a885-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634928190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928190, "uuid": "a535ab59-0ec8-4529-b269-6558762f1f01", "comment": "Malware payload (Loki)", "value": "04903d0a9314c3a92fa42fb88e88b7fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928190, "uuid": "d57d77e3-8cf9-4f3a-b290-28f270cb5a35", "comment": "Malware payload (Loki)", "value": "137fcdfb8f41337b01321e186b35a1dfd83cf9de85aaa0c3e72d60a1134b9e16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928190, "uuid": "34dd8a83-28ab-41e7-bfc1-0cdd161eda33", "comment": "Malware payload (Loki)", "value": "12ed047bc81459792fdbc8c16bc91fdd3a32df02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928190, "uuid": "e064d38f-beda-4c4e-8c1b-07389e504071", "comment": "Malware payload (Loki)", "value": "c42b9b7883cf91097986189d965ca477d57ddeea76f9180a597ffb742c3a536a4e2f8d6795d5fc0fcdb0781727a212eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928190, "uuid": "78350b2c-06a4-4781-bd56-14fc05f129a7", "value": "T103D44ABC3154BD9FC85B8F3545545C24A51268AB034FF31370A729DA8FAEBD69E002EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928190, "uuid": "c6034ab0-dee3-44cf-90dc-966a7b6b09c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928190, "uuid": "2c022177-bbf7-4cb0-93fc-8b3fad159e84", "value": "12288:ErplpzDGW4187Y0XorCRaeYwKPLCV34wDRnN+q8SaAaieiE0RCdG:ErplUlOYcYMwxI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928190, "uuid": "86dcdc79-1988-40dd-b08f-b4ffe749a484", "value": 628736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928190, "uuid": "18d49369-45a9-47cc-a5ee-eb88f22f13a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928190, "uuid": "fcb201f5-6c6f-4ee7-8047-f721697967ce", "value": "04903d0a9314c3a92fa42fb88e88b7fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88a47eba-335e-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634924165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634924165, "uuid": "44beb564-f34e-4ada-aa14-f687e6088890", "comment": "Malware payload (RedLineStealer)", "value": "95e82a0b2a99370162fa203994cc8b0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634924165, "uuid": "7bda41b3-5b21-491d-b130-9a531f5631a5", "comment": "Malware payload (RedLineStealer)", "value": "139c83b8cf3674d992e04f9e4a047c3a7ad5279b2f6b8bf18c39603f82bca16d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634924165, "uuid": "aec2acc7-5868-4105-9a3d-108bc20afbb5", "comment": "Malware payload (RedLineStealer)", "value": "807f363607e6808b1cb7504de1ef9718343bd2cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634924165, "uuid": "b87b2255-be81-4c60-ad05-d7c66af5d5da", "comment": "Malware payload (RedLineStealer)", "value": "0697c1ffb7e2a6d69a8bad8ce7ae85693fb96cd587e1550b513273f9393096b68622e22c6d649306cf1567c8b1eddd1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634924165, "uuid": "6848eb42-5678-4705-88f4-d0c81dea48ba", "value": "T16F26122721610151E4E58C36C83BFEF571F61A764F82ACFF16D96DC62B325E0B222A53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634924165, "uuid": "3bcf652c-60d1-4a65-bec1-56eb54fef68d", "value": "908bea7ee71339f1c35ba419da3ba679", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634924165, "uuid": "a42d8dc6-c8be-4c35-a8b4-22750b28a3da", "value": "98304:wLIgXzEGmyPe4pTQAXf8bTAbqKRf4fRDpvX4:sdpT5XpeEf4fRl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634924165, "uuid": "4d1b303e-27cc-4e19-b6d1-456f8ae3cec9", "value": 4790784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634924165, "uuid": "f5b60aef-1b00-410d-918e-58485229ebdb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634924165, "uuid": "eadcfdf7-ccdd-4876-b204-3b86040b9be8", "value": "Injector.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "560a46fb-32ff-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634883278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634883278, "uuid": "f8deb39d-43aa-4bb1-a438-31618b7986d8", "comment": "Malware payload (AgentTesla)", "value": "5f1a5b9f4fda1483f9409035d19a270f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634883278, "uuid": "4bc718fa-41b7-434e-9611-8b450f94c90a", "comment": "Malware payload (AgentTesla)", "value": "141f6635e9a73f078448f505b92eeb333ce841e4ce781995b75844e448ece1a6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634883278, "uuid": "82fa1f18-7770-4f01-9c30-b820aa9b9b9e", "comment": "Malware payload (AgentTesla)", "value": "3fa2c9986bb4b99853126ab5591cc6d35ad3489a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634883278, "uuid": "64587cd9-c95e-4951-b310-a65a45ce8d80", "comment": "Malware payload (AgentTesla)", "value": "16750ae9db01572716e671ed2030ab0e90b2bd1fe62b6c6bc685e22f0535a5173c21d2b8ea95d6b9bc38a7a3d0884f04", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634883278, "uuid": "cf7674d2-c76d-45d3-ad3f-bcf99eb31a40", "value": "T15CC48B0432B85B11D9BAABF01631590493BB7DAE243DE60D0EDE75CA0F77B408A65F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634883278, "uuid": "8f4ba8c0-2d0a-4dcd-9374-483bbcefc583", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634883278, "uuid": "8aeb5f6d-e057-4c9b-97b2-f69e7b6c9b9e", "value": "12288:38yQ4RkOVwJ7v7U2knCWVQdx+i3+70Ky7KTBiOva:38yhJVwt7Bl+i3+70LUBB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634883278, "uuid": "ba56f99d-e3e4-49a3-949a-6b9b4fb54c5a", "value": 561152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634883278, "uuid": "9ea61215-ec6a-41b4-9314-55723e59349c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634883278, "uuid": "91fa1ecc-5a68-4ef8-9c77-8f9752f76fc6", "value": "SecuriteInfo.com.Virus.Win32.Save.a.26073.7406", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff24a31b-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1634928229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928229, "uuid": "d033745b-d800-4fb2-aaa4-4c214af623c6", "comment": "Malware payload (njrat)", "value": "af5498fc7e4948739f2320fdd8cc7dc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928229, "uuid": "96132213-c2e8-41fe-b910-5e101f68894f", "comment": "Malware payload (njrat)", "value": "1424f40ca88848f45446ad55cc6afe2f929339b7e239389818a1ce8bbaa1580d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928229, "uuid": "8b0a9679-c8af-417c-8d17-5eba8f0eec9f", "comment": "Malware payload (njrat)", "value": "3aa3c8c4126f60c4d1c2234feb03c62aaa9611a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928229, "uuid": "a03a0e11-5404-4aa6-aa3c-4c7a07318c7c", "comment": "Malware payload (njrat)", "value": "fe9a7189a32700e136a4adc2844baa9beb288233889ae6b585f9ea34819d04e103613cb325ad3643c4252445858fd7fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928229, "uuid": "e67ae56b-9b6f-4e20-bc4f-fcea4c322bb3", "value": "T16FB2290E3FA98856C5BC1B7486A5965003B491870413EE2FCDC564CBAFB3BD92D4CAF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928229, "uuid": "a453cac7-47ae-43f8-9d9c-3c19b84e9e31", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928229, "uuid": "cf909699-1273-4b60-8b1b-1693a3646708", "value": "384:l/MKFYuEEhERvoBG16Xuy0MHNw6Tg1Y+75JTFmRvR6JZlbw8hqIusZzZcK:lUW4V6+yDRpcnus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928229, "uuid": "099d7470-3090-4b55-a75b-1d7d1c832e2b", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928229, "uuid": "b0e7951e-f93a-4436-8453-502fce70dc00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928229, "uuid": "538c3807-9c79-4502-8bdb-aa65022913cc", "value": "af5498fc7e4948739f2320fdd8cc7dc5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8d04057-3339-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634908462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634908462, "uuid": "949b2ce3-ccad-44f5-99f7-6c3a5b806604", "comment": "Malware payload (AgentTesla)", "value": "8a3847f7d153e1ac19d9a530abc2b6e3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634908462, "uuid": "f31b1c7a-c7ff-427b-a92e-d753029ea1d1", "comment": "Malware payload (AgentTesla)", "value": "1444e0357cb44d15a7037fa38f19977f5e1d12b6eb516aa2af67efd44b9b9a9c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634908462, "uuid": "b8640585-82e2-4afc-ac56-12fb50525f45", "comment": "Malware payload (AgentTesla)", "value": "98962852fa6b0102fd15a3599550576b62fc2ddf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634908462, "uuid": "c51e7b67-b9cb-4a95-b12e-2e4d5e4cdb64", "comment": "Malware payload (AgentTesla)", "value": "80b94195690d239213b1b36737481902411517700029dd86e34003d51102397e9f08f1d58b47064a1b46795942e8166c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634908462, "uuid": "d95430ae-1102-4e00-9d71-774e3fa967e3", "value": "T13BC49C0436B95B02E5BAABF40631494093BB7DAE143DE60E1EEE34CA1F77B444A51F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634908462, "uuid": "84f64b1e-cdc5-4b27-a88d-ce4c2deac313", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634908462, "uuid": "ca00992f-9712-4e8a-a72a-b4ba68de5916", "value": "6144:JGxhL8mMIrNvxbosyyouw0/hLu3EbDPeXhlMxDCQRknEBTKYhSAjazE3WHeUO68a:4/D9GsyyoyJLQgKXhWJTJhSAFdY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634908462, "uuid": "b76acdbb-7f0f-41bb-8aed-e431d288319c", "value": 570368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634908462, "uuid": "b55b3af3-cba3-446f-ba48-f4fda476401c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634908462, "uuid": "1b4fd7cb-7dc0-4e35-85f6-3bfd25acab50", "value": "VIFON PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bf915e4-3301-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634884066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634884066, "uuid": "3fdaea30-1fa5-4be8-8465-75c9670123f3", "comment": "Malware payload", "value": "a1814d6bde4ae0a31aebd13400c86ac6", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634884066, "uuid": "27610c29-f1df-45c4-b053-7d1328198738", "comment": "Malware payload", "value": "150349d3da0b87df67786f2b449d4675e82fd4611bb045703099ef78e8f99a21", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634884066, "uuid": "6de03376-4a69-4ab9-ae1d-439c555eed4c", "comment": "Malware payload", "value": "c73d3a377443733e99f729ea9b2e6cc56d1a6957", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634884066, "uuid": "7ed964c3-b614-488e-b6c0-3b4f202151fd", "comment": "Malware payload", "value": "86ead96fdafad73fd9b66271f79e26814cfc1ea51320a919c9dbfc645d4ece82fe5747d13ecb619191f66a87c0735437", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634884066, "uuid": "3fd58956-3488-45ec-b7c9-938ee94c2596", "value": "T16F942370CDA04AA8FA1D79F726AFB99832DFFDD873779420F116B20DCD18616A005692", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634884066, "uuid": "06c64057-ec8d-499e-b902-e1c1e14a185f", "value": "12288:ZLWxcz9qBPle2y3ODDZ4PftTV/RtTpqrebakla61:x2EiPleUKXtTt3VqmaUV1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634884066, "uuid": "5ee8e32e-8645-413e-b5f0-ab67a252fc81", "value": 435865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634884066, "uuid": "87f78d3c-21b5-42ca-81aa-bc24f5ca2c74", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634884066, "uuid": "10e3f521-b85e-44f6-8c62-a89316a97e0a", "value": "GOD LOVES A CHAREFUL GIVER.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c9d9378-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928010, "uuid": "ff679a97-bef0-4ec7-a8f0-3d0381603d4f", "comment": "Malware payload (RedLineStealer)", "value": "3f8362dfa319a1f316d9320d5e6bdf55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928010, "uuid": "8abc5d0a-8182-411d-a3ca-84647b30460f", "comment": "Malware payload (RedLineStealer)", "value": "15d012d4d2aecbb5c8d3ad2de3d15bf3856d0b04e9fcf1a631ffa85a05060f2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928010, "uuid": "ee56e683-9883-4e30-927c-55a79f2863c7", "comment": "Malware payload (RedLineStealer)", "value": "c5fc01cdfc8f3aff2b932141e986433f5cad7188", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928010, "uuid": "14bc7883-f0f7-403b-8586-fe0d8c20c5cc", "comment": "Malware payload (RedLineStealer)", "value": "7624226646fe018494e51d5ee52bf62eb1d4f05103a3957c7fe9e60b966157ebc05e6841ce3963d70678c4cd5b36b05d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928010, "uuid": "a8bb784f-76f3-4413-8c48-7ee0cf02944c", "value": "T13BF3F1533AD46E83E7331E70A7F4C58E7EB4E3C34452E95969A0E1915D937C08BA0B3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928010, "uuid": "3e5673d1-dc97-49f2-9add-a131780639ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928010, "uuid": "65cd1ef1-0b06-4a69-b8b1-b01650a44959", "value": "3072:fa8e/PUXPyuad2ZQixAYZCOmwTGkDA6ZdstGymhzEG6:r2UyhdK5AWmwTGeZdstGyx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928010, "uuid": "a1cf3a68-c093-4107-bf1c-9aa48718d0fc", "value": 159648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928010, "uuid": "a9547169-e1bd-46f3-ad34-2ee51e1df723", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928010, "uuid": "aaba3a16-ff68-4a96-b174-c3732ed5d807", "value": "3f8362dfa319a1f316d9320d5e6bdf55.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b372edc-32ec-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634875099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634875099, "uuid": "9de35c7c-563a-498d-9e55-73582860c299", "comment": "Malware payload (Gafgyt)", "value": "f1f0d3d4473db24e2511b10e934fc311", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634875099, "uuid": "98e8b03d-6efe-4760-ba3d-f9e0e97ad691", "comment": "Malware payload (Gafgyt)", "value": "1849ea8715a2faff85da759578fcef573c7e6a403069f5700b79dc6adb139c77", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634875099, "uuid": "d69ada6e-3625-453a-a137-37e74004a4f1", "comment": "Malware payload (Gafgyt)", "value": "6d9baec84594edd5ebacfe4696349e3a04642163", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634875099, "uuid": "574fdd5f-c56d-478d-b046-f0c047fd9e67", "comment": "Malware payload (Gafgyt)", "value": "ef02aaad67b00db0d9b877a87b761796f44174a1e4a3e44d59cfe85a48f22347df8101a5a5d46dc50cc0b186b178ae78", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634875099, "uuid": "4299c413-668d-4338-9c7c-85b794783e89", "value": "T1AB931A41F9408B27C2D227B7E78F439D37366A54A7DB330269257EB42BC279D2E39520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634875099, "uuid": "a6831d28-c19d-4ae8-baf8-8602df42a0e3", "value": "1536:EIkg9VQPAWeMTEb82Mm3xDKMsF0rOLcvoNPzRxQMpy2SjmokCmCVrQAFW9OXkYe:dQaMTDWWFGoNPX5SmCmCVrQAFiOXkYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634875099, "uuid": "8d047b63-f8b4-4516-9e3e-1d3c732b85f9", "value": 97538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634875099, "uuid": "4e3314b7-9975-401f-bfc8-b708898cb552", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634875099, "uuid": "283c1f14-c62b-4795-9c52-2f38b922c5b4", "value": "f1f0d3d4473db24e2511b10e934fc311", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f432d883-32fa-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634881396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634881396, "uuid": "1584aa97-3b99-43f1-ace5-d6d2761cd755", "comment": "Malware payload (Formbook)", "value": "994a2d143c5619a11906c87244855858", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634881396, "uuid": "9fe0ef96-bbd8-46f1-a811-c426e47d6f87", "comment": "Malware payload (Formbook)", "value": "19b95be1b0c890804845c8c6e19cef972c89bfc8156201c3490f047ebfc42ed4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634881396, "uuid": "aa7fe8f9-e8cb-44e9-8d77-76200a8e9dd8", "comment": "Malware payload (Formbook)", "value": "dc6c06fb2c1acf3164db514878209ec6aec95cac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634881396, "uuid": "9c23df5b-864a-4630-986c-d59c3f964092", "comment": "Malware payload (Formbook)", "value": "8cb07f71892144ac88d69e31d927ea1dc6fe5d045e268eabcd85bacdc8b6c39a508b84b256335e91d7559e8bda4896ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634881396, "uuid": "948a93e2-c4e4-4f41-81bb-997b3343387b", "value": "T18D25AE71A1C405B6E4263D7CA876797E893B7F243DE865095FD8FD4A2FBA3C32421482", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634881396, "uuid": "270e3e14-a6f4-47a0-b07b-c031cea46d91", "value": "ac55f6686b1348553fd9b5d485943699", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634881396, "uuid": "a7c63078-acf9-44ca-9aa6-862b1189e44e", "value": "12288:fDug7DeIhyEzPsO4z+oxMOQWHphA3hHx8rkRZQ9XYBk9NAOe6k1+hO/O5N8DoQTD:rt7JhyEz0O4z+OQK79HHQT2ODA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634881396, "uuid": "b740ef0c-fe50-4ca5-b40f-9e4309d123e3", "value": 996352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634881396, "uuid": "8e1dccfc-2264-41cc-955e-b17884a73113", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634881396, "uuid": "ebaac87f-a7fd-4941-8fac-74f9eff13f18", "value": "Docs No-65224XXX [ORDER-2021].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1acf4c1f-334e-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634917109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634917109, "uuid": "47ba59bc-bbbc-4a3c-a775-3bdbf2156620", "comment": "Malware payload (RedLineStealer)", "value": "0bd4dae28b60c106ca2bf9da5e0e55a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634917109, "uuid": "0e6436dc-fa12-44c2-8c2e-5df24b231fb3", "comment": "Malware payload (RedLineStealer)", "value": "1b67816993c0da768b996b377f214fcffe8e831e98bcae28ca1f87c8204ad358", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634917109, "uuid": "480ce3be-700c-4634-b7c9-84b43442d3ce", "comment": "Malware payload (RedLineStealer)", "value": "5a699e5c535e56028a901d3b34175db68c369d97", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634917109, "uuid": "973795c0-90e2-4d53-94dc-32f5080615e8", "comment": "Malware payload (RedLineStealer)", "value": "658f1274cfd84d9aba50b4246dc7cc0e34760525460db239d91c285dc8d606527f111b0b11dfc88d87e89272f9024549", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634917109, "uuid": "c22f7705-ebcd-41f0-830d-6db346fdc57d", "value": "T18A842328647FC05940E3EEA52EDCA8FBD99A95E3640C743701B4A33B8B51B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634917109, "uuid": "5839548f-b3c4-4d91-8a11-05e3a9a3efaf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634917109, "uuid": "1e732983-9da6-42e7-91f7-ef1e0176c7de", "value": "6144:G29XY1Hq1AlaqaoAVzfeOHavspTulZfW4OcjmvXZjSxa:t9XCHeAlaqaohOHavspTulZfW4Ocjmv7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634917109, "uuid": "525a5935-7d3b-4822-9310-ddc87ec2b380", "value": 392192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634917109, "uuid": "03ae586d-3c67-4345-98f7-18da87b1a5d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634917109, "uuid": "f768b10a-2978-4510-9f84-98013e84a2fb", "value": "0bd4dae28b60c106ca2bf9da5e0e55a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ea1d11b-335c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634923262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634923262, "uuid": "b6b79013-420d-44b6-bf66-be8999b22e1f", "comment": "Malware payload", "value": "f869be235ac0196ca99e14cc06486306", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634923262, "uuid": "467ae268-1671-4ab8-8d5f-db106e8c800f", "comment": "Malware payload", "value": "1b69a8362748d0d810262dd461bdb1bb778273f2760071bc773fe98b4f510cb4", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634923262, "uuid": "dc47646f-2f6c-4a5c-aee0-8cfa32b20b3b", "comment": "Malware payload", "value": "2bfd9a48321eef1e2458caf1559080aa213cadf4", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634923262, "uuid": "8110765c-215a-47f0-bcc2-12cb74bca27c", "comment": "Malware payload", "value": "00ba3f9d2924b521a90d9b9ac959fc8fcc1fc77195dbf18f55ab01c0fdc54d4f8c8e26391a07c11dae59c025137dff91", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634923262, "uuid": "76d31ce5-dd77-4047-9f0d-c3c1d80f8c0f", "value": "T1A7F2E139E640E924C7A299BDE15101F5E92CC500A05ADC2EA860F7DE4F3576392BFA2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634923262, "uuid": "b275f2c5-75fc-4aa1-a012-ce4ef299c14f", "value": "768:Ed1EEUpGCoflm802VWnZdw9822zGetDGU/:Ep+GCnNcWwkHta2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634923262, "uuid": "3463b00b-f631-4965-9161-b1ea0e941410", "value": 35208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634923262, "uuid": "948f413c-6b7a-444f-9b8b-9d0fdfa8af57", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634923262, "uuid": "5dec73f2-9d17-4328-ab0f-e122dd55edb2", "value": "documents.010.21.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5db62714-3310-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634890592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634890592, "uuid": "0d78c9f2-036b-43ef-b983-d57fa2299068", "comment": "Malware payload (Loki)", "value": "96a06bd1e7c9ae4ba6e0ef63653be945", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634890592, "uuid": "fdf20dec-820f-453e-bc98-036f342b6a19", "comment": "Malware payload (Loki)", "value": "1ca84618d7bdd56ff4c7f1748601f1de735026d411010cebb343d7f2b568a1b6", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634890592, "uuid": "85ccbb91-30c7-4913-9b7c-656cc32395eb", "comment": "Malware payload (Loki)", "value": "a687d04a52f15e3a444852d9ce41fc3ed168b0c7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634890592, "uuid": "6d4d4677-e592-467d-8f1b-3e65088545e4", "comment": "Malware payload (Loki)", "value": "1fcba545aad9997e6e30372db714306407dd2cd06c40a1d4c2a51df4b26ff21b679b16327b5d23ee0c45518ab48d8548", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634890592, "uuid": "3224aa12-4734-4e20-9fdb-f2f7daac0ab2", "value": "T180227D2CC65CE909E112183DD01A52F9F76D406AE613B82F204573CD4FA16C387CA6AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634890592, "uuid": "6e9fdc8a-856d-4f5d-833d-fe3ba4936597", "value": "192:ScIMmtPWQjG/b+rcafbONa25SEzBC4vNqH9Rcm3aeN:SPXlGT+OcEhlqHtaO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634890592, "uuid": "cb566258-f967-4a04-b250-25d389d45d09", "value": 10336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634890592, "uuid": "439bfc29-454d-4da4-84df-b9c195d3ca56", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634890592, "uuid": "89e7875a-1774-4185-9001-67a42b525773", "value": "BILL OF LADING.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "382e7a5c-3309-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634887523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634887523, "uuid": "4e2656a8-fe87-4228-b5fe-cd369bb2de3a", "comment": "Malware payload", "value": "98d415a295206f21d67fcaead6bee108", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634887523, "uuid": "097cb6ad-efa2-4fcd-ab02-a7c9814a1292", "comment": "Malware payload", "value": "1d41b428cc6962593fe60514175aa9dcc53765bc9641acff8c64af289cba4d43", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634887523, "uuid": "1c38e204-7cff-45b0-9260-2c1f99e5c781", "comment": "Malware payload", "value": "9352ba54bdb42a5b889dc01e6730d14ec1ce4fed", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634887523, "uuid": "471684a0-3032-45c4-9e00-35f98f0b8d0c", "comment": "Malware payload", "value": "8ef2c7cdc28d6be1efb90af58d22a938426539f831f55129257f71d1571169b29a5c7c5ff8a5a64d260c48599b6ab882", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634887523, "uuid": "fdc6a424-34fb-454a-bb3a-02e8223f3be4", "value": "T1C8C6337D4AB99F0DB282154370F16A42D173BE9780F5B585C046326ADB788E189EEFC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634887523, "uuid": "8fcb8bbb-160d-4610-a0b3-a93be1663eba", "value": "196608:fRblwDxqh65qQmYBeaa8sEDez33YDevVgzjIrvrVDlsWbhDSeoiVCFckJV/CN/DL:ncaoczBz33seNLvr9iWFSer+q1n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634887523, "uuid": "fae8e4cc-4520-49d3-9c23-b88510a91dc3", "value": 12329708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634887523, "uuid": "0671f201-504f-42de-a458-29ed12b36fef", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634887523, "uuid": "0559a338-6deb-41ff-b5ef-f2da418a057d", "value": "AveryNuker.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "657162e2-32ff-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634883304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634883304, "uuid": "e21db8dc-b4c5-48a7-aca0-f90a40391f7e", "comment": "Malware payload", "value": "76d1247f075b3ccdc427d553369071fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634883304, "uuid": "66b58562-5387-4308-bb9c-440d1dd0d50d", "comment": "Malware payload", "value": "1d90b987041490e2aee7de22c31d45fd177e99bc55ea3d794907c77123491269", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634883304, "uuid": "5e683298-9cb1-4b05-ac77-e63754399ec5", "comment": "Malware payload", "value": "5184f610beb5f4ef33db334a6b991e7f8edb3729", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634883304, "uuid": "f7da5227-b86d-4d37-a75d-d3f8b96c44f9", "comment": "Malware payload", "value": "0a2816d552ba357e95eed322141adf6dcd3d1372d7a66c59ec15eee0af9803177ac4238a17b7569bf67098950d25a98e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634883304, "uuid": "1ffea9f3-fab9-4b4e-a2c1-71fc67e94310", "value": "T169843B11B6809171E4F302B59A78EB17592DFE330B6690C7B3C45A5E1A33AD0EA317F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634883304, "uuid": "fd361be7-7f4f-4d78-987a-31217b4e84a1", "value": "a015389f60165399e844c3b119b7e185", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634883304, "uuid": "28c7d766-de14-40e3-85dd-b88894091080", "value": "6144:h4WATi7l+pss9dhoMLLSATCNxFx3Tys3L:hITigpsWdhosLTCNxi6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634883304, "uuid": "f2f04697-fe80-4cb8-8a45-d7a5c420e9b3", "value": 393216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634883304, "uuid": "1f77d3d8-2a98-43b3-81bd-8a24962143ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634883304, "uuid": "faf3049b-70aa-411b-ab05-11e53e0ad090", "value": "win_check_security@dgcb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "212c961d-335f-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634924421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634924421, "uuid": "601c49c6-2a96-4992-9f97-58a93580f224", "comment": "Malware payload (Gafgyt)", "value": "b5e9a159f7bd5cc95d3a0f115b5d4676", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634924421, "uuid": "cf9912f3-2ed7-496b-b12f-958af0d0ef2e", "comment": "Malware payload (Gafgyt)", "value": "1dcc2d762c0f8cf9e15ad9ebba447bd8b41d86c63313310614ed0e12edd2a38c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634924421, "uuid": "b9a7e3ed-18e5-40eb-9f05-cabe83f347aa", "comment": "Malware payload (Gafgyt)", "value": "4499b7d028386eb3c9bc2ecf5e4551e87c3696a8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634924421, "uuid": "eeeba26f-4122-4eb3-9105-84157ae3b9df", "comment": "Malware payload (Gafgyt)", "value": "b7f1328bd130ef45dba56d9d40754a527288562722b15613a0403aff2d377ddabbcce2165a9397587a07d7e8a78ba7d9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634924421, "uuid": "6c95e8ac-51b7-443f-9d11-7fc6eb826b74", "value": "T1E2F34905E6408B57C1E2277AE6CF824D33339B94A3EB33155938ABF43FC27991E26915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634924421, "uuid": "4282e496-6086-42d4-9f8f-a54c8eed2386", "value": "3072:41g2L2INNlzkCYYICUqaQcvBZgnyLRM/9+7tmFwfBxKQodn:ug2LBNNlzDYYXUqa/fgnydM/98mFwfBC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634924421, "uuid": "8d5bad05-e9d7-4600-a392-f80316ff3fe0", "value": 159888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634924421, "uuid": "b04afe1b-c235-44d6-ac77-ff13cac3f254", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634924421, "uuid": "33f0dbeb-89f1-4dbb-a394-5d40726d218c", "value": "b5e9a159f7bd5cc95d3a0f115b5d4676", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71e835a8-330c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634888908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888908, "uuid": "dd9492ba-a3b2-4519-9fcf-cabccc501844", "comment": "Malware payload", "value": "76a6b5017c5771dee4dad993599da44d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888908, "uuid": "d14cec5b-bbf2-4980-ab20-d408c1f48eff", "comment": "Malware payload", "value": "1e00968294455af621c8b491dd311550c78baa18a34bd94c17e86329d49e6a8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888908, "uuid": "df9f6355-07b7-4af2-9919-fbcb8627b3cd", "comment": "Malware payload", "value": "55a76ef23bd6f85dc0b927a45794afc48dac1390", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888908, "uuid": "19a8c43b-35b8-451c-8ede-125c2afac9a1", "comment": "Malware payload", "value": "3a9ded015780a185806c1618a32f08f56ecef97cd3ccf16b3bcd40b676993ffb72a680e252923cffe11a249717acfac9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888908, "uuid": "c7320654-3478-416b-aff0-e55a2443e563", "value": "T11B555A57BC9511F8C4AEC138C716A22679303898073937E3BBD162F92F76BE45A78364", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888908, "uuid": "de9286e3-fe8d-49e3-95c0-e8959883bd05", "value": "24576:E6uvsc+cDcrb/ThvO90dL3BmAFd4A64nsfJj6IWadqdb/7H4XJ9OeR5TyXQq4BW3:buvsD7rb/ThvO90dL3BmAFd4A64nsfJ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634888908, "uuid": "3f9bb23e-bcf9-48c7-a95c-b4a2502635f5", "value": 1337021, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634888908, "uuid": "bd9aa8e0-afea-4cbd-8200-05b3a0c844cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888908, "uuid": "7ca1ac26-1702-456e-a671-6e818976c7b5", "value": "1e00968294455af621c8b491dd311550c78baa18a34bd94c17e86329d49e6a8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "777ca7cd-330c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634888917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888917, "uuid": "70d90d03-9502-4014-8e2f-205b759ccdb1", "comment": "Malware payload", "value": "74fb7cbc38efba8dc74be4545b577541", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888917, "uuid": "11bfb3a6-c60d-48d2-a77d-cf9f0c2561e2", "comment": "Malware payload", "value": "1fa0a0793d64b74a911d14a6f36ba3046d5d4137a5a5a6207f94de46d0e31a5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888917, "uuid": "b56081b9-ffba-49c6-a0b0-349b6a34911a", "comment": "Malware payload", "value": "3f4bf836fab5bbda12a7eea55fb24d39a7276a06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888917, "uuid": "269c83c5-594b-4a55-a35e-f9734fa0c8d2", "comment": "Malware payload", "value": "afbae8239c496876e5e401fbf75971d296045d4e1a59d854389e4812c4069eb4458b0a8b7dd6c62613f36b44ae66186a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888917, "uuid": "3224c41d-32c1-4579-bba0-ea8a8ce01de4", "value": "T161856C17BC9160F9C4AAC230CA65D2A177717895073323EB2F50A6BA1F72BD82F79354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888917, "uuid": "8ebfed42-460c-4b52-a53f-fc19f1905800", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888917, "uuid": "1d0a4c84-e93e-4dfb-8807-d35ed648a6a5", "value": "49152:5URAhYherb/T4vO90dL3BmAFd4A64nsfJGAWrlHCUgv71Keb1N:eRx3a1b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634888917, "uuid": "85ea3780-8ccc-44a0-85fd-51ba60ac2297", "value": 1748656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634888917, "uuid": "03a18842-c5a8-46c4-84a5-3b14c6935393", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888917, "uuid": "b36a37b8-5d9b-4b23-b667-a88225dd391c", "value": "1fa0a0793d64b74a911d14a6f36ba3046d5d4137a5a5a6207f94de46d0e31a5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "792fccc1-336f-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634931440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634931440, "uuid": "9bbf8e08-d3b4-4ebb-8f18-3f65b30f0fdc", "comment": "Malware payload (RedLineStealer)", "value": "1af134c8d0c42c155d731736acdad0ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634931440, "uuid": "5f0e534a-d963-41ca-b1a9-258fb0ab751e", "comment": "Malware payload (RedLineStealer)", "value": "2031990c23b02f14927d6e81c767671f030228a52f56ffba1dbc5a20d5cd3552", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634931440, "uuid": "e8d5dd09-6373-4e65-9af8-31a43ebf3f1c", "comment": "Malware payload (RedLineStealer)", "value": "6fbdd621b41cad2aeec78697ef480e7ac9e4320d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634931440, "uuid": "7d7bb3d6-1686-4229-ab91-5a05f3f59bdf", "comment": "Malware payload (RedLineStealer)", "value": "09d7cbacc235e2029821c7587978c904ec01269b03c409a4194a53a229ada478b25be0e53ff4093f9e521e07c74feaba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634931440, "uuid": "353491f1-ba35-4f3b-9c36-eaa819aa4908", "value": "T1DD747D00A7A0D039F5F721F44ABA9368A53E7BE15B2450CB53D52AEE57396E0EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634931440, "uuid": "6c4c435c-6e66-4f0e-ae7d-dda9583248e0", "value": "bac67046644aa5e445c1272184462c49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634931440, "uuid": "c65c1559-af0e-4c61-a433-8f77fd130bf8", "value": "6144:/XRL6e06CiWalbhbJo1y2vQdey7hfWsrY2/NFfD3ArbcPRKpXGn0o7:/5J0I1Lo1Gey71HrRfD3AvQKp2nd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634931440, "uuid": "7a517340-ea7a-444a-b549-1a5837c5c31f", "value": 340992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634931440, "uuid": "4e67441d-8a56-479a-b93d-9a8713392d57", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634931440, "uuid": "f1340461-2660-4e7e-b04b-8ea1a5be4951", "value": "2031990c23b02f14927d6e81c767671f030228a52f56f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bee8c997-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928121, "uuid": "d4bb46a7-a473-4d6b-9aa6-ff647058a611", "comment": "Malware payload (RedLineStealer)", "value": "a2b817981971d64b4bfd82df3c7b4bc6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928121, "uuid": "9a717942-2ee2-4562-bb1c-103391a68a56", "comment": "Malware payload (RedLineStealer)", "value": "20e526f341b09d855bb8476e11065c945f3a894de27084107e5ff38a1b204385", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928121, "uuid": "0bad5ee9-4ef2-49ed-9df7-a32e07c3f31b", "comment": "Malware payload (RedLineStealer)", "value": "bed629d439f6c9a16ae3e288b7b37da893b27cb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928121, "uuid": "def5214f-7e33-4c90-9e4c-2062b53565e6", "comment": "Malware payload (RedLineStealer)", "value": "07a7e0ae7309905f210c8b172cdcc0999d13f214e2d672a74877ef8ed515a89304ff799bd6f87487b69a0ced6eba6bab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928121, "uuid": "7f3f16b5-c6d1-41b4-aeb0-6a6201bc3093", "value": "T1DEE4F114BAA0C035F2B716F809B6936CBA2E7AF15B6450CF52D516EE47386E0ED30367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928121, "uuid": "7877d6b4-e332-429f-ba6c-355bef6335f2", "value": "0aa8675e96bbc2351e2af940f447c93e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928121, "uuid": "37faf32f-aaa3-476f-a715-f8ac55580089", "value": "12288:AIP6+trwZwu5v+m7HEr/ODjmsilZFtNn/XQuDijYcmH:13JIj7HEzODIF3/XQG7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928121, "uuid": "04412f48-c0f5-4288-91a4-cee1fabe1571", "value": 669696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928121, "uuid": "efb45981-a1d6-4690-9b5e-9d5808bfc61c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928121, "uuid": "4c86c35b-288a-4fb4-88db-6c798df8eb78", "value": "a2b817981971d64b4bfd82df3c7b4bc6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6dc66c1-32ec-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634875360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634875360, "uuid": "f5d46679-3ab9-4a41-924a-8813fb2f9a11", "comment": "Malware payload (Mirai)", "value": "ad7c2449343a0cefdaf4341f821a109e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634875360, "uuid": "52686986-2c76-429c-96e7-4857fa8e01e7", "comment": "Malware payload (Mirai)", "value": "216009e7a8acadf6ae81e6f50b460907d353016d8ed48b18d57dd1b14f00dc92", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634875360, "uuid": "727d6edd-f8cf-43f1-a16f-3808868cc8f2", "comment": "Malware payload (Mirai)", "value": "992196830ad28c171a3064a49801383a7392c1ff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634875360, "uuid": "b03bf789-6aaa-47da-b915-06e18940aa52", "comment": "Malware payload (Mirai)", "value": "71dc54ca112b2ea7d12f901047aa1458f306bd854cf8c270c26a1cdd1e1d2548b34c9d46b2b5f7382db726a26cb2542a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634875360, "uuid": "5e3cdad6-7474-4504-9c3f-c55109ad2d85", "value": "T170132A86BC829966CAD01776B62E108E3321B3E9C1CF3217CD245F1177C9A2F4E37A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634875360, "uuid": "f1ac8bbd-1f36-4727-b31a-31318bf58c2f", "value": "768:4e29cZjBmP2XBDFlumI9NY+uanihajaer8pgwmYSWAySxoNZmBNs5:32uZFmP2XB3uVO5OihajaR2wdSJd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634875360, "uuid": "57bb6162-07ee-4e28-a51c-a999e4f0d37d", "value": 44128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634875360, "uuid": "7b5fd074-f92a-4ef8-a513-9c1c4d0eabf9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634875360, "uuid": "3233f3c6-9e98-44ab-af8e-ec020229ad1f", "value": "ad7c2449343a0cefdaf4341f821a109e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bc904b1-3318-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634893971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634893971, "uuid": "dd21642e-25c2-438b-bb71-c6c9be0d65bf", "comment": "Malware payload (AgentTesla)", "value": "384b03372b0048e1cb96f7db323d31af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634893971, "uuid": "140f4bc9-9da2-4080-ba59-6869646cd510", "comment": "Malware payload (AgentTesla)", "value": "21cd1dea5f6846f81699ddc9c7a4469901a87c13efd253001c030645bcca9fd3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634893971, "uuid": "b55a5c8a-23d4-446e-9749-844d0a0dee83", "comment": "Malware payload (AgentTesla)", "value": "26c2955b326420fc61f64fb1f0c1ac26bb8fe6d9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634893971, "uuid": "60965895-8f0a-454f-9fcf-ca7e79301169", "comment": "Malware payload (AgentTesla)", "value": "f315a9a886fa884ced4a13028db5183a94a74ca2cc482f13fc297dc66eff98ce932737afd002b150f26e937af473d34b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634893971, "uuid": "6199d927-f464-41b3-a3e6-8e7b4c36885f", "value": "T1F4C49C0432F95B12E5BA6BF01532584493BB7DAE643DE60D1DEE34CA1F37B448A61B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634893971, "uuid": "0035fe23-f521-4cda-bd25-0e6646ff1c0f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634893971, "uuid": "d3758cd8-e79e-409d-853c-1d73e127a473", "value": "6144:OGxhL2I5JvQJ4xqa+Qt411g9MHNd0HmBFlAil2DARJDql/rsBCq8WeZ:Hxz/D011yMtNAiY6Q/rsETZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634893971, "uuid": "48a1547a-6401-4177-abb8-897a6fb50193", "value": 550400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634893971, "uuid": "03270d8c-fd87-494b-9f8e-49d2abbce63d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634893971, "uuid": "2c38cfcd-303c-4ef4-a7e3-7ed6a389f398", "value": "384b03372b0048e1cb96f7db323d31af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "384c8d6a-3318-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634893965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634893965, "uuid": "53839036-5102-4280-a4ba-50c0d40e870d", "comment": "Malware payload (Formbook)", "value": "80838b2b8dd2a2b48b619b2eb7788138", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634893965, "uuid": "25f47aac-c947-4eea-9f77-7f1842612cfa", "comment": "Malware payload (Formbook)", "value": "2486c4ebc2834ad7e9517107e7d7813fa1b84d5b2df4f928a0144b81d1273e8c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634893965, "uuid": "974b9aa4-048f-4c98-92d8-c58c3a0d057e", "comment": "Malware payload (Formbook)", "value": "d3c6a2dc3835768d4e103ddd34bdf016bb34a7ee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634893965, "uuid": "020f5209-d1a6-4879-80ff-57e1326a26dd", "comment": "Malware payload (Formbook)", "value": "19942e435cc765b33f889cecbfdc32729c5890b2edc5c8e3792e9e431f97e595df868c48ac8ec4b580489d61b33b18cd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634893965, "uuid": "6a03dcd1-e2f6-46c8-8988-b3914f0c2152", "value": "T15CB48B0436B95B02E5FAA7F01632444493BB7DAE283DE60D2DDE35CA0F77B404A65B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634893965, "uuid": "359a4b12-cee5-4bb5-8b2c-181f3a1350db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634893965, "uuid": "09aec51f-3382-4433-bd72-1b9a6174dbcf", "value": "6144:PGxhLkIBFvSr+ea6m2RnQ0qkMUsAUll0KVL+RLqERzi0kxFWF:+DPb16pTqgsAyeK+LqvOF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634893965, "uuid": "c18d0302-78c2-4c46-b940-f2f38834ebf7", "value": 520704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634893965, "uuid": "0c4c3095-75b8-4c07-b67a-a33b51145205", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634893965, "uuid": "dbd2464b-de58-42ba-8d0f-79b4ffb52311", "value": "80838b2b8dd2a2b48b619b2eb7788138", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43c3a3b6-3318-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634893985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634893985, "uuid": "233d4dcc-9d25-4be5-9187-594ddfcf57da", "comment": "Malware payload (Loki)", "value": "c58e48fe28f84e2359af820fb583bc82", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634893985, "uuid": "34367b84-624f-4aa3-95ed-714686c32c4e", "comment": "Malware payload (Loki)", "value": "2587179c5c51388c763787aaf3449a1c61b710db165a53ffb7510c1eadfebf01", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634893985, "uuid": "83539ac2-8178-4987-9084-76acd58d6719", "comment": "Malware payload (Loki)", "value": "b0d7dbab93f62bfdd5c1178c98a3f1b3c7059894", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634893985, "uuid": "47b79bca-098e-425a-b157-928b4fdf02a2", "comment": "Malware payload (Loki)", "value": "e875a010f4b4b5fabced110ecd54e944417463f1dbf36dda19f9ab042306985f8df3acb449f5ee8ce2ca9c0c92df2202", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634893985, "uuid": "317ea885-ddda-44e9-a6dd-b5050063e299", "value": "T12F94CF453548A1EEC62A9E377D92AA0C7B917CF19707C28F65C3B25E4A3D3958E310B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634893985, "uuid": "5012ee74-9cea-4114-af75-db2af926724e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634893985, "uuid": "f1d4f038-9dde-4c28-ae61-4aff3c6a2550", "value": "12288:bUzcPZdUi2iN7EQfpl5wzR3CUpXEiHa3:4cBdUi1hEQfpXwzR3Cb3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634893985, "uuid": "bc3b99a5-8bd0-4a18-aad9-667abf702c99", "value": 429056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634893985, "uuid": "1c9e0df2-c45f-4fc0-a6cc-f2bac0d7b3bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634893985, "uuid": "b0f3603b-f8e0-43d8-a33e-0aaf0da83c47", "value": "c58e48fe28f84e2359af820fb583bc82", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3db17a5a-330d-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1634889250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889250, "uuid": "f7f3ab59-530a-47a3-8d59-6d4af1c0138c", "comment": "Malware payload (AsyncRAT)", "value": "6b81a0180a2d391af6b604b016b90d01", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889250, "uuid": "f9a23d7a-ad4f-4cf8-a5a0-dfa2d669bdaa", "comment": "Malware payload (AsyncRAT)", "value": "278602396c9f613328746aa33d0fa09d0aac466c68ca349ec0d8193d664aef35", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889250, "uuid": "9521f156-0537-4d16-9549-588828663f9e", "comment": "Malware payload (AsyncRAT)", "value": "180493fe32b38958cf63926b2f568555aa44f5f7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889250, "uuid": "d7e1adbd-d9a8-4083-8ba8-dd969f7f72ca", "comment": "Malware payload (AsyncRAT)", "value": "8a260b7d3c2cf4e1f09b1de23eca750203003af0ee3ee594ebf229a63cb1551ac3bda9a924aa50c1013c005b847313d1", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889250, "uuid": "ac9c66b3-a492-48aa-8c21-8c77d1cd7fdc", "value": "T16ED3E114B7D4C133D8FE6B3389A797026370A2426973C76F56CCA2D44E872924E717AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889250, "uuid": "75e786d9-424e-4043-aa55-839ae4a4cbc7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889250, "uuid": "a49a56df-71d5-4e03-98e6-69d5c7642fae", "value": "1536:NFm5i6zs2TwyAuQOQQF5JwumR5e6kE4+0PvsFvmOw38ABVGKPP9ey+V9DkYdWLnJ:NFm5RY5u9nJwumRE6Q14vmOw38a9Mm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634889250, "uuid": "ba7b1128-4877-4c1c-a19e-a8ed711b7c14", "value": 130416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634889250, "uuid": "bac72891-2f19-45a8-adff-338d6a7db3d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889250, "uuid": "2a106df7-adc7-4ba5-998b-558f7e6f6e7b", "value": "PI-23456776544567.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21b5f339-3331-11ec-843c-42010a9c0014", "comment": "Malware payload (BazarLoader)", "timestamp": 1634904665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634904665, "uuid": "79efe3c3-4b2b-4c0c-b747-e73a1f3631d8", "comment": "Malware payload (BazarLoader)", "value": "aca3ce06cbd73347cfdc1019f37fa0b4", "object_relation": "md5", "Tag": [ { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634904665, "uuid": "979aad0f-7b08-44d2-8d7c-7c49f320b94d", "comment": "Malware payload (BazarLoader)", "value": "27b8a197d7ae0f4538f79814ae2885e8b654a1633cc8caedf54f52aa931e0238", "object_relation": "sha256", "Tag": [ { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634904665, "uuid": "8b373372-936e-4de0-8bfe-9b1aff5d057a", "comment": "Malware payload (BazarLoader)", "value": "debfcecf4cd178a6b266502ad9b5e2602638bfff", "object_relation": "sha1", "Tag": [ { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634904665, "uuid": "b797baf1-1262-40d7-acea-0bcec33f4153", "comment": "Malware payload (BazarLoader)", "value": "334508b84b6a2e58ba7e781c7f82e1622443df28d8961fd5c81f2732aefea138e5f8ae4e1104eca5b11c02671fc1d574", "object_relation": "sha3-384", "Tag": [ { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634904665, "uuid": "af75bb08-a16a-414c-89c0-28a070d68796", "value": "T1B2F2E179EA02A059C72BADFEF0D145B5E63C810151A6D06E98A0F7CD8B102F36A7B58D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634904665, "uuid": "c25b2d33-b857-4d77-b920-cf95c7444e40", "value": "768:FRmrqQthgRKjEHTY3vj02VWnZdw9822zGaOdAtDGUhy:HJQtpj0TgwcWwkTtaYy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634904665, "uuid": "c69529dd-15bf-4d4a-a03d-e14955d7f585", "value": 35300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634904665, "uuid": "99177cf9-0b1e-4669-8801-a5786532a1a2", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634904665, "uuid": "1de93ce7-e8b4-46d8-a248-b8da6b33d95c", "value": "details_010.21.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09795a31-3302-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634884438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634884438, "uuid": "dc3f4e78-a130-49b0-900d-0a75a4a9b854", "comment": "Malware payload (AgentTesla)", "value": "e87c1a7e4605479be4d0b3b50c69fbeb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634884438, "uuid": "9de18dc8-514a-47c5-8eb8-ffc0868bb119", "comment": "Malware payload (AgentTesla)", "value": "27f9239f3d2f9959daf11273fd57a68301c81bc893d60b9b3a61e17fa87a55e6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634884438, "uuid": "0c318e92-78bd-4fa4-bb2f-bfd1d81c7c60", "comment": "Malware payload (AgentTesla)", "value": "1aaf3316bcec23135f57124f5c7bea22847632ec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634884438, "uuid": "de676851-d1b2-422e-b63a-d4fb6605fe28", "comment": "Malware payload (AgentTesla)", "value": "feb967992e60bedfef71bde9391af6cdc2b2d21959197fca71aa4e0b28f897c5f3faaf61b52bbbd7c81c97f971aa6f12", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634884438, "uuid": "577d9b18-9974-4ed6-8415-05e52ed40fd4", "value": "T12D6423C9D9516EE5AC10F38C23E1E39533DCE1EB56EE2C3D95F902D808BA90C41739A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634884438, "uuid": "b636c40c-aa53-4011-8f6f-f8006b6da92a", "value": "6144:k+BS5gUeZOl/QwZdoPX84aW7WwT8ohhdv6DQ+JZGLoyr5djFhkGk4qGnBu9g:k+MCYBt4j7Twgv6DdOoyr5dJIGnd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634884438, "uuid": "5e4a0275-4eff-4097-b630-a57ea7a3ad8d", "value": 325143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634884438, "uuid": "4c50c02a-c708-4fd9-ba29-e807397f8bbd", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634884438, "uuid": "2611645c-8674-43cf-b239-60ed33ed04c5", "value": "POIM101385.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffa0f343-3330-11ec-843c-42010a9c0014", "comment": "Malware payload (CobaltStrike)", "timestamp": 1634904608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634904608, "uuid": "cbdd2193-15ec-4810-9275-8e21c77992e9", "comment": "Malware payload (CobaltStrike)", "value": "d18ae28b6de396ed66f6612847fae94a", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634904608, "uuid": "d7f14a11-b262-4dd5-8a17-013bfaabc46a", "comment": "Malware payload (CobaltStrike)", "value": "2825b1fcb91614a08b7c2338e54ee1506915c159bd6a363de7b77c23dd6ea7e0", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634904608, "uuid": "a5efd60e-0279-46bb-b719-16a0cc1a8412", "comment": "Malware payload (CobaltStrike)", "value": "67822f19fb74db92e668df45688ebdd557ad21d3", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634904608, "uuid": "bd57a614-0f82-46c5-b615-61a8615b16f3", "comment": "Malware payload (CobaltStrike)", "value": "474f204fa3d173576990894b391a0463a4686e45614d84aafddd24af5c8cd9aca325008d73708da532a77ad39ba0b9ee", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634904608, "uuid": "0725a80b-e6ae-458c-b0d7-311f65274e40", "value": "T100C57C17BC9191A9C46AF230C975C251763278B9073123DB2F50EAB72FB6BD81E78394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634904608, "uuid": "2858901d-7e8b-41fb-98b4-8691ea6e2aae", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634904608, "uuid": "7c461732-1940-4862-8af3-a6105535e0fe", "value": "49152:pbfwEYGrb/TqvO90dL3BmAFd4A64nsfJIcBttY0aF1LBdSgTCNWJrFux0D1:pbjYtcBt7NWJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634904608, "uuid": "987b9133-5bc6-4059-9ab8-b5d80fb2bcef", "value": 2563072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634904608, "uuid": "4573aacf-63a1-4144-9077-5853760191f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634904608, "uuid": "af21f427-9022-4414-8a1c-317a90513e31", "value": "2825b1fcb91614a08b7c2338e54ee1506915c159bd6a363de7b77c23dd6ea7e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5b6405e-3338-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1634907946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634907946, "uuid": "bf3b8667-6f89-479e-8209-83314b5e5e19", "comment": "Malware payload (DanaBot)", "value": "de8b54a938ac18f15cad804d79a0e19d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634907946, "uuid": "266c5499-b8cc-4716-bee5-0c29aba43571", "comment": "Malware payload (DanaBot)", "value": "2a3acdcd76575762b18c18c644a745125f55ce121f742d2aad962521bc7f25fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634907946, "uuid": "1e95ad1f-29b1-44b9-909c-b69a509c2518", "comment": "Malware payload (DanaBot)", "value": "b6004c62e2d9dbad9cfd5f7e18647ac983788766", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634907946, "uuid": "4c77cf43-7e0e-455e-8bda-c6e5e4dadb1b", "comment": "Malware payload (DanaBot)", "value": "e4ddaabadcbd125aa5766d4ca5b576fa684ab97fe0827688b721d63649def6925dde628ebb9e4556cbee9f9b3b2106ad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634907946, "uuid": "1d452748-4535-49ef-88d1-8f610c965e9f", "value": "T17FC54C2033B69812F273133598F3D0E09ED8BD6299B4AD4B70C23B5F049F6D29A5975E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634907946, "uuid": "7930a8f6-0bcc-4018-8403-bd01474b0afa", "value": "e6d67d5cd426c018e8253fd545967c8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634907946, "uuid": "d437ff1f-507f-45ce-b522-6760dab9de7b", "value": "49152:ZgZziYTt//YDt2Z/fZMdzUAOC5n+LlrxFTGWgKq:Z0ziYTKh2Z/f6AAOGarxFTG/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634907946, "uuid": "fcb9edf9-7ab3-4622-9857-e1aba851e93c", "value": 2588672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634907946, "uuid": "b9915d0f-0bd6-43f1-b6d5-cdc593b759bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634907946, "uuid": "9fbc5f0f-2224-4af2-a1d0-a9391023d4e0", "value": "de8b54a938ac18f15cad804d79a0e19d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0d7c135-3352-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634919186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634919186, "uuid": "bd4c66ea-e0b5-4e0d-b68f-1c268e355d81", "comment": "Malware payload", "value": "b4c503088928eef0e973a269f66a0dd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634919186, "uuid": "f75812f9-564b-4783-9f2f-af783db6d4d9", "comment": "Malware payload", "value": "2a95ce43c87b8a26be71a459eae796a572422bd99cf0b9a3580a3a68e7dbd1a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634919186, "uuid": "d5ce274c-accd-4585-a17d-4562fd4847cf", "comment": "Malware payload", "value": "eb7f418b03aa9f21275de0393fcbf0d03b9719d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634919186, "uuid": "7ab12f02-e7ba-462e-b7ea-7d50535cd1a7", "comment": "Malware payload", "value": "309576573c8f1fdb0d12517bf3d6ed6797df0ffeb204cd854c5ff6666e66804b8ce1285d9d4d71f48d386b12485ec30b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634919186, "uuid": "f015749c-9425-4a4c-8f67-e76fb603b424", "value": "T102947B2433D08C32C6AE4675A4A0C6718634ED2657728BD727C46FBB3C773C08A65BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634919186, "uuid": "bb1d679a-1d9f-42ab-89e4-af9fa0af28d2", "value": "6256ca6fb1d33cce27dff272311e3072", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634919186, "uuid": "24396e2b-a1da-45d4-87cb-11d5446288d0", "value": "6144:FjxzYPg/USg7WFugayIv1pE0EAPMrGWsWDWidF0HQszCZ2Ftppb9Y81+k7pq7FL7:RNYI/7FugaDS2zO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634919186, "uuid": "df2e95db-9984-4cf7-95d3-8d1a87bdadfd", "value": 412672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634919186, "uuid": "1999b48e-2431-4b5e-b7bb-be6464ca302a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634919186, "uuid": "3ff6e715-600f-4875-85a5-5e5c1096e7b4", "value": "Fri051e1e7444.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae8f5f16-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634928094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928094, "uuid": "119b89e3-2708-4183-9659-ac309e4de1b3", "comment": "Malware payload (Loki)", "value": "ac30e2486a187b3532c8ff60991268b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928094, "uuid": "659743d7-5091-48bb-9051-3662bd6942ec", "comment": "Malware payload (Loki)", "value": "2ab9e22c7ab06ab9e6978fed97a0346340bb34b8188138740b4d7a5f84a163ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928094, "uuid": "7e329e5e-e964-4c20-b4ed-dbfe730b4947", "comment": "Malware payload (Loki)", "value": "3100d33701306682e6b129c354d3139d726c9954", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928094, "uuid": "bb42b707-86f8-41f9-895d-b0236f9c34d4", "comment": "Malware payload (Loki)", "value": "8386da4733753a4e3ae3f8271d91119f9ac9e8ef1c789751c98d317fe390d95f167139f9756c477802fffc207ea04bbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928094, "uuid": "ce20ee46-89a5-46f6-891d-078e2b2eb4ae", "value": "T164948D360BACE920F381E8B4F192F74CD9B4ED211E6EDD22C9B62E6945BCBD55C59003", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928094, "uuid": "0e7af17d-2315-4017-860f-a2ed1210f0cd", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928094, "uuid": "c5d7a777-d759-4183-87cf-8c12a098d90a", "value": "6144:hBlL/hlqQxBiHB354KnTppIOtFCGArQ3DOgcdkoMF247Ssd/6HQzX2:nMHAKnTsOtFTAQDOgZLFVGtHQzX2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928094, "uuid": "bdbd2142-ebee-4c1a-a06a-d9f4a76d8314", "value": 416337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928094, "uuid": "18887cc2-f4b6-45fe-a704-8c1ba5261083", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928094, "uuid": "1d2528bd-192d-4deb-83fd-30b9ab483917", "value": "???? 185+????????.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f1a6ad5-3356-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634920767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634920767, "uuid": "57480bf4-eefd-4de9-bc4a-276da070be5c", "comment": "Malware payload", "value": "ad0243d00772cc88c6de8e6d7107d1be", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634920767, "uuid": "d4bbc206-d21a-41c1-a800-7d848a4eca8e", "comment": "Malware payload", "value": "2cd289033bd19bf0bdb229b8cc98a496d80eac284c54c60a04c48352fb5eaac6", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634920767, "uuid": "2204e7fb-4d12-440e-831a-d65ee21cb7e7", "comment": "Malware payload", "value": "e0aae2993486fda0d07555e13a8b20885c2bf7b6", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634920767, "uuid": "e5aa8089-7062-407d-b78c-db5aa8381582", "comment": "Malware payload", "value": "95707ca5322eb107e08033936f9b94d5d15b751f8796b6174e66691c4bc17d6dbf93caaf8d557112cb7ca1aae084f126", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634920767, "uuid": "0ef868ef-6dfc-4237-a533-084a06c405e2", "value": "T1D36422DEF6E1146FCE01757FB7996A54E363D6088BC4E4090EC8D1AA412A50AFE0F366", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634920767, "uuid": "a44d047b-f723-4ab7-89b8-0d28eef9db02", "value": "6144:02QxVqDEGxJH9VfeFZNJlePDgsX9OYIg83ODCivUTG82O65rHZ4Tj:MxVq7bdVfRga9nGliOGeCryTj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634920767, "uuid": "07867d4f-766c-4f07-b49f-0cfb528a92cf", "value": 310338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634920767, "uuid": "3aa760fa-16da-4273-b1aa-707d6ff22dd0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634920767, "uuid": "e836a55b-ff44-4d28-b0bd-7cbd9487ddbc", "value": "ReadMe(2021.10.20_22-42).xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23435a13-3368-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928290, "uuid": "00487c84-0d57-414a-b705-ec9bdfc18009", "comment": "Malware payload (RedLineStealer)", "value": "4b822ff53f5ad740eeaba9e1bb26ad68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928290, "uuid": "17e90d56-72ee-473c-bddf-080ea71fd03f", "comment": "Malware payload (RedLineStealer)", "value": "2d21d56c6e2bb7643be411747eabf7c9eaf5316a1520e3a84f1363c53075d87c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928290, "uuid": "a4c0720e-ce4f-4b7b-bbfd-6ee91c6c9ec8", "comment": "Malware payload (RedLineStealer)", "value": "d3e4912cce03f627ab8da804fc0151c7815f5eb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928290, "uuid": "882f42b9-8d4c-480f-8782-4bd32d2997eb", "comment": "Malware payload (RedLineStealer)", "value": "5cf2987094d556ae8f0c897a8df51e84ba6e3b0a850984c5f5fef690af109108c9ab4bbfcf4e381b2d1e2eb958e10498", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928290, "uuid": "786c7c91-ea00-4979-9372-b56f07cca496", "value": "T1FC156CA93144ECCFC4178F76445D9C20A1256CAB421BE30F31973A9A8EEE7D25A463DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928290, "uuid": "33c73931-2025-474c-81f1-b58f9d247cd4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928290, "uuid": "85580f3f-02d0-4af3-8b08-4d0defec5d26", "value": "24576:KrRKzyKje6aY8FGjyDUYZluEhckcUkdH:ORKWKje6wQjcU+lrkt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928290, "uuid": "a03d3923-ca9c-42a0-9160-75f1c83b4f3a", "value": 940032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928290, "uuid": "7279d933-fdcf-47ad-822f-05fdd93bae33", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928290, "uuid": "aeb8af67-40e0-4565-aebc-e0a0f191e2c2", "value": "AMAZONORDER929293384PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eacbbc8-3320-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1634897385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897385, "uuid": "8aa97657-efc2-4f92-ac5a-7f313ce21649", "comment": "Malware payload (TrickBot)", "value": "89af65215bc0590db38932e27412702d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897385, "uuid": "394323c2-bf6d-4982-9ca7-7b52b29eda85", "comment": "Malware payload (TrickBot)", "value": "2dc0f0bc555a5419b0cf12e7368c8009b09fe5c0a6de7867a473c418c7da3dfb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897385, "uuid": "b6c7cba1-e67e-4765-9cb9-e13e8b4f5cff", "comment": "Malware payload (TrickBot)", "value": "e97bf870f4b513c6309000bcba8955b99e5a0b2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897385, "uuid": "d04a98d8-a250-4121-8b8b-4b3e4416e01b", "comment": "Malware payload (TrickBot)", "value": "1b52fd2833ba91e8070bab45b600fdccb3fd1072da705d4fc59cef37b91031e310d2734db43598ca33ad789b37ad4236", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897385, "uuid": "c44fa668-332a-4883-a879-3a4a877f8b2e", "value": "T1D3A4F1223AE1C873C15341314FD7ABB9B3BCE9044F228A5377D89F1D2D359B15A2B2A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897385, "uuid": "ed6f4152-cb9d-4aad-bfba-7a92aebb69b2", "value": "80d506598da867a09b35bc1fdb2d74ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897385, "uuid": "783de7ce-707c-49ee-ba68-0e79ebccb82b", "value": "6144:b96ZhRWIiMiCIF1DXBVmdCeyNAxR/oLgC+j9Jbnndik1IysdF3bQQYseb:b96Z/niySBVmZy2vuMJJr8k1IysdZcQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634897385, "uuid": "6151d8a7-795a-4082-a10a-2be72337b8eb", "value": 471040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634897385, "uuid": "dab2a905-f371-4a0b-a375-475c396ebeda", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897385, "uuid": "d97a38b2-6815-447a-b26a-5e5e201a76d1", "value": "89af65215bc0590db38932e27412702d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51e9f8c2-32e2-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634870815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634870815, "uuid": "a4d5ea8e-7dda-4380-b54a-0455122d938d", "comment": "Malware payload (Mirai)", "value": "9bd560fabdbb19fce4fbb0a3c433875e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634870815, "uuid": "51259cf7-85a7-43bd-9013-28350435fac2", "comment": "Malware payload (Mirai)", "value": "2ec8b016d2f1c67e2fda70d1841a5e150b8a6baa384205c83c51cf238536b045", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634870815, "uuid": "d0fd6cac-66f2-48b9-943c-0e13cb29373f", "comment": "Malware payload (Mirai)", "value": "08ce11cc749a1383835e4c1904d78b6ab0324b34", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634870815, "uuid": "c1fed954-fdcd-4bc4-8979-919f68d3c6dc", "comment": "Malware payload (Mirai)", "value": "15ab152e8d5027af6b15b233039134123f1eeb4676fe60c83ff3f69f69419a570537cf46d37c871e700a34c53fbe6cd0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634870815, "uuid": "578d19bb-78e1-4db6-b69b-2fcaa11a22bb", "value": "T1BF338CB5C579EDE8D1144A78BE248E749723E000C6932EFADA44C6A99083EFCF5583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634870815, "uuid": "951ede7f-26a0-4ca4-b5dd-f0aecb232d58", "value": "768:jaixFwtLSYAagMo0ebH4/QvQX3hyWfs3INgCJUU/qMCqKomQRCvM:jaQFwtOGYvQXxfs3kgCJt/qMF/RCvM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634870815, "uuid": "cf00b83e-b378-48e5-8d59-1e88406966c7", "value": 51584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634870815, "uuid": "92b6e993-5ddb-4bdd-a8d2-8441e0586d66", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634870815, "uuid": "7e5be79e-0b82-4f8c-a6a4-bc37b8760053", "value": "9bd560fabdbb19fce4fbb0a3c433875e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "344bb0ef-3308-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634887087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634887087, "uuid": "22b29186-6dfb-46b8-aab2-cde690b34b91", "comment": "Malware payload", "value": "e4bb68e83ad2d3ac10e57e7ce39c605c", "object_relation": "md5", "Tag": [ { "name": "mac", "colour": "#285994", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "UpdateAgent", "colour": "#B10D2A", "exportable": true, "hide_tag": false }, { "name": "WizardUpdate", "colour": "#5BF7D9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634887087, "uuid": "c39abbf7-a0e9-4bfb-a8c8-331fba62e0f5", "comment": "Malware payload", "value": "302ad1644228fadb3a049f9c9ee81fba763dab4993f8f9f1187cb97ff3e67567", "object_relation": "sha256", "Tag": [ { "name": "mac", "colour": "#285994", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "UpdateAgent", "colour": "#B10D2A", "exportable": true, "hide_tag": false }, { "name": "WizardUpdate", "colour": "#5BF7D9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634887087, "uuid": "10fdfb30-592b-489c-a256-30e5a39a748a", "comment": "Malware payload", "value": "84c507e6af95b84f51285e01d417ff857b72c798", "object_relation": "sha1", "Tag": [ { "name": "mac", "colour": "#285994", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "UpdateAgent", "colour": "#B10D2A", "exportable": true, "hide_tag": false }, { "name": "WizardUpdate", "colour": "#5BF7D9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634887087, "uuid": "d8311e99-148f-4834-81d1-4202d5c3df61", "comment": "Malware payload", "value": "55a03d75168132e840c47c14624da91be2fd5158540ed22cce42a4e6c79182655837aa4cc8de45558efe754c3868a266", "object_relation": "sha3-384", "Tag": [ { "name": "mac", "colour": "#285994", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "UpdateAgent", "colour": "#B10D2A", "exportable": true, "hide_tag": false }, { "name": "WizardUpdate", "colour": "#5BF7D9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634887087, "uuid": "2f1c8f2d-dd3b-4281-8a71-74377f01151d", "value": "T157C28ECB0B143065FF946AF456CEE573ED3263A95FA200626091C8E63A41FB93B1896C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634887087, "uuid": "1ede22a6-e8f6-4900-b8d0-38e63f5b860e", "value": "384:rNgaZ9dDzr+Q8arwdSr5Dsrv7rNab8ern5RbCcWh:yk8Nab8S5ZO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634887087, "uuid": "c61d4c81-96a3-4bd5-ae82-fadf3a519a67", "value": 25860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634887087, "uuid": "1fff0986-fdbd-4279-86ff-e821647c648a", "value": "application/x-xar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634887087, "uuid": "67c977bc-6140-4ab9-965d-04f340f77496", "value": "malware.pkg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "632aadd9-3371-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634932262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634932262, "uuid": "ecc72e64-686e-473f-ad42-279855fdbdbc", "comment": "Malware payload (Formbook)", "value": "f9ed39427014d807dbbbf35c45d411bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634932262, "uuid": "40a577a7-89c1-4703-94b3-d1ec4ba23aba", "comment": "Malware payload (Formbook)", "value": "309823f6a6820db5d24443327e3b566f8d2aa16b3a9052086f521488a46e1532", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634932262, "uuid": "aaff488a-22db-4e75-89b3-02e631189ba7", "comment": "Malware payload (Formbook)", "value": "ec55a74f3cda76f09db8f409572a944c8bdaf346", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634932262, "uuid": "22bf9a0e-5da6-465a-99fe-ae446cd5e933", "comment": "Malware payload (Formbook)", "value": "11e2969637efd3e1d15907d48427fc538032568a6aeab78e20628b486a3ddd1ddafdf409c800129649bb926e8f1ad201", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634932262, "uuid": "3149be90-c060-4142-acb4-407e5a0b92bc", "value": "T1F3E45CBC3554BCDFC8678F3645545C24961268A7034BF34370A729DA8FAEBD69E002EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634932262, "uuid": "a41802b8-ac8b-43d5-acc4-f3b53aa91ebf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634932262, "uuid": "e8457c6b-866d-42ff-9fb5-455e61737557", "value": "12288:jodfjOW9PQ/UaYd0uw7yk8eZ7Lz2p9g9YuzA+jJp0LdMJUl22:8Bu/kO7nP97z9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634932262, "uuid": "d6e3e8e5-99b9-4ce2-a670-4011cf617abc", "value": 689152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634932262, "uuid": "b715664f-7a2b-4554-8088-62cd5814670d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634932262, "uuid": "24c6daef-69d8-4910-b5ab-922ed0c49b56", "value": "SHIPPING DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8c9365a-32eb-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634874827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634874827, "uuid": "24717268-3865-42ac-93b1-2ee616256fb8", "comment": "Malware payload (Gafgyt)", "value": "2c455ad2ef60412bc63da0afcce8c87c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634874827, "uuid": "e9d0aa5e-17eb-4d81-88ac-c7eead7cf631", "comment": "Malware payload (Gafgyt)", "value": "3158647e616c011251d7510fa692f7a481b98fe69f59f138a16598211ac23e7f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634874827, "uuid": "321d1015-b2f5-4a80-8e8c-8064fb9b607f", "comment": "Malware payload (Gafgyt)", "value": "cc3d15a489f2068c7868b140ac85227c4a11ad14", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634874827, "uuid": "38866d4b-f671-4bd8-8f7f-274e5aceb707", "comment": "Malware payload (Gafgyt)", "value": "32f9be765936e1dc2e59b242e8f2a1639151c9390bf7abd8cf68f3497de49f4f2658026758a14937cb17e868e2c4a9a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634874827, "uuid": "b033a788-3cdb-40f5-9c13-df6bbeae4733", "value": "T128B3952A7E22FFFEE168863107F35F7087D521A226919385F26CE6181E7128D1C9F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634874827, "uuid": "e1d79899-ad01-40f7-a23b-9a045ba00dd3", "value": "3072:R/4tNF9U4vvcKw6J73x8UmkiSFxfKxbXe:BUNFK+c8T8UmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634874827, "uuid": "01a89682-8a91-4636-8958-3116b74d41a9", "value": 113275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634874827, "uuid": "988387af-4bab-4296-8f48-35fe6acee807", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634874827, "uuid": "3b19e2a8-539f-4acc-b71a-7861e4a74004", "value": "2c455ad2ef60412bc63da0afcce8c87c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1693ce2f-3368-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928269, "uuid": "472318e8-2b9f-41b5-9109-90a2acf4cac0", "comment": "Malware payload (RedLineStealer)", "value": "9a74d5eab143394d5f7488c5ec0de4f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928269, "uuid": "2fc93ef5-ee32-437b-8395-e45b0d6611ee", "comment": "Malware payload (RedLineStealer)", "value": "323e2c782142c1ccb02e6d28779211eb520317fe73c4a1931b4c07c00c88cb5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928269, "uuid": "c10469d4-75e8-4d5b-a9c6-c6f92545a326", "comment": "Malware payload (RedLineStealer)", "value": "f32f0d695d48e4d8bc0f7f7521b9bc415a2c28b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928269, "uuid": "ef0c143d-7d98-462a-b8af-2763750ee203", "comment": "Malware payload (RedLineStealer)", "value": "567902e207b768d2997a68e4268f10afa255494274913df69bb8d52937ac43bae4d9945697d8866e871e7356a4c2b4dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928269, "uuid": "b59a8acf-a0a5-4ea8-9013-87e2f1932400", "value": "T1C6747D10A690C039F5F312F44ABA9378A52E7EE16B2450CF93D52AEE47346E1EC3175B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928269, "uuid": "8992cf3e-286d-47a7-970f-7254e02a41aa", "value": "85b11e7df91b461ff7ceddce26982802", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928269, "uuid": "b0a3531e-5499-4de3-9805-a44d94e6aec9", "value": "6144:jkvj81FNSWp06e+r3oTGuqVPip64ZDSRRntNJ/qxrfgAXgPy/4:jAeiWpY+rNFBi6kDSRRtixrYA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928269, "uuid": "bbd3abfc-76a9-44f7-ab23-0db73cca9ddc", "value": 353280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928269, "uuid": "4c95ee9e-1a03-42e7-bc7d-7e4f2d87848e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928269, "uuid": "6871c425-7d99-414c-aeea-9a2134a45698", "value": "323e2c782142c1ccb02e6d28779211eb520317fe73c4a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3f451a8-335a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634922493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634922493, "uuid": "779ec82d-39f1-4605-ad8c-0cba7e168210", "comment": "Malware payload", "value": "f490f5f1806ff64d7aade7ac9afc8f78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634922493, "uuid": "e60d9f20-0f9c-47ff-b559-549a9555d69d", "comment": "Malware payload", "value": "32b64d8d198bcbf4f4f1220eeeec504c8046101f19fe3f84d1b4cde3b489f5ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634922493, "uuid": "900bd84b-9ff6-48dd-b071-b0202d39650d", "comment": "Malware payload", "value": "9c73d95fbdc900bd6cd9819b0879242bddf79bac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634922493, "uuid": "59d71c21-888c-4e53-a7a7-f37525b28cf1", "comment": "Malware payload", "value": "93306c3d51e64f25093036f78b7cc00b4f2f29abfc45a1fcab296221ac728ea3dc47294de5ff407c04ab708c54929a37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634922493, "uuid": "8cb8b933-4e85-4aad-ace6-b48608a06193", "value": "T146F5336BEB69E91EE809C2FF603D0942FB04C761A2C3F5431A235C579B24B6F6D78118", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634922493, "uuid": "46590d93-aa80-47ec-b49d-c39aae5c3dbc", "value": "106f3d3e521ab0377bf478b03f3dd87b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634922493, "uuid": "e7c8a23d-5cee-40e8-a047-cea659cfece0", "value": "98304:a1GPddrgON8f8jaol3P0RK9V2cZRovHxzE:a1GP4q8Uj3P0oP2cZSHd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634922493, "uuid": "a5e46ef1-50dc-4ba9-95fb-cde3549a808a", "value": 3497472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634922493, "uuid": "0697734b-156c-4a97-8a1c-f57b298c9d74", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634922493, "uuid": "a4a3b28c-ba3d-42af-b4a3-c99a94da8ea6", "value": "zwoag.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e07ec7f-330e-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634889599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889599, "uuid": "937f6383-21a6-4f43-9615-73e6033d7b8a", "comment": "Malware payload (Loki)", "value": "8dd69ad3c4bd374d37ffbd59ecf6bb36", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889599, "uuid": "bc14871e-8fc7-43ac-934e-d2f934e0cad1", "comment": "Malware payload (Loki)", "value": "32bbff25b2a71c07f37de2a5a3864b02388263451ed7a8798fd78e93d57114c4", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889599, "uuid": "35e7c85c-f1eb-4a9e-b69b-e78a3552aa8c", "comment": "Malware payload (Loki)", "value": "4c0712b87b063640e62806cc3ce010c0f118c1ed", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889599, "uuid": "580a9204-ea29-43b1-80f0-c13c8b941f01", "comment": "Malware payload (Loki)", "value": "ffec10485f94e78af8e7f53ca82ecbe57e31e35019682fbc4ff6f8f089f77797778c9bf572b7b169357fed1e2eb371c1", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889599, "uuid": "ef9ae490-79ee-4535-9932-4725ad17ddb2", "value": "T15184D03B6D75E373F24F9F7CA1EA5318718F6CD5814C87FA56283A32803AA814987256", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889599, "uuid": "66b5bf69-5415-4830-a7e1-4f14466886fb", "value": "6144:mYO+RtjAG9ueNrVf5tdp6qWw+WTrsx/G+kXD9ZtG4stRrLE7LYMjUrcC1DIIA:7R5l1Tjry+hLtGJLhMAooI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634889599, "uuid": "170e46f3-1192-4249-998d-09e5ef7b6549", "value": 378312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634889599, "uuid": "3102fe9f-db73-49e6-b7f2-901b58443309", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889599, "uuid": "5b3ca4a1-1fdd-4ce0-9472-317edf4b673e", "value": "NEW PO.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9f93a9f-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1634928194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928194, "uuid": "e5fbf497-36ef-40b0-9d8a-c8cf3cd0031d", "comment": "Malware payload (njrat)", "value": "a82da1bff532a65cd40a98f551263363", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928194, "uuid": "8a7d46ce-e7b8-40cc-b6ed-cd762efa06b0", "comment": "Malware payload (njrat)", "value": "3324e0b42bb2f59c605cdab74271e0c3b63a45786d1941d92b3b7abb6946a0e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928194, "uuid": "1637b97e-229f-47d1-bfa0-3a29a6c34d8c", "comment": "Malware payload (njrat)", "value": "7e48a49fdbd41965a5cab4bb848e59d3cda8b5f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928194, "uuid": "b8d1bd97-040d-4d15-b495-90d98e8ca349", "comment": "Malware payload (njrat)", "value": "da4a135209bf72ff788844ce809d0bdf6631271032ed95ba8b71ee528e875538e0655bf72c9cea1121bd2a5d1c721f5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928194, "uuid": "8d1191f6-0b2d-4183-8463-86706d07d894", "value": "T10793E74977E56524E0BF56F79871F2004F34B48B1612E39D48F219AA0A33AC44F89FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928194, "uuid": "f3da7572-9504-4097-b539-a4cfd0f85d58", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928194, "uuid": "3be979dc-5f52-40e9-b2fb-aee735ce1bfa", "value": "768:KY3OUfhWXxyFcxovUKUJuROprXtWNzeYhYbmXxrjEtCdnl2pi1Rz4Rk3YsGdpYgM:0U5WhIUKcuOJ2PhBjEwzGi1dDwDYgS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928194, "uuid": "eb297615-94e8-4794-acd6-ca96986da5a3", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928194, "uuid": "061161f6-d488-453a-bb81-04cd783924b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928194, "uuid": "5540820c-2b8a-48ec-abd9-ebe533b9a9a6", "value": "a82da1bff532a65cd40a98f551263363.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a36a3348-32de-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634869234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634869234, "uuid": "0d77d53d-5059-4ef1-bed9-27385f335089", "comment": "Malware payload (Mirai)", "value": "a8dc9dd621523acad4a153c7166f129b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634869234, "uuid": "aed08c3d-ce37-49c0-94fd-f87c737611c8", "comment": "Malware payload (Mirai)", "value": "337c90584b8da6d91102cddfd181629091d9c52b538f40c42400152a8fe4a573", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634869234, "uuid": "879019f4-4de6-4efe-b896-971557c22c51", "comment": "Malware payload (Mirai)", "value": "38ccd889f7aa586fd00b2a158f40cf4e0733243b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634869234, "uuid": "64515273-3e68-4024-b9b7-94b4a300bee8", "comment": "Malware payload (Mirai)", "value": "b9e4c3fdac87e5be45e2258983d227e3f18dd284a0ab439e767b30b1bfcbb2f524108067883c85fc90c6539595d87d50", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634869234, "uuid": "c579c5d6-51b8-4770-a7d0-78a3a8646033", "value": "T140333ADAB902AD7DF98BEABE80160E0AB23123541053073777EBFC937E321549956E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634869234, "uuid": "d895d7fb-ba7b-4c0e-a8a8-d50beb4c58a8", "value": "768:mLGOe2kf9e9X9nberUI2vcv/QP3w5gFHviPuzWeHXpi2UJTMDnH638gU:mL/4f8F1e40ApFvimzpZi2UJanHY8t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634869234, "uuid": "b8688bc2-b1d6-4575-8b7e-5d3113bb0188", "value": 53056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634869234, "uuid": "7021afe8-ef88-408d-b1cf-c18b8277f0e0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634869234, "uuid": "2bbc5a5b-1b40-42c9-9aa2-8e44b2f39e2a", "value": "a8dc9dd621523acad4a153c7166f129b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10ddc1e1-330e-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634889604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889604, "uuid": "a04cda61-12c8-48e5-9920-ca5f2fd89065", "comment": "Malware payload (Loki)", "value": "77aad9a9748af47b8801fb26d6e9bc40", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889604, "uuid": "4183e433-efa0-4b9d-9fdb-1a367026b40f", "comment": "Malware payload (Loki)", "value": "338c91281208114f3401a255e7bd976f1f90af2173be95bd64d30f69137e632c", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889604, "uuid": "8b7b29f9-dfe4-4605-9f6f-9ac7d312e2d3", "comment": "Malware payload (Loki)", "value": "d487a763821c9c1a393108d9cd19a243d035e6fd", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889604, "uuid": "534e2a4e-34f6-4d6c-8cfa-139ceb3db573", "comment": "Malware payload (Loki)", "value": "95b3f47e7f783a72ea97865f8ee7b66a2119132ace206fce5528c8016b1ab16a80c3c8aba9dbe088f14cf077248519d9", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889604, "uuid": "01dbfa51-dbcf-4d09-a034-d5e5ab84d77b", "value": "T14884D07A31DAF086EF997DFD0D0A44006686FCF6731C214842DA7AB467F9AD7182983D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889604, "uuid": "2f719e55-4969-408a-8d39-13e6077039e5", "value": "6144:lWxxxxxxxxxxxxxxxxxxxxxxxxxxxxbxxxxxxxxxxxxxxxxxxxxxxxxxxpxxxxx/:3NKG4rR1PEttXZICEEV8nvs0/XU7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634889604, "uuid": "75ba43e0-db8c-4f90-9479-205ea4bffd94", "value": 377976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634889604, "uuid": "b6bee014-4c7e-4c0b-b04f-c8672eb224e8", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889604, "uuid": "bb8b42a4-edd5-4882-8855-99eac93ce98c", "value": "payment advice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27a0bb33-3350-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1634917989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634917989, "uuid": "4cc4358d-3eef-44d0-9dc1-d5b208c97077", "comment": "Malware payload (Quakbot)", "value": "f717e2f6f48ae6ee4875ef740cd4067e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634917989, "uuid": "1c98f753-27b8-4797-ae15-737bc2227cd8", "comment": "Malware payload (Quakbot)", "value": "33a3d0898f75bf922cd4d502d5dcedb41768e9fd4cec5302c3524321689aaf80", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634917989, "uuid": "e1cd93ab-59b8-411a-afd7-a8c7f4a51b19", "comment": "Malware payload (Quakbot)", "value": "cef662e43bded5848e499b5f3b506bb3829948ff", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634917989, "uuid": "0824b4ee-2822-4c25-97a4-b45cb25c7ce5", "comment": "Malware payload (Quakbot)", "value": "a983d3686e6436591da9024196d434d5233d716b5a09bcb0a179c3ceabc17f7d1626efe636ec0974a132cca3287844d3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634917989, "uuid": "c352ce6a-1667-4f48-82b5-027804f69a52", "value": "T16CF46E2033B58431F273173488B2D1A09EAD7D6158B4ED8F72C13A2F099B6D1DA69B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634917989, "uuid": "9d204193-7efb-4cd7-9dc5-a101c8ceb35a", "value": "18bc049e94331b7a5a620b30a77ce192", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634917989, "uuid": "fe9acc1e-7417-417c-8b26-1d38b514738a", "value": "12288:PdifdQ3K/AEB30roh0CdSIbKtAJbJ3DcALweuxt2DfJupI3QoUmSyjbfm2OiAxPX:PdiC3pW0rNWBDc1FnmU9xkT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634917989, "uuid": "ccf2346e-f0ad-4345-b2e1-afe86b614dfb", "value": 759296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634917989, "uuid": "676bbcd8-6662-4355-86b3-e9d88dfeaebf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634917989, "uuid": "edd57f65-6875-4b5d-92f0-288aa80706f8", "value": "33a3d0898f75bf922cd4d502d5dcedb41768e9fd4cec5302c3524321689aaf80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47f8e08d-32ec-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634875094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634875094, "uuid": "c68297ba-197a-481b-adc3-8ca97316a0dc", "comment": "Malware payload (Gafgyt)", "value": "54309cf6a48ac062696bb40e222a9d72", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634875094, "uuid": "38255214-a444-4e02-ad54-a11e3fcde494", "comment": "Malware payload (Gafgyt)", "value": "33e1754410bf5bceabb142523fab6968ca189499dc9cd513af6a2482778a8267", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634875094, "uuid": "295a74a1-1848-42cd-9aaf-1f7383afed82", "comment": "Malware payload (Gafgyt)", "value": "f55f6baf624ac9dab9c04f54936222bb770556c5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634875094, "uuid": "1c94e61c-af1c-487c-9d59-6d545ca2e6ed", "comment": "Malware payload (Gafgyt)", "value": "975edd95a6d5a09560b3fa75944d437fd214bec82abc5a9a9d639c9c44170a533783332998cf984aa9d6d15ff171efba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634875094, "uuid": "9505996a-6161-45b7-b180-fde5659685eb", "value": "T19C734A47AD628FB7C146AAB525A759300723B8215F0F1B89713DAAF8470F8CDB80F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634875094, "uuid": "87439109-ad98-4499-a0ce-7e49a3c5f711", "value": "1536:kAmbedEfIKy1BABWWNxiEVN/Co3yzTN7mj9VqYLe8f26e:v+eefvyoWWF/f3Mhmj9VqYq8f26e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634875094, "uuid": "49128ac2-d812-4fc7-b52c-bac146e1d195", "value": 77753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634875094, "uuid": "107e22a5-1b50-4230-a963-dbc0fb0df92e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634875094, "uuid": "2e198e22-4642-4157-b624-faea574808b3", "value": "54309cf6a48ac062696bb40e222a9d72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bb01b43-32d1-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634863584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634863584, "uuid": "942d038e-8ce9-4463-947c-5b6d018a702d", "comment": "Malware payload", "value": "bce4713777da99fff7b5c9bb46fc5bee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634863584, "uuid": "993b2799-152e-4ea6-a6cd-b2f7f3a8ebbe", "comment": "Malware payload", "value": "346de455537cccf3b00efd254183ce2fc03c6397ab844f11e5526a95f28d05a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634863584, "uuid": "76f20b41-f2fc-42d4-9a8d-3eb58194c5b2", "comment": "Malware payload", "value": "77721478fe6abb86ca0095053422b2feb03b03f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634863584, "uuid": "7d550350-0643-473d-93ce-cfed99153ced", "comment": "Malware payload", "value": "a67240f05d79f76ac220d8aa4eb036f1e0b76373cf1405d6f42a9d7daa54a50cc5a4d7fb66e8651d7ab2433c3b5b68de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634863584, "uuid": "30bf968b-2b65-4ba6-a265-fbb595cad9b4", "value": "T157D5332076E85573C769B5FB580B7C2153F222C2D431EA9F129316B99180F70869FEAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634863584, "uuid": "5f7eb749-9a0b-41e0-ac73-0eabf6f0b8e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634863584, "uuid": "a26f3df8-3e0a-486e-ab84-73a02f57af03", "value": "49152:/smhnqAs9pJc0dnKh+Q0N1rs+vIUSg+6+8ohnRh1Na1OKM6nYAKhFQpSH3Oh5gxr:pqXpy05Q0N1rsYSZ6BoXh1kkypSH3Ohs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634863584, "uuid": "a291ad46-e7b3-4b9e-a73f-a8103dde482b", "value": 2978304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634863584, "uuid": "27777ad3-c447-4840-99a1-b23443921adf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634863584, "uuid": "3d1dc1b7-bc42-483e-80ec-a7f0e928c8d7", "value": "HogGrabber.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b68b4a7e-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928107, "uuid": "f3bded69-d244-44d0-acf5-962faddd5e42", "comment": "Malware payload (RedLineStealer)", "value": "3974afbb5234f0716872197575358318", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928107, "uuid": "62c1c5f0-6de6-461e-99ff-4486e8aa01f9", "comment": "Malware payload (RedLineStealer)", "value": "350689979016ce813a57ccd1e2e29a5003b5507d13e589505ef86205aae53e2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928107, "uuid": "680a634f-6c22-4c76-9692-6101a7d758f9", "comment": "Malware payload (RedLineStealer)", "value": "5f5836e28971ac100c83a15b16138111597a4cc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928107, "uuid": "be6503d6-95db-405a-92b3-ea3e68a36548", "comment": "Malware payload (RedLineStealer)", "value": "524c7acdb66b346d48786a08c07c7596134a6c395e1c385ae32b19b6f9b2386124499b84cbd2790d564a936ecc41f914", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928107, "uuid": "85fe8bdd-bf88-43cf-b79b-94495e69d360", "value": "T141E4F110B6A0C035F2B326F845B687ACA53E7AF15B7650CF62C516EA5734AE1ED30327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928107, "uuid": "5ae0f074-8f80-4b2b-ac2c-fb50da492196", "value": "25e96726029c322936cf0033b6a07058", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928107, "uuid": "10e4a133-77a4-4dc1-aeed-acfac96b450a", "value": "12288:zCUuYRZcW5Kk7tgEPV8q4h4wYvrmfUNnBXYLKTcI6eyR:epWsk7tz2AHTscBXY+wR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928107, "uuid": "9ec316f6-b8da-4dc5-83d5-d0c9aa901acf", "value": 669696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928107, "uuid": "ca20510d-f58a-47ad-a2f0-13ea60e0404a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928107, "uuid": "525799ec-a40a-4810-9402-d08fa0f8af70", "value": "3974afbb5234f0716872197575358318.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80c4b9b2-32e6-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634872612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634872612, "uuid": "eb30812d-c58a-4914-8aee-70de124138a4", "comment": "Malware payload (AgentTesla)", "value": "5936715a6a40ec84592e71ccfdfc1daa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634872612, "uuid": "82ee9602-9d19-4cfb-bc79-0979d0f517a8", "comment": "Malware payload (AgentTesla)", "value": "3509582c5fa8e6a4cc257c72e67eec511a90790a60185bce44303fc2c39be80c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634872612, "uuid": "e75b3eb4-1faf-44df-bed4-631e44d6fa8a", "comment": "Malware payload (AgentTesla)", "value": "380440d5690a8ed799138022a7b7678c0323c2bb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634872612, "uuid": "70d87723-bfd7-4484-9478-e0115880439b", "comment": "Malware payload (AgentTesla)", "value": "ca98677002a9f075f435842b5fedf5eb2b85fa2b795051a61d0e2ec6191d1f3c51da3e296bfdeba35f60275ab1909b63", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634872612, "uuid": "d5243673-18a4-491d-89f0-57ffe3f7b0cd", "value": "T13574DFB6D69488A2D8D15A709137CD74A5AB7C74B0E4868F0EFD7E3B3976B8204B7007", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634872612, "uuid": "134e5925-b14d-4cf2-ae1a-ab5e08fbb332", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634872612, "uuid": "243f7012-9860-4253-9862-9a0b188d8f65", "value": "6144:GBlL/HO9V9T1HKlyBtCv1KIhxSVabyXOylMYZ7Q/K:EtQF1H0yB01L3Yau+7YVgK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634872612, "uuid": "3995fdbd-f88a-4b41-85e5-b1949675e819", "value": 346215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634872612, "uuid": "10c0faf8-037e-42e2-926a-9c667b3a61fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634872612, "uuid": "65584994-1e5c-4af7-ba75-0ffb6463046c", "value": "PROFORMA COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c230bf7b-336e-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634931133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634931133, "uuid": "b4292d6a-5597-4c70-a9d0-1e6716da7408", "comment": "Malware payload (RedLineStealer)", "value": "c38636896afd2bff5af0a8c641a50e0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634931133, "uuid": "68a5627f-1591-4064-91e0-f3c20c0d811b", "comment": "Malware payload (RedLineStealer)", "value": "351b7b183ee55d280acfffc23886ef74efd76873d508704336bb782d84176f90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634931133, "uuid": "e33a0251-fac7-4a0b-bab1-bf87f1358330", "comment": "Malware payload (RedLineStealer)", "value": "688967ba3b597755c31be44bf8daf3554840674d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634931133, "uuid": "0de8da23-5538-4575-979f-ea2f09b75de9", "comment": "Malware payload (RedLineStealer)", "value": "38d9a726fc8db9720128f860bda32e50619fc84014dfaf0ebf1e71e996ff26e2db4d8e8c26b57ced3033be789e4174dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634931133, "uuid": "f969adaf-b920-4e1b-917a-bd3c4e77c84d", "value": "T144A4BF00A761C039F5B762F94ABA936CB53E7AA1672454CF53D41AEE97346E0EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634931133, "uuid": "d4a5ac74-ba05-45b4-8831-8ef84e0367af", "value": "bac67046644aa5e445c1272184462c49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634931133, "uuid": "7c55c8aa-4644-4a22-b6dc-1dfc76cb3bf1", "value": "12288:SuIn8SDrZ7jwt+SncSwgQsTGPOel8K7nnvo2:SwE7jwtNGeGP7l8KZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634931133, "uuid": "f07d30de-a285-4d0b-a8be-692a70ab0d42", "value": 452096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634931133, "uuid": "a655b363-9157-4de1-8bec-4c036d14fb11", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634931133, "uuid": "b09335ff-5d83-4420-b30d-5cf44561d86f", "value": "c38636896afd2bff5af0a8c641a50e0f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0693642-330f-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634890301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634890301, "uuid": "afb11147-4fb4-4f48-9f02-1972d99943d4", "comment": "Malware payload (Formbook)", "value": "a26c06af19d765ddcb32a48cd6acb1eb", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634890301, "uuid": "1d407887-f7cd-43f9-a77f-78bdd3b936a6", "comment": "Malware payload (Formbook)", "value": "35204f1850b1439ef9a8fd958d6c3045edae69378aa3593021795d0600fc5a01", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634890301, "uuid": "1415213d-008c-4d9f-bd39-20665a38b8c7", "comment": "Malware payload (Formbook)", "value": "152dcab66baef093434bf69a0c3f9e78f7bbeb90", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634890301, "uuid": "9e274dfd-edc1-4bf6-9c3b-4ba679f99d37", "comment": "Malware payload (Formbook)", "value": "f898f871ec42d4c5fe99d3d574ad9540bece18a378d6e8e5a4a500449492937e663714432c8b75959c9e8635fef10a3e", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634890301, "uuid": "97458880-fdb3-4245-be0d-49b70fbb92e7", "value": "T12384CF41C98284B1DBE5EA755F3BC831D7374E3E2135805606F67EB739FE863402AA62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634890301, "uuid": "a52d8817-cf23-4761-b6a4-d21f9e865d0c", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634890301, "uuid": "29340e17-1e45-435a-a3d1-bb7c09c02b86", "value": "6144:qBlL/k6xymrfKeNn6/13qb6RVCz9j3wJPJFpSZX8F/wnq5onDZiD7ptk2:QhymjKetV+RWTiJvKnq5KDZiD7pX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634890301, "uuid": "09563860-81a0-46dd-91b1-4f200e674b6f", "value": 385671, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634890301, "uuid": "1981d857-f988-41ea-b8b2-368e54a66c36", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634890301, "uuid": "4102119e-f2d9-49a4-bfe4-f1b16d322988", "value": "DHL_119040 receipt document,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bf4aee3-3334-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1634906105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634906105, "uuid": "01424b91-5b07-4b7e-821e-c283f7bc0e01", "comment": "Malware payload (RemcosRAT)", "value": "6cfab0d526994b9b98582a693fa58fc1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634906105, "uuid": "30ff9dec-0dcc-491e-9f8c-17e414edc808", "comment": "Malware payload (RemcosRAT)", "value": "353fc4210bc103d84f0a67dfd4a1a32762484f51d7af15da4080c8efd2752a5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634906105, "uuid": "2691dd39-d45e-4135-8d30-272e3f379615", "comment": "Malware payload (RemcosRAT)", "value": "16deda32ed2a9268e9bfc4d23d21a519cf720fb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634906105, "uuid": "a8abd708-f80b-4cff-8c8a-e3f5c15713c4", "comment": "Malware payload (RemcosRAT)", "value": "67a42038e0bfbf737ca0e062ab71c2c3ac4b3794f10d5040e25daaca84300a2f82de92f2ca57bf8433510ccd93254fd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634906105, "uuid": "3cc91fd3-c545-438e-aa1e-f794616802c6", "value": "T121F4CE0436E95B02E5FAA7F41532594093BB7DAE2479E64E1DDE34CA0F37B448A90F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634906105, "uuid": "2a380649-a613-419f-bb69-69add810b990", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634906105, "uuid": "28083feb-5948-4db9-9194-721f597e38bb", "value": "12288:GmI69Fwmp5ofY7Q8TrardB+SlRnM+/NwaGfm8Jn3GQLdhu7o5ZV75cNUJGAfQ:Gf69Fv5f7QlZPlS+/VGfmA3GQju85nV+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634906105, "uuid": "0182fc11-760d-4274-9ac0-046190b7224e", "value": 783872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634906105, "uuid": "f4c6b39d-e7e2-47ed-983b-6b40736a4d8a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634906105, "uuid": "072437e5-b08c-4633-901f-07741f90792d", "value": "SPECIFICATIONS DATA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb94fa44-32cd-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634862054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634862054, "uuid": "5b56203e-481b-4a0a-a73b-49eb0a6b04d9", "comment": "Malware payload", "value": "29bdae49dbc3bae32e0bfc48c3e1a071", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634862054, "uuid": "ca4aaff8-ace6-4a11-8f71-bbb4609b6388", "comment": "Malware payload", "value": "36265d5b64a71f6a4f94f327497250f5f918fd9f9b18b7151e643cdc3c6271a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634862054, "uuid": "7c98c025-bb19-42ef-8e93-0176620ddbc0", "comment": "Malware payload", "value": "33cad194388aed6cadef494d46c01464234f1f45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634862054, "uuid": "27ac7e04-848f-4d67-adb7-d592276b6420", "comment": "Malware payload", "value": "ab848bccb82845074333cfaf0a435d855bef2c38205be1ec8125059faf7fbfcace674bebb819775ceb9d2b98153a9913", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634862054, "uuid": "76a74773-182a-49df-8239-2902f4e5bc49", "value": "T104E5235128CB9D31C77A24FE053A6B24E6D13DA3C479932B3BA21D651A097B0CF4E4F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634862054, "uuid": "c8b8c122-f1ca-4df4-8191-49777ce1cb5c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634862054, "uuid": "62cafe96-967d-453e-bb53-510973991602", "value": "98304:AqXpy05Q0N1rsYSZ6BoXh1kkypSH3Oh5BemgY:x405QYtsTEB08T8HehLvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634862054, "uuid": "e863496d-a153-4269-87dd-4f118b9562d6", "value": 3189248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634862054, "uuid": "0e67b834-35e9-4ed5-b51c-d9b1ab069957", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634862054, "uuid": "4281d8af-f07f-4b92-a638-907317f40ef2", "value": "ItroublveTSC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecf4d55f-32e8-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634873653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634873653, "uuid": "64a48e17-af18-41f8-82fb-f65177374dc6", "comment": "Malware payload (Mirai)", "value": "be409d69d0b9ef1c536f1e55b078a3b8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634873653, "uuid": "c58e6eb7-ea97-4630-8534-2427471cadc7", "comment": "Malware payload (Mirai)", "value": "363654b4c9d21d53db88e9f15288eb020dfc882cd7218d352e9bdeb4909c9368", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634873653, "uuid": "ee26bcdc-be67-4cc9-adc6-294f63b8332d", "comment": "Malware payload (Mirai)", "value": "3b235f63555d5872bb110ea70ae07247dd20feff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634873653, "uuid": "b3df02ae-eff0-4005-a05d-71b222b938d8", "comment": "Malware payload (Mirai)", "value": "f88dfc3c78e5904c590191b6e00512f308cabb649e5d0694eff1541c7a09f3629ab8cb773b996b1aa049117fcff3cb0f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634873653, "uuid": "7b11c47a-59b9-4b8d-b831-fbe36aa5af28", "value": "T1E763975D2E219FACFFA886344BB35E20924C33E626E1C945E15DEA011E7034E745FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634873653, "uuid": "2cfe7da6-708f-44cd-9c14-1d7224794de7", "value": "1536:58B83DOpSxUzpP+vntvnCEvnNY87YdMyH2q9r0t3bCTeJqmw:qK3DUSq5sC2er0trCTeJbw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634873653, "uuid": "63749c5a-03c3-4fad-9fa6-434dc7f56d12", "value": 67564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634873653, "uuid": "f10358b3-9a6f-4c0d-ad51-1acbbbe004fd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634873653, "uuid": "2ea35f94-a9f7-4ad9-a218-bc2361708f84", "value": "be409d69d0b9ef1c536f1e55b078a3b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e444968-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634928013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928013, "uuid": "4b1fa0a1-7c88-43b3-83f4-f32304c219bf", "comment": "Malware payload (Loki)", "value": "41b5046ac65e64d2cb96b1a6e229db67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928013, "uuid": "c2e8b015-44ca-4ae7-9d1a-15ce015430fc", "comment": "Malware payload (Loki)", "value": "367418cc6a5628cfab14677e14878c26911a1d165d4aad33ed41efa4facdea28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928013, "uuid": "8b6bb23b-74a3-4f0a-aa7f-368e81ca251e", "comment": "Malware payload (Loki)", "value": "184f8bd589c01e58fd7c34c6af406f297e287a42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928013, "uuid": "d5625bdc-2480-43c6-8baf-2fe298501fd7", "comment": "Malware payload (Loki)", "value": "bf8e0a6116ea5f84f97f91abbb91136f3615c417a6ab27fa61d8244357438b8b3138d76a5201ae7f1f0f675462bf8d15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928013, "uuid": "9da6fa93-6bbd-4006-9c93-7d83c9227d95", "value": "T110A32A42B2A5C030F7B74DB2BB73A5B7857E7C332D22C84E9352459A14215E1EB7AB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928013, "uuid": "a9815eee-7ec4-486b-a9dd-237b1d8c3e05", "value": "0239fd611af3d0e9b0c46c5837c80e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928013, "uuid": "49805203-d62b-4bba-a0d1-93a64093d83d", "value": "1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928013, "uuid": "96e76b0c-af6f-4a5b-8326-4df834f43480", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928013, "uuid": "9287a6fd-fb4b-45fe-8568-9c73f4c91109", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928013, "uuid": "7a541cf3-1de2-48df-bd38-acb49cb623f6", "value": "41b5046ac65e64d2cb96b1a6e229db67.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0361eedd-3349-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634914922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634914922, "uuid": "a07c257b-483b-475c-9ec4-b505c5bc1daf", "comment": "Malware payload (Formbook)", "value": "2ea863b6b81bb910cacf7ad6562438d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634914922, "uuid": "29827a14-b3fe-45bb-8de1-b4e9484b9ff8", "comment": "Malware payload (Formbook)", "value": "371a7fde3d56ab06c051efdd78f55fa6a142360de778646d24f713b9097048e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634914922, "uuid": "c2687ae9-ca81-45b6-bc70-7ce7a8cd03f0", "comment": "Malware payload (Formbook)", "value": "13f5dbf1f7ba7191b41ca1aea3d18035709f6744", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634914922, "uuid": "da7f3bd6-7264-4eb6-8c43-232dc665ca68", "comment": "Malware payload (Formbook)", "value": "b6a558b476e0685f12b0ae57b3b339b9bf481bfa35ca0995c5a64b5762681dbb5c56ed231f8ecfcc639365ae9afc07f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634914922, "uuid": "1f9f6ef8-db73-44e9-8aef-6f88923535f8", "value": "T174B48C0436B94B12E5BA6BF01631480493BB7DAE247DE60D1DEE74CA1F73F448A64B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634914922, "uuid": "1062b425-028d-4bee-b32e-adceca9563ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634914922, "uuid": "fbf83425-51d6-485e-a183-c828e04aea89", "value": "12288:UGeKvwZe/UrHaGfb6POd+rTpOSJMvMEB7:UGeKJcrH7/d+/BMv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634914922, "uuid": "95cb4564-b343-451a-b274-936c236d7140", "value": 525312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634914922, "uuid": "19c22fed-825f-41a3-b844-bff477e87c36", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634914922, "uuid": "bddc8a69-9924-4451-a00a-c2df19e412d1", "value": "Muestras.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "324b3996-3308-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634887083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634887083, "uuid": "c43021d5-f66f-4dd2-9686-24b4fcd8150d", "comment": "Malware payload", "value": "e2603218f76a8dfa60eabcab60a00316", "object_relation": "md5", "Tag": [ { "name": "mac", "colour": "#285994", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "UpdateAgent", "colour": "#B10D2A", "exportable": true, "hide_tag": false }, { "name": "WizardUpdate", "colour": "#5BF7D9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634887083, "uuid": "eabfdfe8-5ca5-4d0e-acc6-3bb25bc01ea8", "comment": "Malware payload", "value": "373007eccde6d89930c2235160d18d7f4f268547ec789540cd6e1b08de3e7e96", "object_relation": "sha256", "Tag": [ { "name": "mac", "colour": "#285994", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "UpdateAgent", "colour": "#B10D2A", "exportable": true, "hide_tag": false }, { "name": "WizardUpdate", "colour": "#5BF7D9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634887083, "uuid": "c4fc872c-ebd9-4aad-b406-a3363081f35e", "comment": "Malware payload", "value": "74c2415bcf23356eb201e8685b2e6ee5513ab8fb", "object_relation": "sha1", "Tag": [ { "name": "mac", "colour": "#285994", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "UpdateAgent", "colour": "#B10D2A", "exportable": true, "hide_tag": false }, { "name": "WizardUpdate", "colour": "#5BF7D9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634887083, "uuid": "67ddc2ad-0897-4c01-aa10-ac9df1357196", "comment": "Malware payload", "value": "c741fdcadd4f13ff2baad4b359564854f67862a1619907ab20f3804ac443774452dcffec83d078a95911ecc79568c62e", "object_relation": "sha3-384", "Tag": [ { "name": "mac", "colour": "#285994", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "UpdateAgent", "colour": "#B10D2A", "exportable": true, "hide_tag": false }, { "name": "WizardUpdate", "colour": "#5BF7D9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634887083, "uuid": "057dbc4e-3f0f-41d7-8358-080550d01faf", "value": "T19C827DEA17003865FF94A9F403CDF1F3EE73A39D6F630066619284E21982FB57A1592D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634887083, "uuid": "ebc10fb0-0587-4b7b-85e3-2405ea317ef8", "value": "384:UbZ9JZc2KSr+Q8orTHsra3rS3BybrNab8er0rQScOg2Qa8:UbZLu2x8SwByab8nbR8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634887083, "uuid": "d88fe3bd-c31a-4546-ad84-e7cc9ec126b1", "value": 17840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634887083, "uuid": "5fe97e22-aacb-45c8-b772-e520e3f7fa0a", "value": "application/x-xar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634887083, "uuid": "48db33f1-1fd2-4942-a7fd-4f9ceab7a039", "value": "InspectorCleaner.pkg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bb6ef6e-3312-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634891475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634891475, "uuid": "4ef9de09-1da5-4aba-92bb-954542cd4aa8", "comment": "Malware payload (AgentTesla)", "value": "817341449a197b56cdd3795ca7dba89b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634891475, "uuid": "2331e09d-78fe-4433-a50a-59f88ae81d48", "comment": "Malware payload (AgentTesla)", "value": "3806b35c08f81f6b6d8e3d9d4e9321ffad60f1edbb969655ed90926832c443d9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634891475, "uuid": "4f798454-166f-4a5c-a23b-886ab0cab22d", "comment": "Malware payload (AgentTesla)", "value": "b4f79225b1c45f49771fd72e046d43be1acfab59", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634891475, "uuid": "41c6126d-b303-4cbf-ab6e-5d3e9340b658", "comment": "Malware payload (AgentTesla)", "value": "f75060a77c1ed21ed42ac64877979de11e98fd01632c8e89491c76124f3f03da5e9ba27121f546d23e1c5dfadde4b6b4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634891475, "uuid": "0b2d4918-5684-47b8-a5fd-f2bf20a41930", "value": "T135C48B0432A99B12D9FA67F01632450497BB7DAE287DE60D1EEE34CA0F77F444A50B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634891475, "uuid": "aa842bb0-e0f3-4e24-8a0d-f65630eb7d98", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634891475, "uuid": "44156b42-dac2-4b6c-9bd5-2c54618bd354", "value": "6144:qGxhL4ITcv6IW1BtxIib5SCRif/IDh5loS4DA6zrLUSwbutczDNiVghtSYsOi:jng67BvIKa/IDhASE1CsVLr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634891475, "uuid": "1f8c2105-4399-4a39-9339-b15d832b6706", "value": 556032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634891475, "uuid": "1c765259-1d20-47a6-80b7-1f2b81c39d92", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634891475, "uuid": "2486c697-beb5-491b-ba53-b2ed341a7e72", "value": "Remittance_Report.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c47fdccc-3313-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634892053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634892053, "uuid": "d4ca4b37-d643-47e4-9595-32bf71c07a08", "comment": "Malware payload (AgentTesla)", "value": "042270e4d654c314f574b266ed7b6e5d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634892053, "uuid": "661e1373-71ba-495b-aadc-daaa4b1ede07", "comment": "Malware payload (AgentTesla)", "value": "395014f2f2875fcd5bd4782263aaa7555f440797de528f5135a1d4c52fc920cd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634892053, "uuid": "e03b0f02-0122-42c5-ab59-fe8f9d6d63f3", "comment": "Malware payload (AgentTesla)", "value": "1db2f1b45bcd832da784cdf62fcb213311d1dcf6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634892053, "uuid": "19b1a8c2-99c4-4978-bbd9-a6eed31596ac", "comment": "Malware payload (AgentTesla)", "value": "4ff15825e2ec28a05565522182d25700120b8c8ba956222bbfa12f1d857f11e0daa5d4af41856be1f478b66b5075f1d3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634892053, "uuid": "3664b5f9-6c85-4135-af27-eb4f0d022d20", "value": "T145E49DBD3115BACECA279DB5C9442D50BF607C37071FD24BA45730AA9ABE496CF304A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634892053, "uuid": "b91bbb11-7d88-4e3d-a3d8-73ecbf886d7b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634892053, "uuid": "a63907dd-b876-473e-841b-5c9322b1322e", "value": "12288:SNrIbw8eGkE0rIrDrkWhddMugJ1+MPw6B/lq3MqJFTPYFkueno2kWqQ0:0cbw8eGkszjcJMqw6B/l6Mq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634892053, "uuid": "f064d8a3-03e1-4fd0-931d-5e50002632f1", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634892053, "uuid": "5f849674-dca0-4e12-9857-7b29c53853ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634892053, "uuid": "cefa6585-52f3-446e-abd4-6190579462bc", "value": "Curriculum Vitae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a479f704-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928077, "uuid": "f5764f61-4952-43f3-b6f1-d0b801be4061", "comment": "Malware payload (RedLineStealer)", "value": "87fdd1f971393626ed0c439344f8e4ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928077, "uuid": "93f13006-a89a-4457-b652-bc1d4418221b", "comment": "Malware payload (RedLineStealer)", "value": "396cbe19b8667aa7a158cab7f801b88249c9fbbb389cdf23c7564edadffb8e36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928077, "uuid": "374387ee-48bd-4a0c-963a-1d36bf66f96c", "comment": "Malware payload (RedLineStealer)", "value": "17caff9683f7e4ee06b161ebf04b8c9140c1b452", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928077, "uuid": "0c7cb255-44bc-4e13-ad9b-1f1a99ff2721", "comment": "Malware payload (RedLineStealer)", "value": "789ad5750402387532a1c473bea7a6ce657c0eada0d20d3d9547b3ed3b54493b1ad71d8af44e8fc43f84011a29bb6ef5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928077, "uuid": "741532ac-1fa1-46ac-a449-09d4aa07fe70", "value": "T130F4D010BA90C03AF5B722F449B96368A63E7EE16B1454CB52E527FD4734AE1EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928077, "uuid": "e5e91a5e-f5e2-4cdd-9177-d16646d56cc2", "value": "9cccee30870eeeef9fd80f169e4bd55f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928077, "uuid": "070f101e-3ca4-4717-b182-cfc49be6fe47", "value": "12288:HvawZZoCKt41cXlsCtZ24x7sesw6ubn/TBT82/OXr5caz1oRBV+OFeP:HyWu4OuEhC4fBo2W9zyRB4F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928077, "uuid": "d6176932-29f5-4702-9326-f28b242cde0a", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928077, "uuid": "c0abaa63-8c14-4343-9308-da92b66cd8d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928077, "uuid": "a0933ba4-d242-4631-bd84-391a6e747a46", "value": "87fdd1f971393626ed0c439344f8e4ff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a255179-335f-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634924409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634924409, "uuid": "f451826f-b61d-41aa-a237-751c07840532", "comment": "Malware payload (Gafgyt)", "value": "42f3fb3cf5539002314b4e386b199a09", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634924409, "uuid": "573a0e38-7ccc-41bc-abf5-ef89b37b8749", "comment": "Malware payload (Gafgyt)", "value": "3ad7ed2bd64f9ea590cd4653249abbaf4e9b5e0dc83d29332c54603ba392e937", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634924409, "uuid": "b8b8f142-9271-4254-909f-6edf104cec1f", "comment": "Malware payload (Gafgyt)", "value": "bd95d12519f6c355fae75bff28760ee906e20a59", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634924409, "uuid": "df57f790-f01b-4056-8f7a-e58eb14a408a", "comment": "Malware payload (Gafgyt)", "value": "bce854d59399ada174fdffa96d3ecb91aa22b901d0d9703193065f9e9530d3d2dfbfcd48859cad04d7e021924f28eb20", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634924409, "uuid": "623b84a6-b60f-4c74-aec3-6a722ac763fa", "value": "T13F935D27B552C67BC08752B42BDBE9615833F4BC0B32724B33D47DA52B269C92E6DB01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634924409, "uuid": "5faba635-156d-4f35-a3c3-ec94d5684b78", "value": "1536:W7uJtxMVEOVbazlvhE1hmkJ0S36W6bWjK3TaPXfH0mA+KWOXFseaZYxe:4SMVEOVMlpmXJ0O6WpjKjafUm/KWOXFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634924409, "uuid": "47091d81-d1b4-4b32-8b97-3918296c6d7e", "value": 94679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634924409, "uuid": "f25509a7-55b6-41e4-a777-8b794ebb3b87", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634924409, "uuid": "f2a03910-ca77-47fa-9ce7-6f3ad659bc9d", "value": "42f3fb3cf5539002314b4e386b199a09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e33ea6e4-3361-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634925605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634925605, "uuid": "e6f4101e-3bbb-4bf7-8467-6f2fbba45166", "comment": "Malware payload", "value": "e26a6e636ad111f85a46239cd09ea36c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634925605, "uuid": "9ec5651f-bfea-4e6d-8473-97f3e2029f8b", "comment": "Malware payload", "value": "3b2824f9039ff9ef832838ecc17b941dee1704ea05c09889d689201f357f1f25", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634925605, "uuid": "531390ba-c651-4a4d-b31e-d55dfc2117f2", "comment": "Malware payload", "value": "2c424022575ca27080286b67bdb31d821471755e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634925605, "uuid": "57432e00-e1a5-4702-920d-4d41b22969e2", "comment": "Malware payload", "value": "562e8d9cc8768ebec72281f50c2601e491e2955f4b39ed9628d60b4d8a3304ee5030f9a2b80d31c44ef93e1e0cbb009c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634925605, "uuid": "b4b96108-dc43-449f-9e4a-b09083644cbb", "value": "T10163C6163A21FFFBE55982304BF38A3057D476A22AA15386F26CDB5C1F2168C1C5E794", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634925605, "uuid": "76e00478-f45e-4490-90bf-367bf49f1da2", "value": "1536:8gDJMrmy4F2woWp/JqeNGytn1eaApZ6uyxFNwC8eoKGla4Xxr:XN7NGyJ8pZ6FxFNwBeoKGU4Xxr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634925605, "uuid": "766484a8-4699-4cc5-90de-d01225899ba5", "value": 69487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634925605, "uuid": "21f5741d-93c0-44cc-80e3-3bcdb70fb292", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634925605, "uuid": "b5d0f6b0-8d87-43a3-9f45-f12df4390739", "value": "Fate.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "243d379a-32ef-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634876322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634876322, "uuid": "deae5e0a-ad3e-4b23-8bbc-e2493732a80e", "comment": "Malware payload (Mirai)", "value": "a31e61204ca7304d443605b9995bffe5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634876322, "uuid": "bbc4d668-b63c-4b4e-92c1-09ef4be67703", "comment": "Malware payload (Mirai)", "value": "3b4ca27d15682368c2009bab10f874a48a16b69f5d1bc611c48877373244f9c8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634876322, "uuid": "e5211bfd-e9e0-4efc-9070-651fdc251f25", "comment": "Malware payload (Mirai)", "value": "84078eb848751127ec0f5f63844fddda1c7f0e7f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634876322, "uuid": "c8303e3a-d148-44c8-b186-72980b3903d5", "comment": "Malware payload (Mirai)", "value": "8875dffd5edbe309c21840cb29b85894b64fe702d3fa78381f36f17b9db6ab9f7b82d0d8e56d93a59812e3d028ced841", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634876322, "uuid": "ad4abba1-613e-4e63-b100-368057ed2504", "value": "T159432925AD792E26C0D8B57E11F78724F2E2224E25B8C65E3C721E4EEF04740A5537BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634876322, "uuid": "e7a20ad0-eb31-4e95-a76c-48f0224e92fb", "value": "768:eLobAxU6q9Hfymp0xginuYsCkLB6WsTwIC1DQdszoDaS0O+DCD2:eL0AxvSHfymp0xgunsCkV6vTMDauB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634876322, "uuid": "e5a84f16-ea21-4722-8be7-2632895c8694", "value": 60412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634876322, "uuid": "47808337-f38e-43c8-b526-58647308e5f9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634876322, "uuid": "cda71f14-dede-4388-aaaa-c9a97ccbf245", "value": "a31e61204ca7304d443605b9995bffe5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dfa55b8-333c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634909544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634909544, "uuid": "3e33645c-7bbf-4dec-8421-0779087d0f8f", "comment": "Malware payload", "value": "398371c8cc3528881ea5d49f678a541e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634909544, "uuid": "ca075d21-9cb2-4369-b680-9768b05213e0", "comment": "Malware payload", "value": "3b79b459fa58a0a61d976fa60734e11fce3abd93158a70ed2b9a71cac23fcd05", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634909544, "uuid": "8c3d6d13-5485-4f78-9333-2debe0b96773", "comment": "Malware payload", "value": "cbb50dd295e2e4756e7399e47ade0d5f4a8e4c5d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634909544, "uuid": "7203bf13-53c5-4f4b-bc55-d802fc167d93", "comment": "Malware payload", "value": "94058a267111fc8a7a13531cf9df0a786e3b516c8317f490adf740d6b67110385fa34ab01215d74c438a81b69e34ab82", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634909544, "uuid": "f394fcdb-f49d-4a5f-a3e5-518a8a081fea", "value": "T182C533E06AD5FA04E09F26B633DCA2C90E70FD14DB4747A8B46B73964674F20DE10DA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634909544, "uuid": "7748f1c7-dbf0-4c95-8acd-8edb77641e00", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634909544, "uuid": "4348b788-1ef1-424d-82bd-639d1a8a2d51", "value": "49152:sjPqmxYYx9DBirx9I4Rq1hVPsH7wfXD0gfXJfPkvstmnP:2P7xD9gx9O75sH7Y0gfZfPDtm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634909544, "uuid": "71140425-40fd-4af8-87a8-bcbe13a90b28", "value": 2625024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634909544, "uuid": "484a8b9f-515e-4c51-8c8d-9b22e5d01742", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634909544, "uuid": "2811e7d7-9872-4498-9095-466717be63c3", "value": "398371c8cc3528881ea5d49f678a541e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86feb190-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928028, "uuid": "d7eda211-81c0-40cb-a6c6-b6ffe2580a21", "comment": "Malware payload (RedLineStealer)", "value": "a16b069c7727d11ee51a0b833b7b73aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928028, "uuid": "73d72992-e845-46f7-89d2-7da1e09b88f6", "comment": "Malware payload (RedLineStealer)", "value": "3b96bb0a140911e8d7b7015d951ec502d59c5cda1841804716ce966f20f9ec2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928028, "uuid": "a6f099f1-d729-4a84-b590-87df142e9d37", "comment": "Malware payload (RedLineStealer)", "value": "d0b5bcff593641e324aa0229a823b22df9f6febd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928028, "uuid": "7be6d57a-daa8-4f6b-87d4-941a145c9c09", "comment": "Malware payload (RedLineStealer)", "value": "556a051a07c1f5805a6ef1abfedfec4b0d20cc113527572c17dce044be231be4f5a107d1633c6dfc301ce23c9d6f369d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928028, "uuid": "204793a9-46e9-4f90-b160-94170840bd77", "value": "T1AED4019D3298C478E9A121704835D7D40B3EBCA176244277B6573A9FEEF43A06D323A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928028, "uuid": "605a7399-7bdb-47e5-8a9d-7fd040560554", "value": "96eae633c3835f4142e00d18fc3a156d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928028, "uuid": "e4c42eb4-9297-48ca-98d6-d3e6a40db31e", "value": "12288:hKcp6QQNpY8m/dxWRF3g8uUxxsWYAp56VW2kWeDM:h5MvNS8OYRlV1rsrAv6dx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928028, "uuid": "e60aed3d-254d-4d69-adf5-092d8c1a6423", "value": 646656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928028, "uuid": "b46ed39c-c47a-430f-b1ca-1cc7fd9bcdd3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928028, "uuid": "ec62266f-9132-44bf-a939-48b225d6fa98", "value": "a16b069c7727d11ee51a0b833b7b73aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5803dc71-32fb-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1634881563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634881563, "uuid": "1f3e3f33-56ac-44a2-a82a-e325f2f11a43", "comment": "Malware payload (RemcosRAT)", "value": "d96b6070b2724d3d7a47cbb59d414c9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634881563, "uuid": "8f34f2fc-aded-4335-ac06-6a095d4dd9e4", "comment": "Malware payload (RemcosRAT)", "value": "3bfb18b65c870e3c012f8d38fa70ea7441d6b09530e5f77d837d636c0e2abd0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634881563, "uuid": "86cc6a0c-5510-4831-8acb-21433a2148f9", "comment": "Malware payload (RemcosRAT)", "value": "ec6221a6ff1cd193c4d12e2b932f5ae2bc86abba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634881563, "uuid": "2825d036-4b42-462c-81e1-a079aefc040b", "comment": "Malware payload (RemcosRAT)", "value": "3f22e1469cce3734f49151188c5a24e70c682663df107eeb1382283b891e47bfc91297e90b6349eaaa07442ec3e3d7db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634881563, "uuid": "bdb2e862-275d-4d5d-a82f-90e83c243a66", "value": "T1B6258D71A0D6057AD4B63DBC957644AF99762E603D38028C8BC8FE061FFD78B552A8C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634881563, "uuid": "7cd9d957-2aba-4c3c-8978-212eca086193", "value": "ac55f6686b1348553fd9b5d485943699", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634881563, "uuid": "df4caafd-ade9-417d-9d61-dd6bdc3b69da", "value": "12288:fDug7DeIhyEzPsO4z+oxMOQWHphA3hHx8rkRZQ9XYBk9NAOe6k1+hO/O5N8DoQTz:rt7JhyEz0O4z+OQK79HHQT2ODA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634881563, "uuid": "eebf7006-dd82-40fd-b3fa-268e1d2ba5f5", "value": 996352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634881563, "uuid": "fc43f8d8-cf7f-4a09-bd03-1bb8cc15bd6f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634881563, "uuid": "9480c77b-3431-4580-a038-23794e9a3c42", "value": "PI20200206AP,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39075408-3368-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928326, "uuid": "8a8727b3-e880-4a44-a316-6fb224eac83e", "comment": "Malware payload (RedLineStealer)", "value": "1821f381f526f551b747fa3213ea9257", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928326, "uuid": "3ee9cc26-1c95-4ff3-a5d5-b1373b1cad6b", "comment": "Malware payload (RedLineStealer)", "value": "3ce583620dc51990d79d87e8ba162d19f9c8181fc58db3f7b2a8dd038b6ea325", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928326, "uuid": "828aee10-54aa-4b3f-9d10-2aa21f038ab5", "comment": "Malware payload (RedLineStealer)", "value": "b88031c036105be997a268f7239dcaa9b0a53e5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928326, "uuid": "a31ce1d1-7882-4616-9ffd-1cf3e595aa59", "comment": "Malware payload (RedLineStealer)", "value": "a8dcfd7198ca6b896724d140fcfa05c23390f6219c1232735fcc73a75557d885cd55e4fca358105a5640f29bff1e9d49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928326, "uuid": "3cfcd55c-1d5d-44c7-b99c-baeeb9454198", "value": "T1D2E4F110ABA0C039F5B312F84976936CA92E7EE26B3551CF62D426EA17746E0EC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928326, "uuid": "8c8494ab-351b-442b-b0f4-d506ac2cca9a", "value": "0aa8675e96bbc2351e2af940f447c93e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928326, "uuid": "b9f76da8-3fcb-4b90-8eae-ec5775892c90", "value": "12288:PEshSGEQwugSakBenkSw55+gFQ0Ze3O9fbJf921q3Kb5XfaV4Czu42k:MDhkBhPxI+9fbJk46NXfokk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928326, "uuid": "d2c4bc74-841f-486c-97be-0f8a9b7848c8", "value": 669184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928326, "uuid": "71133ebb-1b80-415a-bc1b-fff7f6f2d0f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928326, "uuid": "ffdd3288-c31b-4049-814a-297b5100832c", "value": "1821f381f526f551b747fa3213ea9257.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61ccaf4b-330e-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634889740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889740, "uuid": "4722da3d-1a59-46f2-8537-6bafc0bf5554", "comment": "Malware payload (Loki)", "value": "edb4c5ce19950b4f15934ca8967a5534", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889740, "uuid": "6251a116-c596-4462-8024-db42695cbd63", "comment": "Malware payload (Loki)", "value": "3d23f48afff69d8e9dc252773671659677d7cd5b54b0806baae84f7d6225b3f1", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889740, "uuid": "5a8eab09-2144-4b8f-9563-da38d6a35cae", "comment": "Malware payload (Loki)", "value": "1697e3331e4ba3c4b27e954cc4c7a6354faf5998", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889740, "uuid": "69c3136f-7aa1-4002-9e55-6d9ab9c6f339", "comment": "Malware payload (Loki)", "value": "6cdb81a8788723dda3f04cf94cffab49abd92598dfa1e00e490f775a7cbc144a2340567e196bd6ba7193ce2aef456525", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889740, "uuid": "be3fdacc-204d-41b3-b45b-bb5e31611515", "value": "T13984D0C6F3BB8D11D82D3F790B14873AC705EEF583EC4C8A4D27328685B6956A443EA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889740, "uuid": "c45d41bb-c0d8-429b-a07e-1f69d961f7d7", "value": "6144:Q7CWZnEGIgQ+lm1BrjnkPlO3nU0XP/lv6GM+j/r4syFB:RQnEGhzm1lLl3BX3lSB0/r4si", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634889740, "uuid": "c0894a08-9cea-48ca-a201-20dc5f445c3c", "value": 378120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634889740, "uuid": "fd075238-4776-4e16-8c8e-cd6534b651ba", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889740, "uuid": "f52fab45-6981-4c4a-9971-f987d21baad7", "value": "007.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df3dd912-32ee-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634876207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634876207, "uuid": "97d15dfc-27df-4e18-b965-74582735a5fd", "comment": "Malware payload (AgentTesla)", "value": "640671d4c545a95c5ee05c5758f6a08f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634876207, "uuid": "cc71510c-a9ac-49da-a81f-657abaa17320", "comment": "Malware payload (AgentTesla)", "value": "3d5648199e299365ade049035e5bcd08f441b4c02591b9240a6713dd6aedd6f2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634876207, "uuid": "3dcd314c-d343-4442-b204-c0d5d7ab245a", "comment": "Malware payload (AgentTesla)", "value": "8bb92184556b3e27a632db6969e889d91e5c82f5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634876207, "uuid": "ef5bc558-6528-405a-8bdd-cd7d9ddbdd54", "comment": "Malware payload (AgentTesla)", "value": "1d0d9d56c53ca4f9adde6030d3335a05fcd85bd2044f62ed3501cea51572f0b02dc951c5dc98f52e0b567cbb1b82e48a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634876207, "uuid": "6aecddac-dbb7-487f-a08e-9edca348afb9", "value": "T1C9C48B0432F95B12E5BAABF01632584493BB7DAE2479E60D1DDE74CA0F37F444A61B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634876207, "uuid": "9b9a46ba-96f4-4840-ae0c-2fbef649a78d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634876207, "uuid": "ad86c9da-2479-4f92-824e-218fa3516206", "value": "12288:67C+fNxlR4zVifB383oDI3ssELgYr+75Xv9bJ:62+5bfB383o+ssZ0+9/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634876207, "uuid": "03052367-ad61-49a6-bf4e-65025495260d", "value": 551936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634876207, "uuid": "7adf0801-222b-4b86-a28b-67eb7a2883c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634876207, "uuid": "7d8ac40b-374b-412d-8da1-3df471d986ad", "value": "order as urgent.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b349088-32e1-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634870267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634870267, "uuid": "d9eb42d9-f948-4223-88f0-e2e2200d42d0", "comment": "Malware payload (Mirai)", "value": "8472e21e42cb29ef20f3b15bd0d66f18", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634870267, "uuid": "17128f37-fdc1-49cf-ad29-fdedb061020f", "comment": "Malware payload (Mirai)", "value": "3d6361d9f9d962a21f03186ca5b679483191743acfae285aa062f7dd71a79908", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634870267, "uuid": "66b4f113-15fb-493e-8d8a-5e6fd757ef37", "comment": "Malware payload (Mirai)", "value": "f4a4ce58f70e08d155308ddc3edb9ccdf9758530", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634870267, "uuid": "b795c208-62b5-4828-b5fb-db1703de546f", "comment": "Malware payload (Mirai)", "value": "9b29b5456f0b8375b2be655f513acd5ada4854dbe3303be79632e08205c7ce45d5c3cb9b70d263578c88af91bb77ec8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634870267, "uuid": "838f397e-dcbc-4b89-acdc-42fc6a0e36eb", "value": "T1AEC33C46EB808A13C4D51775BADF424A3323E755D3DB33068918AFB43F86BAE0E67506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634870267, "uuid": "182af064-215c-4ab5-ad1f-d8d21cb8b98a", "value": "3072:+KhtPUfCBPi49iuFcpQe8ZVu6h+WLwM/9TGyz:+KgfqPiSiuFcpQTVl+WkM/9Vz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634870267, "uuid": "36cc92db-39a6-49ed-9ce7-f946cbbfe16f", "value": 125754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634870267, "uuid": "f42ca77b-3655-43af-915c-3b12ccd2d729", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634870267, "uuid": "6fc22861-8b4a-4f1a-8164-f958078056cb", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d26eda65-332e-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634903673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634903673, "uuid": "07fa908e-fe8b-4b2f-b808-a27e216e09e2", "comment": "Malware payload (AgentTesla)", "value": "a1f4d1ffb6dbcc768b27f7b9fc8ab0bc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634903673, "uuid": "9a4aaefe-ea68-43f5-a3f3-cae3a195b3a3", "comment": "Malware payload (AgentTesla)", "value": "3da13730415f09c07260e029a2e36f2a9c92d9f85f86d0c2879659f28e2cf83a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634903673, "uuid": "fbbf8179-c630-455f-8e51-165e1fb4a789", "comment": "Malware payload (AgentTesla)", "value": "843988c2715972c709d61afb101efd11f00be8ef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634903673, "uuid": "3f1c3768-6b0d-401c-b221-67202dedfc76", "comment": "Malware payload (AgentTesla)", "value": "23f04a523817deecd261f2bd0856004a5188075da6ead8ec8b5a16b3d1eee1e6ee11750ef3b9c898a1323d231cb5d006", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634903673, "uuid": "af7ff7ae-baac-4bbd-b595-7babb7511f40", "value": "T16505BFA93B95F6CEC5580E35C923198C43F5D5433A32F79F60C916D82C21A26CB1F6AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634903673, "uuid": "333f15bb-0e08-4605-a8b1-19062d635707", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634903673, "uuid": "14a423c8-23ed-44f9-9a73-5a5d0aaba6df", "value": "12288:D8hRXIxxQmpsva4NQDOYyTjTtmJzOHZ+vudlQa86mxiUNI8S3e:DEappkuDJ+ssHgujIHiV3e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634903673, "uuid": "c8fb631a-875c-4128-afa1-269ad03c27a4", "value": 850944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634903673, "uuid": "ab8d5b0a-29dd-4c5b-ac82-45f3dab8186e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634903673, "uuid": "2a9350e6-3746-4ec2-9c35-3b9da5c860a0", "value": "Docu_001220778003833_20102021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eab8a791-32f9-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634880950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634880950, "uuid": "5badd41f-3c00-4bec-878f-2bda204bf619", "comment": "Malware payload (AgentTesla)", "value": "9f7e59995263b92231ca69911bc9d20e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634880950, "uuid": "32b57ffe-4370-41da-8185-ac065a369fd4", "comment": "Malware payload (AgentTesla)", "value": "3e8eb7a331ed3b1699d2138aecfa519cb744b9eccb52909420d3d3bed9a3ca05", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634880950, "uuid": "9de94875-55d7-490a-99e3-f8c0a4f5d7e4", "comment": "Malware payload (AgentTesla)", "value": "a79d7e3f0a49ec5324d8631d41f46a833d3a520e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634880950, "uuid": "f14061b2-9cf7-4873-b0b2-c420ceac5e46", "comment": "Malware payload (AgentTesla)", "value": "352003e063e9d92bff8b265eeda02437a1cfda0114fbb822f3544fcca3e0ec4412da7dbbe7f2d59d083b318c1f450ff5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634880950, "uuid": "d9572a0a-e1da-40f8-9566-9d30d13c8312", "value": "T18ED49C0060BA9F14F4BA5BF946B2841453BB7E2B953AE64D5CDD30CB2BB3F901920B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634880950, "uuid": "6bbd3d66-fa54-42b3-b72a-7a1e20f74fcb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634880950, "uuid": "f8ad8062-a9c7-47c1-a780-e95a9b8a6149", "value": "6144:Gp9XAMEvBvp5ie1c89k3er+oheF8kYrQHoL43kEaVteaIHrcq7WrBlmQM7VQysgd:U8Zvmgc8y3ntYMI6kE6teaq7EBlmZ1J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634880950, "uuid": "96051685-904f-4b05-82bf-798325bb395d", "value": 608256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634880950, "uuid": "1574d31c-58b4-411d-b9c7-35a4ea95c250", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634880950, "uuid": "cc39d977-c21e-4406-a425-d545dbcd4984", "value": "675899234.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df7dfbbd-3331-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1634904983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634904983, "uuid": "846b164e-3335-4e44-bb80-afdf75a8d4ea", "comment": "Malware payload (NanoCore)", "value": "2758e51b671a8831a9518f4ee6c8f0e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634904983, "uuid": "4e7678b3-570b-4323-8719-ed3667f3dcf2", "comment": "Malware payload (NanoCore)", "value": "3efbcb58b916487e6ac469d8c289ff1c1861446715480277fbb2e0af1444c8c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634904983, "uuid": "8ba78884-606a-49f2-a3f5-617d843777fa", "comment": "Malware payload (NanoCore)", "value": "7fd0032aaff45b5e5b71af1c432899efc80d2162", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634904983, "uuid": "5ce7d2b7-1ff9-4da3-91f9-0d46171ac389", "comment": "Malware payload (NanoCore)", "value": "6ab99a3f7647205720e09c0ab17a17c82946d1757abc049e3e8603ab7b46b61e29f6fc0119ad977dba76e5aab2779caf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634904983, "uuid": "cc549e40-6d9a-4144-9c0e-ab6e883108c4", "value": "T145C49C0432B98B02E5FAABF41635480493BB7DAE1879E64D1DDE34CA0F77F444A61B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634904983, "uuid": "4ad1413f-207f-4366-b0c2-615e5c447991", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634904983, "uuid": "8d1f784d-df8e-4b9d-9c16-040bff75ef0f", "value": "6144:LGxhLJCrIBNvFre9kfSBWI0N0QqIcQuvH1eI+jHUsdfhnNV6G2AZsd+jxlDur4Rl:axLLSbWIpQqIzuvw5BEAq+jxlKr4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634904983, "uuid": "b9c8831e-cbd7-4c17-a412-63088c6f0d98", "value": 552960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634904983, "uuid": "12c2b896-14d7-402a-86cd-e700f31240aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634904983, "uuid": "cb64ce01-28ed-4356-96b6-7b9b0cb4278b", "value": "Conform descrierii traducereProfil liniar355377.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab5ab225-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928089, "uuid": "6dee4567-6f89-4393-ba2b-4e014da4be69", "comment": "Malware payload (RedLineStealer)", "value": "81bf4e8775d58dde713255bd642662b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928089, "uuid": "9ce29132-5225-412f-acc6-e8d746132cf4", "comment": "Malware payload (RedLineStealer)", "value": "4067d6f3dd428f8e2dd9913ff61fc70d059052af9fb475600ffeb80027589378", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928089, "uuid": "380578ab-53b5-44d5-8d02-596f5873fd15", "comment": "Malware payload (RedLineStealer)", "value": "394d1a83289b0fdc1316ceb4525c091b665b8d63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928089, "uuid": "4fcecca1-60e8-4958-8ce5-c95373aa5b44", "comment": "Malware payload (RedLineStealer)", "value": "103cb32e7c8e1c22c8958e25f0af13bc0489450a49c4d716d2b74653d2ba301c4f19666d6b5ba9b1741fa61af3bd50b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928089, "uuid": "61b318de-ee56-43e7-bc31-a057419343fd", "value": "T11CF4D000A690C035F6B721F48AB99368AA3EBEE15B1454CF53E52BEE47355E1EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928089, "uuid": "6662eeea-c012-4e74-9803-30ecf0f65f77", "value": "9cccee30870eeeef9fd80f169e4bd55f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928089, "uuid": "c29672d2-cae1-454d-bb5c-f30f3c44b938", "value": "12288:clIK2EU7YQV1g+yPDEfH18ZXlC2XCe3R7UHJJ/+Hn24Fz1Ux3yevW0L:cCKQ7rV1g+QDEfaZ1dXCe3u/R+zmx3zR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928089, "uuid": "161e9b54-8a4e-4fe8-902d-2379a8cc7c52", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928089, "uuid": "4a06d3c8-ff8e-4b79-b652-c1651c89a346", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928089, "uuid": "2ec8b8f9-1cec-4037-b4c2-8c8895370f1a", "value": "81bf4e8775d58dde713255bd642662b1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b865a5e9-32da-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634867551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634867551, "uuid": "3d7d36bc-b083-4e64-aab5-e824a334652e", "comment": "Malware payload (Formbook)", "value": "ef243115db5fd87673b93a350bfc68f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634867551, "uuid": "32251889-ce02-4dda-be21-5e2d7077fc1a", "comment": "Malware payload (Formbook)", "value": "408d42bbe82ea5d8abee447060a40ff8289f4c3317022d6c0a1081c37d25b164", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634867551, "uuid": "9b1abd5a-d12f-4da0-bdbf-c9de07003f2b", "comment": "Malware payload (Formbook)", "value": "533fcc44583bb2f952cd76e7eeac1cab65de915f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634867551, "uuid": "9ead17f6-ba51-49d1-bd00-0cf68da1dac6", "comment": "Malware payload (Formbook)", "value": "15efa3adf9da226e9c368209e48049da3c891f12ae51565c2c262f4802fa21312ac40b3057c878f706a9877ad9eb31d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634867551, "uuid": "7d238f35-0d13-443d-a668-2586a6dbc533", "value": "T14F44137261D0886FD4D31EF258BB973EE7B5C70894704B8F4BB06D6A6C3A2C2B6051D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634867551, "uuid": "0bd120b8-b7f3-418c-9eac-d88f0473fa86", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634867551, "uuid": "0c59d154-3542-4bb4-be68-58ee1e77422c", "value": "6144:wBlL/cfBEIt4tl9u58/YK3zX27E1NQLv4gxrL6QE1/ytmnv7YC:CefiPuOgKjXVNsQgxrL9E19nv7X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634867551, "uuid": "e7ecb43f-30c2-45ee-83c7-b20e5c235d2b", "value": 255483, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634867551, "uuid": "29b3b77a-405f-45aa-9fcf-6dab293d85f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634867551, "uuid": "cad71e20-e85f-4307-8d5a-bc4bf09d4973", "value": "Enquiry files1_3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34a44f70-3318-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634893959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634893959, "uuid": "c3fe10cc-4afc-4dbc-a405-088f8b2560ec", "comment": "Malware payload (Loki)", "value": "cde2039ded2a443f9f04daacafbb2862", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634893959, "uuid": "26dfa72b-e6d1-49b2-b05a-5c4f1ecce848", "comment": "Malware payload (Loki)", "value": "410547dbaeafc4ca1a1756e5fbb14f60e5e1f970de3841dd6965923b8ae680ae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634893959, "uuid": "e4317a6f-c0e2-4cbc-91d4-17e34084b3e9", "comment": "Malware payload (Loki)", "value": "2dec7cd14fde3c7b08e9641f55d212fcb96d543b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634893959, "uuid": "651eed34-0a35-4032-a16b-b43b95e3ffd0", "comment": "Malware payload (Loki)", "value": "3129f2c0f165a0374cc7223c72724c926365ec6c61a8743a4da468635c08583bc4ec2e235b6bc0bc5ab5c7cf04057e49", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634893959, "uuid": "2f1aab5e-1f1a-4034-b379-699bc707a6ae", "value": "T1D534121635D359B3E4939AF4D8FE8189E7B9A500900674670B74AF777C2AFC39A0E04E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634893959, "uuid": "9938d420-e3bd-410b-ab42-05a7eb6fb59f", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634893959, "uuid": "24168b4d-d31c-4b4f-a188-2b4be4a0836a", "value": "6144:wBlL/cFI0xVSUClW8kjglzyrtsdVGMBGOdmrhWTvTlKixQm:CefzSzWrjIzyrgVBNohEvTlK4x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634893959, "uuid": "e809c0b5-ee46-48b9-899e-bf64af602c66", "value": 244738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634893959, "uuid": "60cc1098-f6ce-4736-9734-4e0d6d9d45a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634893959, "uuid": "3cba8bad-be2e-4751-a29d-e264b75f3465", "value": "cde2039ded2a443f9f04daacafbb2862", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0abae0db-330d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634889164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889164, "uuid": "b99bd219-b04e-47c5-b6c3-b81e16b763ea", "comment": "Malware payload", "value": "a2c8158e6837c737fdc64cdda72ea5a6", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889164, "uuid": "7ff2f667-99a1-4354-afc4-5bd26b84a161", "comment": "Malware payload", "value": "4207c77aa1cec1ae0cfdd75418f4a72af57cb4fcbb2bc101c619854761336ee9", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889164, "uuid": "ca37b9aa-3ea2-482d-b072-1f044d542bfa", "comment": "Malware payload", "value": "c1a2da7c3fde86cdd1051a0cb169fc59d5b7f1fe", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889164, "uuid": "1b184213-c6b2-4d54-a1d7-4e5edead9092", "comment": "Malware payload", "value": "33012294f1b7a70bcb516ca5b1b447b90fa1c8b7d655c92c04136e2fa9d8d4659d88a25037eefdd160db7c755343d70f", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889164, "uuid": "28b9b830-4aff-4d46-8f6a-d9a23af54082", "value": "T1A7459F23F2C08437D1B32A798D5B7369AC39BD106D29684B7BE41D4C5F3A6807A762C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889164, "uuid": "d931b1df-7d71-4f03-9336-c4f0c0be658d", "value": "24576:vIHJ5EahVuXHW5ALgf6CbXIVV83yDalD8g2Y9TU+RTcAe5GYEASA:vIHJ//iCbX2ZgPTPRT2GYE3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634889164, "uuid": "5dd54239-7aa4-4e20-a64a-2a3c047c4dc1", "value": 1264128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634889164, "uuid": "b970cca8-619a-489a-be1a-b742fb4d43ce", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889164, "uuid": "4b34ef33-3b70-4c27-b170-a1292d72fc40", "value": "Pedido-9987484.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dd57138-331f-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1634897115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897115, "uuid": "54f9db30-ee34-4e8e-8623-2ec70604cc4a", "comment": "Malware payload (Smoke Loader)", "value": "887be0841121eb921b5261584ab78197", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897115, "uuid": "ca677620-5cd7-4020-9aff-db36738e38fc", "comment": "Malware payload (Smoke Loader)", "value": "4290f5fbbd5d7ff8054de896fe4231d83a149f099ee867c75969468e0078e8f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897115, "uuid": "49a9cd76-91bb-4e2e-b100-ff47eb499aea", "comment": "Malware payload (Smoke Loader)", "value": "b0a7b4880e3e2ed3fbd032d101553acf4b144b93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897115, "uuid": "f9ac7d3d-03fd-40c8-b7ef-f9b1206d0503", "comment": "Malware payload (Smoke Loader)", "value": "0bd979cfc072ea10a02436c2525d479f2f553626d49c9862fccc9fe7f59c05d2ad0ea8617c702afb9866f7df5d227e6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897115, "uuid": "e42416e0-5c8a-48d7-8a01-ea84bfb74c59", "value": "T15D548D00BAA0C435F5F712F899BA93ACA93E7EA15B6450CF52E516EE47346E0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897115, "uuid": "ebb8b6e7-4eaf-4e9a-98f4-c6caf9314b6c", "value": "0aa8675e96bbc2351e2af940f447c93e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897115, "uuid": "4d1c74bc-aa63-493e-8e04-cb03eb001667", "value": "6144:5n/WYiBpqOpLe8+BIGsIcmZdv/CfpC2hFpO0TNstvso3oIQ:R/WYiBpqC/lt2vKfRFwYNstvs5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634897115, "uuid": "1ad17b97-1a81-4ab3-ab17-4606199a1da9", "value": 290304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634897115, "uuid": "0b301ab5-4cd4-46d8-a1fd-32224ee00d96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897115, "uuid": "da8985c3-aa5f-4ce4-8ef2-ad7f79c0a89b", "value": "887be0841121eb921b5261584ab78197.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dfba074-32ec-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634875104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634875104, "uuid": "3c044b01-a57f-4db0-a366-c5e2edec907e", "comment": "Malware payload (Gafgyt)", "value": "c31174f75137f65c3ecca8daf469974c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634875104, "uuid": "93c2c67d-3562-427e-b95e-529c5f8d4ae3", "comment": "Malware payload (Gafgyt)", "value": "43fa2d42e08af94744cffdce61be0018b563bcf3078a10500bb1ccc857bd4260", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634875104, "uuid": "27433c2f-3c37-44d5-8940-4948516cb8da", "comment": "Malware payload (Gafgyt)", "value": "74362666a93e392d2d2ccba1282b044bb515de67", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634875104, "uuid": "e3c52685-ea96-42ce-b5e9-60e1dcdc794a", "comment": "Malware payload (Gafgyt)", "value": "4168891bb270e415d439181787b0f51dccfeff906326cfe28ca4db31bd4094c83fc8a414446cd7cd20439fe5d49cf9fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634875104, "uuid": "9dbfdf24-f3a4-4166-9c26-fdcb2385097e", "value": "T1B7930892B901DFB6F40ED77A04D34724B670FBA24E531A72731779A6AE322D43826F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634875104, "uuid": "4436f8f1-70f3-490d-981e-661e32235b33", "value": "1536:4wZVhxpB8F9OEG6ktQm3r/FS3n9RIB6Yy36g4d2f7vTmQ9VqXjewf2Le:R3p09W6KTG/IB6Yy36pYfmQ9VqXywf26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634875104, "uuid": "a68b4a86-3f4a-451c-a391-76f730e49319", "value": 91087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634875104, "uuid": "b283a017-7247-40c0-bba2-acb0becd8dc3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634875104, "uuid": "8b71bce2-5e13-4b15-ac55-9500b1006772", "value": "c31174f75137f65c3ecca8daf469974c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7925029-330f-11ec-843c-42010a9c0014", "comment": "Malware payload (STRRAT)", "timestamp": 1634890367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634890367, "uuid": "04f943ae-6a6a-4c66-a4e2-65bfa2619c4d", "comment": "Malware payload (STRRAT)", "value": "a3fb4ae95c327cd14ea35fba98038d89", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634890367, "uuid": "b1767251-1aaa-4157-aa8e-64741deadf2a", "comment": "Malware payload (STRRAT)", "value": "4407d7019ad4c3f66a63c234b473f23c1a5153cfee8151ced528111a5924894d", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634890367, "uuid": "73ed5309-b4c9-4392-8adf-d3f51534b744", "comment": "Malware payload (STRRAT)", "value": "6c993c1f0fb3386e2a9cfa1eebee55cd5c367648", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634890367, "uuid": "27c708b8-efd3-4bd6-b13b-50b070e73d24", "comment": "Malware payload (STRRAT)", "value": "e863550101160e7335ec2c5115d5f2df9d93f88fe31bd2ff2092c29b6b94afc65c14838ab1c8a23c47b57d019f56b96a", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634890367, "uuid": "4ae5c95a-7eb2-4fd7-aa48-33d2b5619c9b", "value": "T14F04011EFDAFC4F5E24B4172AC2669B1FA8C4154E403822F65FC284B09B4C1E5743AEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634890367, "uuid": "1e9b4eac-e45f-444b-85ef-9c791f0ab114", "value": "3072:tGBfbhJvECwxGXmHkRpZTsUSuMica+h04eilvJ44fd65yJsHbDSLK+hTbY/Tek87:t61JspxGXFvZT3404nlR44fQcGHbDSL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634890367, "uuid": "34cc8ff8-ff9d-4ea5-8f9f-8a7984a47f0f", "value": 188653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634890367, "uuid": "d3607eba-c908-445a-a2ca-c09b94b9d68a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634890367, "uuid": "afbec7c4-9294-47d4-ba0f-e42ee231c6b9", "value": "Payment shedule .jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97a11ba5-337e-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634937934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634937934, "uuid": "5bfcdb96-03bb-4e05-8060-15b2c530e2e3", "comment": "Malware payload (RedLineStealer)", "value": "7d3d6904a5e730b8b4b4550c114bde50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634937934, "uuid": "9bcf59a6-318b-429b-8201-2d1896ab7657", "comment": "Malware payload (RedLineStealer)", "value": "441545356b81c485c0aaea1d3ef95ec893e25ab988af4cd83c519c77a1d3c84e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634937934, "uuid": "30d6a697-67b2-45db-b192-96e1c1ee45a8", "comment": "Malware payload (RedLineStealer)", "value": "703e07beaa3d029290b400351a288c5ef164af35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634937934, "uuid": "5f755d72-f89e-405d-ad25-d15a4ae144d9", "comment": "Malware payload (RedLineStealer)", "value": "f03c9fd6a4c41893db82f3ade8b0d573a9a97233787ac5159f72d829c3029d924abcacc9b2b93e5ebfcb2d289b27b12e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634937934, "uuid": "e45350d4-f75f-4bb1-962f-756553321a07", "value": "T1AE747D00A7A0D039F5F322F44ABA9378A53E7EA1572454CF52D52AEE97356E0EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634937934, "uuid": "232753a1-ef14-4b73-a8a4-88f9a9d621ac", "value": "bac67046644aa5e445c1272184462c49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634937934, "uuid": "0985d6fb-1d40-43a4-90dc-660bd0aa1f08", "value": "6144:PFrxLYBv9VIFW01c/5QeeShhu4bmq2oQCfmEbYcZ9nvX9ArkHP:PF9YxIFW01KeShYKmmfmEbYqnvtA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634937934, "uuid": "5fdba307-7912-4c82-8008-ea3fd6c15458", "value": 340992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634937934, "uuid": "46332041-8ac1-4bdd-a09c-018384470a49", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634937934, "uuid": "292ecce1-de87-4f3b-8012-549459fe8375", "value": "7d3d6904a5e730b8b4b4550c114bde50.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e22f942d-3361-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634925604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634925604, "uuid": "0dd4cb6c-6297-47e5-bddd-710a96f2f818", "comment": "Malware payload", "value": "7af98aab14236d60e84a558d7f68c3ef", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634925604, "uuid": "871b2b1d-ff4d-4915-b6f6-7f678fb43ed0", "comment": "Malware payload", "value": "446fd698c151febcd0db9b57460d1891c837c8c02cbba887c8282ceaf9eef07b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634925604, "uuid": "a82a5ae6-36aa-44a1-ae5f-4eda10d2edee", "comment": "Malware payload", "value": "71c09303c6c2a7986c2cc44931915ea9fb176002", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634925604, "uuid": "6d574565-bde4-4008-8701-674ed3b919eb", "comment": "Malware payload", "value": "03340d259e629554311377b01feaa2e2d2acc2bef378ceeed05db04c47234a4a0eb9c34f51cabbe6280a9b9eb9c71981", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634925604, "uuid": "3195829d-3f17-45c8-970d-8148632b7ff3", "value": "T160432A2725919AAFC4D79BF957DB99304523B83A1F136201B3E8BCB93F46DC82E59304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634925604, "uuid": "b180e1b1-a234-4762-a540-9f85e3f12ddd", "value": "768:OtO48NicSfjM6qJP4BYDzsdlf37CkrSIiW1PSRlKuYEZiFgLQD4IV8E:S8N1SA6qJtDzUPG6qOxEUFYU4IV8E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634925604, "uuid": "51c2d9ab-28e2-4e45-9039-b7b1fe3a1d21", "value": 56942, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634925604, "uuid": "869d7678-d4da-47c9-be25-ffc0499beb83", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634925604, "uuid": "90dacd41-a10d-4eef-96e5-9a9c3c3028aa", "value": "Fate.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b435019-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928062, "uuid": "73479780-636c-4e05-b02f-09903022fc01", "comment": "Malware payload (RedLineStealer)", "value": "08339eec7cdffb00799865548bac721e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928062, "uuid": "34ea1c81-4fd6-42c7-ad48-966c147d3b8f", "comment": "Malware payload (RedLineStealer)", "value": "44e915bf976c93703e9184e4bffb80ec95bc5df71eb5e48da199fd374af33c22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928062, "uuid": "ef13f4c2-bc46-4da2-b30e-c884a0524d40", "comment": "Malware payload (RedLineStealer)", "value": "4be40e15b187b45b1bf022733f7ff31cb366f493", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928062, "uuid": "ee617cde-e9d5-4bbf-9065-3471d3edec22", "comment": "Malware payload (RedLineStealer)", "value": "f1095a950eb3fd3e1ce392ce6fdbafe28b5205c7d4fb580e0541a4b06e3e3b901c486af876055262fdf9a43656b4b879", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928062, "uuid": "fcfd0e05-44cd-426d-9851-a18274a18f41", "value": "T154F4E000A6A1C03AF6B712F44AB99279752EBBE16B2454CB53D52BFD47346E1EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928062, "uuid": "a8c83f8b-793b-44d4-b57b-f401bc820652", "value": "4af4742906d30c7889c195169379a2f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928062, "uuid": "64d105bb-bca5-49a4-8bb3-a22378e9f205", "value": "12288:HMdaBnZ4mFV3gOpN4680Ga3p42EjzEPcX/s/1q61LTyvo5mUrgETulbYW4Fd6uzX:HYaRfntZ80GK42EvEW0kw0ncW3uzUwDZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928062, "uuid": "22fd303f-caea-4ec1-8b37-0ade9f6494bc", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928062, "uuid": "bb451c81-2d99-4860-9162-6226a285b8ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928062, "uuid": "9c06e2f7-fcb8-4eb0-99ee-2bb125e161b6", "value": "08339eec7cdffb00799865548bac721e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7606d741-332f-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634903947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634903947, "uuid": "deec69fb-7127-4577-bd99-e22aaa0766a4", "comment": "Malware payload (Formbook)", "value": "74e58b71d9d25130e6b47e1adccd1cf8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634903947, "uuid": "0dde4260-eeed-4d71-9fef-24f1563bf534", "comment": "Malware payload (Formbook)", "value": "4645255a1302be5b36e6814261279dc48d24f03c3a170b0b2efca04adacd2718", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634903947, "uuid": "53561c49-1679-4572-b091-3cec99ca7c36", "comment": "Malware payload (Formbook)", "value": "92fb13e26c1c0ed3698cece64aabe0834b74e798", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634903947, "uuid": "7db62a66-7ab1-4150-923f-f6e4f4a01d5f", "comment": "Malware payload (Formbook)", "value": "5c40d10104e83b5088743ebce62e21b5f1d70f7066fec45ede7156db8dc79438eabccecfbac486cfddd7aaaca951e79d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634903947, "uuid": "3599c188-8b27-4dc6-bb20-d3d09f36c252", "value": "T149B48B0432B99B02E5FAABF41531454493BB7DAE243DE60E1DDE34CA1F77B448A61B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634903947, "uuid": "fd682ccd-5491-46a4-b3f3-951b1f7ab75c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634903947, "uuid": "70c5b6c0-3ff5-4de4-ac2f-455bde780d1f", "value": "12288:yo02vVCPnF5+SdVr5PJPawONO/N7coUt:yo02vGPXmwyOmoU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634903947, "uuid": "6e42a722-87dd-45bf-a908-bc09f8551be3", "value": 504832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634903947, "uuid": "cb92ef65-d751-48e0-a887-3122592f6aea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634903947, "uuid": "c4eb39f1-9929-46e3-ae4a-44b470a960c1", "value": "Scan_10384648.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b34fa6da-330d-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634889447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889447, "uuid": "3adc2662-2e00-479c-b7a1-100ce8870586", "comment": "Malware payload (AgentTesla)", "value": "394e89606006e87e27f4ae0fd565f581", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889447, "uuid": "bc9f568c-9f76-49af-9e5a-40c4ec4ef517", "comment": "Malware payload (AgentTesla)", "value": "46b5f2101f8b6f5c1e403c081f22f28324eead89b99c29fe4aec7fd897957542", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889447, "uuid": "3ffdf219-b5d3-43cd-bcca-6ae7d20be993", "comment": "Malware payload (AgentTesla)", "value": "57752319c6bf8f207b1c639e56cc5f335241ce4f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889447, "uuid": "f77820aa-2e9b-4181-8781-2597aedabf09", "comment": "Malware payload (AgentTesla)", "value": "b1b6bbe518de7bed83749a68fb6539c7cf842a40f9054a161566af9647de5056e438eb314a3ae5cbc3c6b0d530357bd6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889447, "uuid": "b346a70c-78b9-4509-9482-78569777050a", "value": "T10274B0F875147DE6666F476BDA96ECEC13A627238ACBA4CD806477C305A3371FE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889447, "uuid": "e346f35e-d310-42bd-8867-d0988ca122cb", "value": "6144:v9XnbimU3T+vpZ3Ju66quC+RFcWt+b11zfV5khUXQ5h36BTnyImpWg:FXn+T+v3JuLFKh1zt5MX58fzg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634889447, "uuid": "0c7a5abf-be89-48e7-ba5b-533f36aa447c", "value": 348346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634889447, "uuid": "4fee97cd-ed4b-42e9-a21a-34079f6f508d", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889447, "uuid": "6635fe19-6c7a-4ae9-883f-985b75d0f68b", "value": "FLOW LINE CONTRACT00939.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ddf747b-330c-11ec-843c-42010a9c0014", "comment": "Malware payload (CobaltStrike)", "timestamp": 1634888955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888955, "uuid": "f83d5e82-def7-4b43-89a7-b05af5e414d1", "comment": "Malware payload (CobaltStrike)", "value": "00a20388b39480b86c4f7779037d33f1", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888955, "uuid": "5bea63b6-059c-4ffa-9195-f158e27210d4", "comment": "Malware payload (CobaltStrike)", "value": "4754626f12467f7a14731030afe57b3ffe6bac1c1a8d2d93a027f0cec5be08e7", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888955, "uuid": "17d1e93c-3035-4adb-b862-2dcc42ccd8ce", "comment": "Malware payload (CobaltStrike)", "value": "25874a467e95a25280df9521181b21ef1065ff15", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888955, "uuid": "91474ff8-299a-453d-9942-6e9b73b0d11c", "comment": "Malware payload (CobaltStrike)", "value": "85f5dac1bbc532d68f626a4d3a334d4827b3248d63da086d5db68685603fba094daea4a760231fe1b10709f337e71284", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888955, "uuid": "f05cd6e1-87b5-4018-8025-4208f7146784", "value": "T148854A57BC9150B9D0AAC230CA7582D1773178950B3363DB2F91A6BA2F72BD81F78364", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888955, "uuid": "00157043-f994-4212-ad25-cfd82a85a9e9", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888955, "uuid": "4d27273c-fa6d-49dd-936f-7493cb66d283", "value": "49152:DR6OG2rb/TavO90dL3BmAFd4A64nsfJQB3XHWgvxR+Wb1Ax:DRshx3R8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634888955, "uuid": "4f784b77-7d2f-4656-8248-19e4f8c1531b", "value": 1747632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634888955, "uuid": "f773480a-6619-4beb-8096-11469bb0adf7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888955, "uuid": "cf56581e-e7dc-4c08-ab94-0f84452df68e", "value": "4754626f12467f7a14731030afe57b3ffe6bac1c1a8d2d93a027f0cec5be08e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "559acda1-32cd-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634861802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634861802, "uuid": "ab4dda35-42bf-456c-bc06-e84365125e79", "comment": "Malware payload", "value": "f1910120c0ef8de7f87e8158af2fd3f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634861802, "uuid": "ffa95698-41a7-47bb-b7a2-d92fe7c3b7f5", "comment": "Malware payload", "value": "4782c8c9cfaa755ae347d465c408ecec74852c0b7482874a99383182f26d4502", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634861802, "uuid": "c2002142-ed72-49e6-8f6f-c34b1986a8b8", "comment": "Malware payload", "value": "a7daa779a681c7a7cfecdd03446b73c752cc54e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634861802, "uuid": "3d57cdec-6150-4394-9ea3-84b6703d0bc5", "comment": "Malware payload", "value": "9ade66e98308c26cbd0fce7f04a98ce6880b2ced9a46442f5b645cb43bcc667c10c560a0546532cbf8195f9b19cf12f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634861802, "uuid": "3363d97d-0136-4905-90f6-4d8e4fca442c", "value": "T19C6502387FFE501AF1B7AF7596D079968A6DF66376079669201203C20F23B41ED8313A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634861802, "uuid": "85650fab-92f3-4409-8ab8-f4be1b76342c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634861802, "uuid": "d1c9053a-5603-43cd-b831-6da14e8840c3", "value": "24576:a27mrhic6gvYbAKsy5Ulh3iXWl9557sK6X3ZO0GinMSvTNWfshnGmg/ykTPnewly:anrhr/vAcWKv6X3o0GQN0s/g/ybt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634861802, "uuid": "d9e8be0b-c3b7-461a-8cf7-71b7067b086a", "value": 1425408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634861802, "uuid": "4129accd-e813-48d4-8b09-f43760f728f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634861802, "uuid": "692114d5-0131-4278-b369-488c5ea39902", "value": "Hazard_nuker.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b265c942-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928100, "uuid": "1393fcd9-44a7-4241-b7f4-8692b7f30dbf", "comment": "Malware payload (RedLineStealer)", "value": "47d7db672e2c73a5509ddddae62c933d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928100, "uuid": "944221c0-ff9a-4d6c-8546-3575974162ea", "comment": "Malware payload (RedLineStealer)", "value": "482e95895a002645052feb0fe6bed55cb5d342f823f98898d07ad9b2a69ea0a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928100, "uuid": "50785dd0-32d6-47c1-b02d-3209b3ba5dc3", "comment": "Malware payload (RedLineStealer)", "value": "3ff0753863ebcc7415d75e064758b39a96afff4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928100, "uuid": "76f37e31-90b1-440c-83fa-51be496f7c12", "comment": "Malware payload (RedLineStealer)", "value": "941caf41fd9ff7f9ad32edb30522ed15c7bc8ba9e0823f34e11c924afccf60b06d4defe80ba2c6510612193021dcd425", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928100, "uuid": "7e7b9f79-216b-420a-b1ae-12d61f6ad12a", "value": "T19BD4019C3258C878D5A11630457587F9133DBC91B8241276F6973FAEEEF82D06EA2363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928100, "uuid": "ede7e7b0-12b4-4e5d-9ae4-42f87b9a03fc", "value": "96eae633c3835f4142e00d18fc3a156d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928100, "uuid": "e939c61b-89ce-4869-a8f3-8d08139ffacc", "value": "12288:Ja8p6HmUur0DRVQS4vlukmtUXC1SSCNzZKkC8s0nZJ2e+B/2eDM:JJMHmUFDG7mtD0JPKkHs0naFOx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928100, "uuid": "09c86777-d6b0-42e9-bb8f-48cbf9301dec", "value": 646656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928100, "uuid": "ee408c03-a74f-4af5-a256-00c8aea1737d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928100, "uuid": "411b53fb-a124-4e39-8a5e-a925b0bb06f8", "value": "47d7db672e2c73a5509ddddae62c933d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ad391e6-333f-11ec-843c-42010a9c0014", "comment": "Malware payload (BazaLoader)", "timestamp": 1634910854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634910854, "uuid": "f6cd0387-df98-40ff-b66f-848990e3555f", "comment": "Malware payload (BazaLoader)", "value": "dc667ed66aae40d48560988fa222000d", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634910854, "uuid": "7d0aff83-14ce-4ab1-8c9a-94ca8a7a2dd7", "comment": "Malware payload (BazaLoader)", "value": "485a3c191731de674005bf28bb644672cfcc1bad58abb9b7d0f36d71d2973067", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634910854, "uuid": "e47d7564-92b4-47e2-a427-c8dba4811c6c", "comment": "Malware payload (BazaLoader)", "value": "4e0d78a949fb7f5865ea981c64163d7870684b8d", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634910854, "uuid": "e6b9785c-0d3e-4dfe-9401-785ec0960568", "comment": "Malware payload (BazaLoader)", "value": "81fd1d7b8bffa00ec79bda97885ef030eb50f659aa5ee5950c02e3ff2425160782cfc0b1b4335671fe20dbfaa09c8ea6", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634910854, "uuid": "cf6a2300-da1d-4790-8c72-b858720501c6", "value": "T1C6057C0AF7F84776D052827DC9938A8BE7F17CC58A70834B5291536E1E337919A3B326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634910854, "uuid": "00c26941-f25b-4820-a9d2-8eae8924325d", "value": "b1fcbcae8023f460c7296a86404de9d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634910854, "uuid": "51d88077-f0c1-4e60-827a-3ff3861b8b10", "value": "12288:U0DgYq89aJyKXwAmliposlBT0sVxVTJU7RnVhGqYtZsUSdEPGR:U0DgRiUAzFsD35TJU7RnzS3sUcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634910854, "uuid": "4cd44e94-6852-44db-95ae-d0db6aa00fe5", "value": 860292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634910854, "uuid": "53b7b3f3-86ba-475b-a4e9-0c9bd58a6f19", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634910854, "uuid": "7d026b66-c829-4af2-a7d8-e42bf18b85f6", "value": "peju3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c6c883d-330c-11ec-843c-42010a9c0014", "comment": "Malware payload (CobaltStrike)", "timestamp": 1634888953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888953, "uuid": "122c57d4-3893-43cd-9522-4a67f7744a0f", "comment": "Malware payload (CobaltStrike)", "value": "11af9755c65fc345456b93331d970086", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888953, "uuid": "0e9edaeb-8238-40f2-b568-f1efc50ff932", "comment": "Malware payload (CobaltStrike)", "value": "487424f7ad546f72d0240922d1c6d9800bfcb95d3582eeecbbae0051208b6f89", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888953, "uuid": "d0596d70-8f8b-4fed-897d-b03fcc7b78a5", "comment": "Malware payload (CobaltStrike)", "value": "c3b9b38925766f9fbebcab00b526bb04c3c26187", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888953, "uuid": "ec401d62-43ad-48a3-8c20-2572acb552bd", "comment": "Malware payload (CobaltStrike)", "value": "6aece00adc461d3f690cf74a0ee14eb2291d079a003116346a8727fd81d75fd7338b72eb860a35cc8c6aa67fd496a161", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888953, "uuid": "e4c742e8-9959-4174-8327-6d036c4f8ade", "value": "T1A7854A47BC9050B9D0BAC230CA69A2A177317855073363DB2F90A7B92FB2BD85F79354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888953, "uuid": "ce97ca9c-ae33-4df2-83d0-7d7440092fd0", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888953, "uuid": "2dda3b53-0ec0-4be1-af86-0e973cdf5162", "value": "49152:hxKo+prb/TavO90dL3BmAFd4A64nsfJDUrFHKgvxRQKb1L:hxmzU9Rj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634888953, "uuid": "c1ead0b7-0a40-4265-8529-cda0d2ca2f59", "value": 1748656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634888953, "uuid": "9202dc01-d287-44bc-87ca-9944d5385ea5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888953, "uuid": "d5b7bf26-64b4-437e-bf3a-ed6830ca1793", "value": "487424f7ad546f72d0240922d1c6d9800bfcb95d3582eeecbbae0051208b6f89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "883d65c0-3332-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1634905266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634905266, "uuid": "f960595c-1327-4b0c-8313-7e8a22c0171a", "comment": "Malware payload (Smoke Loader)", "value": "6619cb673bf96428f23b9c4cb7251c15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634905266, "uuid": "d5203657-c732-4ad5-bc5a-d7ed48c25cfb", "comment": "Malware payload (Smoke Loader)", "value": "4968bc86855058e4ce9cbace83fb9f5f23607b868730e54fc26a4070ce7fdbb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634905266, "uuid": "fba19071-5402-4989-86f9-e7325ca6aabf", "comment": "Malware payload (Smoke Loader)", "value": "9fea56ce88840bea1d12bfb0d67548cc3fbbb9db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634905266, "uuid": "bbfc2a53-eca5-4f9c-90a5-51ad7b3c690d", "comment": "Malware payload (Smoke Loader)", "value": "b92720533f7d2c70364af754ae2c50425cb8b2df3471c9ba3d05fbea1653a1ac966ece73d9b7206a9b05df883c0abd39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634905266, "uuid": "50a49601-beb1-4915-b573-5af8bc3e1933", "value": "T1CE548D10AAA0C035F5F312F859BA93ACB92E7EA15B7450CF52E426EE57346E1EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634905266, "uuid": "e6a83864-3986-434b-8c96-874c77a80218", "value": "25e96726029c322936cf0033b6a07058", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634905266, "uuid": "a83c38c8-01a5-4c6f-ac01-18801eaab589", "value": "6144:hnDiF7VI0x8zGxCJAVPvZDoVlpXU30IaEhROg9b:ZDkO0042IvhuXuLaEhpb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634905266, "uuid": "a6158d5a-ae4a-4eaf-8487-932363c98e5d", "value": 291328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634905266, "uuid": "cdc67066-8a1c-4855-959c-3163e1b81bdb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634905266, "uuid": "6c0cc888-5835-49ba-9b41-18e2e39c8c0c", "value": "6619cb673bf96428f23b9c4cb7251c15.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbe041c5-330c-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634889140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889140, "uuid": "2d70b69a-046d-4a48-bc51-138675d9b76c", "comment": "Malware payload (AgentTesla)", "value": "478be5314f4b786f9ec75b2f86505743", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889140, "uuid": "90c01c65-d4f4-4694-b093-f850d0d659a0", "comment": "Malware payload (AgentTesla)", "value": "4995d93769866b4ac6e5f3b549ce0406f8fe2cc7e1c8724d3130193da6723c62", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889140, "uuid": "2e8ed50a-4183-4307-a124-db7190011d62", "comment": "Malware payload (AgentTesla)", "value": "bb53424b79bdab45985441072ccf65a9f999b4d0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889140, "uuid": "73b21e32-f437-4dd9-b43b-8838a578c2f5", "comment": "Malware payload (AgentTesla)", "value": "7050209ff2e6b9339216263d399c00fe6ebf6e17176df40a8e7c50a3aafeecd17d061b6533c27f55f62833c4b6aaeb37", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889140, "uuid": "8eba6fae-ce6a-4b6b-ad03-4541784bba99", "value": "T12DA47A0432A98B11E9FAABF00631554497BB7DAE287DE60D1DDE34CA1F77F404A61B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889140, "uuid": "d8061d2a-e049-48db-9eaf-7c5896aa8d55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889140, "uuid": "c667e758-fadd-421e-9ae0-7f0c2aba72d4", "value": "6144:WGxhLzI5Pv0C1VG51XsFtxF+onRfO3txTA+PXwQ08Rbs79RpzcALh:/sJXV0XsXxFBRfIAuAQ08cXpFL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634889140, "uuid": "ad8df70a-2228-4a61-bc69-9b0d1bccb84f", "value": 472576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634889140, "uuid": "1ccfe3f1-fed5-4c3c-ae72-59bdeced849c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889140, "uuid": "21353d14-184c-4417-8a2c-fb427724ac73", "value": "new order 00041221.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ba2db69-32fb-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634881435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634881435, "uuid": "bddfa0df-f253-4d2e-9256-d05b12a4711a", "comment": "Malware payload (AgentTesla)", "value": "392f0e8e6ed60e4e1c35bf1f6be5ec57", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634881435, "uuid": "6b78f10a-bc88-4a9e-b4de-c05d49c7d57b", "comment": "Malware payload (AgentTesla)", "value": "49b6ab1d5d071bdca6b3cfec673a258110848bc5beea2805d6b7e016731a4655", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634881435, "uuid": "85a5ce0b-2606-47ca-b18f-a9f8991d141e", "comment": "Malware payload (AgentTesla)", "value": "72aff1f262792ec3e626888583c55549d395dcb7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634881435, "uuid": "6fe2a47f-4d3f-4f39-ae06-743afe1e55d1", "comment": "Malware payload (AgentTesla)", "value": "b6ce680f5c7df326e748ef062796d2242781adc59e8fd6514c4095776869812fd9a8d28cd9f4f7faef767ded1ee15c2a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634881435, "uuid": "26cf949f-893d-4ef8-85dc-4e936cb6f06e", "value": "T1C47402363289CC27E20B563149A6A765A6B4DF04858467CFF3B43F7F7D326CAB44844A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634881435, "uuid": "494d578f-58ca-49ef-8ed3-580bf96e1777", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634881435, "uuid": "0ad5cb7a-b5b0-4105-b58f-d03d242ea5f8", "value": "6144:GBlL/VGeKGDuGyGNQuy55SVyvdhZJrfdX6qFck4o+v/WwE8jjlw1qA:EmPgmKSv+/WWjK1X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634881435, "uuid": "31e810de-992f-4b96-94fe-309886cae32d", "value": 346718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634881435, "uuid": "b27b8646-05ef-469b-92ef-1388e9c66931", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634881435, "uuid": "864b36a7-c6ba-44d5-a2a2-abd3fdcc872c", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a315a1c9-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928075, "uuid": "6027e100-82c1-44a4-b7b4-cd5d1aa32e4e", "comment": "Malware payload (RedLineStealer)", "value": "698e58a302e813b1d4d71457354cb79d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928075, "uuid": "51c79a0b-2fe4-4ca2-ab3d-57d772c9c1e2", "comment": "Malware payload (RedLineStealer)", "value": "49e735a45613bfeb3b690bf26ae8832cbcf01e1e5c713bcca51c66f55b39398c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928075, "uuid": "f6385d03-237c-4adb-b19e-54298a04c258", "comment": "Malware payload (RedLineStealer)", "value": "4f13ae4a06165ec3a916eda593fbeb7704f2b4e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928075, "uuid": "cfb1890a-9163-4c89-ade4-fcc93b639100", "comment": "Malware payload (RedLineStealer)", "value": "76c21cb2457495daf0fec92c2e384d7c2dfd1e98cdc2a2a637b2af102d982c016876ee99ccee58380668b80f9dd4be66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928075, "uuid": "da32eaea-203b-4f1b-87e6-7e822af3b66d", "value": "T113F4E000A690C035F5F726F889B59328A53EBEE16B2454CB52E51BFE57356E0EC3132B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928075, "uuid": "e8ee6b2b-c8d5-42f4-a325-dc7ecc72aa43", "value": "9cccee30870eeeef9fd80f169e4bd55f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928075, "uuid": "bb0c5402-e6f2-4b03-9d19-0f412e850bd2", "value": "12288:Wibz+YYlm81dmqWr+Lc9DNllK8uvlja7lfHNSsGSz2L6uibeiKYVX:WI811k9r+SK8IMXfzS6uGzV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928075, "uuid": "243f4407-9b5d-48ee-a823-cb3928c5e801", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928075, "uuid": "fac09855-7747-44d0-a1f9-35c9500df93b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928075, "uuid": "c4e70da7-e40e-4249-9009-d2add0210e3f", "value": "698e58a302e813b1d4d71457354cb79d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3ada2f3-3361-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634925606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634925606, "uuid": "5d803196-c1f6-411f-889b-f149d7336c75", "comment": "Malware payload", "value": "99a9910cdb069ff0ff148f8993b62a30", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634925606, "uuid": "e65daca7-91a7-470d-acde-ca396372c8e9", "comment": "Malware payload", "value": "4a0c2fa568a0a7d495b4ab3c35ce0d669c3a447226aaf2fd02eb0e6a462d1ed1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634925606, "uuid": "4ad6f0db-2ce7-468e-a60d-33463e11cec1", "comment": "Malware payload", "value": "96fa2444d60e2e2d8ee5f57fecb9715e7a7dae98", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634925606, "uuid": "977c6fbf-965f-4ff1-92db-977c5459295d", "comment": "Malware payload", "value": "6310e0a03fcc8e8c6dee8594f9a721c863f4697036007e8a910d70a53dce00496a49053fe709b41fadd3552d48f86bd8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634925606, "uuid": "9ea7eeab-0346-49cd-9fa6-c4e8e48d5e0b", "value": "T137B33C05E7408B53C4D2277AFADB43453323DB54A7AB63065928BFF43F827AE4E22516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634925606, "uuid": "1129a13a-dd67-474e-a003-cd32eef576ab", "value": "3072:2qtarDrrM5izrc+kweSWo+M/9Ibmew3K2+s:2qtarDrA5fZweSWRM/9amew3H+s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634925606, "uuid": "b5acf7fc-0bd3-4514-b865-c458854fc093", "value": 117629, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634925606, "uuid": "686f3d5b-4ef3-4002-9d2f-49d72b000170", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634925606, "uuid": "12a37e84-83b2-4ccc-937d-7bc9f31d44b2", "value": "Fate.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7e71c36-332b-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1634902313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634902313, "uuid": "37b76244-7fff-442f-83ab-ed9a45db81f1", "comment": "Malware payload (NanoCore)", "value": "ce6c1427a68e923224e5b905c111a705", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634902313, "uuid": "8cc04efc-b48b-4387-b052-cbce64941af2", "comment": "Malware payload (NanoCore)", "value": "4a3c5b05acf2b9146986099a82aff6b616442d38222aa5be8ab875e1a73be94e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634902313, "uuid": "fb57bbf4-5262-4830-ba78-90eb99070978", "comment": "Malware payload (NanoCore)", "value": "5edea42e155b4ee11df0d4ff92cdc8e9f1ba0a98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634902313, "uuid": "5f30aa79-d840-4fce-abd4-d0c5ae1789d9", "comment": "Malware payload (NanoCore)", "value": "f832950d81f114d8b60586787e02786f714cb5346f27bb2e154402ab2a2b2c9cbaadd531f5a0fcfc5907db0e6d362214", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634902313, "uuid": "4abd8f7d-165a-448a-9e22-33bc4e214ecd", "value": "T145D4AD9236A84B51EABA4BF085318A0087B73D2A547DE64D2CCD74DF0FB3B404666F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634902313, "uuid": "4ea746a3-8bda-473b-a849-5ac5d4e113e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634902313, "uuid": "cc0d1d12-650e-4478-a358-212b66d11e56", "value": "12288:OJ9XIX7zoGgSwSsX+m+R+BFb20WWf+or5FbnVe:OfXG7pgNt+R+Pb20WWx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634902313, "uuid": "c4eb236f-857f-46a5-8d37-4a532c2114d8", "value": 652800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634902313, "uuid": "f5b0a70f-16e0-455d-8134-edc935633442", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634902313, "uuid": "e3ca6835-066b-4360-83a3-dd3a14038203", "value": "Proof of payment.jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "accc244b-32eb-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634874833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634874833, "uuid": "6f75d3af-3aca-49bd-9873-4bd7d131b7a9", "comment": "Malware payload (Gafgyt)", "value": "a0adaec0c1e4b3b2a2f64c8e4e9fa7ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634874833, "uuid": "f033f7ca-d934-4b61-ad4d-341c68519be9", "comment": "Malware payload (Gafgyt)", "value": "4b7c16197b387ae59351467a7f84accb1b93fb7ec8f64676bf6fc4eac94047e4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634874833, "uuid": "d2217d1e-c29d-494a-be23-b1687882b764", "comment": "Malware payload (Gafgyt)", "value": "0b82648e1987134a3ec5cf4e2db0afc53dba59ac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634874833, "uuid": "852e347a-75f4-4c86-8af8-7778504e0bf9", "comment": "Malware payload (Gafgyt)", "value": "2cf25b8db059b39fc2fafe211eb8ccf3d8dcb4aef883fe66ca44bc81ab91a720bbed2d85e4fc4a953ed3dcabf814ce0f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634874833, "uuid": "ed0c9608-f4ef-46c2-8de2-9edb30cfe031", "value": "T19CB3C517AB618FB7C85FCE3306AA850120CDA55612E97B6FB2B4D92CE74B84F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634874833, "uuid": "0c49b8ac-fb0b-43b4-a7cc-14f8116e30d4", "value": "1536:ZLeTikthhSMOCMQS+ZjN4pjuIxreg2OeN2eDo/TUmkiSFxfC7xbXe:ZhHC3S+dUreHNTDiTUmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634874833, "uuid": "aae6d090-3956-45d3-80a4-f5f9babfe32b", "value": 113275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634874833, "uuid": "65f39dbd-199d-4aab-a7af-478af9bdb42f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634874833, "uuid": "af360c22-3b5e-4f75-82bd-e9a2da2ad915", "value": "a0adaec0c1e4b3b2a2f64c8e4e9fa7ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26b3ca29-3322-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634898231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634898231, "uuid": "4aaeb9e3-c6b8-43f8-abe3-aa2317766902", "comment": "Malware payload (Formbook)", "value": "37983cf849f7f7566b9572d57f0dab0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634898231, "uuid": "9aa1c8a3-9c13-4441-8097-659afc7df05f", "comment": "Malware payload (Formbook)", "value": "4c20199af53476746b9169321c057437c7341c334d61f496820876d9feb63251", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634898231, "uuid": "338499dc-f126-4e09-a50e-ec346f767e90", "comment": "Malware payload (Formbook)", "value": "1fdf342b37fb0f6a3131d29752daf1861523e40d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634898231, "uuid": "424191cb-bbb7-4f14-80e6-48b9937d480e", "comment": "Malware payload (Formbook)", "value": "27f8182d2a24cc05a4405fa8354bcd743a349ed63bb4a0d15f762b35fa6ca1f455f1ce0395f180b0a8ca3cf1da926bfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634898231, "uuid": "3ecd9fae-f069-4295-aee3-2e67c9ef4086", "value": "T1D2A4AE407A7C4E97C4A915FA8091D4810BF56C6B86AEF3C91ED374EE2EF6FC50682487", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634898231, "uuid": "c19b0436-ce40-4c11-b366-d5f351a82243", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634898231, "uuid": "17ccbf74-1946-4d71-8ca2-947c8352f6f5", "value": "12288:/AGr1P6zxdW2LrBLlJksRUCjux4LZnZf8o:/LWxk2pXBLDX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634898231, "uuid": "b9ac4e4d-83aa-4c24-9010-1021cb66a5de", "value": 488960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634898231, "uuid": "cfd6c7b6-f0df-4a6c-a466-3d254362d159", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634898231, "uuid": "73d2e14f-6a59-4272-92a0-623b8eb2730b", "value": "POSGORSGL2110210416.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ab471fd-32de-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634868978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634868978, "uuid": "f4756771-47a7-463f-ac65-1194453dd255", "comment": "Malware payload (Mirai)", "value": "2af6167aa24d06f1795c507272d02916", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634868978, "uuid": "087f29d6-3b5d-4fb2-9316-f4bfa464cc8c", "comment": "Malware payload (Mirai)", "value": "4c6ea0ba603fe0b1d8a97485afcf756d6e2a2630dfe18ee33353a17588924741", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634868978, "uuid": "4e9c1638-0d50-4c0d-86b7-e19c4198de38", "comment": "Malware payload (Mirai)", "value": "24092366777f504a441a27f3555ca64e00719528", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634868978, "uuid": "240b367c-eb95-4f3d-b457-cbb38ae97243", "comment": "Malware payload (Mirai)", "value": "41f97e24b3edad792dbd067d17c4bc210dc86d3d5921f4cf14db34de3bb26adf89e8b47c2232d49a2252ae0e4b90fbdb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634868978, "uuid": "460a2b79-ddfe-4726-95e2-5ee7b3048df9", "value": "T165332B027228494FF9D61EF0393F0FE093AFE98024E0B585694EEB458676F771586F89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634868978, "uuid": "2a1aac0a-39c9-4673-8a17-e36e1d4447e8", "value": "768:opgPdUwOe1Po/7wni3RiAPSnPfDPKA2JjcRlgaizjrvVwipnpBX9QeA3:D1FOe1Po/kcExB9Mai6wvXeN3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634868978, "uuid": "2f079afe-2936-4ad4-8582-c0bf2991037a", "value": 51604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634868978, "uuid": "404842e1-b361-4e78-a5c7-0e69793bdc8c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634868978, "uuid": "5f701680-ea61-4f4e-93e6-b079a2fca730", "value": "2af6167aa24d06f1795c507272d02916", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a765fc36-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (GCleaner)", "timestamp": 1634928082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928082, "uuid": "44034968-71b1-43b6-8216-c6053c4c5e8d", "comment": "Malware payload (GCleaner)", "value": "bab4569b91afc1b8e96f1f39708c41bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928082, "uuid": "0bcb193d-2eb4-4a53-bd8c-803c2b19522a", "comment": "Malware payload (GCleaner)", "value": "4cd754af5d3b9faa7e9626f79fccc35464224247a10f4d01ef502a0423e637a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928082, "uuid": "e838c698-1802-41c9-94df-2a9d46b8320e", "comment": "Malware payload (GCleaner)", "value": "fa6afc54f0e7a0a8a0477d9ac7a18334dc4814d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928082, "uuid": "abcc9a13-2d63-4eb5-ae52-e432c5955be1", "comment": "Malware payload (GCleaner)", "value": "15d94769f9d197b497ef815739380ae8726f7153b7494d98fe505005b3a8012007cf3e78e1ceb13fba2ca2eb1967941b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928082, "uuid": "e6d852dd-fa66-48dd-8d66-472370fe14c9", "value": "T1FD1633050D3E95B7E58B4F73BBB237360B47D39651E1C81A33D06AEA1C26223297835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928082, "uuid": "cf8544b8-0fc0-45e2-8dce-f2941d8cb615", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928082, "uuid": "cdbb953e-c2e7-4955-9b87-8f00e67f81e8", "value": "98304:JT1nlSNFz/c8HZGVl/+yBTMaeyQRNzn4/KfPClr+Lcisg4ieGQ0:JThoLH/yKaeyorJ6lKLci+iQ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928082, "uuid": "3bb72a06-7a11-407c-93ba-c6205f475f6b", "value": 4054854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928082, "uuid": "b7730f29-6b6b-43cd-b8f0-136ef436f362", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928082, "uuid": "95ae25a2-78d7-4215-b953-bd9a4848288d", "value": "bab4569b91afc1b8e96f1f39708c41bd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6c873df-335f-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634924672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634924672, "uuid": "8002d9c9-c948-40de-98e7-a635eb0afc06", "comment": "Malware payload (Mirai)", "value": "620ce9d3f5f3de52d9bd3cd27d88a70f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634924672, "uuid": "431f666c-7b57-479a-9014-f647992f3a51", "comment": "Malware payload (Mirai)", "value": "4d252c9368de64e54747a60573f5dc2ebfce2d756bb204368635209f08c8c712", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634924672, "uuid": "4c00abb1-c18d-4554-a9ac-399461d2db02", "comment": "Malware payload (Mirai)", "value": "edb4a69e84d9816ab7012e706364fb1d92f8b6af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634924672, "uuid": "f1748561-ea72-45e0-8cd0-86995bb9f552", "comment": "Malware payload (Mirai)", "value": "5d227cf2d82f102bc1e7b805161124b6020c964d3d68938cd8a880fb1097ad14ccda361a74cb49ae6e56b20215016c92", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634924672, "uuid": "2eaed30e-af35-47cc-80fe-222e0856107e", "value": "T11EC3842E7E12BFBEE668863107F35F70879521D227A19382F26CD6181E7128D1C5FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634924672, "uuid": "bead3bb3-6a95-4268-9ba2-21303f312cf7", "value": "1536:47je1TwGq+f+AM2rK/jeve9eLe8B2rK/4eBmq0GAzQj1l72HBe+EJWfRZrmW+IFj:3ClkB0MZQHQJ6RZrmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634924672, "uuid": "19cdf0d5-cacc-4b2e-bf48-f30b942b6f6b", "value": 125962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634924672, "uuid": "8241b511-0a4e-493e-a4c9-9b291a53ad54", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634924672, "uuid": "3d6f1a65-21ec-41fa-8c11-1278418bb081", "value": "620ce9d3f5f3de52d9bd3cd27d88a70f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97349b4d-330f-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1634890259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634890259, "uuid": "30c5cce4-7194-46bc-b40e-31d0fc6b4d79", "comment": "Malware payload (GuLoader)", "value": "d029c174ae382073d9b2522352837943", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634890259, "uuid": "d7c78a76-2629-407e-93dd-221f617e1a14", "comment": "Malware payload (GuLoader)", "value": "4d935d0aa1789ea320a74e2a195743b49b3520f7667187cd57c2cf0b710086d9", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634890259, "uuid": "e71e3a85-40c9-4d67-8d99-a85aab81b303", "comment": "Malware payload (GuLoader)", "value": "5ac1b60e5fb5539e80fcd63047161efbd90356d1", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634890259, "uuid": "b3fdad28-8771-456a-a4f8-1e274482a215", "comment": "Malware payload (GuLoader)", "value": "134b86900ac67799081edb85cd800e2884bcb43821525b0477b6232623a887b58b47cbbe825b5ff558385febedbcd938", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634890259, "uuid": "f3567576-2cd9-4bf4-8595-ba882d8f6685", "value": "T16BB329F2B59885D2F253CFB1CB56868C0132EC305D068A1BFFDA3A1839B5543AF53A56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634890259, "uuid": "a4e65412-a2da-4330-87d4-a88c109b2453", "value": "4e2704c7ec18ad07f9bb5b3620701034", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634890259, "uuid": "966953b2-5dd2-43ce-9aa9-f9b563e1db12", "value": "1536:U4dQ7+6ei46NW6mQ8f7D+2WgHfKOPL3AGt1brnY0eFXQgzq:9dyx32zoczLDYBFHW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634890259, "uuid": "82c2aae9-ca13-477f-b17f-adbdbfed37da", "value": 110592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634890259, "uuid": "fcfd1ca7-53da-41a3-86c9-bf92b8f67ad2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634890259, "uuid": "2d2f06cd-03c3-4b3d-89d8-d4ba51af0a21", "value": "DHL_Shipment-Notification-2166598383-Notification-XXXXXMSG0073728273736_OCTOBER22-2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8306f065-331f-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1634897097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897097, "uuid": "07fe53fa-befc-4736-b233-c0eea7edf86b", "comment": "Malware payload (TrickBot)", "value": "5c4f11f182d70c0e379cbd8e74d3a23a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897097, "uuid": "7d531e6b-cab8-4eac-ba6a-6883c6b9861b", "comment": "Malware payload (TrickBot)", "value": "4f80d51a856dad4037a2de22d17ec77a3f6a8768c9d312f489f859f9cf4f0520", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897097, "uuid": "049da8b0-abaf-4611-b63c-38bb26504b45", "comment": "Malware payload (TrickBot)", "value": "74b21db750ba635fef711d67028cec8946ecb506", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897097, "uuid": "33751b74-0dc0-4a0b-a34b-65a6ffa48221", "comment": "Malware payload (TrickBot)", "value": "32c605feecaf6f1ec1df1451ddb7770ad2da85f36718be68ed5b984ec4627f42de89aa5d927c8cb0392c7d0aba49e506", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897097, "uuid": "ef0ffa8e-c64b-49b3-9009-eddd5c297f25", "value": "T15AF4AFD59A5296D7FA46CC3AC30065A7C4D71F329A61F0F5EC0B2213BDB39A28476B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897097, "uuid": "0c3dd69a-226c-4394-8252-5e073b6137d3", "value": "0287a7604016003972a047b182e6c22a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897097, "uuid": "cecaa451-b6df-40a3-ace4-d543210a3cfd", "value": "12288:7NP2qgMhn9VbKac3cM15xIKR5pduDkgcKOuCEUz+ovYJXA8ZRA5cXO/+uBY2F0cC:RPp2abM15xIxD4KXJg/vYRbKDBhF1TSz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634897097, "uuid": "f4fa13e0-6f1e-4d2d-90dd-ed2643454b0e", "value": 723456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634897097, "uuid": "aed600b5-6f8f-402c-bca8-dde088329b63", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897097, "uuid": "f596a0d3-d7b7-4356-a1fa-5bfa34427f52", "value": "5c4f11f182d70c0e379cbd8e74d3a23a.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c883e0d0-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928138, "uuid": "0d127ae4-c304-4e84-859b-4d08a42180c0", "comment": "Malware payload (RedLineStealer)", "value": "3bf12c76dd13e3469c696fed3c503ccd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928138, "uuid": "ea2b2a8d-7e5a-4339-949a-dac3d2cb54cb", "comment": "Malware payload (RedLineStealer)", "value": "501a6c2059ef01f1d1d3a37631c6bb571089f64c97b3000faa7426a04bf9186c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928138, "uuid": "eb51bf53-bc93-43c2-806f-3f1e1a6b5b40", "comment": "Malware payload (RedLineStealer)", "value": "4c4b9e48ca6b4b538270d6c4e6ce9b7bc8c6a194", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928138, "uuid": "efcd0059-8726-44ce-ae9a-838dd60458a5", "comment": "Malware payload (RedLineStealer)", "value": "511871eb81fe7117bb2993a37a5000c2833c4dadb74824f3003284eb9454ddda94ca15a7eb48f6884e81f3b01de7adf6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928138, "uuid": "0db50c6c-4b4d-465f-85ba-477ae4b8c5a7", "value": "T1BCF4E000A650C03AF5F722F849BA6328A52FBAE1576450CF52E51BFE5735AE0EC3135B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928138, "uuid": "9ddaa5cf-acee-4dd6-bcc0-5e420de01ed9", "value": "4af4742906d30c7889c195169379a2f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928138, "uuid": "98fe0c39-e715-4438-9e14-70c8496d8209", "value": "12288:Yid8sgcpFXMsoh/MMBcobq2QE3IIA/0xRsx4icWMldfvj53ZDS53Srz:Ye8sgcpZ9MGsMZoWmvj5JD5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928138, "uuid": "1391d6e5-f838-46c2-a8c9-44f89448507a", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928138, "uuid": "eaeef729-939d-46b3-946c-b7010f32b464", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928138, "uuid": "5bdd796c-c376-4d3d-933a-2ac427760141", "value": "3bf12c76dd13e3469c696fed3c503ccd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9561444-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928112, "uuid": "269db5da-4d9d-4cbe-b318-867d2cb72cdb", "comment": "Malware payload (RedLineStealer)", "value": "7552188b290098d344a3fe26953a46d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928112, "uuid": "807e8269-b7d4-419d-8d4d-118080c2ccc6", "comment": "Malware payload (RedLineStealer)", "value": "50224e503e84f0376fa543fde98fa60d74c94b89ca4b980591419b56ed7d3b7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928112, "uuid": "f82eb77b-d241-4c4c-9c1f-adbd4ab2aeee", "comment": "Malware payload (RedLineStealer)", "value": "6e04ba06d1e4d1d330f582416a3e9059c28d2dee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928112, "uuid": "c8b4bd4f-e75d-41e4-b324-66e967a8b212", "comment": "Malware payload (RedLineStealer)", "value": "0c01fe7e8be00405038fb41e7ae8e38f6caf691931b823b0acd5d4af32e9d588a3a30d2ff575aa69a40a967e11a0aa77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928112, "uuid": "08d1ac48-f4ee-46dd-a46b-9afd9526f3aa", "value": "T151E4E110AB90C035F1F712F84AB693A8A93E7EA26B2550CF52E416EE47746E1FD30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928112, "uuid": "c7eb0726-7b19-44c1-ad2c-4ee75bedcd74", "value": "25e96726029c322936cf0033b6a07058", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928112, "uuid": "6869ced1-767e-4267-b0f3-3040fd190cf6", "value": "12288:NvVIf+Q8uNdAG1y3rdWq90FAw5oyYOyhXnYfsKOyR1D:NVImQfvTw4q9M5oacXnkPD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928112, "uuid": "ecadb93e-3724-4955-9766-033617e59fa7", "value": 669184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928112, "uuid": "39ec4df2-53cb-46dc-9c81-bd490fd1a407", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928112, "uuid": "6f12fde8-afe1-44b1-b1c3-e7b5400d7747", "value": "7552188b290098d344a3fe26953a46d5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61ceeab7-32da-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634867406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634867406, "uuid": "10620ece-39e8-4a4c-8122-758cb1902934", "comment": "Malware payload (Mirai)", "value": "be53dbd9067ec4960a79a5a273d98fab", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634867406, "uuid": "8b2fa48e-dbb8-465d-9354-745a458da7cb", "comment": "Malware payload (Mirai)", "value": "50aa5219ad1080a17954597f9370aff75b579f8e550ca196fd4d298ff860a67b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634867406, "uuid": "10c8e43b-b0c1-4031-b536-37f4daa2ba7d", "comment": "Malware payload (Mirai)", "value": "2542023e69a80e86a1f9c1af3bb4a0c09c81f46a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634867406, "uuid": "f72d1b4c-c4d8-42df-8abc-dddd4bfb7c54", "comment": "Malware payload (Mirai)", "value": "acb2c28bce1ef8b9f94186a96c227353d15cc3935441128c4727e6b00b64f47171038f2834f4b88c838aad882b044a11", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634867406, "uuid": "7cda01ca-b1eb-4d87-b524-d7bc79906945", "value": "T1B24308817881A626C7D05377FA5F018D33199798E0EE33578C296FA07B8AD1F0D6B74A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634867406, "uuid": "075e9b33-b14d-41b7-860b-bedd81572890", "value": "768:30ESWRYSaG0wBXAy9abThYrB2dPsnjVB5uEBwLRzqmPrqYhH8qkJSULwCVy/rCxE:dSaP0waejVMqY/cJ8fhWfM5tMd7oHm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634867406, "uuid": "56a64933-9a4e-4f32-be47-024ef032e5dd", "value": 56880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634867406, "uuid": "07df8920-a8fe-40a1-90ec-6a16b55060a0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634867406, "uuid": "3c0e6e6f-6512-473f-ad0f-5639a17c9f3d", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c13e3f9-3326-11ec-843c-42010a9c0014", "comment": "Malware payload (Neshta)", "timestamp": 1634899958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634899958, "uuid": "c997fd1a-819c-4cdd-bc98-960a1a60ef38", "comment": "Malware payload (Neshta)", "value": "8efc94a68d078ed67459403c868aa9f0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634899958, "uuid": "38a44403-c0b9-4a44-ac27-0c1b80f78f8a", "comment": "Malware payload (Neshta)", "value": "511f5c0a9946188ad3dbbb58c2e2e5564402d83dd77379a39c8a17c660a737da", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634899958, "uuid": "31d4bad7-86d6-4490-90b7-f83cc3bba1c2", "comment": "Malware payload (Neshta)", "value": "64da6737b14dc11fb68fe4aef22981219ecbfd9f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634899958, "uuid": "83e5b4f5-bcac-4d2f-b721-a00b78a302dd", "comment": "Malware payload (Neshta)", "value": "145ae8de28968c291dc6b416cfa5e70913e34e63ceed5030e3f2c66f1660e8924484257f01bd9db80e79c3c74114287c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634899958, "uuid": "601a6d91-6d35-46da-898d-025b4e89f59d", "value": "T1FC34131422C588FBD88B4BF141FA5B39E3F3519B0015AB5B47B24F6836742CB6A2E753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634899958, "uuid": "d287fc7a-4908-4fcf-8839-ada8e6c13981", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634899958, "uuid": "94059d35-ab42-46ec-a55a-6c64f2e5dd80", "value": "6144:wBlL/cbnggLr08960+6EV1PEb5rHfSRUGA4C:CeRP8RZMbBHfadA7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634899958, "uuid": "19215551-d93d-4e0e-8fda-b8eb4e9ae635", "value": 244021, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634899958, "uuid": "aa6f65ae-a1b6-49b0-b08f-6daaf9d311dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634899958, "uuid": "7d7af570-9bfc-41c9-8f46-6364c57b9314", "value": "8efc94a68d078ed67459403c868aa9f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cccf312-3330-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634904442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634904442, "uuid": "f826b884-05cf-4a2e-a771-857714f56c4f", "comment": "Malware payload (Loki)", "value": "1b5c8e1ab3d91e363526c423f961c01f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634904442, "uuid": "1886a2e0-a849-4ff7-8742-05da5624d641", "comment": "Malware payload (Loki)", "value": "517af664cfadc897195445bd52929627257460831a2386df0bf2b064fa502c71", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634904442, "uuid": "67cbe995-fa5f-4beb-83c1-9b95de2d363c", "comment": "Malware payload (Loki)", "value": "a2e06479ad17e518d180896fd458f4523741540d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634904442, "uuid": "54749798-f1a8-40dd-8651-b019aa17dfae", "comment": "Malware payload (Loki)", "value": "53f2e0303654ea524957d679a9f119aa80e123bc61e67f5d787988672e00e1773531b2bcabb0372bce74e3335c1464bd", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634904442, "uuid": "1c9806bf-623e-4663-ad2c-10a313bf091f", "value": "T18C227C3CC688E51AE112183DD01A52FAF76D446AF613F96F204973CD4BA17C347CAA6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634904442, "uuid": "95f7c969-1547-4f43-9bfc-564189ba9ee6", "value": "192:ScIMmtPWQjG/b+rcafbO525SEzBC4vNqH9Rcm3lu5b:SPXlGT+O5EhlqHtlAb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634904442, "uuid": "df831b03-726e-48c2-b69b-4099ad0350de", "value": 10335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634904442, "uuid": "101501c6-1434-4aee-addb-31d1a49f20f2", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634904442, "uuid": "655bd658-152b-41fc-9be1-4155dbe738fa", "value": "0001.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "174bbb8f-3320-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634897346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897346, "uuid": "90ad1e81-3ac0-4433-8aff-3923971979c7", "comment": "Malware payload (RedLineStealer)", "value": "5cfa1c74d3410705daf7055374b56f2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897346, "uuid": "b13194c4-0755-44dd-a846-6dacd663b3e2", "comment": "Malware payload (RedLineStealer)", "value": "517c6f4aad96b59020c6c736521a3084b2c625c5d7ce4f637634839b98b28c11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897346, "uuid": "5b6dfae1-5637-4dd4-971f-5f8951c9796a", "comment": "Malware payload (RedLineStealer)", "value": "6943644e7c6e52324353770e13ede9b78e3036a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897346, "uuid": "a4b3e926-0b88-473a-be52-11e9a41be629", "comment": "Malware payload (RedLineStealer)", "value": "856002ee1fb476a86506aa2266224908710d44d5816f6b0693128d870c33d780aad58ed5d2e3148d93666e94845dc5ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897346, "uuid": "b2997ff5-981b-4124-9b4f-3682aac3e299", "value": "T117639377406691A6C5892330F4B11F4B367CD6381980B698F14FF2AEEC1D29D9EF83A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897346, "uuid": "1f472a4d-2a1e-4035-b0d7-863ab27d0694", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897346, "uuid": "af9daf4d-3be8-44a9-a911-8da3423db621", "value": "768:QMedEMYp16zhzxfCH+zU72gSWASIkDrG556ufBxQseeIYECraHJLQFS3dQ4UsDQ5:VFMYp8htfCHWeVtAmG55ivnpmEab00", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634897346, "uuid": "0a513e79-542e-4a66-903c-c624f5c610a0", "value": 70144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634897346, "uuid": "b9c1f8ad-c043-43a0-aa6b-d71f5948537d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897346, "uuid": "a3bd08b6-292f-4f7f-b1ba-e24a712af7f5", "value": "5cfa1c74d3410705daf7055374b56f2f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "743b02a1-336f-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634931432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634931432, "uuid": "fd8521c4-16fd-4353-8b39-b618a93a15e4", "comment": "Malware payload", "value": "7248a1b7dc64248926d1cb69329913bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634931432, "uuid": "93933403-6f24-4d1f-8294-866da749e71b", "comment": "Malware payload", "value": "553fb518faa79fd3a2c45b6fde880a8800999fb9bb9f781994fa79a70ed55da9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634931432, "uuid": "f3fbc6dd-accd-4dd8-978b-89146091bf0f", "comment": "Malware payload", "value": "7858317ed00a201e5aaec17bf206ad672ee02602", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634931432, "uuid": "cae91aa2-42f7-4778-8023-943ba8d2eed2", "comment": "Malware payload", "value": "c91dd0834389c490c5fc1155ffdab2e22b085d8babe02f1b228e83bc90c7991c4d2dc2bd7f3b980f3ffbbd9fb4dfa47e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634931432, "uuid": "c8344ff0-6420-40fc-90cf-545bd777682e", "value": "T134B409BC3154BD9FC86B8F3945541C64A61268A7034FF31370A729DA4FADBD69E002EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634931432, "uuid": "d27b5180-d2b7-4988-be5f-632df6b99b0f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634931432, "uuid": "75cab9cd-5b6f-4bd1-88ec-a19e7edd39ae", "value": "12288:S3somvfPfu91uDbbdxNAqCPM2BJnnLSFbC0OA0DJ1Klgl:Stow1ubfN3mMop", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634931432, "uuid": "92a20323-9cb2-4c3d-857b-37f1c7d6d838", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634931432, "uuid": "e09c2ec6-7b09-4456-bf46-b9ccdc7ee443", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634931432, "uuid": "351640df-2c56-4999-b158-00f46d9766de", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81d4b1c3-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (DCRat)", "timestamp": 1634928019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928019, "uuid": "565ecb10-438a-4106-a7a5-85411b3ce8b7", "comment": "Malware payload (DCRat)", "value": "9c06e0e1858701cc632ff0ed06d48efb", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928019, "uuid": "436f634e-550c-41f1-bd8c-37a82db3ecc1", "comment": "Malware payload (DCRat)", "value": "55a6107a5ad6b8cd13b69794498a3b890ed6a5803cda738bd98c16f0077f0ebf", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928019, "uuid": "d0f27c3f-dacd-4842-9d7e-841bec7e4a81", "comment": "Malware payload (DCRat)", "value": "5683f8ac98732a31fb0da617c5b892b78ca90066", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928019, "uuid": "eabbb242-c276-4834-bf6d-4e704d6da255", "comment": "Malware payload (DCRat)", "value": "6885f9df9e2a4d14cc338fc6d93a96bf1b348462440d70ef117a2ea3d5cd59de5af9393691b587a52cf0e0c1299a56f5", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928019, "uuid": "5e15753c-07df-4d91-b72a-b5557b2cf167", "value": "T16F759F7A56E8C609CBFCA37E072A9ACD7D1AC44E9021775DCCBD0D8D4620BA67DB0349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928019, "uuid": "1ef19ee5-91b4-496a-86a6-414ac2142d00", "value": "3fd48f2b49a69674203a1b3779fc17fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928019, "uuid": "75754633-4aed-44e7-9201-ffc5adbb86b3", "value": "24576:fiINCguyl+wsmtRR2nBUIcMu6dhHp6OZ3i8G/lNBaX8Ug4iU+Z2fxOT6D2G/N1Fb:yguyYwwBxcrg8yS8G/LjU+CxLc7I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928019, "uuid": "50f34be5-c0f9-4653-b311-53fab4e145da", "value": 1614336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928019, "uuid": "0db0954e-41e2-4e80-8085-2c55fe01e5f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928019, "uuid": "9cdaab56-32e2-4536-8140-68374ef55ced", "value": "9c06e0e1858701cc632ff0ed06d48efb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78850f52-32fa-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634881188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634881188, "uuid": "bb2252d3-5bef-4af5-9312-b7570da226bb", "comment": "Malware payload (AgentTesla)", "value": "932e49471158b4c267e2f431a859d99b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634881188, "uuid": "7aacb0cf-6d6a-4425-9a71-1038370f1c7a", "comment": "Malware payload (AgentTesla)", "value": "56083bc659229d4e7e5d199b24edce16abfcc1c6bcf0ad7b8836e6a1b2175506", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634881188, "uuid": "3f470ad3-9abd-4efe-80fd-ce4d23e43b94", "comment": "Malware payload (AgentTesla)", "value": "1ffcdc2a064ae913b69d31310fe9511bc2a90d48", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634881188, "uuid": "b22ae1b5-6405-4bae-82d1-696728b17453", "comment": "Malware payload (AgentTesla)", "value": "726270927a45667764a80548dfc07a2b6805a3adcc0d42c9568584ee6ebdf7bded401c45fccc5b898a663baab287f488", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634881188, "uuid": "795a5cdd-5735-46e8-8a2a-37ebcc1f35f1", "value": "T16153F906A7498435CB790BB3A15B89841BF050A6919BC34F2DCD63E48D4B79B3F5A3CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634881188, "uuid": "708e3498-ca17-4dc1-a8c8-2ae69db20d1e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634881188, "uuid": "363aac71-80a1-44f4-b493-973d71a74853", "value": "1536:XeAlXrWa6igFOfuEdMKoBHWsmKKqWCu2fBR:XeAyFO21BHBMqWWT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634881188, "uuid": "3a4dd83e-5e8c-476d-9edd-531a3b2a397a", "value": 64000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634881188, "uuid": "aca39c26-611a-4bf6-8839-7033419a5a5e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634881188, "uuid": "a6563dbb-e199-4a61-8cf2-2d204c732913", "value": "Proforma invoice INV2.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b057d632-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928097, "uuid": "7b34e735-c7cc-4f0f-a489-c7931db48aea", "comment": "Malware payload (RedLineStealer)", "value": "4788b9f2b49471fa3f20ce9ac9fd8524", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928097, "uuid": "586de6ef-d32e-4392-8f9b-292b9f92af87", "comment": "Malware payload (RedLineStealer)", "value": "5733022e0a84fede4220137c51b947633ba407457ccaf3022bcec3876b2c7d0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928097, "uuid": "48a3efc4-719d-4e2a-9c34-ad5598473e2c", "comment": "Malware payload (RedLineStealer)", "value": "37daa0fae772bf7634f1e71339a31252b86fd9a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928097, "uuid": "f5b95dd4-6223-44fb-abaa-f4063410329b", "comment": "Malware payload (RedLineStealer)", "value": "cdf66a5be55496c7ad30c6d0b0f96d484edfab6443ee737c2dbfb24dc33dc61a157fdc03d6be79a0447a6a25b0f8b2ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928097, "uuid": "04df23fa-874f-4f48-8869-c97c25f855a6", "value": "T17FA32A2067CCDA15EAFE0E74B8B0155583F0E4A37802EB5F0DC558DA1E63B84DB52BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928097, "uuid": "4526d817-cbce-4b1c-b1a9-e27c2a282a77", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928097, "uuid": "de301385-732e-49e6-bf36-35015603a5e6", "value": "1536:Uw7+10LWIvcw5pl6GUyQ07eBarr/hwch/bd6dRxTxMhhcOdVk98rY8m:r7ZWIxpC0KSr/hwchzoRfif6GYP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928097, "uuid": "8e20e671-efbc-4a20-a0a8-d14fc36ff085", "value": 105720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928097, "uuid": "0a435bbb-06ff-4e8f-8a15-c21124d9847e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928097, "uuid": "9de5cb20-834d-4231-b24a-ec2fbbfcb5ae", "value": "4788b9f2b49471fa3f20ce9ac9fd8524.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "143df553-3323-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634898629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634898629, "uuid": "e530919f-9fe2-4c96-9557-b895814135e5", "comment": "Malware payload", "value": "0845e9b37fc37cf35f3dd20ae1d1dc1a", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634898629, "uuid": "1bcb02f3-797b-4aab-847b-b61862257a6a", "comment": "Malware payload", "value": "577e2247e88fea7c78b2c420bb824abf66efb8e2f887f645713b3a9c0d1ac113", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634898629, "uuid": "879e282c-de2d-47b0-9076-36ba0b0c50f7", "comment": "Malware payload", "value": "cafaa63e41ade6d3d81d5c8182caf9ef7f367d4f", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634898629, "uuid": "730ac953-b72f-4e21-9876-fbc61b88c60d", "comment": "Malware payload", "value": "963dc84bc850ffe196bb810ab684c558514190a99968871c713e03650d5d0978fad4e14dca790f94efb075bda3ad3c9f", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634898629, "uuid": "51df6596-ab8d-4124-9863-53173aa5ecb7", "value": "T1FE459F23F2C08437D1B32A798D5B73A99C39BD146D28684F7BE41D4C5F3A6807A662C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634898629, "uuid": "04d72a15-6129-4c42-ad53-f7de351717dd", "value": "24576:6IvP5B0LmA5qPW5AsiT7/aBls3/NiAjajtlGtAgy9TU+UT7e5GYKASA:6IvP5pAMHHOls3Vi5gITPUTeGYK3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634898629, "uuid": "449b4d12-8b57-4e9b-8346-8b0040af35cd", "value": 1264640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634898629, "uuid": "912a84d4-73cb-4f3b-b52e-2139822ad5f1", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634898629, "uuid": "511eaa2f-dcc2-42bc-bcf1-d19778612da8", "value": "Pedido-833874.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c235a0f-333b-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1634909165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634909165, "uuid": "418613e5-e532-4c7b-af9c-e700b0fc44b3", "comment": "Malware payload (Quakbot)", "value": "b5a6a69fff90a9cd84015cd16460f949", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634909165, "uuid": "b95dc4ec-fb8f-4cfb-a30b-186836aeb84b", "comment": "Malware payload (Quakbot)", "value": "57b99fc8a6b93bda0bb101abef224504b26db8b2e4884aa7a83c94e2e1005755", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634909165, "uuid": "2910afc5-339d-424e-9e1e-bf8a032c76b8", "comment": "Malware payload (Quakbot)", "value": "5fe44fd619fb82fba6eb341de290063cfc7af788", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634909165, "uuid": "1346a241-f2f6-4b72-9f5b-15ec4aeaafc2", "comment": "Malware payload (Quakbot)", "value": "5bb498ee91045b138d95e3012e7d3827f67ee950b55e0afae1402196383e693c14faedc6c224c936f9b27e3d30094dc0", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634909165, "uuid": "314fda9b-57e2-4a14-8bde-f05998c9c5bb", "value": "T19B34E046B91CD89EFA17833148C7ABAA6323DC304FD71E876695762C7FB8DA47903046", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634909165, "uuid": "2ed16dc5-680e-44da-ac9f-c75868de1741", "value": "6144:WKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgBcfZw6lBVb7oWSuKMA6PujbmvV8DzJ:CZrlBVbszXjS9t8DF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634909165, "uuid": "f1de3042-5228-4efb-a662-20d8aaac38ef", "value": 234496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634909165, "uuid": "cddeb82c-7eea-43b6-bcee-53050ff6cf4f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634909165, "uuid": "0ce12872-4506-4a44-aa01-6d3f6e79ed14", "value": "payload_1.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0819746b-32d3-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634864249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634864249, "uuid": "d23db879-582b-4a3c-8fea-50e00fed07e5", "comment": "Malware payload (RedLineStealer)", "value": "53f43b1e9d99d6a356a332d9073b4736", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634864249, "uuid": "7cc23f70-f0b0-49dc-9330-6fe50092752e", "comment": "Malware payload (RedLineStealer)", "value": "584bf67e7c8e93629e175733fe42907e60916047e68f1b4973d4cbf3dd2c22d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634864249, "uuid": "68653d05-f422-4823-b758-9b196eb449f7", "comment": "Malware payload (RedLineStealer)", "value": "71e6c5a216a66b2b523b1b022d44c10b276c6195", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634864249, "uuid": "29469055-149a-4221-9c6b-0896f179d4a9", "comment": "Malware payload (RedLineStealer)", "value": "26efc347339e666b44db89093776821779c91a317edf63fd5af237c6a44bc958605b8d4a6b16ee79e13538b6440a65c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634864249, "uuid": "cb91eae7-81b0-44f2-8d4b-789d7271ec23", "value": "T1F8161AE8CADA8111ED8B2778E8761D7AC42BBFBD99B575CD840EB470BEB70D26074041", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634864249, "uuid": "cf9e257e-b0fd-44af-b854-edddb14106be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634864249, "uuid": "92f99abb-90dc-4581-92f3-f8d019d145c3", "value": "24576:EDEykfXykf5ykfqykfGykfKykf+ykf2aztwClwUykfqykf/ykf:EoDPDBDiD+DSD2D+gHwUDiDnD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634864249, "uuid": "066d93e1-7bab-44e3-84db-4a2bd34f082b", "value": 4061184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634864249, "uuid": "79402369-6478-4130-a39a-3f0676dbd422", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634864249, "uuid": "f7f4da73-eb63-48e2-a37d-3b651ae87a2a", "value": "ItroublveTSC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f51a1c8-330e-11ec-843c-42010a9c0014", "comment": "Malware payload (Stop)", "timestamp": 1634889763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889763, "uuid": "f4fce54a-7c11-4894-8978-0eee7c2df9ad", "comment": "Malware payload (Stop)", "value": "1b91bf136ea911e84d372e78222f2a54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889763, "uuid": "dfaadff4-0c13-41cf-9e20-425e3f8ecd5c", "comment": "Malware payload (Stop)", "value": "59d0891001fbd6107176eabf298e6247ebb7c9da90e2e31c342d3333e50679c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889763, "uuid": "68a7a2f7-6122-4127-84cc-bdd10bd9706c", "comment": "Malware payload (Stop)", "value": "58813bc4c7e6a160c127b8f222042f88fb470126", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889763, "uuid": "9d58e2f8-a867-45ca-b397-c16f3da2f4fd", "comment": "Malware payload (Stop)", "value": "48732ccc55e6ba0c540c190d4e3ab995373d7228fb06b20d9c0e8aef3780dd915468111f2e3d80844c1baae69cd3f029", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889763, "uuid": "00a1a3a8-51f3-4d49-86c0-86c1f3d84bfe", "value": "T1AA05F100BA90C035E5F252F8597A93ADB92E7EB1676065CF52D126EE4738AE0FC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889763, "uuid": "d9742a2e-5fa0-481d-9bfc-9ded471adaa8", "value": "0aa8675e96bbc2351e2af940f447c93e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889763, "uuid": "19fba29d-0423-4048-9e8e-dfd9e24782cc", "value": "24576:EfhYFVaIWyVCbJ5iuy0YK208q6RW4wgVxBfDo:eh4VxWyVCbc823q6RW5gVx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634889763, "uuid": "62af28e3-db9f-4718-a12a-24e44cf6c25a", "value": 823296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634889763, "uuid": "aa9799c0-2413-4af4-ae4b-a65078fe5041", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889763, "uuid": "f6fa608e-a675-4fc4-a3fa-09c379ffda6f", "value": "1b91bf136ea911e84d372e78222f2a54.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "509d4658-331f-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1634897013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897013, "uuid": "beb3f82c-6f98-4186-8a7f-460d3bb38135", "comment": "Malware payload (TrickBot)", "value": "be38f8af6ffa8e3c30cd434eb640ddee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897013, "uuid": "907b7deb-75f4-46fb-b5f3-20a3f3824a54", "comment": "Malware payload (TrickBot)", "value": "59ebd6bc57fb358ceb738d4ebd339910a443b21285f6efb7fb5bd784ff9f3e20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897013, "uuid": "310aecc1-ece5-4843-8efb-f59f3526e997", "comment": "Malware payload (TrickBot)", "value": "c327e67c6766bf7cb390a823553ac6d08079b2d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897013, "uuid": "4aa769c1-1a1e-48ce-9e06-b00b1ddaa194", "comment": "Malware payload (TrickBot)", "value": "71d4c2d048cbcc98ebc1367eb91a08a3079c225a4de768d13116018490c322ada67a7cce965fb07e8c28cea6bb45fefa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897013, "uuid": "65c4b076-be5d-43a3-a34e-0af5cc44bccf", "value": "T1B8A4F1223AE1C873C15341314FD7ABB9B3BCE9044F228A5377D89F1D2D359B15A2B2A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897013, "uuid": "91f2e634-e2d2-48cf-aab6-93dc04bdb6d7", "value": "80d506598da867a09b35bc1fdb2d74ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897013, "uuid": "dba91a47-7859-4c43-b4b1-af120e443be7", "value": "6144:b96ZhRWIiMiCIF1DXBVmdCeyNAxR/oLgC+j9Jbnndik1IysdF3bQQYsRb:b96Z/niySBVmZy2vuMJJr8k1IysdZcQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634897013, "uuid": "2d1d825c-89d5-4905-9db3-22ea009b5543", "value": 471040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634897013, "uuid": "6e48e4a7-8f4b-4838-b94e-190110ce82f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897013, "uuid": "92103a94-6f9a-4542-a82b-e8319de7d291", "value": "be38f8af6ffa8e3c30cd434eb640ddee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d10d7010-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928152, "uuid": "4e82c907-9853-4a7c-9fa8-de21d13e8050", "comment": "Malware payload (RedLineStealer)", "value": "6f360453f25fc51c325c297c802a7b39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928152, "uuid": "d00c4ad7-a3ca-4e0c-9c66-b410fc3c4b6f", "comment": "Malware payload (RedLineStealer)", "value": "5bbf7c41579bac06169c81fafe92940dcf10b511d21cafa41e7ab809961305a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928152, "uuid": "94b0a666-17b0-4a7e-8adc-fb1ceabf8815", "comment": "Malware payload (RedLineStealer)", "value": "7d6a8c32d6955ff25e95b593df566ca12627e70d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928152, "uuid": "d067da5e-c47a-4df1-87fa-f573bda28f40", "comment": "Malware payload (RedLineStealer)", "value": "d2b8e67ae2fcadb968778f134684cafcb7b352c369a99aa5b9ca9025467a5e696854fd6bf397ff2d270d6e0115b6fad9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928152, "uuid": "6cde5e4c-0ed7-4d89-ac2d-2dc58e0e3cb3", "value": "T175F4E100B6A0C035F1B322F889B99379A53EBEE16B1454CF52E51BE997359E1EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928152, "uuid": "e17a7796-b6a4-4fe4-b7e3-0ae349bedc5a", "value": "9cccee30870eeeef9fd80f169e4bd55f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928152, "uuid": "f892b527-97d6-4435-a7c4-091e3e927661", "value": "12288:3ggbJRYMWBCLTENtr9mMNSt/GZ8pnKvLu2HsEICJVCXUz+LAz9pjbF0n+GabR4:33JRQCXatQMNSt+mpeLu27Id8zDjbyK+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928152, "uuid": "465825f3-1765-4efb-b783-d151e06cf0cf", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928152, "uuid": "060a0f37-0125-4b0e-83fa-af0cb4951965", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928152, "uuid": "293048b4-f196-46e3-ae7e-2f47a05bdaf2", "value": "6f360453f25fc51c325c297c802a7b39.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecf87b14-336a-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1634929487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634929487, "uuid": "fba6e973-e2ec-434d-a66b-e9e0e59dd302", "comment": "Malware payload (RaccoonStealer)", "value": "e4c99dcc117b45dbd02c49723df0e5da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634929487, "uuid": "3b231124-62cd-442f-97dd-e5976593b66c", "comment": "Malware payload (RaccoonStealer)", "value": "5bfb87691070668037df7a6bc1eac92bdb683ada3159b83c136146632835cb7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634929487, "uuid": "73d95841-42a5-4608-b6cf-9683aa30e9c2", "comment": "Malware payload (RaccoonStealer)", "value": "9b31d81aa541f473360574fdbdd86aca2201033a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634929487, "uuid": "1e741f4b-4389-446b-8bcd-63e5706cba2d", "comment": "Malware payload (RaccoonStealer)", "value": "965a1a4b644cd4f94de2a11d6516d56e5c3fddd67e3474b6f1ac0334837d954680d3b2775826ec8981af4c153019c6b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634929487, "uuid": "e578c588-faa0-4b40-9d3f-7942cdebf714", "value": "T12A1633C703464AE0EAC533B7373C76A17EA25B54D588CF470F16429738E7986CE66A23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634929487, "uuid": "ab03c809-d84f-481b-bcc4-0ee7d0438aea", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634929487, "uuid": "a1d7119c-2ac2-4e7c-bd8f-9cf385020484", "value": "98304:Jm5tMCL1IVwr6K1JbcJSAzjznJQP2mHIb5cDXLqA9Nrq:J47X6mcLz/nJZmob5cDJvq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634929487, "uuid": "c0ea582a-acdd-4132-9303-2c60004cbd3b", "value": 4078457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634929487, "uuid": "f5ad9cf1-9e1a-4a8f-8dc5-bc8ecb59a880", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634929487, "uuid": "3318b4bf-663e-4b27-aa72-bfa403ebfc48", "value": "setup_x86_x64_install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9dbc676-335f-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634924677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634924677, "uuid": "45fdb130-f1d2-4df3-80d2-ebcba98e88f8", "comment": "Malware payload (Mirai)", "value": "af32c3cf7c5c01f6a2960fae8450cb90", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634924677, "uuid": "eae49beb-f0f9-48c1-9b89-1a701edab3ee", "comment": "Malware payload (Mirai)", "value": "5c9b013de90907966f9449d6e5010d184804a5ee5f016295f56d4812258737e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634924677, "uuid": "4b2962ba-78c3-4bc1-a5df-3bf4d8a6580b", "comment": "Malware payload (Mirai)", "value": "baad7b22b36a04d6412a5552c84c70ccf8f357ac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634924677, "uuid": "8a94b5e6-4bd0-4c30-a61b-4affe112189e", "comment": "Malware payload (Mirai)", "value": "269c680805c7ab77e4fc9a96908891e00d6340eff961b78d25029dbd8170c6b9fb4e7358c392353d55eafdd365b58a36", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634924677, "uuid": "77f3a3e6-b885-4512-be57-f1a1330685af", "value": "T1FBA30897F800DFB6F40AE67604D74B20B670BBE54F931622731739A6AE762D42823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634924677, "uuid": "5d314122-a4ce-495a-8c4a-51bd0e22dde9", "value": "3072:bxrGTMVEJAysSj1cfpsm2qbmuxVqDr78fz1e:bxrGTMVysAcym2qbmuxVqDr78fz1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634924677, "uuid": "a310cec8-a8a4-4ffe-af88-da130f77c172", "value": 98915, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634924677, "uuid": "32577701-fb57-4de9-baee-c6506b7c47d5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634924677, "uuid": "14b22694-7598-44e4-b8e0-9fb9c337593b", "value": "af32c3cf7c5c01f6a2960fae8450cb90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "602f3e3e-32da-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634867403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634867403, "uuid": "120d89c3-3201-430c-b149-ca3965c68415", "comment": "Malware payload (Mirai)", "value": "3a1b8c3da0b2732e5f54d50684fbbe12", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634867403, "uuid": "c1fead07-3f5e-4fff-b052-4085de132d19", "comment": "Malware payload (Mirai)", "value": "5cdc1f2a3246e0e743e1e7b56f10f4db0cfc7db57ee6638c9ad9ea8d535a136c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634867403, "uuid": "cc3495da-c82b-4bb2-92eb-daa731717d37", "comment": "Malware payload (Mirai)", "value": "42c791120eb8562ff38ab2cb9441ed57e67d2957", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634867403, "uuid": "c1ddf571-2fc3-4172-90bc-f0a97d3175fe", "comment": "Malware payload (Mirai)", "value": "f078d8236c7b63e423b3e68125633fed6220c666413020eaa87b6df7db4ba3b57d40228af482640d90500698c4130435", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634867403, "uuid": "9b6bb0f7-9536-4f9d-b387-08d8d1d307f1", "value": "T1F0233AC0A683F9F1EC11457C307BA7726E77F43AA03AEDDBD7D99423A841602960729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634867403, "uuid": "7af2cda5-5423-434f-9626-c4a454c4af72", "value": "1536:Ovmt6GStZRjrMcPzOubNuyooPDdgYfQ5I00mv4aL:O5GS1HMcPCuh6oPhg7iqvjL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634867403, "uuid": "aa412225-d618-48e1-a5b5-0b1befdc9327", "value": 49852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634867403, "uuid": "45c0f1b8-712d-4a33-a918-7c0553ee5cd2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634867403, "uuid": "c1831bce-5a21-4c8b-b344-d6ddd7f80e1b", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0f984d7-32eb-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634874840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634874840, "uuid": "6ca75421-66cb-40cd-81e0-bef5b34f98d6", "comment": "Malware payload (Gafgyt)", "value": "618784f561abe8fe40e73957532d4f3e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634874840, "uuid": "ff137485-b137-4ec5-9898-bf358430dcb3", "comment": "Malware payload (Gafgyt)", "value": "5d2ff034e5e4d0bbca36b50560ab8814518c480939941e89aef3a53202b00f1a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634874840, "uuid": "9cee6dc5-2dec-47e7-834d-32fa9f0dab8e", "comment": "Malware payload (Gafgyt)", "value": "4e503b36146272403b4be4567756fa3cbfca195b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634874840, "uuid": "64ba829b-e8c9-4575-ba85-5b7d63443566", "comment": "Malware payload (Gafgyt)", "value": "10bcf3884d1d5d688968a1827a6f1f67a80f9c72ab97f3e39ffd2b8c0af399ada7410bca490ddb8adeaa9aa9516f7555", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634874840, "uuid": "15a1688b-00a5-4275-8562-1f63a7c246cb", "value": "T1A0E32A09EA408B57C1E2277AF7CB424933339B64A7DB33095928ABF43FC27995E22515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634874840, "uuid": "2f51f470-6d6d-4e46-9776-e9175c382db4", "value": "3072:fuNaNpF4uVN++dkhnxvQennF4M/9OD4bNWkE1kmpwfvRQfZn:mNaNpF4+NChn9QennCM/9ekmpwfvafZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634874840, "uuid": "05df1fd5-6af7-43c5-a2ce-4c9c6c1beebf", "value": 150385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634874840, "uuid": "6ec39bba-cd31-4b58-8d6f-a283c068eb50", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634874840, "uuid": "b67bbe44-30c3-4ee6-af0c-049a1118ae80", "value": "618784f561abe8fe40e73957532d4f3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d22472a4-3310-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634890787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634890787, "uuid": "904d75c9-71a5-4237-a473-3fb9d360dfd4", "comment": "Malware payload (Loki)", "value": "d64d1b6ebcfe87c43b84001380cd3477", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634890787, "uuid": "ff5bb94b-087f-48b7-8b34-bbc7d31208b1", "comment": "Malware payload (Loki)", "value": "5d7d222573cfafc45a0c51927cdfcc507914088d0e2b49edaa12556dc176df79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634890787, "uuid": "3398be05-4c52-48f3-a480-bb3758ce557b", "comment": "Malware payload (Loki)", "value": "f91964131b130ec5c934cd17e70a3de5b2e549f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634890787, "uuid": "7bed1be7-e644-4914-93f4-060ffe3aeba6", "comment": "Malware payload (Loki)", "value": "3741e4f3e060dff886d41422d407696e7361a0a53c88aea0bc2c331aedba27d94ea95b791e2f5c851e226c3813522d90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634890787, "uuid": "67cc756c-6f3e-4237-aa16-bc46efbb3732", "value": "T1F894590432B94B12E5FA6BF01631554497BB7DAE287DE60D1E9E34CA0F73F448A60B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634890787, "uuid": "46349313-2131-4fc1-8f87-604ad0be2d54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634890787, "uuid": "680eecfb-20a5-40b4-9f7d-c840f176bdad", "value": "6144:GGxhLxuI6Gve+4IeZKw+LTTT0MpoY0ENnC3JdHPx3TI1:vpxxziZKw+LwMEENnC3J/G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634890787, "uuid": "d9ad812a-9e54-4fe3-8382-fdae8e4858e2", "value": 424448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634890787, "uuid": "00a5b10f-fad4-48bd-9a7b-38ffe198d403", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634890787, "uuid": "a0a50fd2-89e9-428d-bb83-b68359d5b8c0", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78cdaabb-3368-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634928433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928433, "uuid": "c5f1fe2a-2586-4f91-b41f-a6fa3d7050a2", "comment": "Malware payload (AgentTesla)", "value": "6908cd5efe5473c75c9f2fc4a0b71557", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928433, "uuid": "6d7e0857-f158-494d-968d-e2eacc4f10db", "comment": "Malware payload (AgentTesla)", "value": "5db2f2a9d86b6af21d70f614d0d918f22febf3ec5915e05d83b1fa791e4917d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928433, "uuid": "d7484143-e5a8-4a89-9f93-9201e5637aee", "comment": "Malware payload (AgentTesla)", "value": "4e9bbcaf024a89dba6b9e2df0324b6903bdfa6f0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928433, "uuid": "9d3651ca-2bc1-42cc-92a4-ed72a91fdcf2", "comment": "Malware payload (AgentTesla)", "value": "451feda80aa5d0cbcbfc05bcd0619e41fde3034ce6695058fa74ff9340de2c6a33ca51841c688bcca9df36245e33ec22", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928433, "uuid": "2c9a0610-ee5a-4197-9d66-d364b9de48fb", "value": "T11CF46CBC3145BD8FC82B8F3545545C64962268A7074BF303B0A729DA4FADBD69F002EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928433, "uuid": "66ec03be-db44-4c35-9952-5a64d88cb24a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928433, "uuid": "d974fda1-bbed-430b-bb6d-1630cac7516e", "value": "12288:v0IlrxdlODrcYk6F3iaoRcUqxCVDn5PArUnjckdoJNuqoGFiYCsjx1frR3G9mb6m:v0IndlSI6F3iHSUqxCVM0lMuqoGVxB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928433, "uuid": "2d047694-9a24-439e-8ed2-3cfa5f78be8e", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928433, "uuid": "19be6ebc-a13f-4b38-94fc-5766f63a0cf0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928433, "uuid": "2db9460c-beb7-4be3-b0aa-25f768944462", "value": "6908cd5efe5473c75c9f2fc4a0b71557", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99edff3f-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928059, "uuid": "57c0a3fc-968a-48d9-8720-0d91f14cc63e", "comment": "Malware payload (RedLineStealer)", "value": "629fae16174d14a6ed488f9a76f1f382", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928059, "uuid": "111efe8d-b5d0-41a4-a663-11fbdd181f0a", "comment": "Malware payload (RedLineStealer)", "value": "5def03f7eb6fcd53894ba7430eb712aace0a6d7eb2f5b5a8030c1b7c560f8d49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928059, "uuid": "79c052ee-7868-4adc-a727-1b7ec66a947b", "comment": "Malware payload (RedLineStealer)", "value": "e1e1016e7e2c848ceb5580ec3c3ee67e505721a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928059, "uuid": "a0d08709-6a80-4824-a1cf-cd416bb64603", "comment": "Malware payload (RedLineStealer)", "value": "049410180789aeee38e7abee76402939856e07629217b9eaf5a57d9dae3b2036838a4f8ce079dc293515f8f850e46209", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928059, "uuid": "2c3bf225-03b6-4904-913f-a69348c1a2ae", "value": "T1BAE4F110BAA0C035F1F712F806B6936CB93E7AA26B6555CF52E516EE47386E0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928059, "uuid": "645b29e1-750b-40f7-b760-4aa0e6429640", "value": "0aa8675e96bbc2351e2af940f447c93e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928059, "uuid": "6dbdab4d-6ff2-48a4-b154-afff20838a3e", "value": "12288:OwQuVku3vFWMZFVLNin9pMa53IrkP6WkXuTRIKDpOxm:rQuVksjr729pJg/tXu1y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928059, "uuid": "6caf2066-84a9-4727-9b68-4997e727b4c5", "value": 669184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928059, "uuid": "b46e1ef7-dc18-4508-8ffd-c0fc84294002", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928059, "uuid": "f606d438-d64c-4d47-a036-5c71da1075f1", "value": "629fae16174d14a6ed488f9a76f1f382.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ba41952-3379-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634935766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634935766, "uuid": "1b5a55e1-7a44-4115-8d54-b07a28818983", "comment": "Malware payload (AgentTesla)", "value": "82e1d03d8c42186ee9816ebbb7a71e78", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634935766, "uuid": "f497d6d3-76b7-4b19-8404-b991544d2631", "comment": "Malware payload (AgentTesla)", "value": "5e1daf38670154cb7700b046673255609c6b7ff7e8c518e4186d86403d3ab713", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634935766, "uuid": "9cdc7ce9-784d-4d02-a8d1-b20d4c1ed8d9", "comment": "Malware payload (AgentTesla)", "value": "a363c459629fca6487c6f2b8265ff2cbb016d628", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634935766, "uuid": "bc044b13-3b4d-4a86-a8bc-86b9942bb7a8", "comment": "Malware payload (AgentTesla)", "value": "75255def63c9e9e54ce33abca1a4b7375b904b2a9a68aaa2330d01aefbb499ab45ea56689ad7cea3abbea4b8ec875f4d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634935766, "uuid": "fabf7745-7d4f-453d-a1ab-16a2e27b38e4", "value": "T126F46CBC3155BDDFC86B8F3645545C24A51268A7064BF30370A729DA4FAEBD68F002EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634935766, "uuid": "80edb07a-f81a-49f9-8eb7-cea95fb362b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634935766, "uuid": "c0fe3975-67e3-477b-8b85-7bf85ac4d9da", "value": "12288:zKyk7kSSBxVXtgWHlDPJ8liaeCf6d7dmr7Jm42cLwPK6Hv:zKyUkRFXSWHlukwf6bk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634935766, "uuid": "7b6a2f86-c972-4377-ae6c-105346f68eab", "value": 753152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634935766, "uuid": "25a2e5e5-3735-4ecc-9b02-afba704e6680", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634935766, "uuid": "22eeddd5-f77b-448f-a383-509ac5e5028e", "value": "COMPROBA.BAT", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4c9da54-330d-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634889450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889450, "uuid": "3e5d748c-d4f7-4b71-a1f3-5bec0c8f8a98", "comment": "Malware payload (Formbook)", "value": "0d1e47f9c9e97439af102247df16e32f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889450, "uuid": "3343578f-7692-47d9-80d1-87355ba6939e", "comment": "Malware payload (Formbook)", "value": "5e719cefe52f3351eeb10b2aa74d5454493bd1365ca8258867ffa2affe8a17b3", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889450, "uuid": "05029ec0-3b9d-4798-a846-776bd1b53557", "comment": "Malware payload (Formbook)", "value": "e6c179251a9ced22d13c32d8f3e7bc148347bbf1", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889450, "uuid": "fbe4a5f3-22c3-4a4f-bd83-fcfba47ab5c2", "comment": "Malware payload (Formbook)", "value": "71501b52f67997f4fd3dc6a1a065b5ed51b2b4531db836a766b4cb92ef74ebdce94abfdcc1c51604c4e660d4b0ab933a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889450, "uuid": "2e223014-bb62-41f7-a97a-568dd63b8740", "value": "T1B9240F7EF1870E488F4693B8071B2F82164CF51DF39995B236A8DB3869C5D7B921293C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889450, "uuid": "3b659446-4a39-4421-9728-213fe466b034", "value": "3072:gI1D5ILSwOX7Gk+Iic7tC6fyDM1y9SNHoNkmq3:/1WOX7Goii0DCy9S9o+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634889450, "uuid": "5141e42e-a6b8-42a2-b65f-fb93f812fb17", "value": 215954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634889450, "uuid": "2354c445-3bbc-42d7-a74a-e2ccd7cdac13", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889450, "uuid": "345e3d6d-8815-4e2f-82ee-43276f757768", "value": "QUOTE B1018530.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eda8a8cf-336d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634930777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634930777, "uuid": "c5613f78-fbdf-4140-b03a-9f37c274c635", "comment": "Malware payload", "value": "5aa4ced2cb7f41817b6860904acd4268", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634930777, "uuid": "0cbebc3a-a396-4b7a-b48f-bd028d3e128c", "comment": "Malware payload", "value": "601a3a9cf5afe228769602f67d8257afb70bd750b0069affbfd90af8b9f16a4b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634930777, "uuid": "1bede0f0-7838-4c80-9816-1c1c3841c1ab", "comment": "Malware payload", "value": "e0080d5815090dfee4d1e688873b0d20522a8cb1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634930777, "uuid": "2f9660cb-a81c-4bfc-b4d0-61f97329d764", "comment": "Malware payload", "value": "95b156c35a15bc1e535afcc298fe3f4567c46d203f2111a84c3dc0a3deb1331a3cb1a0934898dac119e7aa6cfe1785f0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634930777, "uuid": "17e00df3-2f76-4785-8abb-acb9e5374136", "value": "T125B63340280AEA59F54144B6A8C40A32B9B77FF77BD621CABB52774C7FC21EB004B759", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634930777, "uuid": "62c76f47-0de7-4cc3-94f0-d06d4b46d5d9", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634930777, "uuid": "6f21a6d3-7c04-42dc-a6f9-c2d864cdfc6d", "value": "196608:Y1GW8mipYrNHtOTMQ9nScTmwReQRVd5s7EwmA+DUlt7lB18c3lZb:478VpYlt3cTmI7FwoDEz8cz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634930777, "uuid": "22cf02ff-cf47-4612-a6f5-469184d63385", "value": 10992128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634930777, "uuid": "62418cb8-299f-4ff7-8386-e5109043271c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634930777, "uuid": "c1dcdcf1-854f-442e-be69-bc96ca27758a", "value": "5aa4ced2cb7f41817b6860904acd4268", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a58d9c0d-32eb-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634874821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634874821, "uuid": "281c3d2c-3a10-48d7-9f15-98af610aff0f", "comment": "Malware payload (Gafgyt)", "value": "6becc50d51c4d20e0f3e64627424b43b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634874821, "uuid": "dcfb4ca4-6f72-4ddf-9128-b7f6b485fcd3", "comment": "Malware payload (Gafgyt)", "value": "60956ca81c7ff3f6bb6beea16b62baac47c8d0ea26e4a06fbaff0ede2ff50b63", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634874821, "uuid": "bcd6e5aa-a8ce-4c9e-96df-191c8dab6a0e", "comment": "Malware payload (Gafgyt)", "value": "0fcb24e44370c4f18618b0bbd52d513252a8b127", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634874821, "uuid": "1b9dadd8-bf66-492b-8089-3e52e53888f1", "comment": "Malware payload (Gafgyt)", "value": "f595c44d2b7f528e267f4e95831fc619c832cd8a5eedf45b9dc70a05c8f397d07fbb37ee4c6c2caaf86f0170ace0e812", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634874821, "uuid": "f7208436-c713-44cc-922b-835bbabf2437", "value": "T1DAB32801D5508B67C2D2277AB79F825D33332BA8979B33125A24BFB42BC27DD1E39521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634874821, "uuid": "00049ab1-048d-4666-9720-bf888cb559ed", "value": "3072:b6an17WtsWhdgYJi0D6mbPbmTQOWsXAOn:Wan17WPJi0D6ibmTQOWCAOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634874821, "uuid": "86db6be7-68ad-4d44-bf9d-abf817ac68c4", "value": 111512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634874821, "uuid": "5e18095c-d625-4ed9-9cd3-ca4b1f0ff75e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634874821, "uuid": "56cc82fd-a1b3-4469-9f92-0c233cba3317", "value": "6becc50d51c4d20e0f3e64627424b43b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d2119f2-3309-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634887504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634887504, "uuid": "305c6d32-ad6f-4a60-ba45-3c74c17d1e2c", "comment": "Malware payload", "value": "24872cd671d2f790c51567cb2f5102be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634887504, "uuid": "d25eeea5-1b29-44e2-993b-676885173b36", "comment": "Malware payload", "value": "60dd8814d409e4ce28bf068df0982a3ab82549f40589da218af79a47be93078c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634887504, "uuid": "25c2cb21-1af7-48ab-93aa-f763fab958cb", "comment": "Malware payload", "value": "e8b03b5ac222e382af70d31c839f97510e2cd277", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634887504, "uuid": "a503238d-5d4c-4def-9f4c-b3d78e7fc3ab", "comment": "Malware payload", "value": "6ca423519f66bacefc700f38858560242df9bf777e41405030ee2c1bd09400891499c4a620f49f108cad75cc1c579f4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634887504, "uuid": "dade88fb-49d8-4072-9c63-71af431a9bd6", "value": "T1C4C633446551049EF3AA0E3A4521C827AC3AFC3B8B06C54F55D832BE8E7F379AD7D690", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634887504, "uuid": "3081ba05-0a4a-4d9a-adc7-7b6c65c4a505", "value": "f4cf09dd5265ea802d83e943c2137765", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634887504, "uuid": "58db92b0-5625-4c3c-b9f7-73db84909d03", "value": "196608:ggprQwnCsXDjDyfVW3q+09iq2pPe2m9/r6M5NxclUZVZbfuu+IEz5+cgt:FTCEDmlh2p6pJVZqu+jAZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634887504, "uuid": "ca4a8979-1c7b-4e59-8871-81e29b13d4d0", "value": 12589001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634887504, "uuid": "a1acc417-4945-41d7-9744-3145cdf080da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634887504, "uuid": "2c4afee2-c6eb-4629-8c73-81ed89c91aaa", "value": "AveryNuker.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6411e468-3363-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634926251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634926251, "uuid": "11253b26-9a42-4157-af29-71c0f326889c", "comment": "Malware payload", "value": "2b136149c73629d88dc48e8537ca03c5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634926251, "uuid": "98e00914-d30e-4e8b-ae6d-16a6bc143007", "comment": "Malware payload", "value": "615e6d39f293de56a632047eea507a7a05793285caf018e1b7fc1d6ce490bb1a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634926251, "uuid": "a183c5f9-c8df-40ae-9300-d8da23c711d6", "comment": "Malware payload", "value": "06cef49494f0d239f76f5aa011b9a08db6a41578", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634926251, "uuid": "6f84f120-68e2-4f2d-98ec-394c162b97a5", "comment": "Malware payload", "value": "ec3c4222045de35c927694e2fc0f4397101daa78887e5fb82b318cd6ce0c475e8643a5714607c1bcfa75a16f7a09199e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634926251, "uuid": "60baae14-711d-44c7-9c58-a8338df4b8de", "value": "T1EE45AE3033B64421F273033448F6C4A15FECB9629874AD8F7186366E0A9B6D19B6DB5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634926251, "uuid": "2b005132-30c7-40e7-bdb6-a2cd163e83ba", "value": "1a5119a1aa1907d9cf1064edbeb2ac74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634926251, "uuid": "6b1c0a39-9dd8-47c1-8e08-3c07accade85", "value": "24576:m/o9iBRudBYZb/WqWletdadgndrqnq/wKkVW:YRuEbeqWYMqnFY2IW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634926251, "uuid": "faaff926-6bde-49b1-8ae6-f7e4d93a0c0e", "value": 1211876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634926251, "uuid": "5b17946e-989e-406b-bd49-6f31e261d67c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634926251, "uuid": "3fbbb1f6-f698-4990-b82f-4e2ae8b12666", "value": "4a8e923c9cdd44e1a8f4a4962ac6d51e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dc0b838-330e-11ec-843c-42010a9c0014", "comment": "Malware payload (Socelars)", "timestamp": 1634889841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889841, "uuid": "e576134a-3679-4e95-8b53-4d5e3b38ac5e", "comment": "Malware payload (Socelars)", "value": "ba112d9fef4d22198141db8abc8c8eaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889841, "uuid": "a25234a7-b074-44ba-9384-eadcdfb4c74d", "comment": "Malware payload (Socelars)", "value": "63ae0603a0742f791166475f08d0af36dd0f625e55ab25ed18070e92d1cbbaf5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889841, "uuid": "ddcfffaf-20bf-4356-98e2-d962ddbd6f03", "comment": "Malware payload (Socelars)", "value": "1c85c25537f23f7201ad3bed11d692b93939aca8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889841, "uuid": "be5e1cfb-e7be-4c61-80dd-85f576fe99da", "comment": "Malware payload (Socelars)", "value": "f737ebc390ca8a0c71ec263e3bf6a0de611b3e90e11e0ab00e36adbe5562d0dd6812664aded476426884d55d72dba6a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889841, "uuid": "fd24cb7a-bd9a-4e2f-a547-0715b197e0ee", "value": "T19A659E11F783A036ECE301B286FF4AFF8D286721035954D7E3C06D695A609E27A3765B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889841, "uuid": "1f8f2d01-ff18-4a4b-8305-7bf0638540f1", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889841, "uuid": "6023ae00-5448-4d3f-8a3f-34f3f047fe12", "value": "24576:0xpXPaR2J33o3S7P5zuHHOF2CxfehMHsGKzOYCMEMfX4GZ1mV06GY:kpy+VDi8rgHfX4GZsV06p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634889841, "uuid": "f50afe12-ffe3-4927-a5c1-dea2b6e17346", "value": 1527808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634889841, "uuid": "156e4090-06ed-4082-974a-501f11e68cf1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889841, "uuid": "73281d9a-67fd-4be5-ad87-8303f2992b91", "value": "ba112d9fef4d22198141db8abc8c8eaf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f37210c-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928068, "uuid": "9a40afea-d451-49f5-8b1f-b1a335a21f3b", "comment": "Malware payload (RedLineStealer)", "value": "a0a14fe1c769b5e6878d6d8b2f2f1860", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928068, "uuid": "317933d4-874c-44d4-ad21-07ea3d0f5a17", "comment": "Malware payload (RedLineStealer)", "value": "63eef0eb632cf27e9af54475ca4403e27d65b84077913c2ca7f626ea7abf5788", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928068, "uuid": "a6e9abe4-e0ed-4ba8-9766-117983b29448", "comment": "Malware payload (RedLineStealer)", "value": "d439faa16a82cf1c18ea4482249a372c6e1e250a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928068, "uuid": "40953ef4-c470-4337-990b-76901f00eb34", "comment": "Malware payload (RedLineStealer)", "value": "a6dc7fc1281c1bce65632d8f06b45e9c7881e0815a865da1e2e0f2b06c4ba40964101b5ddaa0346b522f17d1e8bf34d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928068, "uuid": "5fce1a9f-4784-4b2b-a3b2-c1bb3fbf234a", "value": "T123F4E000B691C039F5B722F445B99368B93E7EE19B6450CF52E51BEA5734AE1EC3032B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928068, "uuid": "1ad7c753-6e84-4713-b99f-f0cf25102e4b", "value": "85b11e7df91b461ff7ceddce26982802", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928068, "uuid": "ad475663-bbfa-422c-912c-39b7fae7f23d", "value": "12288:+Dx3bvgd2smAWBlmdd9bLSjXkFsq43HXGOaTE0wWxVZcWd4AxC7nTedXpSSs+FCs:+lLvgd2smAylmdd+XkqqeHXPawRWxTEC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928068, "uuid": "0e07c1c4-6d2f-40bd-8d00-c9a53dcce0f2", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928068, "uuid": "ab33dfb9-d828-498b-8ad2-59e545517293", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928068, "uuid": "ddc70c85-c5a7-4d94-9bed-70c14ddd0769", "value": "a0a14fe1c769b5e6878d6d8b2f2f1860.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14c93144-3368-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928265, "uuid": "cacac3f0-025b-4b93-8a9b-d567e91b59b6", "comment": "Malware payload (RedLineStealer)", "value": "e5bc3b4559b222118e9c719804f8c930", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928265, "uuid": "a101a9a3-de39-42f1-b598-0fe3d0c01aac", "comment": "Malware payload (RedLineStealer)", "value": "64f9f7fccc993e73cf2ad970c822c53e4b6830687af349f8d791037ccd8b3a03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928265, "uuid": "9b6b01db-3df1-480f-8a52-36c85f3a4b5c", "comment": "Malware payload (RedLineStealer)", "value": "b438d056407405a6b04b381110d84bd938040f20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928265, "uuid": "70dd8879-ab03-4c21-8af9-fdf7c801aeac", "comment": "Malware payload (RedLineStealer)", "value": "72994da237c065a69ace57f00a22621200673bb07f827fb47d7b3a0d135345c240236fb52ab12a3d3789e54ad70617d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928265, "uuid": "c8512871-1d7f-461c-bded-d51365a1e201", "value": "T129A4BE00A6A1C035F5B362F84AB9936CA52E7EF16B2494CF52D51AEE97355E0FC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928265, "uuid": "187b448a-06b9-4b5a-b853-4fe8e4cb6caf", "value": "9cccee30870eeeef9fd80f169e4bd55f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928265, "uuid": "c54da78d-33bc-4e6b-bdf3-127ac4d9b2d7", "value": "12288:rHpzNniEEkBmKxUEkrPDiBDRO7V4TGezR:rxF/P8KxEADM7Vol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928265, "uuid": "03248bb6-12ab-4ef8-a504-ffc18ea9b934", "value": 463360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928265, "uuid": "c620af6c-7c01-4e52-8fbc-46eeea8aea76", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928265, "uuid": "f7e88a41-5a88-4a22-b9eb-19142dc7740e", "value": "e5bc3b4559b222118e9c719804f8c930.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da45bdf3-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (OskiStealer)", "timestamp": 1634928167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928167, "uuid": "64120b5c-1765-4eec-ae14-5e06dd5d8396", "comment": "Malware payload (OskiStealer)", "value": "ab031839b4f841c3b709fdeb2f8d2889", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928167, "uuid": "9e134de0-33cf-4c8c-a148-e222432c7807", "comment": "Malware payload (OskiStealer)", "value": "65d44c4290e2bab8287d1a51f22a5ce6b72e989126975bd9e99692a693008b0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928167, "uuid": "cae7ca8b-d20e-4eb5-b0da-722428bf0fcf", "comment": "Malware payload (OskiStealer)", "value": "6c9e7d0f2a212fda955802586713d8996ff5d11d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928167, "uuid": "aedc26dc-b730-4600-9610-ecb645b77ccd", "comment": "Malware payload (OskiStealer)", "value": "c39a99d4f93690b8c51308842d27dfe3cca9997725cda264b8c598a7ff36c5ed4042ba783427541859dd51da64b741fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928167, "uuid": "1252ae13-2617-4994-8006-f9eaa11fb0a3", "value": "T14084ADDAE560E6B2F40FA931512C3E194B0A5EF631ADC44589EC7C173CA2B1D364BE63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928167, "uuid": "5a1ced8d-312f-43b7-aa20-c9a3bb2143ae", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928167, "uuid": "976682cb-d615-4500-bf74-a93599f404ce", "value": "6144:1BlL/G4BUKkY3PBmgaklTZFbsIG5RQzq6IvpnwxByMmSo/mpC:jY4BNPBTaSZqIG5RQWd1HNOpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928167, "uuid": "15145e15-abb4-474c-8660-2e68fbe9d9e2", "value": 384973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928167, "uuid": "b34471bc-7448-42de-bdb7-d9da771926f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928167, "uuid": "8ccaad03-2e22-4569-a3ff-272ff75407f0", "value": "Trf 00983764.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74af3bed-3320-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1634897503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897503, "uuid": "fb51a580-2214-44aa-8bca-3a8e77d334e2", "comment": "Malware payload (Smoke Loader)", "value": "570668d02a9cbf8ec21a4197f3da5a82", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897503, "uuid": "b0650253-d889-49f6-b63e-89b463e06f27", "comment": "Malware payload (Smoke Loader)", "value": "688ed142a32a28fb365861c9bd655de6e68b9dbcdae0a75c65bbb3b4230b8163", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897503, "uuid": "9d9f61b3-1f07-4953-ac61-b88d6142d63a", "comment": "Malware payload (Smoke Loader)", "value": "a22b7f9e93ad67d1e241a2b4a4d266955585b36d", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897503, "uuid": "1cde9f89-33a4-4ae2-a9a0-db4ed0cd67fc", "comment": "Malware payload (Smoke Loader)", "value": "5cc0a6457e64715fde47f0c9a5cd7bb39fd814e9a181194e6f9a21923e49c24de6321066dd42eb643d80e3357462b67a", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897503, "uuid": "7b5aa8c7-e375-4c66-9ecb-137f8cf570c9", "value": "T114746C00A6A0C039F5F312F44ABA9368A53EBEE15B2450CF53D52AEE57356E1EC3171B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897503, "uuid": "6bc3fe2a-9e03-4f90-90b0-805d65d0bc54", "value": "4af4742906d30c7889c195169379a2f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897503, "uuid": "d57a97c7-9c71-4bea-949b-7d8f6f6fe322", "value": "6144:/0ldhIM0tCvHqKoP1J45xQV2j7KqBuj3dZut4DB/D1/+qiDOnUzt:/ad3HqKoP1JjMXzuj3dZutM/D1mqdq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634897503, "uuid": "b5626a87-4abc-4621-9783-3c3d862bd7a5", "value": 352768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634897503, "uuid": "3c75e547-0612-40fb-baee-188fa8e3d951", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897503, "uuid": "b4720d33-bbe8-47c5-812d-bfa89b84d4a3", "value": "570668d02a9cbf8ec21a4197f3da5a82.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68eded05-335e-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634924112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634924112, "uuid": "44426940-007f-4f76-8373-fad269d37674", "comment": "Malware payload (Gafgyt)", "value": "390683e05e1e65a89a6a237717d91cb0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634924112, "uuid": "b0931d2a-4265-413f-a922-b465d06248c7", "comment": "Malware payload (Gafgyt)", "value": "6905f5292059d375919468521298156db1da57332356e71fa152c8ccbd9fbcfd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634924112, "uuid": "0934b413-2e7a-4df5-94fe-d8bf50453367", "comment": "Malware payload (Gafgyt)", "value": "3dce6b2d5ed26ad5e6484f6416b361700126095a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634924112, "uuid": "bfe90588-043e-4167-945f-a6fb7e77fc6f", "comment": "Malware payload (Gafgyt)", "value": "7b9efb09115dbcc5f1ab50ebbcd0abb1ea712a8f3c7ee4e9e677470807bdb41710278d2f1d6a8fc85b4cf8f4b13d787f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634924112, "uuid": "7a842785-5fd3-43d7-9281-4c166a227b74", "value": "T146C32805D5508767C2D3237AEB9F825D37325BA493DB33215A34BFB82BC27891E39921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634924112, "uuid": "f967be0e-9067-4909-bbb9-9a6ff5e1ef8e", "value": "3072:WkYP4WY4noL8xOa4/F3OfDIMF8+mTQOY5NX3cn:lYP4WY4gIOakOfDe+mTQOY5R3cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634924112, "uuid": "03bee776-0c27-4ee2-9793-c5cf70d55350", "value": 120999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634924112, "uuid": "1336a2f2-fb16-416c-a8d5-66b592f16871", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634924112, "uuid": "972cf023-6172-43e8-afbd-b27ee480c0d2", "value": "390683e05e1e65a89a6a237717d91cb0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c297bfd8-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928128, "uuid": "4e6b978a-788a-4033-9944-4cd87a4a17bc", "comment": "Malware payload (RedLineStealer)", "value": "3bdfe8f20970495b408d007cd6bc88fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928128, "uuid": "c09f4c19-4c1d-4357-9390-de8497431ab4", "comment": "Malware payload (RedLineStealer)", "value": "69f485e0ea916f303f13e5ba45a4d1854bcb38e39d2b10068c3da786b7666c5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928128, "uuid": "fdd20add-ebad-42b3-99d9-8040173db14d", "comment": "Malware payload (RedLineStealer)", "value": "d7fc771f3001e8536bb6b3849d8e2024189d95c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928128, "uuid": "f50c63d2-2df2-4ed8-8013-70d59d4d29b9", "comment": "Malware payload (RedLineStealer)", "value": "31f5df7fcb1647555ac069837081d6122d9f75e04ec8a57a3dbd4911c72f751c32e651c45f0952434c85d7dd64259149", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928128, "uuid": "feb2c5e5-648e-4ce9-8517-8a289be23623", "value": "T174E4E110BA90C036F1B256F849B693ACF93E7AA2AB7551CF52D516DE0734AE0ED30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928128, "uuid": "5d41f337-e911-4e85-b977-07a5d6f86577", "value": "0aa8675e96bbc2351e2af940f447c93e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928128, "uuid": "3c777bac-7826-4a12-8026-67482626d981", "value": "12288:3DtijHDg0+9nJ6hWFCjiDMyldah0mnNTIgn1xF3XcZnC4IMzH:TYrDg066hkDhlTmrjNXcxb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928128, "uuid": "92cf1aba-99ee-47c1-a899-f831e3667844", "value": 669696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928128, "uuid": "a1aa95e7-dcfd-4631-bebb-4e42c7c27a75", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928128, "uuid": "d39a2527-ca17-4799-b467-a14c0a3f97ea", "value": "3bdfe8f20970495b408d007cd6bc88fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40ce65f3-3322-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1634898275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634898275, "uuid": "dd5072c7-cd4d-4ebb-8640-6863a4ddcf15", "comment": "Malware payload (RemcosRAT)", "value": "009b10471359c9d05d810591dfde36af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634898275, "uuid": "ed07ba82-c38f-455f-af58-7070f14f88b3", "comment": "Malware payload (RemcosRAT)", "value": "6aa1329fc1a0a21844c1f75d779154833278f42adb7d7c3a8d760ad465951d07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634898275, "uuid": "088288e6-7da7-4aae-aa24-0a5019e66d5d", "comment": "Malware payload (RemcosRAT)", "value": "20d691c180613eeff21227d5b40e3839c38937fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634898275, "uuid": "24cf0c7a-38a1-43d1-a855-c070f5340622", "comment": "Malware payload (RemcosRAT)", "value": "04dda18dd4106f42737a1e5cc1c414b2b7246ad294419c8fa9e364f69abad0bfab98b8726e1880a47ae46d7a0a7c5795", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634898275, "uuid": "1de822ea-e2e3-4b81-b1fe-56d46669fb6b", "value": "T1A125AD60A9D40476E6673E3CCC35097E423EAF942D595149AEF0FC661FBE3CB3226192", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634898275, "uuid": "9f57cf6b-3b2a-4938-845d-aa03686250cd", "value": "ac55f6686b1348553fd9b5d485943699", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634898275, "uuid": "0776c66e-753b-485e-9e7c-7b83eedf9763", "value": "12288:fDug7DeIhyEzPsO4z+oxMOQWHphA3hHx8rkRZQ9XYBk9NAOe6k1+hO/O5N8DoQTR:rt7JhyEz0O4z+OQK79HHQT2ODA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634898275, "uuid": "2db14557-c426-4bb4-a040-b69a2789ab58", "value": 996352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634898275, "uuid": "13a09d06-e09c-4c86-910d-e81cd1da9708", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634898275, "uuid": "088b5d27-5858-4c99-bbab-aea3f4d3a9c8", "value": "AWB # 1012617429350,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6055ecd4-330e-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634889738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889738, "uuid": "f669f2af-b0cb-4fca-8b87-157aebe1e4be", "comment": "Malware payload (Loki)", "value": "6673fd1e2940ba51a6045f539269b28d", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889738, "uuid": "34787e38-b0f8-4ccf-b711-07762662a792", "comment": "Malware payload (Loki)", "value": "6aab71bd0ff6e5df7ccec18d7080cc50257b58de114619849304662b9f992f3e", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889738, "uuid": "6fe2b2cb-22a2-491d-8366-4320c834d3e2", "comment": "Malware payload (Loki)", "value": "fcd75b45f9ae33a1b2a759e7ac3430471622dcc7", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889738, "uuid": "52faed69-1799-443d-a688-6d20071019a4", "comment": "Malware payload (Loki)", "value": "61a8d274119a8a3d8d625f4b14c783276cf170764762aefd8772ec1207eb4a19e411970217ce14c4886b66e235df3d47", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889738, "uuid": "c6781a38-a88a-4bed-8c75-4872b7f1a643", "value": "T11184CF8B976E616AEC5F85F4A454CC508C10CE65EE4E4C39B36271ACCB34D092BCBDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889738, "uuid": "0d2d4947-903e-4647-a3d6-9fa544a836a5", "value": "6144:QMwusfEqA15CYCR7Cvi36rLevRNO78Po0kpfWSHjr3DIeWw:Vv6EqM5Cb56ryi782Wq3seWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634889738, "uuid": "0acaad3a-77d3-4c97-8596-77fbd09a2d68", "value": 378296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634889738, "uuid": "240cfabf-39ca-41fe-94a9-e19db8b020bc", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889738, "uuid": "5a745275-c2c8-4722-b8ef-22afbb0be1e9", "value": "SHIPPING DOCUMENTS.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a277ca0f-3355-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634920343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634920343, "uuid": "589ee617-9143-43ab-acfa-ce0ebe751338", "comment": "Malware payload (Formbook)", "value": "20fd7e5095e76d04d33d30a75ab371ac", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634920343, "uuid": "38757053-9500-4793-8dd0-7fed9dee982f", "comment": "Malware payload (Formbook)", "value": "6c1b4e7a9293f13eeca94e2ce5aa97d358492bd3e9fa76716c119300e6d5da37", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634920343, "uuid": "ada2d6a6-3cc2-4ffd-af5c-977c07ec3bd1", "comment": "Malware payload (Formbook)", "value": "31549d4f459e52ec34a0cf2c20a1f79dd08a385e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634920343, "uuid": "d433a141-87b9-425f-9635-ca17ea295d8c", "comment": "Malware payload (Formbook)", "value": "2d540393f9ea7f7d91d4c455e3032a21d627369d5251ba2b129911f5c4c79395e93d0cdb2c03f7c485d2b7e294af6b54", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634920343, "uuid": "296dc270-38ea-4e4a-b400-ca601710fbc5", "value": "T16474BFF875147DE66A6F476BD996ECEC13A627238ACB94CD8064B7C305A3371FE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634920343, "uuid": "c68a366a-0a51-4bd9-9c3b-6bdd159c5c12", "value": "6144:knbimU3T+vpZ3Ju66quC+RFcWt+b11zfV5khUXQ5h36BTnyImpWq:kn+T+v3JuLFKh1zt5MX58fzq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634920343, "uuid": "25e5a6f5-2b23-43f2-890d-66fb4d4c3c07", "value": 345307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634920343, "uuid": "9adcda91-d123-4c17-9906-10d774aae8fe", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634920343, "uuid": "a8300551-9d5d-465d-95f6-b1c5d0e22a3c", "value": "_Payment Advise.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff910f45-3331-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634905037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634905037, "uuid": "369a255c-17a5-4dc6-871c-d842b519d5d2", "comment": "Malware payload (Formbook)", "value": "d1f76ed4210b6bbbf232271b8b198133", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634905037, "uuid": "baf940b9-2196-4dff-87b3-a4ae1c2f666c", "comment": "Malware payload (Formbook)", "value": "6e025a1d72e2abfb9c0fb6c945d3fcdbe2124c5d68d8f5fb09b8389bc30f799e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634905037, "uuid": "dc7332a6-2311-407f-b99a-b47c4813b729", "comment": "Malware payload (Formbook)", "value": "a8407cfa0da5ecffdfeeb22a824f4e9fa368249e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634905037, "uuid": "7b3fbc36-3536-4f67-8759-edc74e4bf3a7", "comment": "Malware payload (Formbook)", "value": "4b2b2340027fae1d2c36395b9fabf138362c4b302bcba093864a7f5cc3af335b1b0a6249a6ec0d6e240c753ea61191bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634905037, "uuid": "1023c348-4907-4269-b670-e823bd16bd53", "value": "T19244232E37B154BFC08A5B70A8F7A5D9E77749090310E30793346F3B59A87C6AAA5313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634905037, "uuid": "63414cd2-3c22-421f-b1b5-db645a3f7b55", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634905037, "uuid": "34af8779-61af-4029-99a2-8be5c1bbcb5e", "value": "6144:wBlL/c4ANoQTYbc6xdeyRF4gBIDi0dlwSKSSiOHq0IpE7A:CebN/T0cIeQF4gBb0dlwSKv7Z7A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634905037, "uuid": "2579b8bc-1eaf-4fc1-b738-7ef3fec90f6d", "value": 262671, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634905037, "uuid": "bc7ddf9e-106b-476f-9ac8-615fba0bd44a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634905037, "uuid": "4a9aa77c-07fe-4f68-882d-9b09b7b189a7", "value": "uu5009125.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bad448ce-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928115, "uuid": "4ef72f94-d0fb-4f9e-8e7c-0983b198df9b", "comment": "Malware payload (RedLineStealer)", "value": "c2253e759cfe3733e1edb4fd3ea25297", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928115, "uuid": "788fa534-c452-4de1-801d-208863cc9e4a", "comment": "Malware payload (RedLineStealer)", "value": "6ef9faaeca28ac5c7d80c7d34c803550bf0d320a49df42d16455ac530032bee3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928115, "uuid": "54572ea8-ac17-47c6-8e04-d6e350bc9fce", "comment": "Malware payload (RedLineStealer)", "value": "faec2f72c7e552da81de9e53f2b7d2456d966608", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928115, "uuid": "d5d57a4a-db46-4bf4-8434-f46acf8f09f6", "comment": "Malware payload (RedLineStealer)", "value": "dcb47a04c5d207ff3cb674665926520d7dd1c88af1c880224c40c3fa519f5f1430c48d8a39da480fa0447be8d071df79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928115, "uuid": "0a766e9a-03ab-47e0-9fc0-822df2a7e3b4", "value": "T143E4F110B690C035E1F313F849BA9768A53EBEE2AB2550CF52D526EE07746E1ED31327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928115, "uuid": "d5e19779-c490-498e-b27a-3e189e5aa3c5", "value": "25e96726029c322936cf0033b6a07058", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928115, "uuid": "58aa61c6-fab4-4e5e-9a6d-03454c9f9cfc", "value": "12288:oxPWKywqqBos8Tpjm+4V3w2qAh0pdZaUoXW5uzSTiHEKG:E1rFBF8Njmn9FqPpdQXXWkK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928115, "uuid": "5202be36-a5c1-47a3-bf40-6145fa41212a", "value": 669184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928115, "uuid": "bd1a1199-19bd-4621-bbbb-76675c18a4b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928115, "uuid": "244c17b4-cdc3-4dda-9071-169b7b0ef9a8", "value": "c2253e759cfe3733e1edb4fd3ea25297.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cca35577-32fa-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634881329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634881329, "uuid": "5ebaca92-cd2c-4268-9be7-d0cc5c70ddd1", "comment": "Malware payload (AgentTesla)", "value": "ec281e6fe9bb110fe25c711894e33221", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634881329, "uuid": "615ab312-422c-4e2b-848f-1e5f7dec97c0", "comment": "Malware payload (AgentTesla)", "value": "6f4fbdddf7fe64ca33406a9773bb2d16000247ef4506803dd6fd301ca873413d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634881329, "uuid": "e4ff9404-a420-40d4-8932-ea280bb64150", "comment": "Malware payload (AgentTesla)", "value": "cf130eb2e37409f74adeb5e3acb1bc0ab6e42759", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634881329, "uuid": "bb34d43d-99df-410c-b280-591482f880c6", "comment": "Malware payload (AgentTesla)", "value": "09aff8d8beaaeb1232136233c3209eb348ce6f9bf40e77a3d7883df75e333826c4b0371e7ee746de54c7b4a71c0a4284", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634881329, "uuid": "111e142e-97a8-4313-b114-6ef38c7b9571", "value": "T17DB4E06B3558C9A4D2382A33BDCBD34D3BA67CB0A543D10E7AC7B25908713B20D715AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634881329, "uuid": "0607d472-fefe-4c28-9054-be4a004491a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634881329, "uuid": "61b98d73-470d-4cbb-8524-a3315db66848", "value": "12288:I9+SUi2iNUSGjhqFvKa+WcHzkg+fRju53gRXoG5zpZ:6Ui1WSGjcFvzazORj03EDh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634881329, "uuid": "e7e6cd03-3082-4332-a25c-1e4e1540b19a", "value": 541696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634881329, "uuid": "d0975dc2-90e1-4966-b627-7499a430c58a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634881329, "uuid": "e656b5d0-8ee8-4810-8a6d-eac3a57fb4da", "value": "F\u0130YAT TEKL\u0130F\u0130 TALEP RFQ_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "488a6392-337f-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1634938231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634938231, "uuid": "bdc23a85-3a73-41ff-85ae-c33ff911eb50", "comment": "Malware payload (RaccoonStealer)", "value": "fe2a170c403e99115e30dd615f848a3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634938231, "uuid": "abb7b90b-8c9b-489f-9125-7e1e51296353", "comment": "Malware payload (RaccoonStealer)", "value": "6f54181807e2995147e132e7bf87ed669966b4f68a49b29fdaf4467864aa946a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634938231, "uuid": "cf3d2a8a-b814-417b-beb9-24edabe95fff", "comment": "Malware payload (RaccoonStealer)", "value": "0170400caa176e1035f153afac061e0364f34e02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634938231, "uuid": "99acc1cf-224f-41d8-a5a1-e673ba087e98", "comment": "Malware payload (RaccoonStealer)", "value": "26afb930f1094c1d789764c744d3a1fd215cda1ea3dc31654e61d66e8dcfb8c2553ee56167a0f431ec0f34f06869068e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634938231, "uuid": "e43bf587-5f07-43ad-b879-f1bc458410f0", "value": "T1F5747C00A7A0D039F5F325F44AB993A8B93E7EA15B2454CF52D52AEE57356E0EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634938231, "uuid": "3c4b3a45-cafc-4347-b13a-dc6afc9434e0", "value": "bac67046644aa5e445c1272184462c49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634938231, "uuid": "47070e87-697f-42e1-a978-21ee4903c9b5", "value": "6144:8wCLYl9IPb8BlslQl0RkP1NKmT2Y/31dJMsz1zX3mRv9x10:8nM9Iz8BL0SdND/31dJx1znmf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634938231, "uuid": "a3480f8d-2dae-4928-8e91-3c343b1aae0c", "value": 341504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634938231, "uuid": "d07e2e63-bd5a-4b6a-87e6-adb5e4b13d53", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634938231, "uuid": "384a4d86-144b-4524-94ba-5fb804aff5d8", "value": "fe2a170c403e99115e30dd615f848a3c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a080d5b7-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928070, "uuid": "ebbd9822-0b88-44c1-8f71-e656283bd52f", "comment": "Malware payload (RedLineStealer)", "value": "1861d7463ebd245a790a94719904bae3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928070, "uuid": "c448de88-e504-4086-ae8a-4bab461dbebf", "comment": "Malware payload (RedLineStealer)", "value": "705de75afbed97d05847129a5e9ba1b8188d96f2a23218a3ee8bf2afd566b827", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928070, "uuid": "0ea9d138-4fc1-4256-b2eb-83ba2c9f2933", "comment": "Malware payload (RedLineStealer)", "value": "5a7a24ff1c04ea25569ba9d78586ea108765800c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928070, "uuid": "03bdba44-8453-40bc-bbf4-e8cfb87d4aaa", "comment": "Malware payload (RedLineStealer)", "value": "255dcb17a71bee1978eafc2df06d7c4dfbb5b6126489110a4ce51bea663a3d636e1dd869502f01178a0febab95f1c128", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928070, "uuid": "4ed7b414-f244-48a5-a294-20061f67fc88", "value": "T179F4D000B6A0C03AF5B752F44ABAA368B52EBEE15B2450CF52D41BED57359E1EC31327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928070, "uuid": "87542f99-8d21-4b7f-85d8-468af8566d6d", "value": "85b11e7df91b461ff7ceddce26982802", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928070, "uuid": "1356b4e4-c6a9-4364-a696-399eeb14775a", "value": "12288:NsvFHpFAvoixUV/ENuxtR0ndyt75yXR8ifGudyKd+ZB8jMWgsT29YqhX+qQBZ:NE1pFG7xmxMnONwSIE8A6TuYqhuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928070, "uuid": "69ffe69c-36a5-4b60-b8b4-e22e1556297a", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928070, "uuid": "f94e9bdf-5aab-4473-b78d-34e334c8431b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928070, "uuid": "d72384bf-6cc7-4a22-a941-696c9d364b5c", "value": "1861d7463ebd245a790a94719904bae3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "201d86a7-3308-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634887053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634887053, "uuid": "5c4a321f-c980-4a7e-9131-e7ffdb0b508d", "comment": "Malware payload", "value": "0a3f302dbb47b759028a4a26f1f38ac3", "object_relation": "md5", "Tag": [ { "name": "mac", "colour": "#285994", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "UpdateAgent", "colour": "#B10D2A", "exportable": true, "hide_tag": false }, { "name": "WizardUpdate", "colour": "#5BF7D9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634887053, "uuid": "7ec807e3-51b9-4a6f-9164-04aa0fe8c348", "comment": "Malware payload", "value": "7067e6a69a8f5fdbabfb00d03320cfc2f3584a83304cbeeca7e8edc3d57bbbd4", "object_relation": "sha256", "Tag": [ { "name": "mac", "colour": "#285994", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "UpdateAgent", "colour": "#B10D2A", "exportable": true, "hide_tag": false }, { "name": "WizardUpdate", "colour": "#5BF7D9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634887053, "uuid": "1bf15650-a975-4fb2-ac32-dda1c4fca1cb", "comment": "Malware payload", "value": "c3a5ff3703c9b4316916d67a1033ca18e7b115a6", "object_relation": "sha1", "Tag": [ { "name": "mac", "colour": "#285994", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "UpdateAgent", "colour": "#B10D2A", "exportable": true, "hide_tag": false }, { "name": "WizardUpdate", "colour": "#5BF7D9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634887053, "uuid": "6bab42e3-ff93-4a04-aa1f-9050250e39b7", "comment": "Malware payload", "value": "137f404adaaf29feea16f73618870a0751605d4dfcbc52eb8ff856ad7028b5413da71f3dc1377bac08aa090d4e51238f", "object_relation": "sha3-384", "Tag": [ { "name": "mac", "colour": "#285994", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "UpdateAgent", "colour": "#B10D2A", "exportable": true, "hide_tag": false }, { "name": "WizardUpdate", "colour": "#5BF7D9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634887053, "uuid": "f0823751-75ca-42f4-812a-65e6791cf97c", "value": "T18883B62307B6D593C5CBEBB4F44B6B629A01FC913FF268E2C344E9144E80B5D569DB0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634887053, "uuid": "5698e861-2b61-4c0d-b4ca-265e9c03c5a1", "value": "384:iiDtzI7/SxcdGhTRFKTmmSxWohbsFc2qKebuDmXo4wBFRMrqx1ansQeFVDY6igLf:HtzIyeo4cwBFRMqxIsN3s6igrBEFUJv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634887053, "uuid": "db3f5a10-285c-46f0-9f88-1798764eca27", "value": 84016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634887053, "uuid": "bcc7a7bd-f642-4139-bf23-b326c0033047", "value": "application/x-mach-binary", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634887053, "uuid": "f1578128-e319-4b47-afb8-cd3f5ffe2223", "value": "7067e6a69a8f5fdbabfb00d03320cfc2f3584a83304cbeeca7e8edc3d57bbbd4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eafe66dc-32ec-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634875367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634875367, "uuid": "8d9a7624-de55-496f-bcbe-1831e10c6625", "comment": "Malware payload (Gafgyt)", "value": "2169ff46aad1203052c652c13cb3ae65", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634875367, "uuid": "fb94ce65-fb9b-40e2-818e-8eed65db997d", "comment": "Malware payload (Gafgyt)", "value": "71f1b3126805a5445678d020d573c8368d541be8d2efb9c4823a68a649fbec99", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634875367, "uuid": "303dc29b-8dd5-4176-898b-287c099f7859", "comment": "Malware payload (Gafgyt)", "value": "733a13f8dee32b0acbd44070574993b8e9e3b9a8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634875367, "uuid": "a7f17867-555d-4e0c-bb94-b294e7a3821d", "comment": "Malware payload (Gafgyt)", "value": "67044f50f5f0fd11c31cc9ea565a2f16bf2d158cc45d8b86a179c74c23357104fbfcf5a48cfd6836ab09488bdfcc9e39", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634875367, "uuid": "c71e11f4-774e-42cf-9861-d890af10e84f", "value": "T1AF930941FD418B27C2D237BAE78F435D37366A5467DB33016A396EB42BC27982E39520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634875367, "uuid": "58fc594b-3b43-413b-9c4d-df346c257d4e", "value": "1536:LBkF9VQPAGaHYyEfgcqpq1innPTxHOx5ePczYrmREqQ4b/X7XSee:OQ2HYBv1WTMePcKmREqQ4bv7XSee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634875367, "uuid": "bff1cf4e-0cf3-4b5c-a5f9-3453684e84ad", "value": 92448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634875367, "uuid": "ded9fe95-bcc3-4c2a-bed6-fba0bcf1ebfe", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634875367, "uuid": "dd4e359a-286a-47ae-a30b-6a21a345597f", "value": "2169ff46aad1203052c652c13cb3ae65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8e04058-330d-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634889510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889510, "uuid": "065fc276-2c7c-4672-8b27-6f0d89a813e5", "comment": "Malware payload (Loki)", "value": "1aad29963b6d94dd0fe3ea9698531818", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889510, "uuid": "7aef701a-1f3f-4973-8c08-a0889a426aa7", "comment": "Malware payload (Loki)", "value": "7297e759b41c1701a65a736c6ce297e9e2ced882730c0c2347a1a4d59a0a7846", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889510, "uuid": "78cdc4ef-9e17-44ae-9e27-8815cf49c57e", "comment": "Malware payload (Loki)", "value": "90883bee05a75a1ec754a3d3637abbf3dd387df3", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889510, "uuid": "b01c1a64-4306-4cdc-979f-cbd99c3fa3b4", "comment": "Malware payload (Loki)", "value": "09e87103ee7f1f62b914424c172d71dde445ec242e46da0307fd634dd056fc77f1e591508e28fee44a5ac7c7c365a8ff", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889510, "uuid": "d3309118-b851-41ab-b4b8-63357631b1ef", "value": "T191D4F03662D08FD1E71F3934A84DD18B65639D01DB4B920742A27E8D34FB6FF24E2A64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889510, "uuid": "3c5e484a-ce25-477a-bc71-47969108400b", "value": "12288:Wy4zW8GA9OHn9+9gOh7szO9gxbCjJZEO/2+QZB/TXrMmcP0AUfd4GoiW9+jX3:X4zkOOH9sfbgx+tSw2+QZBw0/fd4GnWa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634889510, "uuid": "90ddb538-006d-42a5-9ab0-b257f268deb7", "value": 609496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634889510, "uuid": "478b7285-7d83-4f91-8b7a-38d707fd13ef", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889510, "uuid": "21842025-3e66-4469-8eb6-2c96e920d6b2", "value": "Proforma Invoice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fde32066-3307-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634886995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634886995, "uuid": "78acab7e-2097-4316-857a-d891534e18e4", "comment": "Malware payload", "value": "a9f696f6e753202bbb0d5e31d6248f04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634886995, "uuid": "810ef5f4-4506-44c5-b6c7-ac6acc68c783", "comment": "Malware payload", "value": "729ac3c86c5848c5c1b18c714c38e2e9514c9c010e1f8462270e82269a2399a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634886995, "uuid": "a9651339-6df6-44e1-b55e-0526945f0cf3", "comment": "Malware payload", "value": "711f0c9cafaeca25675f37de88525153f383c346", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634886995, "uuid": "2eb55b7e-d804-4192-bf84-7b639a949d0d", "comment": "Malware payload", "value": "c6458b3cc79348eef03410277cbc0567142ae12f1bdaaaacec6447e83b82ff4e3c27376cbc79d4d833354d8bdad314b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634886995, "uuid": "d786ee2f-be3d-4168-8482-2faff32cbe62", "value": "T1E3963314A7840DDDF0A60034D6B04535F03ABC724709DA472AACA5179FB7AFDAE76FA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634886995, "uuid": "1104df9b-9e56-4750-9440-0a9be3499820", "value": "f4cf09dd5265ea802d83e943c2137765", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634886995, "uuid": "3a4f7079-7944-483c-b517-21906581b6de", "value": "196608:Q/LlxnNww7ICteEroXxwlVfEqlbkkwR7VTEJL3Zc1Bm0zjPJl9DFkGg:AVLInEroXIfEqirRRoJL3ZOQ0zjPJHDe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634886995, "uuid": "9bf48832-a6a3-40f2-b8c0-77ff160c0a74", "value": 9021855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634886995, "uuid": "1a2bb39e-3d90-42f5-a3f3-2cfa6f5745ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634886995, "uuid": "278d5a09-9a0c-480b-af01-60e61e77c585", "value": "mrcommunity.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8480dcb3-330c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634888939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888939, "uuid": "90b26a81-fa79-4767-9bd1-424df919ecfd", "comment": "Malware payload", "value": "154a7aa1926c98a75dffed11bca19902", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888939, "uuid": "a29ab8be-c8cf-4947-a8cf-e40e56858577", "comment": "Malware payload", "value": "736c01002e1c260f40987e943279ca43627a4a3e67adae05107becca47b15bee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888939, "uuid": "035c293e-5f51-465c-829f-365b4fc93ca4", "comment": "Malware payload", "value": "c9748b25185656ba387a4b259f00683d5fb8fbbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888939, "uuid": "dcdb2924-044c-42f6-8423-c0953827be66", "comment": "Malware payload", "value": "690f13080444b0d04322faff0fd466f771918923c3ed656a5f7f2d29db7d819e5cfd629f3dd2eb74460ba36ce4175e3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888939, "uuid": "de6af54a-575c-4e0a-9c51-fd7513e9c26c", "value": "T11D953916B8D305BAC57AF1308552D3627A317CA987323BD71E81BA6A0AB4FD46F3D314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888939, "uuid": "e8134b7e-bd76-414a-aad6-6fa290e248ee", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888939, "uuid": "e700efb8-83ea-4429-bb6a-f9893ff9fae6", "value": "24576:s7Fue37Bv8uD8zes/MOhLtd48HSEjJj2WbSKhOlVV7E1/:sV7B7D8zeyMcLtdVHpFbSjB7E1/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634888939, "uuid": "014c677a-ef5d-4924-816d-d291a3887b1f", "value": 1961600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634888939, "uuid": "c95d17ef-e8ba-4c3b-b40c-f25568a54a8d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888939, "uuid": "c1ceb299-b0d8-45f0-8c2a-a28591c598ba", "value": "736c01002e1c260f40987e943279ca43627a4a3e67adae05107becca47b15bee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a1b03b1-3358-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634921537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634921537, "uuid": "c5aa2b6a-c4c6-4440-aa08-a1d11a0a2f3f", "comment": "Malware payload (RedLineStealer)", "value": "27988be4a41feb2b8b37dedb6949e9f4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634921537, "uuid": "0882f7db-852e-40e5-b4a5-17607ed37aa4", "comment": "Malware payload (RedLineStealer)", "value": "73d7def516f13281fd06673ef3b5b87eb99ba4f708dbfa78a11bf0de94b23df1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634921537, "uuid": "9d673f78-a550-4044-955b-fda199e8d4c1", "comment": "Malware payload (RedLineStealer)", "value": "4bf776600242d676c07dab696999f13982f333ea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634921537, "uuid": "fc52ad72-db7b-41e3-9db2-17c0b9c86212", "comment": "Malware payload (RedLineStealer)", "value": "1032e10daeffbf5e1b0b8903a05cf4de7a8165b66d815406d563104f81124bf1ccc4534c706c9f77d654db7065c334a2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634921537, "uuid": "ffbfc346-268d-4bff-a71e-d92f871aaf16", "value": "T10184032864BFC01984E3EEA52DDCA8FBD99A55E3640C743701B4A33B8B51B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634921537, "uuid": "6f096fba-3654-41d3-93f1-0581523176e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634921537, "uuid": "34d43b90-ebc2-476d-871f-6fbbc3731a36", "value": "12288:G/I169Esn3uaHsxoMsA/XCgcIs4MEOGJ/iI9LJdDEYE:G19E9D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634921537, "uuid": "f56916a6-5aff-4301-aec8-0571f310d337", "value": 395264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634921537, "uuid": "33dc693f-ade6-4e31-a89b-654657853761", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634921537, "uuid": "685171bc-46fe-4fec-93fa-c28c24eb2045", "value": "27988be4a41feb2b8b37dedb6949e9f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfd88f18-335b-11ec-843c-42010a9c0014", "comment": "Malware payload (SilentBuilder)", "timestamp": 1634922996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634922996, "uuid": "0e65166d-de0c-4b97-a2bc-abce6b983530", "comment": "Malware payload (SilentBuilder)", "value": "ea82027c0050ec2af055a6f902f3d090", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634922996, "uuid": "bca06b24-af1c-4190-8e1c-993345fb240f", "comment": "Malware payload (SilentBuilder)", "value": "7419431b88e64098a177a2d9f30e62d865c4680a946657c050a3a191d862e39e", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634922996, "uuid": "872e0240-4e08-4f02-954e-4056fbe690b6", "comment": "Malware payload (SilentBuilder)", "value": "2afbc3bbab123822a84fabdf51057e1c9bec1063", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634922996, "uuid": "484bf62d-1b16-484b-8ad4-9b0e976bf4f0", "comment": "Malware payload (SilentBuilder)", "value": "5f538ff7eaafb22307d8c9b4e7d3ed24a0f9de53ec7a0af64813c942e6bd9767ff260924c935a3ae99112ae853438d1e", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634922996, "uuid": "962c56af-b4c9-47e7-bb45-72584dca1d34", "value": "T1E134E046B91CD89EFA17833148C7ABAA6323DC304FD71E876695762C7FB8DA47903046", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634922996, "uuid": "35562cad-6eec-46cd-b94a-496cfa851a34", "value": "6144:WKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgBcfZw6lBVb7oWSuKMA6PujbmvV8DzJ:CZrlBVbszXjS9t8DF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634922996, "uuid": "e73ec296-1430-43e2-8089-e1c8c525823e", "value": 234496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634922996, "uuid": "7177fb69-d744-4091-b83c-743824880b8b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634922996, "uuid": "eb92a94c-9463-4ddf-b585-0c88dfb4c34a", "value": "biz-1651663957.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a13dc0a-330a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634888090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888090, "uuid": "1447f4ae-9413-4802-85b5-d090d3e629a9", "comment": "Malware payload", "value": "827db2567095ca4df839c873d1b2db2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888090, "uuid": "655088c0-1250-4809-bae8-c22dfa96219a", "comment": "Malware payload", "value": "74529c97adc11d4248f535eaf092d262663d236113284656685881d84f5208df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888090, "uuid": "c26e1a55-00d6-43cf-9464-cb9094e062f6", "comment": "Malware payload", "value": "b8f13a2accee2f7309db6fdda702a397a24ecb65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888090, "uuid": "8665a0a6-430b-4a4c-8d63-8d6808613684", "comment": "Malware payload", "value": "db047050e414acfad0108c85104113ad3b48fdeed3baf7291d45ae581ec36ea36bb0375b25d9315e785aebd12bcd4705", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888090, "uuid": "b859c88b-60ec-476a-a6f7-bb39af75e0be", "value": "T18E963349456544EEF0EF0235C551883FD97BB82B0B1AC74B19D85293CEA3369ECBEB90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888090, "uuid": "57147d21-73c8-4dd3-9cee-68b7a05b03a9", "value": "f4cf09dd5265ea802d83e943c2137765", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888090, "uuid": "ec51ea60-603f-4ba3-9365-1103e518ae2c", "value": "196608:9Wjiw/CsXDjDyf4F9/r6M3WI8cnxZQQdf+ZGVvkDZ:AtCEDfKtyQQdf+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634888090, "uuid": "b8ffbbb7-9102-48d8-b505-303aecffc2a0", "value": 8664130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634888090, "uuid": "e99f95cd-7d4a-4b23-b124-b5d3f3fc725d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888090, "uuid": "c3e6daa0-3aaa-49ac-abea-8d2c6a66d521", "value": "seraph.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb9ee0ab-32e2-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634871100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634871100, "uuid": "08fe9cce-cdd2-40e4-b936-41876ab5e098", "comment": "Malware payload", "value": "cf92a854dea1fb28cb12c47f6b5d595b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634871100, "uuid": "40bc3beb-45b0-478d-b377-d745f111c0ec", "comment": "Malware payload", "value": "7495bb8e7260acdc5822cabc7c2c17d54655eee8efbc0bc4887e040fb4b7dc64", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634871100, "uuid": "201571da-e65e-4428-86e6-c767a61c0030", "comment": "Malware payload", "value": "b6105811b820151e0fb27c76d73a0353eb38c124", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634871100, "uuid": "cbeece8e-1759-40c4-b132-18410f809f36", "comment": "Malware payload", "value": "b0a0a99573354a3b8bc053284de968d1409f8c59a1693262cbde0147d5869fee5f775c7997c27c5d2b630dc616294804", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634871100, "uuid": "5299e0d1-836c-495f-9a00-e71be9b9d36f", "value": "T133E533224981E504D12F583DB26F7885B579DC205B89CEF9EB8B7240C83D6BAFD6021F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634871100, "uuid": "85f0a883-5bc9-4c3b-989a-50bc0aa3b393", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634871100, "uuid": "8b8fde1e-1079-46f7-ab61-e0b3f350357c", "value": "98304:QgtdAoVQAWmwnICJGjXVhUzwVHFgsB9pxvRUZ5:Q6iHAJqrQM2gEppc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634871100, "uuid": "b2f6977b-73a6-4bc9-8ea3-de70b70c8a64", "value": 3196928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634871100, "uuid": "f459251b-76f1-448d-9389-6058f8701d0e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634871100, "uuid": "261d24aa-1725-45dc-a7aa-f9a1ebbee336", "value": "cf92a854dea1fb28cb12c47f6b5d595b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad42d93c-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634928092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928092, "uuid": "b1ad9a67-b98a-48d9-9946-2d3b7e7d09e2", "comment": "Malware payload (Loki)", "value": "6fcc51fa6b19798c3821287aac712871", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928092, "uuid": "5a317ddc-479b-4f15-8e84-8cfbf67c8e49", "comment": "Malware payload (Loki)", "value": "7675d05ed54e7dbf0713f0ae49310d9ddd7b20b436b03907d1d6bd9570eb79b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928092, "uuid": "dd5446ab-7fbb-42fe-94a6-867ec93ec0ab", "comment": "Malware payload (Loki)", "value": "b20fc64a49a5808f4460f02581de977736df0a29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928092, "uuid": "9f083dd7-cf59-4ad8-8821-c2074d11e9d3", "comment": "Malware payload (Loki)", "value": "5716a2dfa1c68ca3be31b4eb0fb0cceca69a7d1bca668ffb1df6e75efa475b143782f9faf2a37d280cc99ab8bb3d9403", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928092, "uuid": "648dbb90-f8c3-40ce-9586-056668b0dbcf", "value": "T11194CF3565828122E9953B326E55E0F013E36E0B7B12621FB2D43F6AAF7D1E9F7C8105", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928092, "uuid": "e40b42e1-0c2e-4e78-9b2a-9df291c827b4", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928092, "uuid": "3bfa3c67-3051-4c99-9a59-f017595ea536", "value": "6144:HBlL/JhFS7pqxIK2JEHlt1bQuc36IAIHmfokEh9vbIx2NeAfuKRGwd:hRYpq+K8EHltqu2Hwwju0uKRGwd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928092, "uuid": "12c35b14-6386-463f-8f66-60b29d81a4ec", "value": 447782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928092, "uuid": "5aa15d3a-b333-451c-b353-feaa96d87b10", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928092, "uuid": "71a38648-5126-450f-ac8c-5b89b6b595ba", "value": "Order PO023012019Order PO023012019PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98346c0c-330e-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1634889831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889831, "uuid": "185dbec8-067f-447e-8c97-030745637f65", "comment": "Malware payload (ArkeiStealer)", "value": "641be2c98b6b46e8dacf34789090afd6", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889831, "uuid": "7755a79e-38b2-4efc-9bd5-7019a3bbbcd4", "comment": "Malware payload (ArkeiStealer)", "value": "76b7e0265f5fd3d3fead08df85a41d4fac0ab5bd881f9c44dca6987e69c9b63c", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889831, "uuid": "4915541c-2a5d-48e9-8a07-6ecbfe9255b0", "comment": "Malware payload (ArkeiStealer)", "value": "bc02cf5282fa75a16d6dcdd71a23c1b40eb28ceb", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889831, "uuid": "b40b8f18-74ba-43c8-8943-e450db6e4195", "comment": "Malware payload (ArkeiStealer)", "value": "1ed294ccd13f133bd5901b85dcf8997c86910b60e4c4346c01071188e856cc426257569d9d0cca4ed2861f6e07ec5f1a", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889831, "uuid": "7d73ef2d-7c83-4119-95c7-8471a3fcc8d7", "value": "T1F2F5AF32B281843BD07B273CDD5BA7995A6A7E102E38994B3BEC4D4C0F39641791D2DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889831, "uuid": "62142ecb-741f-4950-af46-3b0962a58314", "value": "f835dd1d0ecf6e80cc8d40b09f2d5bf8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889831, "uuid": "4d433242-3b67-47d8-b7e7-eb484dda20a9", "value": "49152:PlJnEIeGH3xSdKa+jDLWa2oRvxlqdsY5M09odfWzFM3Hx1:P/n/H3xqK5jDLWarxOsY5M5dPR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634889831, "uuid": "1ef83535-f698-42a2-8b74-867b165eed3e", "value": 3403776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634889831, "uuid": "8ec1e9c2-c849-4737-a48a-066208da96ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889831, "uuid": "d01226f6-0949-4557-ba91-e625cbf18d09", "value": "641be2c98b6b46e8dacf34789090afd6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd0d474a-3374-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634933809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634933809, "uuid": "b6959af0-1126-4ac7-a3d6-00925299fb0b", "comment": "Malware payload", "value": "8f979a7b50a38354d61dd9408e9539c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634933809, "uuid": "15e69dfd-82c8-492b-9904-09fdc8c81b11", "comment": "Malware payload", "value": "76c6b0da06afa8c9f4724d1c2166eb95c91e633296d854a545369ba9e0251e9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634933809, "uuid": "25b29326-9f1c-4e7a-97bd-5271919a194f", "comment": "Malware payload", "value": "67c7a70550fc77c6a4de9cb4a8ca11ff7ed7ba3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634933809, "uuid": "63936c21-a436-4d37-ba17-c19348b97bbb", "comment": "Malware payload", "value": "7f35d257b87290beac34c5e7cdf25e2464375fd3846d37ec507d447d8c44e5b409d182b3ce9c3a8c160470a71e3b8d48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634933809, "uuid": "2af7ab04-2eab-46af-9774-2035a6a90456", "value": "T198F47CBC3144AD8EC46B8F7649541C14A22668E7064BF35370B725ED8EBDBD68E102EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634933809, "uuid": "f32c4201-d9a1-4aed-a201-1033968e2c7d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634933809, "uuid": "e9da0f9c-795d-4c72-86ec-1803a67d5837", "value": "12288:ixMYWBWTdbTZcuIcV44N8kAHju60Sz1Lq9JTDKCdPnMWlMnN6RyQTmgE4PKle2y:pYWsdpOzBN1Lq90CaWlqN6RyM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634933809, "uuid": "326c8ecb-d67f-4499-afb2-b6b318629bea", "value": 762880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634933809, "uuid": "aec88901-849c-4c5f-86b1-15bdca8c4ce6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634933809, "uuid": "3b92922d-dfaa-43ee-aee5-8eaa4785e6f5", "value": "ORDER INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4965c0e3-32fa-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634881109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634881109, "uuid": "3c9084ac-23ef-47ca-98b3-663badb8b308", "comment": "Malware payload (Formbook)", "value": "a8849d90ecc227cc4cb889d854b1dc17", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634881109, "uuid": "55fbf7c9-d4ee-4278-a533-e4b83903481d", "comment": "Malware payload (Formbook)", "value": "76e745479aa92ba3a9d7aa6448aab35758ab2ef7ece2a66d4988bd0cde207771", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634881109, "uuid": "ecf99c99-47bf-4d71-94d0-d6302942701f", "comment": "Malware payload (Formbook)", "value": "a5f3818f1d33551f19b263b2afd4da88feb95ac9", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634881109, "uuid": "1b53da12-bfd9-4a79-a1ef-e62da2c7cdae", "comment": "Malware payload (Formbook)", "value": "e08a5a091692cb6de9ddb5bde131c7a54c6a4add7c76cddcdb1b85bfb43981c1df9b401ffc447dc32c7b2948caf12419", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634881109, "uuid": "925cd5c5-195c-45f3-aad3-c83039ee5906", "value": "T173B423F0384D1E232AA2213B7DE589407B5DE6B2E5E0BF23A99055371F1CB9A7C25C43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634881109, "uuid": "5333dad8-7b2e-4595-ba95-04ee1345ec9b", "value": "12288:OBMVszAXdKC1K46Ch3oCRc9DijX2t4t0vHRmoyJ:OFzudK8K4TqCG9DijX2qt0vxmoyJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634881109, "uuid": "28f4238d-6557-4c08-af49-63c82c83225c", "value": 539639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634881109, "uuid": "ba92d0fc-feee-4190-9485-c186e6de4b86", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634881109, "uuid": "3defeb74-7d83-4d59-a2bc-9942290fec87", "value": "PaymentXreceipt.pdf.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d527f27d-332f-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634904107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634904107, "uuid": "c5dee023-9f52-44bd-b5c7-12fac9fc9e33", "comment": "Malware payload (Formbook)", "value": "08ae4dd275718d077172abb99be15464", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634904107, "uuid": "d26c450d-3d56-43cc-b107-1041a1be5f9c", "comment": "Malware payload (Formbook)", "value": "7716fec715a46b0eb4518d53703b0fc2186e6a473a876de7aee9155ec289f93a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634904107, "uuid": "b385c375-2922-46a6-a43e-4f3f2e21aad6", "comment": "Malware payload (Formbook)", "value": "cf99068f0ea4acafc515fbe334a71e62401ac757", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634904107, "uuid": "a21dcdad-eed9-47e7-ac81-051f98ae878e", "comment": "Malware payload (Formbook)", "value": "9c1ca886dcd3e4c621234d1a0076cda9eac02aba973007801b1e742096bc7fcfc9ac7eac3ed932c1a5bbb2e7709b9dd8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634904107, "uuid": "1a19ba89-8e51-46b8-bd02-ff8e4a89a861", "value": "T1C874A0E1FB6188F6E8335379B47768262023A93ADB71004E16DDF72A5E7338205E7947", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634904107, "uuid": "ed727380-9911-46c4-8f81-e5e3ab01ea9b", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634904107, "uuid": "3cc01c85-d590-49aa-a638-a71fa1bb20c9", "value": "6144:VBlL/kE286EZd6JrL/TMo1HjvHuFgDJI8mpVObrdtGf7Ypk0TwjenBRN:D6E2864eM7YI8frdtGfEpkOwjkT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634904107, "uuid": "4e22dafe-ef58-449f-ab5e-315d1003ca01", "value": 342122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634904107, "uuid": "98ddc922-efdd-485c-9338-2c91d3bb585f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634904107, "uuid": "dacb46b0-df4b-418d-bd77-77ec7348bfa7", "value": "ORDER N. 1487.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feb362c3-3349-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634915344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634915344, "uuid": "ef64d396-403c-4006-963e-06c218d0d25a", "comment": "Malware payload (Loki)", "value": "6e3c82c82fb2fcf38123d93c0d6b93b2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634915344, "uuid": "737228dc-8aea-42a0-8459-3a34bfb4dba3", "comment": "Malware payload (Loki)", "value": "77fd63dabf73eb44f7c9830553740ea290cac78bc333322326c70b927a69d4fe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634915344, "uuid": "4bdf8bfa-b7ef-48ac-84f1-0c28ddc26405", "comment": "Malware payload (Loki)", "value": "df87c816ea5edb6b8c763fb133ca0e52840d944b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634915344, "uuid": "52ce9f4d-cf36-4913-822a-70cc5b577063", "comment": "Malware payload (Loki)", "value": "5b10c4cff96201b12f7f29e7bf537ed02fc72d4b2f0df89efc4261143eba4de5dc9158589b07a646d718e9f06e726018", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634915344, "uuid": "b52ecf7f-b42e-4b4b-bc0f-088ad3f2e835", "value": "T132449D3973F0C431DAB255308C38CAE1197AB859DB60F16636E8AF2F2E7129C56E435D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634915344, "uuid": "4482d439-fd50-4c62-a251-78fcf2697e3b", "value": "df9601abec2416ae7ecc0dd0d7272e84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634915344, "uuid": "f9c348b1-0338-43a3-a91f-6f5c07cf71f3", "value": "6144:uceVoLVEb4uqb5iKxkMGxArlx6Q47dtsxqX7tNfVXVHQLIiu8c:uce6VEb4xNxkMEArlxyTsxwZGEX8c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634915344, "uuid": "9a7f6797-2400-4de4-8b96-b495215895c3", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634915344, "uuid": "a8be32ef-50cd-4e39-a335-1f764e455e81", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634915344, "uuid": "d080fff9-d32d-43de-9ee6-3f9985ae0bad", "value": "6e3c82c82fb2fcf38123d93c0d6b93b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32b4d632-3325-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634899539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634899539, "uuid": "6ab6af90-02b8-4018-b861-07e86e063f7a", "comment": "Malware payload (Loki)", "value": "e569cf93ee6733d55657ada351f94c34", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634899539, "uuid": "6e706680-8a6c-467c-af51-9871e447c9a4", "comment": "Malware payload (Loki)", "value": "7856e67720d4bfc7a20be52838f806a92efc3aa98c4687716daaf6ad5dc6180e", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634899539, "uuid": "e56c35a3-5c78-425b-b8f3-cf12af566add", "comment": "Malware payload (Loki)", "value": "987028a00e45a7a189eeb0f9f31bd7b25df70188", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634899539, "uuid": "8b8ec15b-81d1-4856-b42d-d9bb6388751c", "comment": "Malware payload (Loki)", "value": "2c5c19e188fa60d988d1e31b94d86b309a63a704ab2c276f984281557319a47e049c5888be340d4f059464fc7448f0e9", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634899539, "uuid": "197df02c-3a2e-4977-9015-85b4aa61871a", "value": "T176C2757DF59B0E48EE46C6AC061A7BA6014DF52D72C440E237B8DB38795C91B8B23D38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634899539, "uuid": "f307e08b-6cbb-4901-83e4-2017b52893b9", "value": "384:dYjmCInrA7ET1D60ft+x4OoYTsccSuqgXAo+F3H+urN4F/zZ5/39MRu/ljEmJU7:imlrAy1Dtsx4VYFuqgXgHhylrCYG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634899539, "uuid": "e0799df4-6916-4457-b28d-be670f3e211f", "value": 25907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634899539, "uuid": "9040adb4-1b62-4988-871b-510d6ff6c5a8", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634899539, "uuid": "38121cd9-9fc7-428f-97d0-b3830ef011b4", "value": "e569cf93ee6733d55657ada351f94c34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aaa2245-3308-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634887071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634887071, "uuid": "f7de13b8-8c65-4961-9765-515942d12837", "comment": "Malware payload", "value": "6a76ee693b3d43ed385ce4b930fe3e30", "object_relation": "md5", "Tag": [ { "name": "mac", "colour": "#285994", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "UpdateAgent", "colour": "#B10D2A", "exportable": true, "hide_tag": false }, { "name": "WizardUpdate", "colour": "#5BF7D9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634887071, "uuid": "d6592b47-1b5a-44cb-90a2-d257223b85b1", "comment": "Malware payload", "value": "78b4478cd3f91c42333561abb9b09730a88154084947182b2ec969995b25ad78", "object_relation": "sha256", "Tag": [ { "name": "mac", "colour": "#285994", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "UpdateAgent", "colour": "#B10D2A", "exportable": true, "hide_tag": false }, { "name": "WizardUpdate", "colour": "#5BF7D9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634887071, "uuid": "ef6495bd-d318-441e-9c67-c29a046c4815", "comment": "Malware payload", "value": "3112eba5dbe03ce824ea63997f16becd8b3c82b2", "object_relation": "sha1", "Tag": [ { "name": "mac", "colour": "#285994", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "UpdateAgent", "colour": "#B10D2A", "exportable": true, "hide_tag": false }, { "name": "WizardUpdate", "colour": "#5BF7D9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634887071, "uuid": "ada40ded-5f71-40f8-bf7f-15dd50fd1f37", "comment": "Malware payload", "value": "c363840f169f9e07f7943f4e521b9770accbe5ccfff16c1157241edf92a6cbf0fecf1c3952224035b9feb2a247374483", "object_relation": "sha3-384", "Tag": [ { "name": "mac", "colour": "#285994", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "UpdateAgent", "colour": "#B10D2A", "exportable": true, "hide_tag": false }, { "name": "WizardUpdate", "colour": "#5BF7D9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634887071, "uuid": "29ed73f6-e9f6-41ba-87d0-bb25d82c884c", "value": "T1D24257139F8C4E66C42E43B880DE07D76762F2850BA787079E82C0591F563D9B978F5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634887071, "uuid": "9bb7e2e7-7c58-4349-b9b4-5ac3038dcfe5", "value": "48:x1eNn/h3mtSRU7M5HbO7z4C7MPDH6jjKsK:xkZNzbO70CIL4ji", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634887071, "uuid": "a939bf64-8b4d-4a58-9474-4d448409ceb3", "value": 12556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634887071, "uuid": "74353ea2-4e2d-4610-9dc1-7514d4e4e663", "value": "application/x-mach-binary", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634887071, "uuid": "17b6d238-a390-4bec-9f28-2d094525c4d7", "value": "DLVPlayerAgentUpdate", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7d83eac-3320-11ec-843c-42010a9c0014", "comment": "Malware payload (QuakBot)", "timestamp": 1634897615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897615, "uuid": "1fa9bbeb-d155-47a6-8c71-ac716daeeabb", "comment": "Malware payload (QuakBot)", "value": "cab72ace08bfd9114939c22f04a5524d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897615, "uuid": "749b2eae-2edb-4e92-8dc7-a513028571c8", "comment": "Malware payload (QuakBot)", "value": "78bccdfce650d1b0c3023ed1cf7174625e88af831865a926c927a320c1177e10", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897615, "uuid": "a167a164-992b-40db-8259-5eb42c199f68", "comment": "Malware payload (QuakBot)", "value": "4cbc3ac583a001e2a717acd4db8fce69257f57c2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897615, "uuid": "f870c488-8929-49ab-b1e9-e90d00695752", "comment": "Malware payload (QuakBot)", "value": "9ff6464c33d4adf35cc63124f8bba86abb1153721b5917f12fa219d1c348787ea2f4a66c9ce59c466ee4e2c311965af7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897615, "uuid": "3b34a4ef-479f-4e51-b76e-4749ddc042ae", "value": "T13A3533D574E8CE90C014D21B8B65BD78A18A64C680AD4BBDFF2BF1F2269744720BE75C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897615, "uuid": "9c62019e-1fc5-4934-b85d-5e9ce2c0d1df", "value": "24576:/xrHjxsKK2jWSHw3mZZrbcF+tuGp3dA12LS1o2PjWlZn3j/x34:/tHGKJjZHw2ZZrbcF+tzbAMLYoNZ3j/e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634897615, "uuid": "3adc9860-54d1-4f41-a5b9-ad649041396d", "value": 1134254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634897615, "uuid": "c607d2ba-c4a9-4a7c-9461-dc62d1dbfb06", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897615, "uuid": "0ff0e897-7a13-41f9-8892-2c0011e6df80", "value": "78bccdfce650d1b0c3023ed1cf7174625e88af831865a926c927a320c1177e10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afc2db4a-32cd-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634861954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634861954, "uuid": "511571b7-2b5c-4453-870d-5dd7c082d890", "comment": "Malware payload", "value": "b98d223c71d68edd727cd7e4a281e8a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634861954, "uuid": "8f9bc1cc-24c1-4801-a84a-2b2d04a9d082", "comment": "Malware payload", "value": "796cf93efd52fe870ec214efa6a9df0fa43d51f5a3cd7cc3bf89a194a45efbc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634861954, "uuid": "3b39a133-7d43-4320-a700-2cdc7f3a39e1", "comment": "Malware payload", "value": "ebb02b048ef8cce653425d02c8f7a195b0cd9500", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634861954, "uuid": "1caa4b3f-8979-497a-b02b-0080efd101d6", "comment": "Malware payload", "value": "14e44e7961ef7eda3e63afacca7c5a97f310d616c1bb4548cc4c866272f2619491b322fbb416142b23b76334d5b0382f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634861954, "uuid": "2493ecc8-0a74-4681-8160-b8c491c6a003", "value": "T11AB6330A720064ECE1635BB7F99084F9DE32BD2B8788213B1F9871A066F799979F5350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634861954, "uuid": "5094eac9-43a4-420e-9036-a8dd3aea02b3", "value": "58053a2a3020fdc7713b576ad93bf7bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634861954, "uuid": "93b8855c-b7f4-452d-83c7-6a8b380ae033", "value": "196608:Ocq+GIxUl6G9onJ5hrZERhyiU8AdZYJERS48RmU/3ZlsPv1r2RurTqg8CB2BEqbN:hPWl9c5hlERdAdZYygtN3ZW1+urp2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634861954, "uuid": "4dc55861-2048-4f33-add5-b1cf168974a2", "value": 10626069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634861954, "uuid": "c8098432-029c-40c5-92f8-4943892b9654", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634861954, "uuid": "8c696698-e911-4fdf-a68a-88780660cf7f", "value": "Discord IP Puller.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bba1c81a-32ed-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634875717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634875717, "uuid": "c4190792-6a72-472d-ab3f-bf79e190062c", "comment": "Malware payload (Gafgyt)", "value": "4ca8defdc04697511b17763684e3fb07", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634875717, "uuid": "0be5c2a1-1c27-46f5-a667-97e7baf9d6ea", "comment": "Malware payload (Gafgyt)", "value": "7b416813283a1b15cc1fcd301d8f39ff53532531ae5c7a657c92c8472636aebb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634875717, "uuid": "ab529e26-494a-41ba-9894-eadf9b148963", "comment": "Malware payload (Gafgyt)", "value": "f096c8ce4f905159f96ac3400d250a0c4d35a095", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634875717, "uuid": "42c69e9e-eb0c-45dd-9a73-0ec4c7d7c3e6", "comment": "Malware payload (Gafgyt)", "value": "6e359e3fdc6b531e78997e192a05ca9cc71df49c7a39f6a1c4539e6f80afa6eb75c92e98043887a858a646cb50082758", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634875717, "uuid": "e5475cf0-a8fa-419a-aaa9-e50e66c9cb46", "value": "T1D5831943B72D0B43C49B6AF12DF72BF08769F96117A76180A11EBFC44772AB02522F65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634875717, "uuid": "14c397cb-e46d-492c-80ed-ef89ee59db6e", "value": "1536:BQOc40ozMPjej5qckA39ikRFacnrWBfOEmQ9VqXjtWf2Xe:Bl+3y4ckA3BdrWZOEmQ9VqXBWf2Xe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634875717, "uuid": "4a24b539-76c3-401b-b5a8-7d75558ec853", "value": 84796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634875717, "uuid": "96ff3f21-c103-49c7-91b8-d14460cadb68", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634875717, "uuid": "3c0b8a02-a23f-41a4-9685-e184cecf139f", "value": "4ca8defdc04697511b17763684e3fb07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2986586-3361-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634925604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634925604, "uuid": "42cdd81c-50ec-4554-8bac-5792f058bb3b", "comment": "Malware payload", "value": "56b330e98b88045c3964e246f6615f81", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634925604, "uuid": "d435f8e8-b7a8-46f3-a5ee-aa75c0e0b270", "comment": "Malware payload", "value": "7b69e780c22fb9e6417221f3afbcf5e84e99c28ccc0ea645f4375b2495a6f838", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634925604, "uuid": "a3678384-928d-4400-9755-5bb8919bae67", "comment": "Malware payload", "value": "ec4b5a5bfe731c904778bb038337ea52ce3fb5af", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634925604, "uuid": "75e4673a-a5ad-4e84-bd88-c486caab8ea3", "comment": "Malware payload", "value": "bed381eec74131a9613975503c01c63e35ae0651b56428aac1398e1dfa799c6514c3deee99a7b223e420383c41d7a425", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634925604, "uuid": "b47c8671-8145-4af3-acd7-410717d563fd", "value": "T14423E702AA81DA73D5831BF906EB5B214632F97A1E179F41E32C7CF49B521C8722B758", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634925604, "uuid": "769dc5b2-b375-4eab-84bc-889f3711101a", "value": "768:txqPU/cie25HoLeIaii5/VdBZ3kV8iUlVESHINVX1egfyoY/TVZNKgLGe4VPZ1:7q0ci7h8aii5/VPZ3kpUQSHyX1e8Y7VS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634925604, "uuid": "0feaff72-e909-444b-b4bf-a74aeb7092c8", "value": 48355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634925604, "uuid": "eebfc96b-696b-4a03-bd6b-d5bc181ea2e3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634925604, "uuid": "babde8bf-af53-477c-855c-196800450fae", "value": "Fate.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93301d4f-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928048, "uuid": "6b497dff-5a13-40d9-b7c1-a791d478c117", "comment": "Malware payload (RedLineStealer)", "value": "4a5bf1fde48d1b83d0f83cee16684158", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928048, "uuid": "3cb1e6d7-847b-4fa5-8f66-f757acae1f4f", "comment": "Malware payload (RedLineStealer)", "value": "7b8b79dfdae95b72a9942954399a990919a340c14c886980de420d046998f097", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928048, "uuid": "247fe40c-0ae2-4b85-ac1f-0108c89afddc", "comment": "Malware payload (RedLineStealer)", "value": "699e6e7581c2c7fc300fb482ad12a4cacd6c8e50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928048, "uuid": "aa558c0d-8d34-44fe-9b56-57df1fa5fca8", "comment": "Malware payload (RedLineStealer)", "value": "9970d0fd5465ef534f4148083d9d6a58b6f7053417dca88bc85495d9c31cbc4a7dfd05bdc2d0d17785d23f872ab99b5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928048, "uuid": "d28a84fe-d9f8-444b-8e19-9fcb8d0c093b", "value": "T124E4F110BB90C035F1F312F8497993ACA93E7AA26B6151CF62D416EE47386E1ED31367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928048, "uuid": "9bd32704-3ce2-43d0-825a-3149e565aab3", "value": "25e96726029c322936cf0033b6a07058", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928048, "uuid": "2734915d-6e9d-4246-968b-4662e15ab38d", "value": "12288:Uvj8mmXDPyR9hHgltMWkrJhrGqMEHz8lp1zKDOFwOdOyhXnYfsKOyRt8:yj8msDPyRgbMW8VzHQnKDOFN4cXnkg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928048, "uuid": "8f859a3e-e02a-410b-9acb-4fb7e9f80157", "value": 669184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928048, "uuid": "5e3bda2d-da8b-417e-a5ae-0d81f9684ea3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928048, "uuid": "ac102c82-0a94-4434-b88a-e576318e355e", "value": "4a5bf1fde48d1b83d0f83cee16684158.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e54b4fa0-3361-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634925609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634925609, "uuid": "d1aa812b-0796-4f16-af75-c14837256382", "comment": "Malware payload", "value": "69c1d5e0b8292fa369aa20891b53aa5c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634925609, "uuid": "a85d36db-bcd9-4d91-94a7-286f43fa0bb7", "comment": "Malware payload", "value": "7be14c98ce5746fc02e66b63336c3ed3d96560ac4757d648d1ac0c5e23fc7468", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634925609, "uuid": "bcff48e6-a996-45a3-8e40-cd3eaf0630bc", "comment": "Malware payload", "value": "660cce217ddd4b09a32c7d7e79110a9d4aa6b859", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634925609, "uuid": "fb326d03-5ae9-4af3-bdfb-e83f698c51f3", "comment": "Malware payload", "value": "dcca1a03b69e366727e7d62e1a7dda74cfc1432ac58ff58044c1422121d1ba914d3c537c4df4276c4d5acc616e7a0fc7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634925609, "uuid": "d644a2f8-dcd4-40b0-a7dc-af081c37716e", "value": "T107430A41A941CB13C1D32BFAE7DF476D7B2679548BEB33017B297EB4274279C1A29220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634925609, "uuid": "3a573c51-8299-48a8-8ae1-6ae95437002a", "value": "1536:23sU5zkb/fHwuZFoxxlCObQ57W1U6gpUVQHQf45XFr:8zkb3QqFGlCObQ5SUOVQHy45XFr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634925609, "uuid": "5453bf8e-47dd-4809-99c4-15e5ed4eb774", "value": 58883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634925609, "uuid": "236e323f-433e-4fb6-8a66-5019601bfc11", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634925609, "uuid": "ee7cc78f-2628-44bd-9231-0925a3210450", "value": "Fate.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "350f2995-332d-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634902979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634902979, "uuid": "ae552720-dc53-4cbe-a3e3-d82f6b3f29d4", "comment": "Malware payload (Gafgyt)", "value": "078c0413d03e3f405c0822d565a70d0d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634902979, "uuid": "28213a0c-7560-47f5-be8b-9bf9448a825d", "comment": "Malware payload (Gafgyt)", "value": "7cadae50f53815c427d8920b5c13a35e58e15206ec475fa3cce15cf97edb13f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634902979, "uuid": "41b9d9d6-ffee-49e2-b405-d4dec3ddf0a3", "comment": "Malware payload (Gafgyt)", "value": "dc7554339b65c7d35bac9266f20b9a791e67ad18", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634902979, "uuid": "5e6bf9df-2088-480e-9230-eb1036f9a153", "comment": "Malware payload (Gafgyt)", "value": "d5b73191715ba0e9bbfe6596c05d3a905c02557709146e80027839e0b2933877a9bf71706e2c2e5a7c96773488f3d234", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634902979, "uuid": "2634c57f-eeb2-4297-8206-7e0286f36ac6", "value": "T123B3D86A7921AFFEE06883310BF7AF20C7D521D626915386F15CE7585E3128D2C5FBA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634902979, "uuid": "916d5373-47c2-4d35-aab0-6504681a038d", "value": "3072:C/4g3Kd1rD5hZmxgA9OKdwwjF9GhsR1Ae:O9anD5hZLHKdwwjF9GhsR1Ae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634902979, "uuid": "bf10ede8-eb21-4991-a6a5-635b5a246ee3", "value": 116503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634902979, "uuid": "cbc0796c-8ce5-43e0-8e81-1df579133eae", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634902979, "uuid": "8588342f-774c-4f3c-b56f-c25bde6e4d8a", "value": "078c0413d03e3f405c0822d565a70d0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "795965db-330c-11ec-843c-42010a9c0014", "comment": "Malware payload (CobaltStrike)", "timestamp": 1634888921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888921, "uuid": "dcba6a61-5394-4113-b929-0a88a304cc2d", "comment": "Malware payload (CobaltStrike)", "value": "cd9759458569109a01572d9c25626ea7", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888921, "uuid": "62da72b5-3a81-4c8c-a583-f0cdb39757fe", "comment": "Malware payload (CobaltStrike)", "value": "7cd70b5e3a4e9faba7aee9b0a0784d61ed804096f834c773e8357efcdc8be966", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888921, "uuid": "57d92ffd-b154-4b94-ab45-729c73a9f915", "comment": "Malware payload (CobaltStrike)", "value": "1359bed9249437c5032496f5a4559490a53fd16a", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888921, "uuid": "23c7786c-ee81-4b88-a96d-2fe0ab66d6e9", "comment": "Malware payload (CobaltStrike)", "value": "6249a0118d6ead9564ca090aeec218ac970a3c88a10c328bfcd38d6da84a4f632f065961cefe79afc3ed6fc263a33790", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888921, "uuid": "69c4ef65-6d86-4045-96c9-c2aa2811df28", "value": "T181952916B8E30ABAC57EF130855293617A317C6947323BD72F90AA6A1A75FD42F3D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888921, "uuid": "ea1e64f1-717f-4ec8-bee6-e6abacc4da57", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888921, "uuid": "0229973a-0435-4f58-bd49-202d9e933d7d", "value": "24576:hYlJXepOovecoTdgmyw05H1lJplibEUNxFlbE1R:WXexvec0QwEHJybE8vbE1R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634888921, "uuid": "c0790c2c-4476-4374-9344-f10e4cf7a2dd", "value": 1947824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634888921, "uuid": "78b3b034-ba7f-4c0d-9426-09e373d3b48d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888921, "uuid": "56f16b60-6ad4-4557-806d-8cf3780586f0", "value": "7cd70b5e3a4e9faba7aee9b0a0784d61ed804096f834c773e8357efcdc8be966", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "898dd122-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928032, "uuid": "2e463943-1ec0-42a8-94f3-c37c39f2a936", "comment": "Malware payload (RedLineStealer)", "value": "1bf34a0acc6d16c8df54781180aba753", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928032, "uuid": "5c8ac53f-2ba5-4780-9e89-398374214556", "comment": "Malware payload (RedLineStealer)", "value": "7d46db522dde40d8dfd8429e4460a9221027b1de6c88c3d0d0f7133a42214a23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928032, "uuid": "814fb765-623d-4d7a-8f27-50a058f4117b", "comment": "Malware payload (RedLineStealer)", "value": "683e93b36ee0ba1661a5024e336c1d2cfa7898d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928032, "uuid": "83a41f14-1fad-4f4d-bfd0-6827ff62830f", "comment": "Malware payload (RedLineStealer)", "value": "dbd0f76f813d51d9ca5142d2c9f0a8bc5be2883a7907e34a5da38b2cb2cf5d662a5e8e384e32957680ddfa604cd24ff6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928032, "uuid": "534fd529-b60b-4f2f-965e-879671ceff09", "value": "T1AAE4F110AB90D034F5F323F8457A976CB92E7EA26B2554CB12E566EE47746E0EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928032, "uuid": "fe9a5d95-3d2b-47b2-8d87-090a58acf57c", "value": "25e96726029c322936cf0033b6a07058", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928032, "uuid": "11ca7f0d-022c-4192-aeed-6c5a7385d81f", "value": "12288:cwLACP4jzo/hok6G8eZy66BkKW4lmrJ3SrOp6W6X1zRoKO57l+:ZXoz1k6GU7plwNALX11e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928032, "uuid": "29fcc48b-e83a-410f-8e0a-3685465723b6", "value": 669184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928032, "uuid": "e41f6c90-426e-4704-a9f9-6faca84c9598", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928032, "uuid": "682439a1-4f0c-44ad-9a0f-33484ce8f0f2", "value": "1bf34a0acc6d16c8df54781180aba753.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c44e887-332c-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634902669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634902669, "uuid": "baf24cc0-973d-41e1-aebc-4585fdb5c0e6", "comment": "Malware payload (Gafgyt)", "value": "b0968b6d23ba0efae43bc532e308b73e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634902669, "uuid": "8f60f66e-2146-4e32-aaa1-868a554db1c1", "comment": "Malware payload (Gafgyt)", "value": "7d5c277b8cae71753366efd255f3196c3c5fb8191164a4aecb529b26f5cd4072", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634902669, "uuid": "03e3eae9-bd41-4356-9db6-f2b70095b341", "comment": "Malware payload (Gafgyt)", "value": "245ab156697730e1aaa87906d229d078edb4f65f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634902669, "uuid": "04612842-a136-4f33-b869-43dfa6cb7b4b", "comment": "Malware payload (Gafgyt)", "value": "7708e927af011819d78fc80b82436f7b4f281ff1f2df7d99ee80e236ae15bf131885d88a74e87a12213a1f69dc50fb4b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634902669, "uuid": "917b2be6-6717-4e1f-ba5f-a9a3114a62b7", "value": "T144933B07B71C4F43C1DB59F029BB2BF15769B9E112A36181B91BAEC05B33A781523F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634902669, "uuid": "dd377172-8c46-4b73-b184-20c227fa1725", "value": "1536:T3oCu/OcwUBvPsTbwHH3P6zMSIHsiO6aRv/lz5m5hLg6wOFO6V6qDjjofSee:T43/qUBvPs6X03IHsi2/S5hL7wOFO6Vt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634902669, "uuid": "56172c9a-bad7-44a4-8acd-1a0afcba3869", "value": 92720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634902669, "uuid": "8dd40f60-f1fe-4747-b570-22f9ebb2c960", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634902669, "uuid": "c2c2e08c-e462-438f-a2f8-5aabbbbe8d62", "value": "b0968b6d23ba0efae43bc532e308b73e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "441ac8bb-32e8-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634873369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634873369, "uuid": "aa9f4df2-fe3f-43e0-a2f3-f686884ece73", "comment": "Malware payload (Mirai)", "value": "76cf26c46b34648c074f960d8124165f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634873369, "uuid": "2e116dc2-7270-4ddd-8b70-d5e48d20be99", "comment": "Malware payload (Mirai)", "value": "7d6aa9d61f8144a96fdf56dbc11de5a4df9d00ee8e7b41abfc384d2d395b9d09", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634873369, "uuid": "cfaf9659-0ace-4567-852e-c860a14c7dde", "comment": "Malware payload (Mirai)", "value": "6b14d640f82767acb2608354fe58c81a2dc44aa3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634873369, "uuid": "0eab2c5a-a245-41da-92e2-f42c2d5afacb", "comment": "Malware payload (Mirai)", "value": "b36e7cc4f4be85af8e416992ec3be9eb9c0c2e0c45cd0ae2ad4fe898b5d70f8ba5dce3413ee425a9e1ee9cb0589dd9e3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634873369, "uuid": "9d6ba897-07c1-43b5-ae86-1c7277e9205c", "value": "T185239DF3C41DEDD8C54902797A284E3D5723E50086271EFB5E9A86A59007EECF60A7F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634873369, "uuid": "035f1912-5de9-4e71-b5c2-27ca96558b7e", "value": "768:Ma1/hnrsPxgOH59EEvc9NhG/BJLtsqFaANjq/CboO+O4ICnI:Ma1/tsFZ/c9NhA4yOzOgICn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634873369, "uuid": "465f039d-f502-41a8-958f-38b061c9fc68", "value": 47216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634873369, "uuid": "ac572b6a-5791-4d36-abbd-8b3fd1147e11", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634873369, "uuid": "99975e39-3352-43a0-828d-4c27b2ca3364", "value": "76cf26c46b34648c074f960d8124165f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ea45ce2-3332-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1634905250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634905250, "uuid": "e4bc4c10-443a-4d2b-bc32-31be6764f1f6", "comment": "Malware payload (ArkeiStealer)", "value": "815e2318a44c4b92c836992683f7d5d6", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634905250, "uuid": "1b2f0f12-146c-4f44-9029-b045f698cb82", "comment": "Malware payload (ArkeiStealer)", "value": "7e32246b94f18bb427c454fcaba418783da308469ce7901142e5344107d36a15", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634905250, "uuid": "145ce0cd-380c-415c-b8df-8ee61d0e5ebd", "comment": "Malware payload (ArkeiStealer)", "value": "de02db5e13886e8c834cbb9df91567a3c2758a31", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634905250, "uuid": "54ef5634-e939-4ddd-8f54-a2a1ca6dd3b3", "comment": "Malware payload (ArkeiStealer)", "value": "49f4931af36273d076be372bc26d11a562d45e195d2b0a659adf684bcec9d747832fc97537f91ff8cbdf8dd7d413bde8", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634905250, "uuid": "3379c58f-3067-4be6-8a05-371438793f63", "value": "T129549E10ABA0C035F5F316F84ABA93ACA92E7EA16B3554CF52D516EE47346E0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634905250, "uuid": "6c38d581-99c5-4ff6-9b0a-06828c86d239", "value": "0aa8675e96bbc2351e2af940f447c93e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634905250, "uuid": "e3ee5394-714b-447b-b0f8-416b4ced22c1", "value": "6144:xnLNmN0GRzcklSKEAN2GnC1v4bvNLMFbBNAx0uglH01sESP:pLNmNlcTS6vev10NsxglH0GES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634905250, "uuid": "597ea315-690f-4cc5-912f-fc07944380a7", "value": 291840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634905250, "uuid": "9d577aed-08fb-4a3d-8772-70a228c5dddf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634905250, "uuid": "a76e42c2-4140-4e58-a335-d4d0c80b00cf", "value": "815e2318a44c4b92c836992683f7d5d6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcb571d8-3314-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634892523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634892523, "uuid": "ea7c6eea-b601-4b7b-b595-609a36f9e1bb", "comment": "Malware payload", "value": "d952c66ccf5cdff430b9eda595b3c1ed", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634892523, "uuid": "64b569ff-5bce-4380-8242-9df95e0e6137", "comment": "Malware payload", "value": "7ea071f8bcd58102f05faacc93da83b7acc06ae07108ef096f2ed7d643828d31", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634892523, "uuid": "111b5fd0-3ff2-4a5a-95eb-57daa6a3330f", "comment": "Malware payload", "value": "60f2efee669ff15ffc5837b55c61d70151f705b0", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634892523, "uuid": "6ec5a302-2f35-4de5-935f-7d45c0031b02", "comment": "Malware payload", "value": "86a0db12810b456310932ab3e016600e9953d64bfc8e221abb71e6bd254cbb0a2cf2025493a465472445962f5fdfdb81", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634892523, "uuid": "582c167f-df02-43b1-895c-c338202dcdb2", "value": "T15EB31206C318F4B2C7E3456621963770027CAC10B0F5F7766FCA1B587FDB198296EA9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634892523, "uuid": "05b4d557-fd1e-4c17-8c27-8fd6e20db01d", "value": "3072:nah3z+ieG/ztsb3kAJ4F7wymdi8SNcyn2dHTkAb:a5zYIztsb3S7evSdnEr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634892523, "uuid": "1436d2ca-80b7-453d-ace1-7080185da06f", "value": 114580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634892523, "uuid": "a58dc82c-8807-4397-b060-ae61a43caa2c", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634892523, "uuid": "67723ab7-3032-466f-8229-3c7a41b443ef", "value": "Proforma Invoice.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "930a9439-3355-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634920317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634920317, "uuid": "dec80b80-60a5-4902-a3a7-21209109d7f4", "comment": "Malware payload", "value": "f92bfb22e0814e398dcf919e2314a6d6", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634920317, "uuid": "ffb7514d-5590-48fd-acae-a03064517c63", "comment": "Malware payload", "value": "7ebba471a6add5db375fbda0f662bb041059a205cc0530df642bf1450b64a029", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634920317, "uuid": "b0c57520-c893-496b-aab5-d2a49a5b95d2", "comment": "Malware payload", "value": "e0070cf6f4b27f271dd38efd9f58d5f78d587dd8", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634920317, "uuid": "9b1c7cb2-81e2-46c2-b7b4-bea4626c0e0c", "comment": "Malware payload", "value": "a05aff6d537e7ff8226ade8e4040f76f7b6e9248ba3cc56396aa1dd2564832284bc33f19c0ffd61599cdf7fb93e08804", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634920317, "uuid": "23061707-5b63-4686-b9b5-bc729bcfe1b4", "value": "T177459F23F2C08437D1B32A798D5B73A99C39BD146D28684F7BE41D4C5F3A6807A662C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634920317, "uuid": "b7e88834-6f23-42c5-86e3-ca2025ec29f8", "value": "24576:TuxP5B0LmA5qPW5AsiT7/aBls3/NiAjajtlGtAgr9TU+UT+e5GY8ASA:TuxP5pAMHHOls3Vi5gBTPUTpGY83A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634920317, "uuid": "cfe22b06-c7ed-44bc-be6a-dd79812c713d", "value": 1266176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634920317, "uuid": "f47090da-1080-4d24-86f3-061f81d0d1d7", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634920317, "uuid": "99fd70c6-ae22-4260-acf3-5a39941d852c", "value": "Pedido22102021.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40ab23fe-3355-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634920179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634920179, "uuid": "aa560f37-c7ad-4144-ae2a-b7f4708113e6", "comment": "Malware payload (SnakeKeylogger)", "value": "c368da96b56b5584411d55c00c55a4b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634920179, "uuid": "e7629005-3a0e-4583-a946-e43997672f4a", "comment": "Malware payload (SnakeKeylogger)", "value": "7fab4484ff1eba1d0ee9048c96a4daf0f8441c230bd6cf2f569c4bf775e8ccfe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634920179, "uuid": "7c9fb1b6-427e-400a-9e21-9b6586291d36", "comment": "Malware payload (SnakeKeylogger)", "value": "ea04d8d13b0b2ab75607767ff283a1b67f773aea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634920179, "uuid": "9b4918ec-100f-4705-9808-a15bd1ea0957", "comment": "Malware payload (SnakeKeylogger)", "value": "59e3db876d71bc8b75784f7a52c2ef3a0786234d9497b05ace4c7c5fc621a501dee8854491d47c619e28b6452d94b8f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634920179, "uuid": "a438bd94-621c-4eab-9a47-0e674942a15f", "value": "T1FB35FECDB6C39B2BDE8C697049414B0076122FC6915AB9A1F79B3ADBD33F9906D0C748", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634920179, "uuid": "173af0fe-b075-44e5-a3f6-68f3d9732349", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634920179, "uuid": "2bf7d6b3-8743-4b98-833a-a7413de68210", "value": "12288:YSTgeyhP7VWYgnTQbpqrEgi5gl6iEC/MHmg789IW1dXg:nMhUVnkbpqrEgi53C/MHmg789IW1dXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634920179, "uuid": "68c91699-cc9f-40e3-8047-6fb62b178616", "value": 1072640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634920179, "uuid": "a30838e0-7779-4536-b338-a42ee4b610cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634920179, "uuid": "a77177a9-0851-4e47-b44a-8e7214e699df", "value": "A87gmDqdYqpHVq5d12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07ac98c9-32cd-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634861672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634861672, "uuid": "32d8d8f7-3631-4d72-a787-03e43913c7a7", "comment": "Malware payload", "value": "6ac5e900c2c60346ba401e014345d7f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634861672, "uuid": "dbbcb776-82cb-4ea9-84fd-596ce1d3d8e9", "comment": "Malware payload", "value": "81ac71909750b1ba2225c173ea99f56d6e237aeb70b45212ac757e265c25ea6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634861672, "uuid": "578e075c-7d2a-491a-873c-898dd735124b", "comment": "Malware payload", "value": "616a611d59cc5d443991303e26136e0a44926ff5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634861672, "uuid": "68a3a1d7-b81e-40f6-8f0f-b907fc331ce2", "comment": "Malware payload", "value": "387bf1a5ad557615a584390efc0e812760e0068594fa65165c7a345f5a785a59679a76665e42d02d8e1efd4a41f8c2e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634861672, "uuid": "87acba26-d145-49ee-894e-189359870f73", "value": "T120963319A3840CDDE0F60130A6708535E13BFC724344D5572BAC9A67AFB36E9ADB6F90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634861672, "uuid": "0729befd-fd85-4657-af50-33238175a355", "value": "2cdcfb3a828433ba76b5b41f45519bd9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634861672, "uuid": "5082b0d1-38de-4d37-8243-9d2270bbf8b9", "value": "196608:ySHx7ww7ICteEroXxsfVfEqlbkkwR7VTEJZ3OcmjQ9/DLDxbDw64g:1LInEroXafEqirRRoJZ3On+/DLlj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634861672, "uuid": "9aae95be-ed6f-45e1-8a53-82d43a84d085", "value": 8810872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634861672, "uuid": "e862e554-823c-4351-a2b3-832536ba11e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634861672, "uuid": "2f7b93b1-1c54-495c-a7a6-80b09c00731f", "value": "DEEM Nuker.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a2118f8-330c-11ec-843c-42010a9c0014", "comment": "Malware payload (CobaltStrike)", "timestamp": 1634888949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888949, "uuid": "ba3f88cf-7c0d-45b7-be63-1cbb9068e702", "comment": "Malware payload (CobaltStrike)", "value": "4267c01715ab404a05cff5d65f889fbb", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888949, "uuid": "8aedc378-48e5-4d0a-b3bd-dd0d42a49943", "comment": "Malware payload (CobaltStrike)", "value": "8232f63ec9d5569b492e04eba453162076fd79ab634dca162faa664a1a75d3ad", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888949, "uuid": "5b83c365-b7ff-4e6e-a87f-e300e76e5a58", "comment": "Malware payload (CobaltStrike)", "value": "780fadcf9b4ea69cce6884e15e60f6fdf185d1b9", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888949, "uuid": "bf7c16be-547f-4c0a-80bf-b1ce65cb1880", "comment": "Malware payload (CobaltStrike)", "value": "2d904d5fd61c4d296ec6e18c00a9acb48e7388f250465cc03f4cad648d4b94c5128b254a66e388bc067e695d6c673d17", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888949, "uuid": "fb32fcd7-6ee3-4968-b9f0-7cf37d2d3bf2", "value": "T149854A57BC9050B9D0AAC230CA7582D17731B8550B3363DB2F91A6BA2F72BD81F78358", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888949, "uuid": "9dd99520-0fe1-4d67-a17a-70f8e015723e", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888949, "uuid": "18205194-6c37-47f3-a5a5-135d281dc77e", "value": "49152:hR6OGFrb/TavO90dL3BmAFd4A64nsfJQCLPH/gvxRSKb1e:hRsUq8Rc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634888949, "uuid": "d0c94dbf-94f3-4a6d-9141-f344179c642c", "value": 1747632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634888949, "uuid": "acf2239c-c8df-40fe-ae8e-a65f5ab374b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888949, "uuid": "e2656e81-99a5-4919-94d7-f0349448bfdf", "value": "8232f63ec9d5569b492e04eba453162076fd79ab634dca162faa664a1a75d3ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02a379e0-3368-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1634928235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928235, "uuid": "da8fcb28-02a7-4eb3-9976-0b20f6cb9019", "comment": "Malware payload (RaccoonStealer)", "value": "51338c55b880e26c6b89c62323f4db10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928235, "uuid": "5efdb636-4daa-48de-bc83-b379df1a2199", "comment": "Malware payload (RaccoonStealer)", "value": "8309bf94b5d9d975a7de27600867794f60c9008763fc208208cbb8d9f90b05fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928235, "uuid": "e7a9829b-0bd5-4a8c-9377-39f6fdc9078c", "comment": "Malware payload (RaccoonStealer)", "value": "39e85ffa395c61d83a7b03713ec67e3656dd6c87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928235, "uuid": "5dfc50b6-30f0-4eda-889f-d67a3dac60cf", "comment": "Malware payload (RaccoonStealer)", "value": "d8272438b4d60e4006e76fc286c635120dc72479859741bd3bc4c046ff914874ec92361b1039535e44942639cdd10994", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928235, "uuid": "1fcafba4-032f-4033-9a45-a60b5663f0da", "value": "T1B8746C10B6A0C039F5B312F44ABA9368A52E7EE16B2450CF53D52AEE57356E1FC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928235, "uuid": "a4ac3743-702d-4ce8-96bd-c2c97c55fc98", "value": "85b11e7df91b461ff7ceddce26982802", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928235, "uuid": "003887f8-8563-4b8b-a8cc-1273475dfbec", "value": "6144:BUry+V6gudaMW6uLHw9AHcjKGKVr6x+etD6hFvpNlvKVrfcFi5abSJ:BMyvgusMNuk9A19NK+SD6hFxuVr0Fxe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928235, "uuid": "b4181327-dcda-4e0f-bad3-df6cdd5533bf", "value": 352256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928235, "uuid": "c7976a72-0dea-4268-9692-778b5f6fe5a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928235, "uuid": "24b30b23-1195-4f67-9302-bd472304dc68", "value": "51338c55b880e26c6b89c62323f4db10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80c9042b-330c-11ec-843c-42010a9c0014", "comment": "Malware payload (CobaltStrike)", "timestamp": 1634888933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888933, "uuid": "70b6e669-c36a-49b8-9b82-0e7c6f5ea3e6", "comment": "Malware payload (CobaltStrike)", "value": "1d7fa8815a5b11435b9aa0a851cfeeb2", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888933, "uuid": "026e313d-532f-4629-9fd0-baa5613a10ff", "comment": "Malware payload (CobaltStrike)", "value": "83f06213409abbf39756e856aea050e2b7b40b0c488ac6b966b15cbb2ec1e5fc", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888933, "uuid": "2f296b06-65f7-4c4d-8f24-4f3e51d044b3", "comment": "Malware payload (CobaltStrike)", "value": "4bb3d31b1f49abd55f23c996be157cabb39771b9", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888933, "uuid": "4065b778-6a4e-4dc0-82dd-a2e54237890a", "comment": "Malware payload (CobaltStrike)", "value": "29925874a903a1041e25e5f0a5ef26a101674a9af1498dadb6dc9c09c3c92ceb885c5e49e646ada541f028de91fc1daf", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888933, "uuid": "4087bfd9-2d28-4aed-8dad-b5bd550ac94a", "value": "T15E854B57BC9150F9C0EAC2348B66C6917A317899073323DB2F50AAB61F72BD45F783A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888933, "uuid": "62a60df9-bbd5-4900-bf7e-6610fa2fd953", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888933, "uuid": "6ce81a58-dcbd-4b38-95d4-e74da7b0b380", "value": "49152:7yF+N5Mrb/T7vO90dL3BmAFd4A64nsfJGeIg9H5g+/HSxb1C:WFWKpg5HH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634888933, "uuid": "41bfe4cb-d480-4640-ae60-7049d0294c7e", "value": 1757872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634888933, "uuid": "e67242e3-e99c-481d-8c7f-caeb100adbef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888933, "uuid": "d1000e36-c745-44b7-83e1-8f5b12b1e071", "value": "83f06213409abbf39756e856aea050e2b7b40b0c488ac6b966b15cbb2ec1e5fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7145567-330a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634888192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888192, "uuid": "9e444498-5b3e-4814-847f-4b32baf677ac", "comment": "Malware payload", "value": "91751813a323fa60dda186c02663aa02", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888192, "uuid": "0b8a2498-6a18-4571-805a-f2469317155c", "comment": "Malware payload", "value": "84b06a7712e90b0ddd4b1375f49882c9e384195a04325bb275708185a56adf75", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888192, "uuid": "e4604096-e857-4304-9a72-64eb26cbfdc0", "comment": "Malware payload", "value": "445e9518fd01bb1fa7fdee0f917cdd3b74dd16af", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888192, "uuid": "1593a327-7a76-4a89-ae4a-ed1bc61e7237", "comment": "Malware payload", "value": "98a3475e1b490821a6f2ea38f4de4c1dbc1884ee4592316c2e2cd0d490f61cf42465f9ae9ab512b7f6fb2623301cc3f1", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888192, "uuid": "5fc351a4-ecf5-4858-bad6-8432b46bef61", "value": "T1FF8633EFC1D540D0B89F567C5DD0BBDE1CF9AA233B8321D2805D72AB5449825E2C2DAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888192, "uuid": "e51334b6-a625-4742-a2b6-1ae1b32e7b3f", "value": "196608:Nb0B6FNW3zn0rFBKoc/PsX0GmQzCKh3tbghd1zaHB:No4WQrTKZ/TG9ltclaHB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634888192, "uuid": "0bfc7329-cc24-4e74-936a-c18273ec5f6c", "value": 8511956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634888192, "uuid": "861fdfd8-0194-4ce9-9651-72278bce4342", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888192, "uuid": "b8c2add4-9519-447b-bdc1-6267122e561d", "value": "SeraphNuker.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80022e08-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928016, "uuid": "1598e105-1a38-4f06-8ecd-fdcdc61a6188", "comment": "Malware payload (RedLineStealer)", "value": "86ac1786ec128539c8232ebdae87eef9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928016, "uuid": "0db4684d-4f3d-43e7-bf76-762162d5d66b", "comment": "Malware payload (RedLineStealer)", "value": "84d735d199535d1cf5c38355e3698c3855405823c8b6fc3d7e0c8d21a9b9ae91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928016, "uuid": "5b19b237-16fb-4a97-ad68-6cddfec26eaa", "comment": "Malware payload (RedLineStealer)", "value": "8f6da9dd43d35f317332ea8906891d3df5520734", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928016, "uuid": "6e0389c3-2321-4723-9436-193f6fb45361", "comment": "Malware payload (RedLineStealer)", "value": "fe9910f3f4f069a61648588f4f640a0010b674bd489442a65f401541df598ec40944b90b4d8b47f8098fc346174444f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928016, "uuid": "689083cf-bad4-450c-bd8d-55cf1bb59ac4", "value": "T128458A2D267DF4BAE4A0567712A0F7F30CF698F9D8908332AD559152ED7A4E62C3C432", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928016, "uuid": "89d345b7-7687-4c7d-bd72-76fa6d71b897", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928016, "uuid": "16e460e3-fc6b-4a7b-af1d-86c02bd12b63", "value": "24576:wDHGVCN2dNdTYf7hRGBDxlBpBU45g1LjC1gkn3RDqk:wDHqzuf7mBDVpBKjC1z3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928016, "uuid": "fa0aeb02-f9a5-4eba-a2e5-4841cb7ead02", "value": 1184200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928016, "uuid": "fc89d902-020a-4776-9a07-1143986abb46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928016, "uuid": "a58676bc-04fe-46ef-bf23-8511aca08363", "value": "86ac1786ec128539c8232ebdae87eef9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3b0317c-330f-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1634890307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634890307, "uuid": "28b7774f-8f3f-4979-89f4-52fa35f46f1e", "comment": "Malware payload (RemcosRAT)", "value": "b36937c3fefcd1df032ac2900df91e9e", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634890307, "uuid": "11f0b1d4-6468-4258-8597-7a4da075026d", "comment": "Malware payload (RemcosRAT)", "value": "850e7fa559e58fcb57b7cd78f297ce077f1ecf6dd25d62ffccdbb00dbce86bfd", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634890307, "uuid": "ffd033c9-a4f4-4574-bb7d-1e01661c4a24", "comment": "Malware payload (RemcosRAT)", "value": "bb494c6af0b07691596b0d08b2826a88d790349c", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634890307, "uuid": "dee26799-292a-4b2d-a1e6-e95157c59c04", "comment": "Malware payload (RemcosRAT)", "value": "d02fa52933b2101769fb09741bb535cbd4bf14d5c29812b1f688a4a0811dd14c5a9cc7c0cdaee9ac68aac72bd8b248ff", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634890307, "uuid": "fdcf79dc-0abd-4f21-a1c2-1eee0747ffcc", "value": "T162E4AC3872F0A352C935423267E2D1789AE11FACEDE2C306E2B42D95B341DD93E8955F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634890307, "uuid": "b7cc994f-3855-484b-ac5f-fea31fc70499", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634890307, "uuid": "0e66a36c-8572-4d8c-82fa-bc53f51f3a6f", "value": "12288:ptnlaPwq8HRQoWR87YSdEEYunKDLnWFcyCcPMweE9:PAKHyoWR87YSGWKXccDcPf9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634890307, "uuid": "4b6efc42-2ab8-4f46-aa4f-99bc50e02b86", "value": 678637, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634890307, "uuid": "e4b0f2b3-7996-41ee-9e47-744e7e7def16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634890307, "uuid": "5ddf215c-d79f-4141-8a51-08c7ea65f250", "value": "DHL_119040 receipt document,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03f883da-330d-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634889153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889153, "uuid": "da9a410f-cbcb-4b92-b972-c3ec4c27382d", "comment": "Malware payload (SnakeKeylogger)", "value": "3059cf89548babd7f883f6669403711b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889153, "uuid": "13976f87-8d44-4a71-9a50-50ba96914c2c", "comment": "Malware payload (SnakeKeylogger)", "value": "853384b95098ae2591328fad181230b71e49dc55935af66056d6e505500ab8fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889153, "uuid": "2804cb32-d0bb-475e-b4dc-9071ec93953a", "comment": "Malware payload (SnakeKeylogger)", "value": "7c97d773f230f63eb7669370611986cd5c92f03a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889153, "uuid": "2adecb0b-7db0-4196-9c8e-78f890c3c500", "comment": "Malware payload (SnakeKeylogger)", "value": "5439793e9dee15a6a584a4bffd22221d22fc3a959b5b60b3d12d43512eede5fa50d9c6dfb331b75b7cd11bd8108bed8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889153, "uuid": "1fc7d1fe-f15d-414e-bf18-29845ecae131", "value": "T178A402B2F5D540BAD8598731953BEE3A6433AD3DD4B0584F226D732B7BB3293402A127", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889153, "uuid": "d4821ebb-5bd7-48ea-a1cb-687a7ca19986", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889153, "uuid": "2cf94817-ec39-4ded-9cac-1501f48ae3c6", "value": "12288:j4C8+ZqG3cAh/AT6yTMXgxyEl36ctAoikdgZ:rzcG3jh/ATryEl33yugZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634889153, "uuid": "5e0044b5-5023-4094-9960-cd7aa20bdd15", "value": 475339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634889153, "uuid": "708d3f73-696e-4226-9608-b84999a8b0d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889153, "uuid": "4a9b8dda-2dc1-452e-8b0d-20894338b090", "value": "20000090087890000-098.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02704470-330b-11ec-843c-42010a9c0014", "comment": "Malware payload (BazaLoader)", "timestamp": 1634888292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888292, "uuid": "1e88cf53-2156-4a67-b20b-4f0a307547c7", "comment": "Malware payload (BazaLoader)", "value": "68dcee34a097ea4b65dfb34e9752dc03", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888292, "uuid": "c7b8d147-eba1-48c2-b4f4-038223b3e183", "comment": "Malware payload (BazaLoader)", "value": "8569b09daf48398aceb8dc15b5105b51f675177176a0762dcb633d1245ccab25", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888292, "uuid": "f814a13a-61d4-4cc5-b092-c81405d0125d", "comment": "Malware payload (BazaLoader)", "value": "399b09123daf7151f9674255e4c5b9e1c389da0b", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888292, "uuid": "60895a3c-8463-469e-ae25-d1969c6c7889", "comment": "Malware payload (BazaLoader)", "value": "c90f6df6f4611a24bc8700ede51e8dfbf5f5fb6477d6312f1058f64cfa0bcf6b5adf2b458124c06d6c516b9ba1aaa359", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888292, "uuid": "ccbba30f-1411-4fda-87c7-62d04824a133", "value": "T1B376331CBF9985DA5537C058F45F8EA62FA3536C305362BEDB794C2AD90D0C1BB0A293", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888292, "uuid": "dd682a2f-9f9e-49a1-be12-8de3df64106b", "value": "196608:5STUD1FKyGTB5JZiFl+VT7xHMKNwyfJmmo3mESqfl+Sx:UTemZYMTJMK5mL3mEfr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634888292, "uuid": "1b857189-c768-4872-9c9e-4b470411787b", "value": 7778362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634888292, "uuid": "729d2c3c-f2c4-4622-803b-84160a8bdef9", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888292, "uuid": "9eb8043b-ba58-4ad4-9aa4-0c0e6d206a0c", "value": "venom.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fe7557f-3377-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634934941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634934941, "uuid": "84def62b-78a1-44f9-a41c-6d232d09239e", "comment": "Malware payload (RedLineStealer)", "value": "59bd2fca527f56362d7b7ace29258e5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634934941, "uuid": "b93057c2-7223-4abe-b7d5-43a369cd5ca7", "comment": "Malware payload (RedLineStealer)", "value": "858d2384fe0e2ed91c2e2400e4f58435d59989a0e209747004a0e63f898ba483", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634934941, "uuid": "9a26c275-54b5-4e00-a265-63736717e3ad", "comment": "Malware payload (RedLineStealer)", "value": "f0a41b9cc62d571b4503922af174e8468d2a3e5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634934941, "uuid": "43b2f298-2900-4db6-ae37-1ef6d38a7abc", "comment": "Malware payload (RedLineStealer)", "value": "cbdc74e07e40a5cbac9e885996a1debab9190b07d05cfd6bd4b2aecf9817dfaa430599b5f2ac47ae06f0693cf3f15565", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634934941, "uuid": "f9e64687-ecd1-4716-a774-0e00442272c5", "value": "T142949E00A6A1C039F5F316F489BA9368B52E7BE15B2454CF63D42AED47356E1EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634934941, "uuid": "f74b4f63-7852-41a8-ac70-e2c05c941d94", "value": "bac67046644aa5e445c1272184462c49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634934941, "uuid": "2e1e629e-7a7b-4e1d-905f-ce349a562f02", "value": "12288:9m4q/GxSh+9Dc+Y16CbZtIjR1A08BqR5j:9bq/qtkzIjfA0eU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634934941, "uuid": "e4211f83-ab0f-4961-868f-baaa175c96a7", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634934941, "uuid": "ce946908-e44c-448e-9e70-6e7bfd0de3e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634934941, "uuid": "2b460130-6ea2-45fa-b466-e43af24f652c", "value": "59bd2fca527f56362d7b7ace29258e5b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bf0a0b2-330b-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634888388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888388, "uuid": "93107de6-5671-4338-9b85-df94a90aa422", "comment": "Malware payload (Loki)", "value": "a5ad00e076df522a7002ec00b4531bae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888388, "uuid": "772d5824-9f25-4a26-be43-0fcbe66a5f7b", "comment": "Malware payload (Loki)", "value": "86319581747b4164071c0364257eb113bcb5165ee6a8a92c19b0cbda54be46f9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888388, "uuid": "cfda23ac-202c-4b2e-a5c5-02ae5b5d1beb", "comment": "Malware payload (Loki)", "value": "4ef9bf3b45770b2ccc863165c35278bc2a546565", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888388, "uuid": "3ceee042-b2d4-4140-aad0-3127b380cb9c", "comment": "Malware payload (Loki)", "value": "65af1a01ae4a2de5e0b060e1ddc31a6146b69176a9be7a41ad47342845f01fda26fb3eb557a95b7ac35a789d702ae694", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888388, "uuid": "13eb387b-5e0a-4036-8b06-d72b7c4ca7df", "value": "T12C548D10AAA0C035F5F316F8597A93ACA93E7EA16B2454CF52D426EE57346E0FC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888388, "uuid": "04cbfc52-7602-44d9-af8c-2ada9c186901", "value": "0aa8675e96bbc2351e2af940f447c93e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888388, "uuid": "aea06b60-41cd-4215-86f7-356ee1296538", "value": "6144:3n6wx3KkSK6fxT0w37GMg0i6v9TCP86tUa0E6yBbvH3:36w5Kkd6ZTNlFdvdktLH6yBb/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634888388, "uuid": "c54f6925-7c5b-4f65-b09d-b6c83d2e5d36", "value": 291328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634888388, "uuid": "73635825-f99b-4f51-9d7e-4b679ef4c1f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888388, "uuid": "0fe1cf18-d717-49a3-b152-97f2a11c57bc", "value": "a5ad00e076df522a7002ec00b4531bae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f741543-3368-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928257, "uuid": "f661b463-ff1a-43ae-ba9f-fe32b0d4e71f", "comment": "Malware payload (RedLineStealer)", "value": "d08c7505d9deda3037398a2bddec6e49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928257, "uuid": "ec817fa6-1ea7-4b1d-b794-2eb4385114ea", "comment": "Malware payload (RedLineStealer)", "value": "8840d8c54b58cc29c57916919906a81fff6bca7bede7c6d5b08a363359ff3582", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928257, "uuid": "9e343282-dca8-4e6e-b847-1dea39101d36", "comment": "Malware payload (RedLineStealer)", "value": "c35417022f575351d7b634aaa297d2e456887a7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928257, "uuid": "4d3307e4-481a-4e4c-ab9d-a1113a6d2b32", "comment": "Malware payload (RedLineStealer)", "value": "e4dbefc2f11c959dc4dde010924291261cf0160215154ef0ddd7efe50d8e6c335ed1d78061fe928495485ebb1238c8c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928257, "uuid": "927ab63f-eea5-4218-b3bc-600da6a26470", "value": "T163A4AE00AA61C039F5B362F48ABA9368B52E7AE16B2050CF53D51BEE57355E1FC3134B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928257, "uuid": "bfdeaf5e-acb7-451f-ab1a-ed45028d914a", "value": "85b11e7df91b461ff7ceddce26982802", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928257, "uuid": "b2a5e68c-9217-45db-ab30-8fdc0dbf9819", "value": "12288:TSOyO8hAMF5B+y+576AtAc+YNjip8XjTYWbX:TrvSf+l5LlvjY8XP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928257, "uuid": "4644a97c-7c1c-4d9d-af33-f7a9792b7ffa", "value": 462848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928257, "uuid": "dfae1859-c1ce-42bd-8529-86514663fa82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928257, "uuid": "6168a31b-a38a-458a-a58d-d6b03e29f1e4", "value": "d08c7505d9deda3037398a2bddec6e49.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d078211-3367-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634928038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928038, "uuid": "d494a55d-42d7-4b22-a1f9-0b5fd40cb20e", "comment": "Malware payload", "value": "f28a036b6ada9440be66ab99d73054cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928038, "uuid": "dc463f0d-1083-4a12-aabe-fdc37a9ca5f4", "comment": "Malware payload", "value": "8867a5229762e4b01828f7295c0821f4acd8545acb7fc648b05b87da54754120", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928038, "uuid": "1bf82b5c-245f-45bf-bad7-e5cb50b923e8", "comment": "Malware payload", "value": "20ca118bfc987428812a7619f4c945c558599506", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928038, "uuid": "d14dda3c-9375-4a67-a99e-60558285f7f3", "comment": "Malware payload", "value": "b3e2610c2ac1d0d77cae088012515033fd8419681f21587219ae2895b00a63d82f4cbdd254366a1a8fa88ddf36bf1cc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928038, "uuid": "92814839-38d2-408c-8b49-b94a5253f68d", "value": "T18626026366644065D1E0CD3D8937BFE031FE1B2B8F40B4FA62DE26C91A225D1D7A3993", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928038, "uuid": "37937db3-d846-4cc3-a486-f112ceb443b3", "value": "908bea7ee71339f1c35ba419da3ba679", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928038, "uuid": "e68f1e2d-809d-4026-9848-d90b5a478077", "value": "98304:rL0U2LecdPtnMVzUU4E0d1elu2DctkzXn45wjhQ:LcdPtnMqeXWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928038, "uuid": "82e26f09-2a60-4243-896f-3850400582bd", "value": 4777472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928038, "uuid": "dc2d5f50-a3c3-40ea-befb-61bac35cdb18", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928038, "uuid": "0e3da9e3-0317-479d-8ff3-a72512f29d64", "value": "SWAP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "709060de-32ce-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634862277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634862277, "uuid": "2308e6a3-bfc7-4f76-a851-faad5947bd7f", "comment": "Malware payload (RedLineStealer)", "value": "a9477b3e21018b96fc5d2264d4016e65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634862277, "uuid": "6f5fa06b-7739-4895-aa85-50ed4b519da2", "comment": "Malware payload (RedLineStealer)", "value": "890fd59af3370e2ce12e0d11916d1ad4ee9b9c267c434347dbed11e9572e8645", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634862277, "uuid": "833fe586-9603-4ec1-af0e-d2a7f6d7b964", "comment": "Malware payload (RedLineStealer)", "value": "493fa8da8bf89ea773aeb282215f78219a5401b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634862277, "uuid": "cf89d7d2-9cbd-42e3-9e04-7d50617777f0", "comment": "Malware payload (RedLineStealer)", "value": "9ac2e79f19099341fab04d91fc95c19554f4b43c9424c96466cb5140e0470b015f95c3603381361775c0bdc0646a1a52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634862277, "uuid": "6e515112-5ac9-4e14-b702-0f06a894f86f", "value": "T107F512103625490EEE7641B42966858CC7722F271790D6AC3F8D3D8B7FF27F44621AAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634862277, "uuid": "ae4d3ea1-03a5-44f8-814c-b0b310f9cf8b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634862277, "uuid": "535083a7-12d9-4123-8ee5-49cba240807a", "value": "98304:5kjozJ9/im8XVBKl6t1buVfRhq+5tXzgCa/T:lzJpjS346t1bIfuq07", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634862277, "uuid": "c0416f7c-13e4-4735-8825-59495e52a003", "value": 3361280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634862277, "uuid": "03084227-fafd-414f-a2af-95d459c6c855", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634862277, "uuid": "0472bef8-31a9-4bb5-970d-296f14406d4b", "value": "Mercurial.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3edadbf1-331a-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634894835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634894835, "uuid": "eb61b9bd-5e6c-406b-ba46-e752f04b9a99", "comment": "Malware payload (Loki)", "value": "8449ee0cd73ae89d429ff7a6081fe0d9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634894835, "uuid": "4d5ccec8-3370-41a1-8b23-575fdfcabd4c", "comment": "Malware payload (Loki)", "value": "8948dee3a319253518fa5e411ef6dc99aaba30b078b10417bb823826a5d1c9a7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634894835, "uuid": "a9227749-5d1d-4d7b-aa88-c1bbd95346f3", "comment": "Malware payload (Loki)", "value": "ffbdfc866c6de504707549f5db6c1f070cf5ead7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634894835, "uuid": "f7b2c29a-6506-42d7-a39d-8c01199d7328", "comment": "Malware payload (Loki)", "value": "9610868b5294bce0048d888aa7974f7c85dd4174482cd4842d862a12937bb1e0089e312b9ce43f689a5ca2fea8a45b81", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634894835, "uuid": "00e0538f-fc22-4dc5-ab8b-bb4b751949af", "value": "T1D1946A0432B95B11D5FAABF01632490053BB7DAE2839E64E1DDE34CA1F77F448A61B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634894835, "uuid": "a4da9984-1aa3-457f-9ce2-53dc6b3ea50a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634894835, "uuid": "23f5622f-2f59-4ea4-904c-66c59268f7be", "value": "6144:fGxhLWR4Ie3veW1J/pVcHlqqiMRHwJK3WYuFsgEbq9KE8P:OyMeW15p8eJK3WhyPWc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634894835, "uuid": "755d3a2b-42a5-49bf-83d0-b14470174111", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634894835, "uuid": "010dd93a-bbe0-4e32-aa65-0b9ed9ac2c6b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634894835, "uuid": "2da1250f-bd4e-42ff-a750-489e2adc9b9e", "value": "8449ee0cd73ae89d429ff7a6081fe0d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98b29d60-330c-11ec-843c-42010a9c0014", "comment": "Malware payload (CobaltStrike)", "timestamp": 1634888973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888973, "uuid": "f2b641d3-3c0c-4f46-96a6-9f38148496e7", "comment": "Malware payload (CobaltStrike)", "value": "408d0913df1091a713e67db6321c73bf", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888973, "uuid": "a12c090f-974f-42c2-8f98-9dcfc9b2eb36", "comment": "Malware payload (CobaltStrike)", "value": "89cb65bfaf8e7cb59a35bca859df284488f1f2264a4845c3bfcf4f82b3c3fcdd", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888973, "uuid": "7240f052-7d1a-4140-b40e-58dbb18204c0", "comment": "Malware payload (CobaltStrike)", "value": "5893f3799c20d3b2042e7480abf5e9199915366e", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888973, "uuid": "11459f24-7cb2-4b52-ad8d-e0b4185276a5", "comment": "Malware payload (CobaltStrike)", "value": "ee4a7f11fbb03913dcc4181861f5e07639aa18b0d25476d4ca60e6fdd20cc6358318c464a6c849fc2d2650ac291ecec4", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888973, "uuid": "35e40927-4a78-48a0-b3da-2f1238e15bf7", "value": "T1DA953916B8D30ABAC57EF1308552936176727C6847323BD71E84AAAA1E75FD82F3D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888973, "uuid": "8cb13859-242a-4d24-bd02-f690bdb38054", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888973, "uuid": "a1f87004-d034-4161-949e-d3819a07d93f", "value": "24576:3AgMNiJpGUYVs6thcqQZqzDVKH+pIDzgZNbtUiBE1k:3MiJpGUv6th9QZiAHlQbtdBE1k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634888973, "uuid": "92899f2f-b9e5-4d27-a38a-df96abb89c51", "value": 1947792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634888973, "uuid": "d3d32c4c-d052-4063-af52-7f921298ab06", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888973, "uuid": "f07ab6c4-17f1-49e1-830c-03222c05fa17", "value": "89cb65bfaf8e7cb59a35bca859df284488f1f2264a4845c3bfcf4f82b3c3fcdd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "047f06bf-3368-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1634928238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928238, "uuid": "241e46e9-68cd-4191-b40c-86ecfe6e03a9", "comment": "Malware payload (RaccoonStealer)", "value": "344125656ea9ae92a0dd9738771d4502", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928238, "uuid": "1c70b36d-8c4e-4d87-b716-e8c675c43541", "comment": "Malware payload (RaccoonStealer)", "value": "8a529c4d939a4c2945ed6f545f70dd639fc9e42262971c98a2710dd9a1fcd5ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928238, "uuid": "81af3250-48c1-4351-8abc-eb469ccda1aa", "comment": "Malware payload (RaccoonStealer)", "value": "3c0aabd867110d01aeb285713424662cb3dd4bdb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928238, "uuid": "6e3363eb-4fe5-4e15-a0b3-83cde2a25062", "comment": "Malware payload (RaccoonStealer)", "value": "67bebda5efcb8f99d6d3d1bda8d7dc7461c25875c953915d75288d5eccca1ec8a5720621f8aded7a823561cdf37b42cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928238, "uuid": "e986504c-deb7-4c40-b033-fce3718b5bb2", "value": "T14B746D00B690C039F5F716F48ABA9368A52E7EE16B2450CF52D52AED4734AE1FC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928238, "uuid": "f6a37745-5986-4172-b489-7c22a2b7ce55", "value": "85b11e7df91b461ff7ceddce26982802", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928238, "uuid": "0c348a1c-bb70-4f2c-80f2-6b9ba05fca3e", "value": "6144:Da3ZFodwv3uyFXxiWGgkmvVoSvQVzD6gzHDNYXOz/fWgvCds:DqZFvv3uyFXxi9sS0QxD6gzjHz/ugb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928238, "uuid": "b29a294c-0c16-4f39-8e20-4791dd5d6b9e", "value": 351744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928238, "uuid": "f3fc9376-9850-4fc6-a245-a1213686fb5e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928238, "uuid": "7491762a-5236-4b00-9c7d-7b43fd080bfe", "value": "344125656ea9ae92a0dd9738771d4502.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b65dcfa-330c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634888924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888924, "uuid": "59ea0d9a-90c5-4cc2-bd1c-040d07ac7683", "comment": "Malware payload", "value": "4428d6a263ad7425655c933683dc4346", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888924, "uuid": "3acfc250-5b8c-4657-9018-7f6251713a07", "comment": "Malware payload", "value": "8a5fd251454e696125125f48b93d4d865729e68cc27abc988339e086cbecca51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888924, "uuid": "b6687a55-6830-4b87-9658-08f0b5d7f46e", "comment": "Malware payload", "value": "0f41d1ecb07c57bc51ad948d8431b9d40da3a056", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888924, "uuid": "4fc5b80c-2e85-4792-bc37-fa28b4f3a6df", "comment": "Malware payload", "value": "b9ee217dbbabcdeb7f0bb86db87e6c6bfbbad2c29a9298e8790317bbdd7b5d2e66d007cd236a2dab47b2b0eea7a2d2ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888924, "uuid": "fd9a6bc3-06fe-4079-8100-32f11eaaabf4", "value": "T13336E007BCA190B9C0E9C235C9669299773178C9033163DB3B54A6BA1F727D41EB937C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888924, "uuid": "b1fb0efb-f487-4769-864a-262c5980d6af", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888924, "uuid": "8e8d5499-1072-468c-ad99-3ba03ecc1dde", "value": "49152:5xkNUirb/TzvO90dL3BmAFd4A64nsfJczmHAJ5csxvrFfqoXUMv/STh9a1qxyFhB:5xR2rRWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634888924, "uuid": "04aa689c-a2ee-44dc-b7e6-7e7243fd7ba6", "value": 5171888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634888924, "uuid": "13f0f1c6-5104-4fa2-9d4c-75c406d0aa2d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888924, "uuid": "b40dcc07-f538-41c9-a418-6c965dd76e1a", "value": "8a5fd251454e696125125f48b93d4d865729e68cc27abc988339e086cbecca51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eccac80-332c-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634902674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634902674, "uuid": "4703902d-77b9-4c74-8347-d0bd86ff3a28", "comment": "Malware payload (Gafgyt)", "value": "3261955e948c332811b87b54d4d28603", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634902674, "uuid": "0be8a6c2-ee15-4b56-bc47-524c0b443905", "comment": "Malware payload (Gafgyt)", "value": "8a67d0a20f52f8b5913c588c4911eb1f4b337672589453853ae0c67779c33b36", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634902674, "uuid": "0a427de1-4818-4109-9e1a-0d8beb81e18c", "comment": "Malware payload (Gafgyt)", "value": "dcf3b49b8cd645a4582be6982d9dc31509175af8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634902674, "uuid": "abe4f58f-8f38-4cc2-aaef-e8d16b2ca8bb", "comment": "Malware payload (Gafgyt)", "value": "d04de0842fb9daa8919ed77653836aa7f4f52c28d92c5d01d982c0d6441f2e3fdfd02120e335aad727848d7b3152fbfb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634902674, "uuid": "320cf46e-e5bb-4452-845d-374782e816e9", "value": "T161A32A05F9118757C1C327B6F78F47493B3167B997DB33026A34BEB02BC27991A2AA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634902674, "uuid": "d3a7eaeb-e5c9-4ae5-8c1d-7e38e756e584", "value": "3072:7e9h9oZt5hvFfKufS2faYj0+rQ0Knm4XATe:y9wZt5hNfKfpYj0+rQ0Knm4XATe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634902674, "uuid": "3a5892d0-c3c6-4ba0-a8ea-e9ef9d716578", "value": 103862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634902674, "uuid": "9e2d36f5-0ee1-4fbd-9762-54ab1580cb5c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634902674, "uuid": "867c074d-fa39-41b5-a9c8-88abb8a2e5fa", "value": "3261955e948c332811b87b54d4d28603", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8b6171c-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928084, "uuid": "5e96f13d-c13e-42dd-8eae-fb04aa23c632", "comment": "Malware payload (RedLineStealer)", "value": "bcbac0f2d270fe819966ad355c692f52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928084, "uuid": "76a54ddd-2f38-4772-a8c6-a04229dc4eb3", "comment": "Malware payload (RedLineStealer)", "value": "8aa97f56125128481ed88169f59ae1a0f1928e8cb4c8a1ce9db7a3c2e754fabe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928084, "uuid": "f136220c-ecf8-4e01-8dea-9cefc94f86e9", "comment": "Malware payload (RedLineStealer)", "value": "7abc615e069e14b61ff010aca889b64bf6ada15a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928084, "uuid": "0dbdb263-ca3e-4fb1-ac58-d13665dbf957", "comment": "Malware payload (RedLineStealer)", "value": "ddcfa3768ca9e8cb280683d705baba01214bf8d70cd90a9cc9a284d68b31b566eac32ccdbcf372936474c72d6b2ab028", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928084, "uuid": "07568ff7-ae5a-4cbf-92c2-c1b3baaee53a", "value": "T181F4D000BA90C03AF5B716F44AB5936CB53EBAE16B6454CF52D51BFA46349E0EC3071B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928084, "uuid": "bab850bf-039b-4e06-934e-d5055198aecc", "value": "85b11e7df91b461ff7ceddce26982802", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928084, "uuid": "4f8f64f2-9fc5-4ecf-bd7e-ef01d88292f1", "value": "12288:UhMgBXVXJr0m2PdYZqRrnZ9N4tPplHHhWQx9fVxDH7JPhaJOiOAHxensTy92TEGt:Unrrv2PSg9atT5bJuRtTy2TEexIg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928084, "uuid": "2c0a3cdb-231c-4fa9-9209-313ac707efe3", "value": 730624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928084, "uuid": "0be574d1-a8c9-45a1-8bb6-0a2d4b039d1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928084, "uuid": "f336a90a-fc77-4162-b6c5-1e878e083624", "value": "bcbac0f2d270fe819966ad355c692f52.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "739a22e2-3368-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634928425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928425, "uuid": "04825779-5dbc-4b76-9985-7755e7c17c95", "comment": "Malware payload", "value": "7e7e20bac722de83b363c29ee7e4efbd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928425, "uuid": "2fefc92b-fd02-4179-ac15-5aeae9d52c69", "comment": "Malware payload", "value": "8b3a26ce1e5307340caa595352252ece853b99ba8c8343b3c95685355e41b743", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928425, "uuid": "ff5675a8-a0ab-4db6-afd5-437cc86b47c3", "comment": "Malware payload", "value": "eea0c64b196e290bdbbc68346fdbd9d95f346a0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928425, "uuid": "149acf8a-72c2-4b79-97f3-8a0aa96c83fd", "comment": "Malware payload", "value": "a16cae84dfbfa91bdf49ff8780ed2baf0cd401d98c9fc605138d91274b3bfc6cee8caae9281112c01c857d592cdb7583", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928425, "uuid": "5a03f87d-6940-4fc1-b0e9-6978d8c8938b", "value": "T127F5336F4AC43876CEB86B7013225E09725BBB1C12FFB489999B652774098B7337C325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928425, "uuid": "1eac584c-1d46-4a3d-8130-7d45a268de8b", "value": "106f3d3e521ab0377bf478b03f3dd87b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928425, "uuid": "83ed62e7-8828-41f5-b128-d76cf77a8082", "value": "98304:axBI1GBZQQV/5V+rEKGfebNJGWDKpigYwhAhrF:qB4GB+u/H+rEKGfeGsKpv7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928425, "uuid": "4f93cd1d-6980-4eaf-8f92-724f2cb0212e", "value": 3574784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928425, "uuid": "3c899a1a-af44-4b50-a563-2ca5061d9550", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928425, "uuid": "3cc8c1d5-c48e-4f9c-91b9-34cba03219a6", "value": "7e7e20bac722de83b363c29ee7e4efbd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b02cbcef-3300-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634883859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634883859, "uuid": "51063de1-2765-4f36-a84e-7c11d86c09e9", "comment": "Malware payload (SnakeKeylogger)", "value": "b31b5c207c40b7f5a343125fe4f08e8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634883859, "uuid": "f07a62e5-64ff-46f7-b5c4-95451649a4fb", "comment": "Malware payload (SnakeKeylogger)", "value": "8b663cda7b9c7a5c80be11f639e4c6fd3b458371847d7ad5ecab085d036983ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634883859, "uuid": "1d3687d8-9eb1-4990-b497-a9aa79940022", "comment": "Malware payload (SnakeKeylogger)", "value": "027082190be834bfb69efcb0ac43bb8e9940facb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634883859, "uuid": "83f29be1-65d7-440c-a079-4b903eef30ff", "comment": "Malware payload (SnakeKeylogger)", "value": "f1638e86ad7e73c5fafd6b96785f0caad5a2d986233b2d7515511850b8b2c11bc70b32a1294dd5cefe0814b885764cae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634883859, "uuid": "adba061f-1ff9-4ef8-8220-423df7c963b1", "value": "T1C0824B1A77D8CB61C2B9877EA9F2500453F1F6D3B921DF0A3ECD42C99D2314A1A513AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634883859, "uuid": "21d97455-475a-44c4-9943-570c3af86b13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634883859, "uuid": "f20a38fe-8746-411b-9dcd-b3e09053918f", "value": "384:8O8Mx4mV5t/QMcFGPr8n7vpjZAU3JbmK3LBHW7B5SF:ra+HlcIkDpjBJd3LBQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634883859, "uuid": "bdd65101-16ac-4798-b2cc-e61f959b4598", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634883859, "uuid": "3e5dfd96-d540-4472-abb4-77f9e3dbf25d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634883859, "uuid": "001636a5-959b-4aa9-9565-0075f16dc9a9", "value": "Sample.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdf125ee-330d-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634889492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889492, "uuid": "ab85894e-772c-4b61-92db-6141a9620dbc", "comment": "Malware payload (Formbook)", "value": "6324844054583aa8cfdb28672455825b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889492, "uuid": "6bada573-47c9-4e30-b9d0-be147c22329b", "comment": "Malware payload (Formbook)", "value": "8b74f24d2bb35c5ca0c146f55f109ee228e8f274301e474084d1bbe12a6527d4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889492, "uuid": "7a8e076b-d67e-4ad1-98e4-fdffa0b645a3", "comment": "Malware payload (Formbook)", "value": "60b30164794137a8aa182b34c691f464664df672", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889492, "uuid": "72355c7b-7fb5-47fc-b5fc-45763081a642", "comment": "Malware payload (Formbook)", "value": "31e2bcb815c8a79a33fc8e6e9fc76009b39bc8cbda0e886d6a6a2413ba77654dac3a6bf3c83b557ddbac60240415bf73", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889492, "uuid": "9b3aa17b-8e9a-40d4-9276-c5affa61b828", "value": "T1F944AFCF2A648BB9C66D3176414AC91D4E96DFE81D31E2A11930F00D9579FEE2086FE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889492, "uuid": "e25efdd7-4e01-4776-9c46-d16a5da264ec", "value": "6144:ULM63Cj5JE2aSA89g6sUuY7Xpe8TsLC5m/iCFp:UA6y1JE2aSA2lw/LCMPv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634889492, "uuid": "69ee5a23-54e3-4b0f-99dc-9ae31df57d4d", "value": 270888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634889492, "uuid": "271dd7ff-7b18-45bc-97a9-ee8253b7bf2a", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889492, "uuid": "4dc6ffb2-3266-44e4-b607-e8a985b3114a", "value": "Bank_swift.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa9af9fd-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928222, "uuid": "e57c0770-fef3-490f-855c-3516045b8c9c", "comment": "Malware payload (RedLineStealer)", "value": "ade97ee2d8365bac817b0ce3c933cd8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928222, "uuid": "7e1c5b2c-adc2-4f29-be62-18b9e5c08ee1", "comment": "Malware payload (RedLineStealer)", "value": "8d5b572415a417017f3cac4151ee47381999a7826c09553160512310314aec68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928222, "uuid": "045d9bf0-9924-4f5e-99d9-daed3b115ff0", "comment": "Malware payload (RedLineStealer)", "value": "3c01c46b6f14a5e752b78c7bd7916cfea7cb81ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928222, "uuid": "9abd88a9-a560-46e4-acc6-7c6f0ded4238", "comment": "Malware payload (RedLineStealer)", "value": "962c364bf8212be4923bbd970ecc570d552f22268a7cef8f8c814a321f738f4ed1ec81a494b54d018a96af988592c8c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928222, "uuid": "30eda409-35f0-4dec-ae61-b7435a45c7de", "value": "T16A94AF007A90C3B8F1B202FC79799368A57A7AB95B7950CB52D516DD473CAE2EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928222, "uuid": "0b21a71d-ba74-4494-90e7-76323ceaedc8", "value": "7d703f3dcc20ca3d782d2ebcd1926d70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928222, "uuid": "8238e828-1b1a-4b51-b0c9-483e8e5c7157", "value": "12288:OaI7cLZ/ngbp1pId1J0RRbqIWBjvrEH7z:MYqbC1J6ArEH7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928222, "uuid": "dca6ba30-0568-4c8c-bdb7-9d5ea286b56f", "value": 418247, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928222, "uuid": "955e45d1-e1ed-483b-8c0a-4ed499f4578b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928222, "uuid": "83376467-bdc1-4642-9783-a2c7271bf5e4", "value": "ade97ee2d8365bac817b0ce3c933cd8d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56acf178-3341-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634911626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634911626, "uuid": "bb13b9c7-6af0-4e3f-8c85-d3ea826a81bb", "comment": "Malware payload", "value": "44a20c6259effbc4f8d19d3b9ad9e79e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634911626, "uuid": "c5da7c62-df5d-45c3-a8e0-9ca2088f4d24", "comment": "Malware payload", "value": "8df85de69eca57ba12d2044e751c655cef674fb84b9a78d0c3f48c7d71285eef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634911626, "uuid": "c4e59046-8fa5-4918-ab79-f693934cdc83", "comment": "Malware payload", "value": "170ad5ae18a3080f27ca66bae3cb5eaf4125e4d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634911626, "uuid": "3ea9db01-d42a-4967-82ea-7bf863b91333", "comment": "Malware payload", "value": "dc00e127f464edecf1c01a3d4e76ffc50e7df2fd8cd057163ff21373c664d966adaeb028bc0ddd7c6b3fe064166b4754", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634911626, "uuid": "55272fa3-2949-4a79-a544-6386d3d48767", "value": "T150A4AE00A6A1C039F5F362F449BA9368A53E7EE15B2450CF52D52AEE57396E0EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634911626, "uuid": "72bf9365-a649-4bf2-aacc-386044586510", "value": "85b11e7df91b461ff7ceddce26982802", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634911626, "uuid": "a15c81e3-840c-4a54-8e68-d141833e5f1d", "value": "6144:AP4wNuvLiiCuTp96R6NIDCClmktNrKoHTR3RgBWSyj3L8cBzquus/fqQ3hQ/:AwUbvcr6wODCItNLthgWdj3L8Iks/SQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634911626, "uuid": "2bdb3d51-facc-4d0a-b538-51707c3b9a00", "value": 454656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634911626, "uuid": "cf3a9661-727f-431d-9eff-37c8fd58427b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634911626, "uuid": "b995d1a3-5816-48f3-9bc9-6a45004bd3e2", "value": "44a20c6259effbc4f8d19d3b9ad9e79e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d099ca11-330d-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634889496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889496, "uuid": "4c9c7ed0-45f3-417f-993b-42ff48788bcb", "comment": "Malware payload (Loki)", "value": "7d3bc47bdf2724f829e91bee5bbd1716", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889496, "uuid": "920a608a-12bc-4d06-bc51-b191a7703599", "comment": "Malware payload (Loki)", "value": "8e989181131c292bb9c2d2d6c48247fb4c86a861f34c1951055340205f4717cb", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889496, "uuid": "cbeb7364-bbc9-46b7-81e9-f441b43193ba", "comment": "Malware payload (Loki)", "value": "19dc590ad8e23d2969e959f5c1965c0e07dae877", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889496, "uuid": "5b538bbf-0f13-47b0-86dc-bc12e44b3a72", "comment": "Malware payload (Loki)", "value": "f0a44bb98aaa7e988475e333ce74488cd34176e4d80c78178283a59e9526c12d5bb0247d6c84ef54f15104c28f82dc08", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889496, "uuid": "c361ff50-24af-423b-af9d-97228c64cb9d", "value": "T10584C04667B0C5B2E662993483E267436498FFB61ED8055C327DBE0BD632E14AD20F37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889496, "uuid": "d269a88f-a96c-4623-824c-57a6099c9594", "value": "6144:+ms7b0IwwcCwEinRpdq8Dr1h/y2YWULghw6FLgFQ/QiBNthNzgyBUsX8iSc:3hrwcGi3E8DJhLYp6w65V/5BNPyK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634889496, "uuid": "9c386a97-318c-48a1-94fb-1705df0076e1", "value": 378136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634889496, "uuid": "0d19e122-cd3a-4087-abec-ab41712b0961", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889496, "uuid": "7978776e-fc77-4d41-8bed-7177059b7d2d", "value": "swift.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9f3d79b-32fa-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1634881271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634881271, "uuid": "e8725b83-a4ab-49c3-ac48-a110432cc8f2", "comment": "Malware payload (GuLoader)", "value": "a039ced0b74f5ad2a8cb806cda3c200b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634881271, "uuid": "9133f8a4-7d1f-48eb-b9c2-d0b16ed8a994", "comment": "Malware payload (GuLoader)", "value": "8eccb1553d3f9cd0995a2ec89086c1c02f74fbd95a0f267bcb445701a42d2e79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634881271, "uuid": "4d8ca1ee-c124-4de9-b80d-00bc2002e1e5", "comment": "Malware payload (GuLoader)", "value": "9342348b685c80bfbf8fce23f9e76950020d5902", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634881271, "uuid": "63d4f66b-c09d-4c55-b98d-a5264eebe648", "comment": "Malware payload (GuLoader)", "value": "b2b73e24591bb9ad1f6bb45230ed8c78df56560f9afa59579f396f13ffaafbcb9417e6b58f88100ed2186750a958fb49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634881271, "uuid": "f5dbe69f-5846-4c0b-ab8d-09f7740c12b9", "value": "T1CBB35B5E6C74AC35C81F43399B32416CC0476C20A953BAD6327E36093FF5ADC6962F5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634881271, "uuid": "0386ed2b-509f-47fc-8ede-21751ae4bbb3", "value": "9a680a4ab9f2f92c6ce20903d7caa304", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634881271, "uuid": "86b229d4-65c9-4c44-a770-ed6d40846036", "value": "1536:TY+rEoQ1SGx3i+8hFSiVmCw4EXbxrRPDMIyiWMSHf:TYYEn1z3i+cID9RbMliDS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634881271, "uuid": "3888e5ee-d1c6-429b-828d-012f16d1c4f3", "value": 110592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634881271, "uuid": "cb2e0b2d-33f0-4bec-b12b-877813520e02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634881271, "uuid": "d29e76ed-7617-4f48-bf7d-b238290e66a6", "value": "Factura FAN CourierFAN Courier Invoice 7038848_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95e39fdd-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928053, "uuid": "f0bc89b3-b7a8-44de-8d3d-e866174ba8bc", "comment": "Malware payload (RedLineStealer)", "value": "ffb3e54d9dd15026cd84c0fd96610e67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928053, "uuid": "3dd4e7af-4d96-40c1-a63d-3079e75efedc", "comment": "Malware payload (RedLineStealer)", "value": "916d17ef447b915123bb8192b8e7ee718e21bfc2e12c461c4a5ab25e61ecad54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928053, "uuid": "8484bd30-9a09-4f9e-b866-7df69c9e2621", "comment": "Malware payload (RedLineStealer)", "value": "071736e9db7673ed45fb67fe6442a7ef8c3f9af5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928053, "uuid": "1153cae4-c845-4b99-afa0-df9dfcfcd9d9", "comment": "Malware payload (RedLineStealer)", "value": "dcb2bb399ad7e9d99e2a542940e0004c3d255dcac05be31fa8c946df566478d255d05d7fe9a4d63ea38f61f62f88eaf3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928053, "uuid": "8ee22ddb-6981-49e1-8114-c9fdda2851fd", "value": "T13FE4F1107AA0C035F5F312F8497693ACB93E7FA26B6155CB92E416E907386D1EC3136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928053, "uuid": "8b5fdb7f-9a2a-412a-949b-ae38013effb8", "value": "25e96726029c322936cf0033b6a07058", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928053, "uuid": "5fed2974-ac54-4ef8-8506-6471d8c66634", "value": "12288:H66oYf0il0q0Vl6NEufG9L631tDUmNBP6pXe3/tquvkU:a6oKB0T6Nn+41tXN5EXevL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928053, "uuid": "d4b4ffa3-2be2-44a2-ad6c-cfacfd35732e", "value": 669184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928053, "uuid": "9ac07444-d27d-4a93-8d96-3e9a23d61e7f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928053, "uuid": "6b04c37d-11f8-4434-a35b-cfaf0a056b22", "value": "ffb3e54d9dd15026cd84c0fd96610e67.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "054afb84-32de-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634868969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634868969, "uuid": "2b887ca2-42c4-4bd5-9cb4-7971461dab3a", "comment": "Malware payload (Mirai)", "value": "4635e3761f10a21d01fec0df9fa36e2f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634868969, "uuid": "d50b44f7-7907-488f-a34e-676d3c1caeba", "comment": "Malware payload (Mirai)", "value": "91ccea41a26fce7feab89f9b17c889b9f7c37f29b5b5a9390a7d3f2990f43cfa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634868969, "uuid": "03ab1479-4d7c-439c-ab64-db3bc0c94211", "comment": "Malware payload (Mirai)", "value": "a33d4b91fc25603b0ed98b17381f6a6e017f6c32", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634868969, "uuid": "a882b239-f07a-41f5-b3d6-f17e36d18cae", "comment": "Malware payload (Mirai)", "value": "5cf857e747ccbad7f61d8372481f1301a2617345a6a62a464bcc6bda021b72bd9cdd7cb13f63de009281b26a9d9e2e42", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634868969, "uuid": "38d6107a-db9b-41f5-a093-ce7b130825ff", "value": "T1A963C546BF610EF7D89BEC3745E92B0529EC560B21B97B75BA30D818F64B20F19D3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634868969, "uuid": "b123eee3-9561-4848-91b6-32ae90b4ed3e", "value": "768:YU6bhcgHSIJWB+cHlfD2wLX3YEwja6PN1oAg5oRKxeU3hVpxedxAxePx28szI2Zx:YU6bh1HkV2wEVjZPzgj1GCK2dFsTcJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634868969, "uuid": "0f0d6c6d-369d-489d-b329-89450b47b4a4", "value": 71764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634868969, "uuid": "779b85e6-b7e9-43bf-9434-858c768d2829", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634868969, "uuid": "809d7688-4fc4-456f-9310-5d4fdd9c8bbb", "value": "4635e3761f10a21d01fec0df9fa36e2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a41a02a8-32e7-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634873101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634873101, "uuid": "d6258f05-f4fa-4670-9e32-708247ce5632", "comment": "Malware payload (Mirai)", "value": "17ab8131fc2ddacbeac40966491aee1a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634873101, "uuid": "d6945c2d-ed0a-4eab-9802-b9d74ffd7b02", "comment": "Malware payload (Mirai)", "value": "920267c907ce2e9dbc342eab71e188224733321a3cd33b72ef60fa0d71515790", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634873101, "uuid": "7b9002b2-fbb3-4d01-bba6-dd7b301ead9d", "comment": "Malware payload (Mirai)", "value": "1a44858855f3b3157e48d05889f15a6983f512cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634873101, "uuid": "1ee27915-9274-434b-b899-fd8b53e7f811", "comment": "Malware payload (Mirai)", "value": "261107751686df5b21d8c1cdae563318e34e2c9a8bac73f62d5cac4ae3fe1bc8cfad93e9bbaf0bd40b773bd7fd5efd0e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634873101, "uuid": "0bc9d961-b647-4d04-8871-3f47649fffdd", "value": "T14B235BC9A587D9F8FC160A342172EF326B76F93F1018EE87C7959933D942702E10A5AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634873101, "uuid": "d919acc6-61ce-4fd8-a8fe-10ccb5ec5837", "value": "768:53sPWVrWy7PBIedilokjFMdMh80otXzAlxKUu141AaIK5pYim6gls:/D9I8ilokjFMdMu0iALKH14SDKLrm6As", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634873101, "uuid": "1a616a4c-dd0e-48d8-9688-2003654dbf4c", "value": 47024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634873101, "uuid": "46d82c99-d3a4-4454-accf-a59940305352", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634873101, "uuid": "2aed4922-8d52-4039-8537-97f0f8cea52d", "value": "17ab8131fc2ddacbeac40966491aee1a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6147afee-32d0-11ec-843c-42010a9c0014", "comment": "Malware payload (Mercurial)", "timestamp": 1634863110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634863110, "uuid": "9fcd9577-d89f-4c4e-8723-45cea3543e15", "comment": "Malware payload (Mercurial)", "value": "b28c8b50fda9f355c2d97cac7a9b13b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mercurial", "colour": "#79A0AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634863110, "uuid": "397e11e4-01ce-4f9b-aede-d01f51e33481", "comment": "Malware payload (Mercurial)", "value": "926755cc31c239edc78b3ef4aa3b3cc64fbe7209d907f9d1cdaa4b560662adfc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mercurial", "colour": "#79A0AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634863110, "uuid": "c7fecb5d-6e6c-483b-89ec-0d2b7cc1a86a", "comment": "Malware payload (Mercurial)", "value": "cff75e49e2f567ee9e890cc5c203e1c3549945aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mercurial", "colour": "#79A0AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634863110, "uuid": "2beb013a-08e0-41ad-96b9-a68ed3e0dff8", "comment": "Malware payload (Mercurial)", "value": "4508984235dd3e1b7422ac8ea65eeea408869061313e11776beb65afb8eb6850f187d680e0c4dd501b26bc40129b4168", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mercurial", "colour": "#79A0AB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634863110, "uuid": "95e16ccd-daa0-480e-a03a-55987a52a685", "value": "T1651306497BEC1609F3FE4B7A6CB1512846B6B866AC22DB4E1D84589D0873F80CD50F77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634863110, "uuid": "a68367af-325d-4002-a0c4-c530509441df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634863110, "uuid": "72e842e5-9d22-4d4f-a281-3424da36b17d", "value": "768:AcxqpM5/8H2v+uWuZMHLsNTj2KZKfgm3Eh50:AcF8H22u6LsNTqF7Ej0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634863110, "uuid": "de80b652-d7bd-4bd6-ad6b-d907a57c0072", "value": 43008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634863110, "uuid": "3bf33ae1-e968-4ee2-ba55-7bed3993af75", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634863110, "uuid": "1ff703c5-4c38-47b9-a380-d9b06c48f2dc", "value": "Nightmare Booter (DDos) [IP Stresser] (1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b521b95-330c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634888951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888951, "uuid": "15ef212d-841c-423d-a523-2f13007a56c5", "comment": "Malware payload", "value": "9a75b5249af441da3114d6d274e6f2de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888951, "uuid": "91fb161f-a7cd-48d6-b342-8a19b5f0215f", "comment": "Malware payload", "value": "9304dd6097abd22d8209fe94ecf89b6f373375637089886058b473a346be6d68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888951, "uuid": "7dd4166a-a4bd-473e-a2ff-e76afed4da2e", "comment": "Malware payload", "value": "0f284297c4a7df05e4ac4dead5eb5b022334ee13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888951, "uuid": "b7ba43a3-30dd-42b2-b6dd-5322f119111c", "comment": "Malware payload", "value": "8673ae1bed741140a8f255d14c8e329809a1e5b9a3526854036e721253fdcf4326c376f72e2b73bc4afd5572fccd06ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888951, "uuid": "5ec6add8-d6e6-49ea-bba5-ea2f5e590854", "value": "T19B855B47BC9160F9D0AAC231CA66D2A177317854073323DB2B50E6BA2FB2BD45F79364", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888951, "uuid": "388efc8d-b5b6-4c86-bd3b-66a55fa9569b", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888951, "uuid": "7a18d346-5fbb-46ff-adf2-08bffc41e9a8", "value": "49152:eZ8O1NHrb/TavO90dL3BmAFd4A64nsfJ78kPHngvxRngb17f:O8yp8Re", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634888951, "uuid": "2833abd0-d134-4f89-8361-853c3515defa", "value": 1745632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634888951, "uuid": "786c11f1-0fc0-46f2-bd3d-3df8f5242a08", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888951, "uuid": "6f5e057f-0775-40fa-999a-ec3f004a4eb9", "value": "9304dd6097abd22d8209fe94ecf89b6f373375637089886058b473a346be6d68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86a6dee1-330c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634888943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888943, "uuid": "ff2a5762-8ce5-4922-9850-038af69e861b", "comment": "Malware payload", "value": "1c63f79269e8415984a2aeaf612e99ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888943, "uuid": "45efd023-517a-49df-a0fc-e94de393b67a", "comment": "Malware payload", "value": "934c39dceb4e82940e3fa6773fda7fe02c902345ac66cf9ecab9f6a64997c1e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888943, "uuid": "0598d5d8-3e86-4929-aca8-9127784282c0", "comment": "Malware payload", "value": "0dd39484fa2b34edb8ed4c6c1f6b5d7b9d41b3e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888943, "uuid": "c22379f3-5a56-47ae-8461-0586b9e67143", "comment": "Malware payload", "value": "fa0f4f5932ba07cd9caae9305efe889919807cca1f69b6b1aec14f0ef85b103426150626363089d22bca51f6a0a361d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888943, "uuid": "15bd790c-8ade-44c8-8238-37bfa6228507", "value": "T192853A07BD9060FAD4AAC2308A75939177317899073323DB2F50A6BA1F72BD81F78764", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888943, "uuid": "8d299446-f720-434f-9b84-0b6ce20fbf57", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888943, "uuid": "9d179f43-5116-478d-a819-bbc818a9b89b", "value": "49152:NgbPorUf8rb/T4vO90dL3BmAFd4A64nsfJLw0bGRHpgv717Cb1k:qbz2l51f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634888943, "uuid": "698a2456-d899-4a7c-b17c-d42d09e30698", "value": 1749168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634888943, "uuid": "14328136-8472-482f-bb72-b0ad306bfb5b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888943, "uuid": "cc02f997-bf80-4c85-8d7d-668b1e4f7f73", "value": "934c39dceb4e82940e3fa6773fda7fe02c902345ac66cf9ecab9f6a64997c1e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d19807d7-3325-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634899806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634899806, "uuid": "e5733f32-884c-4639-b000-a360baab9de7", "comment": "Malware payload (Formbook)", "value": "bcbc243712a9a1ad4cfa18c53e5b44c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634899806, "uuid": "478413c7-f773-463a-b826-6f602e87023b", "comment": "Malware payload (Formbook)", "value": "936b41f8bcf1d1fef4e71b000e2e37c4cc2baf58b34ca848759d2a8de5b9b9aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634899806, "uuid": "0cfc026e-f93c-4f18-bee0-729ae233e32a", "comment": "Malware payload (Formbook)", "value": "7b48441b8a6403ea0a297c77f84aff5e206ab821", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634899806, "uuid": "972f7386-dd91-42dc-abaf-3fc931f0acef", "comment": "Malware payload (Formbook)", "value": "895b529de12079941a7f1526d2bc6bd03dbb6f5217615faabb724d6d203a72c316ce6605ad973f2b18c895262e344390", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634899806, "uuid": "80831083-cf3f-4ba0-8ad9-6eae387a2e3f", "value": "T159D3D681C98291B1DBE9FA361F37C83197374E7E2421805606FA7DB339EE9270437962", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634899806, "uuid": "363d157a-6f67-478e-addc-4dfa0de89d46", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634899806, "uuid": "59f1e135-0b93-4f14-844e-53f041fd6e7c", "value": "3072:sR+i61Wdn6hpOoE1cymfbmmo6H/BA0rqb6tmR:sNn6/1E6xymrfKgqb6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634899806, "uuid": "0bc2a9e4-3604-4584-b8b6-278638555422", "value": 141312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634899806, "uuid": "1a979b1a-9004-4422-8ab4-0936b0acd41d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634899806, "uuid": "9b21a06d-65b9-4230-9c9c-94eab6ae17ca", "value": "DHL_119040 al\u0131\u015f irsaliyesi belgesi,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "246654e1-3308-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634887060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634887060, "uuid": "841831b0-7162-4e72-b5f2-40d24d2bac10", "comment": "Malware payload", "value": "9b868734b247af0c4851edadd98ce3cb", "object_relation": "md5", "Tag": [ { "name": "mac", "colour": "#285994", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "UpdateAgent", "colour": "#B10D2A", "exportable": true, "hide_tag": false }, { "name": "WizardUpdate", "colour": "#5BF7D9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634887060, "uuid": "5bf78d5f-4f0c-4dfb-abc0-1df26563d696", "comment": "Malware payload", "value": "939cebc99a50989ffbdbb2a6727b914fc9b2382589b4075a9fd3857e99a8c92a", "object_relation": "sha256", "Tag": [ { "name": "mac", "colour": "#285994", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "UpdateAgent", "colour": "#B10D2A", "exportable": true, "hide_tag": false }, { "name": "WizardUpdate", "colour": "#5BF7D9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634887060, "uuid": "56a149df-8a88-4ecf-9b85-d6c89d1c3115", "comment": "Malware payload", "value": "01829dadef2d4e8b73f00e3a1f64e4c7395bdf38", "object_relation": "sha1", "Tag": [ { "name": "mac", "colour": "#285994", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "UpdateAgent", "colour": "#B10D2A", "exportable": true, "hide_tag": false }, { "name": "WizardUpdate", "colour": "#5BF7D9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634887060, "uuid": "5ce23c56-453d-4c06-931e-52e27c96e5e8", "comment": "Malware payload", "value": "265f7b98a5b977a2450d50717a008fc1c062def60308c92352a160c07f336899c2557cea618f8a9b9b21ac0d5df5f384", "object_relation": "sha3-384", "Tag": [ { "name": "mac", "colour": "#285994", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "UpdateAgent", "colour": "#B10D2A", "exportable": true, "hide_tag": false }, { "name": "WizardUpdate", "colour": "#5BF7D9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634887060, "uuid": "4f49634a-fe74-4e72-a23c-62972d8b14f2", "value": "T17E932C335776CA63C6CFB7B4B1877B1B8600FC926DE559E29768E9140EA0FCE9518B00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634887060, "uuid": "91e5722b-e397-415c-a7c9-3c4a28d5b28c", "value": "384:fi6lXphUn2CEw9uu6zTTuQc/eIEfc9R7OJ+g2JNMfZBbNglP5zA7tzHNypA1ZN5Q:fi6dphUnd9fooS2RcBYPNS/ZviR1TH9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634887060, "uuid": "6e4bb0db-7fbf-4801-9fc6-ab38a230d38d", "value": 90768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634887060, "uuid": "b56aa1fe-cf04-4b38-9e63-cc6545fd2aef", "value": "application/x-mach-binary", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634887060, "uuid": "0272b6e5-a1ac-4fce-8aa8-92927d37e6f4", "value": "939cebc99a50989ffbdbb2a6727b914fc9b2382589b4075a9fd3857e99a8c92a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1906dcaf-32e1-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634870291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634870291, "uuid": "03176c45-73c1-417e-b030-c6276474899f", "comment": "Malware payload (Mirai)", "value": "21221c256b9ba1e3bcaf24f14f56940e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634870291, "uuid": "c2c9c56b-43d5-4112-9108-34b9fc06fd55", "comment": "Malware payload (Mirai)", "value": "943af216d67d322b4ddae7361637a108bb721c4a005bd55b50d4a7e1d3aa8648", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634870291, "uuid": "e0067698-ee94-430b-b703-5257eeab61a5", "comment": "Malware payload (Mirai)", "value": "ad75702debfd0aa449a89106a201ea970de627e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634870291, "uuid": "fd123bda-73c1-45d6-a8fd-b9b38744a765", "comment": "Malware payload (Mirai)", "value": "4f31f79a4e1704a366dfbbde4a538b0fa84e5ff40a1d2676d58d5b9227552ef5e46197a21e5b762089e931c84c31a6f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634870291, "uuid": "f2b4a236-a445-4700-9740-bead009ec1f8", "value": "T11F33280BA58181FCC559C17443FBB53AC876787E0639B1DA7BC8FF276D85E601E28889", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634870291, "uuid": "63a877cb-ca58-4995-9af9-b2b59fde90b6", "value": "768:Dbs093tGOHn2PAe6nCAQTGWexrecbwUg4ubt7dwE1rjWb571H7vungg:M0937QAe6CAQiWexKX1xV1rs71H7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634870291, "uuid": "bca0bab5-ccce-42b8-aa1b-12ed564452f3", "value": 54528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634870291, "uuid": "62bdc9bc-4af2-4782-81c1-4ecb4595abce", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634870291, "uuid": "256b4f53-8bcf-4593-aeb3-8d5bd571667a", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ac7280a-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928034, "uuid": "bb667343-dd8c-4c0b-9b7f-1f634bd76dd1", "comment": "Malware payload (RedLineStealer)", "value": "59a3bf14f5c1d421989fd6acf433e2fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928034, "uuid": "fa0e9760-b2ac-4fcc-9796-ef675d676401", "comment": "Malware payload (RedLineStealer)", "value": "9567e4fd99496d809dcf943efb55901e24013975faeff00f13b839b84711b053", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928034, "uuid": "630989f9-ecdb-4562-85c4-186543a8d64c", "comment": "Malware payload (RedLineStealer)", "value": "cf5c27f3c20d3848e963bae9937b6f3ac5fd6a91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928034, "uuid": "5e647cc0-2e3a-499e-9cd2-d19e3c101466", "comment": "Malware payload (RedLineStealer)", "value": "7dd4d6ddbb3d30c6b4c85009d43b5cd92249983cc6ec05a3419937de909579d007233224c0245e6f67874bba8dcfe7de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928034, "uuid": "54b8d775-c0be-45d9-a14c-504939c0f1a2", "value": "T153E4F110BB90C034E5B316F849BA93BCB93D7AA26B2551CF52D51AEE57346E0ED30327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928034, "uuid": "b77106ca-1dba-4d34-8022-0fdb08394ffc", "value": "25e96726029c322936cf0033b6a07058", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928034, "uuid": "a794812a-ee4a-43a1-8ca3-baa3016cace9", "value": "12288:FLHNPRx8SNfhxUf3Y+icIHZoT7FLXAfP8aeZU7w:5HNpx/Of3Y+icI5G9XAn2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928034, "uuid": "28d2881e-2bf9-4359-8dbe-e66e39740188", "value": 669184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928034, "uuid": "e2c49d81-04f4-4560-a814-24375de03d40", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928034, "uuid": "2242d993-0752-411a-b82b-7da9acaf9adf", "value": "59a3bf14f5c1d421989fd6acf433e2fc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a51dd926-32ff-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634883410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634883410, "uuid": "91de377e-2c55-4e26-a4a6-c8476f5ff8d1", "comment": "Malware payload (AgentTesla)", "value": "3f447387337591602b837f5b02ab271e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634883410, "uuid": "bed7a722-2fc8-4e59-9507-6a8292befdba", "comment": "Malware payload (AgentTesla)", "value": "958ada8f665a73d481ad974e482e553d2b4e84e895febe16c4766599d60a7225", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634883410, "uuid": "ad517767-6708-4538-ac96-48d2befa40dd", "comment": "Malware payload (AgentTesla)", "value": "33291bad68b6b05efec4eb10c1092a08b7745e85", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634883410, "uuid": "f08e2c51-fc8d-489b-9311-e2a69bd495e5", "comment": "Malware payload (AgentTesla)", "value": "e66d8a23673ce26ca645621e2f0283af1de9f4694a073a2dc85c2225cafd2b2b2a7eabaf227b66263415a95670b075a2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634883410, "uuid": "e0b56480-501b-43b1-a640-6f011e428eba", "value": "T1A5C48B0436A95B12D5BAABF01531590093BB7DAE287DE64D1DEE34CA0F77F448A21F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634883410, "uuid": "c95db231-190b-43d9-be88-81a47314559d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634883410, "uuid": "ef1bc9bd-75e5-42c8-9c07-ba8f79378ee2", "value": "6144:+GxhLLUnIBpvRjxiOiPUjNLByLx+iGFV46g0ZJeg8mGlN+30SvwH+kN:3TUITJxiJiNLkLKFV46pjGC30SvwH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634883410, "uuid": "9c1ef619-1d2b-46db-b1ed-77d5c5ed6c04", "value": 558080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634883410, "uuid": "3831038b-77ca-4813-92d8-e2a3ef096814", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634883410, "uuid": "cf8024e6-8c84-454e-a6a3-4c3cfde5f0e8", "value": "shipment doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9c517cc-338f-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634945400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634945400, "uuid": "0edc789b-975b-473f-a386-829ef467de9b", "comment": "Malware payload (Mirai)", "value": "4b863f4de003a50ef103e620f160aa68", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634945400, "uuid": "158693a7-5d5f-46f6-b773-35bb087299bd", "comment": "Malware payload (Mirai)", "value": "959f1afbe8948646c706310d888ce16342492c5fb577bf619de72aba635b17a0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634945400, "uuid": "6250090c-11a5-430e-8d0f-df40be0da214", "comment": "Malware payload (Mirai)", "value": "f54f80f88d1dfce4d949e7ed86218f3bcbd90b9f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634945400, "uuid": "79ec34f0-786c-4ab8-95d7-e369c310f1f9", "comment": "Malware payload (Mirai)", "value": "66a446eb1902bcdf7a768e8dc9b40edc2569f262a46cd6038a3f2f3152a9b56ee3fa9d8f0ef55e6cc5fd689737ff9d02", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634945400, "uuid": "6280d428-ca96-4900-83d9-0dbd58178ca5", "value": "T1A2533A51B8819613C5D4137BF6BE428D3B2523E8E2DF3217AD222F513B8A82F1D67A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634945400, "uuid": "31aa9e9a-1043-4cb5-8d18-f680ef913510", "value": "768:lniaia+vgGqxsOvlG/idybxA3fUBAVz0mSE9Bz62ocNMsaz+SychwJZY10UPZvBO:sai5v+tkRFgfUBez0mSoBJY6zJa10oB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634945400, "uuid": "b6e934ad-952e-4071-88c1-bb6a8321f382", "value": 60760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634945400, "uuid": "88d83fc4-499f-4c42-82a6-29bd84ee80e1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634945400, "uuid": "a904b59b-1f15-45e0-a89d-75c0d749cd81", "value": "4b863f4de003a50ef103e620f160aa68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e31d5f0-32f5-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634878889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634878889, "uuid": "6c023704-6a8c-4478-8881-8e6a45d5205d", "comment": "Malware payload (AgentTesla)", "value": "e1ecea0bc4b06e4ed65e1e61004ec221", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634878889, "uuid": "185ecafe-aa39-45cd-8b4c-e9503ca64fe7", "comment": "Malware payload (AgentTesla)", "value": "95adb79ec9bd9c77bba228ecee761419cd852a3aa302a7cd7bec0834952666a3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634878889, "uuid": "3d46c44b-e3e9-4d68-a611-0e50e0a2f657", "comment": "Malware payload (AgentTesla)", "value": "b48b8b03198c6b5c04da12afa1fa755f70a7b574", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634878889, "uuid": "266ccc6f-330f-4dac-b99e-70ac51b63752", "comment": "Malware payload (AgentTesla)", "value": "dcb1070bdfd50cefdddcc68935857d732bd15fa1bfe913e9e44c101db551dcb9b8f028d359c58391a3b84881e9e207c2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634878889, "uuid": "3bdf08ef-efa7-47db-b436-fad51be888eb", "value": "T10D05E072710AAE85EF392BB5A400A7412FE47C37CB29D25EBDCA729715F3550CE30992", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634878889, "uuid": "10ce557a-8e38-4489-ab8c-0de9823c7596", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634878889, "uuid": "b188e24c-829a-42d5-b6c1-257c62300b35", "value": "24576:hYbw8eGnrssmE2X83ldaIP1veAbTqV+A/x:h4Xc83ldaIxbTC+A/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634878889, "uuid": "b28d2611-a16b-42b1-9871-79d9bb11893c", "value": 839680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634878889, "uuid": "e0e2d0fb-8a5c-4bd7-9895-5092bf2bed63", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634878889, "uuid": "7c94a62a-c7cb-4f9e-b9c4-2a6a90551113", "value": "overdue invoice PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a65571ca-3332-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1634905317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634905317, "uuid": "b4099cd8-43eb-435a-911c-e63e4ed5c432", "comment": "Malware payload (Smoke Loader)", "value": "e2add9d7b4cab3122ad445c1de492cda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634905317, "uuid": "b4584de2-33fa-411d-af08-c5dd3f43ae24", "comment": "Malware payload (Smoke Loader)", "value": "9616c0f39e3c02eb66041652ed2c07396a7a25ce9ce9ef69585b6685ee1a0804", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634905317, "uuid": "73164c69-0b1c-4be8-aa7c-99aae7594a68", "comment": "Malware payload (Smoke Loader)", "value": "808c2b69b0f6bb948ee51988d3c88b38d95d3479", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634905317, "uuid": "186358f5-8499-4372-8a66-641a1bc00f19", "comment": "Malware payload (Smoke Loader)", "value": "9e92625a45d5e6b9d6dd181765fc0b8675c9e7bc9d0a2902e8d3dd24b6c7fd12bcade9c88e936c6eb9b96749273e3475", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634905317, "uuid": "972cc36b-75ec-4b36-b8db-1989e9b735bd", "value": "T1F7548D10AAA0C435F5F316F849BA93ACA93E7EA16B2450CF52D526EE57346E0FC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634905317, "uuid": "47af23b8-a177-4b1c-849b-a901a52309d7", "value": "0aa8675e96bbc2351e2af940f447c93e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634905317, "uuid": "9037f3b3-5eb2-4bc6-892d-e42ed5ceb80e", "value": "6144:5nWpLHe9fl9PNXOgc3uGSH/QKvoTqLuowy4A0l0DRHR4k:RWsp9HdPfHvGNytq0DRHR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634905317, "uuid": "8d8283dd-cb12-4d4a-90ab-ce4be4a521c2", "value": 290816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634905317, "uuid": "8dd44cd3-aa8e-45a1-b593-4d6755860042", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634905317, "uuid": "061fb9c5-7529-4e21-b81d-4e93276be553", "value": "e2add9d7b4cab3122ad445c1de492cda.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f21906d8-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (NetWire)", "timestamp": 1634928207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928207, "uuid": "acab04f2-f839-4bab-af89-62ada355127e", "comment": "Malware payload (NetWire)", "value": "585cc23f62a61f05e84eca1ccd6655aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928207, "uuid": "e8cfb56c-c0b2-43db-9ec7-494db35d1fe3", "comment": "Malware payload (NetWire)", "value": "967143d314abcb1ad4cab1133dc0b296ae38580511b9cd412fdf3a7c282160e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928207, "uuid": "1c40c69a-93e4-4a4d-94ea-9dd7a769d4ac", "comment": "Malware payload (NetWire)", "value": "1c4df25e54798382f052223a3da32693b0f2f9da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928207, "uuid": "03f968fd-c45b-49ea-bab5-a2b114620939", "comment": "Malware payload (NetWire)", "value": "05a5767dff93e57c33c9ea8ef155d39382d162f145a9269d02e998c16130cd85505802d33e8d0adfa6c98e68c1c629d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928207, "uuid": "a0ad9063-d82e-474f-b628-8cab77e4b31e", "value": "T1B3E46B7BB6B152B6C5293B7C2C9ED6F8992EFD281532B18725C47C08CB7FA9064150CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928207, "uuid": "c404e757-7d67-409b-92f0-5aa13f9f6e6b", "value": "7c956dad9ea202d643355dc7895aa9c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928207, "uuid": "fa21f399-c563-4a5f-b15e-164cf684eb36", "value": "12288:EdO8lwYc+Plun+IBTid8obF+OCefbtaruRmDI:EUOTPlun+zdRaYb7F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928207, "uuid": "0a74b1f7-672e-4a33-be16-67eebbf993b3", "value": 702464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928207, "uuid": "157ea7f8-a54e-428f-aff9-50cb1cb02f04", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928207, "uuid": "0394b534-3a85-4650-a3bc-f96eed2df53d", "value": "Qamhwewajfobdwckfaugfgmgprjttcibln.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b5883a3-330d-11ec-843c-42010a9c0014", "comment": "Malware payload (BitRAT)", "timestamp": 1634889273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889273, "uuid": "88820125-6711-4add-b241-b2fb03ebcc2f", "comment": "Malware payload (BitRAT)", "value": "cb359b177605b936f7fdffa64869bdf9", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889273, "uuid": "c30fe485-541d-49c2-99c6-0d6d1bcb3bcd", "comment": "Malware payload (BitRAT)", "value": "969c3fd429a58baf7cd7c95375a80c0d6335df32cf6107205e1ce82526bae511", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889273, "uuid": "ba1c1904-6ff1-4272-9346-c117622e3813", "comment": "Malware payload (BitRAT)", "value": "3bc1d96db28a34908ecd012802c2116e7059215b", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889273, "uuid": "02a262f9-e18a-468a-aa06-510f768a859e", "comment": "Malware payload (BitRAT)", "value": "4d95e14a17e8228fbe6744837354c2a200ab8f44ec13c806cd7565a5128813d218815697f2c340a71b841d3cc56439d4", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889273, "uuid": "c604f90e-6c6e-4136-acd4-59090d55728b", "value": "T16EE523E1D32648A5DD36633CA8B3592A7173B93EDBB0004E5ADCF63B0F3275A0092957", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889273, "uuid": "034be217-3cc6-4e6b-96d9-e7d97a779d8e", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889273, "uuid": "2ca750c7-0593-4dd8-bf7c-f3034c2e1a9b", "value": "49152:eE286xT68bljvXaC9bfawTmKxJpHzhy7bitFYXOpXZvkje1x0ST6ZVKqKo6:eE286x2Abhra6mWJlzhynitlXZvkje1x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634889273, "uuid": "c36e06b6-82be-4445-a7ae-942cfd2f9795", "value": 3138609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634889273, "uuid": "94f68c86-3816-4e01-a813-4a6bb4c9e58d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889273, "uuid": "5948ea7b-005e-4117-bcc7-600f5f5b112e", "value": "payment invoice 962008.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8e11f13-331f-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634897188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897188, "uuid": "c77c83fd-feb4-49a9-b52e-06fc49a1d4e9", "comment": "Malware payload (Loki)", "value": "c8448f9cc3379dcbc504469d36446ed5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897188, "uuid": "0b4e1934-6ab2-4a7e-afcb-aea2a6639752", "comment": "Malware payload (Loki)", "value": "973cf901e982219a28db36b7120f924ad2c5d79f4561eb43c7274f91f8edd454", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897188, "uuid": "fbdbedd5-219f-426a-82cc-eddae2810817", "comment": "Malware payload (Loki)", "value": "55c884adf2871680e7b0a283547d6f0ee7d16585", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897188, "uuid": "bb1f25d6-8c7a-4161-9f76-893aa1d7cd4a", "comment": "Malware payload (Loki)", "value": "de5f39644de9f9b013e420feaa1f4a6b900c562d64c44545b814129f8d65c4f456ec952ab5bcba45e17ef93d007aae2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897188, "uuid": "c807eb6f-3866-4c5b-a1a9-c0d7c5261c2f", "value": "T142548E10AAA0C035F5F312F859BA93ACA93E7EA16B2454CF53D526EE57346E0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897188, "uuid": "522b06de-fd57-4396-9c51-e8349efcc92b", "value": "0aa8675e96bbc2351e2af940f447c93e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897188, "uuid": "bfe7afc4-b67e-4d69-bbac-50d9952ffb56", "value": "6144:AnuM3W+L7UwfX01ylUgHvGYbGpzvFranoGKDke0wekM/gd4:guMvHxfEbshStvN9DXDekM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634897188, "uuid": "b6c47ec4-a733-4e07-a8e8-727dc9ea513a", "value": 290304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634897188, "uuid": "15716dc7-0b91-456a-a924-55a26d5d8aa9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897188, "uuid": "503b34f7-f8ef-439d-af43-570b36664d84", "value": "c8448f9cc3379dcbc504469d36446ed5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4673061-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (BitRAT)", "timestamp": 1634928157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928157, "uuid": "ee1d51b6-b01b-47aa-84fe-aae30d76c9fc", "comment": "Malware payload (BitRAT)", "value": "89ba901d7a7d593130af029dabd12c29", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928157, "uuid": "5a6a62b9-395e-4065-8168-3b59af44cbce", "comment": "Malware payload (BitRAT)", "value": "98f04db705b35b0debfedc6cebe7fd63624f4172fd0cfe3e8e5fd9eb997119ed", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928157, "uuid": "2c048fd3-eff0-4670-b4b0-1cc0c5c7cbfe", "comment": "Malware payload (BitRAT)", "value": "022916b9f6932e252191e6cb2795489898d13343", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928157, "uuid": "dc133559-c1b2-4d20-9ed3-38301ac27721", "comment": "Malware payload (BitRAT)", "value": "49430101ee290ca42324b16bda2a574c3bb149206cd4051b114e956cd0fd2424ee5a505b0112866c8a6c9a329631f84d", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928157, "uuid": "bbc61cf2-c994-433d-89e3-efd28c86f93b", "value": "T1DB243DC5E98455A0DD59AB706A36CD3542237EFDA874A42D28DE3E273FFB2D31026063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928157, "uuid": "9843ba42-d35f-4a11-935e-41c15a7bee52", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928157, "uuid": "3fb9d907-0459-4dba-ae24-71a71e4e318f", "value": "6144:0AkzL7r9r/EDppppppppppppppppppppppppppppp0G:AP7r9r/+pppppppppppppppppppppppH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928157, "uuid": "7ccf34db-bcce-4e92-ab6f-09688ab47e90", "value": 224768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928157, "uuid": "f3108423-3a23-46b4-846f-ea94a402fc2d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928157, "uuid": "ca19f609-4834-4de9-b2f1-f3465c95852a", "value": "CQUOTATION REQUEST4.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b95c871-334f-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634917754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634917754, "uuid": "c2ea6e1b-3e83-4c37-8657-4f8162404a5f", "comment": "Malware payload", "value": "14bc7425fca8f4d6bbe6e4a15a7f12ea", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634917754, "uuid": "f65f8fe6-bfe8-4a25-9c54-518df7836260", "comment": "Malware payload", "value": "99496d1adc50289586eb3cb32b01284b9df5400034c01acbe382c9b1acb95ecd", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634917754, "uuid": "07ed57a1-0446-467c-9097-9c6b016b638e", "comment": "Malware payload", "value": "a7c507c7517b13c39412403fd9ddda8f2a882b06", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634917754, "uuid": "a754251f-963f-4df4-b0fe-73d647652d5e", "comment": "Malware payload", "value": "9ac66d871410e3283a8eb411615f230c9736a1f06e4f8364c9bb4f858830b7f4a7ff7342a082a5aa4263c6f059ce914c", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634917754, "uuid": "8f812707-29b2-4247-8b93-4cff5c6129da", "value": "T1F1A58D22F2C24437D1732A389D5B9764A93ABE106E28684B3BF83D4C5F3978179253D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634917754, "uuid": "8916f8e9-49e7-4f1d-abd6-cf9aa7f18b3d", "value": "24576:75QjxSfEFmW5AS7vb4slM3c/0QURyR/hGe3b9TU+YTe5GYSASA:75mV/lMssQYq/h1TPYWGYS3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634917754, "uuid": "9c5b3f12-9497-4455-80ef-6013b55066f4", "value": 2143232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634917754, "uuid": "7c9bcd08-1782-4a70-aad7-5bdbbeee5017", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634917754, "uuid": "94b15bd0-49ce-40f6-9aa3-b2a073f8d668", "value": "_-$teokq.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a68a8c38-3331-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634904888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634904888, "uuid": "9f98d641-0716-4788-83f6-6da33ea3dc74", "comment": "Malware payload", "value": "f750e72fb124b61b3e6384d432f8faca", "object_relation": "md5", "Tag": [ { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634904888, "uuid": "d25fd67c-2b0b-4785-9eb1-29df0621da92", "comment": "Malware payload", "value": "9a3578378e73b5cb541bcff2abdedd46cfea914f4bf786c3eeb2ef578f6c7ad9", "object_relation": "sha256", "Tag": [ { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634904888, "uuid": "a2c55e0f-4f4c-45a3-8ab2-3a29b9acb867", "comment": "Malware payload", "value": "74ddae2d685fd2888f82dc222933a992152c7312", "object_relation": "sha1", "Tag": [ { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634904888, "uuid": "d54e5490-19ef-48cf-89b8-f24bc552f5ba", "comment": "Malware payload", "value": "89a12cb6391890840a4fdd5c70f876295207742b48191bb949df9b44bed54d0ac4dbb9e315ab9f3d67aa728e10697f56", "object_relation": "sha3-384", "Tag": [ { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634904888, "uuid": "415bd249-1bb0-4cfe-95f4-f17dac100fb9", "value": "T11E057C0AF7B84776D056827DC9938A8BE3F178C54B70834B5291536E1F337A19A3B326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634904888, "uuid": "30686959-2fb7-45d9-ab18-ad80473a1da2", "value": "b1fcbcae8023f460c7296a86404de9d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634904888, "uuid": "b0c12c2e-0b18-415a-9753-900b87578085", "value": "12288:U0DgYq89aJyKXwAmliposlBT0sVxVTJU7RnVhGqYtZsUSdEPE:U0DgRiUAzFsD35TJU7RnzS3sUW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634904888, "uuid": "d9fd6707-afa6-455d-a14d-8f63487654d5", "value": 860292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634904888, "uuid": "f9159a0c-6494-4ee9-b2b2-b746f80cf622", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634904888, "uuid": "b4e6846c-bd22-479e-83a6-187506ed66cd", "value": "kingYouLove.jpg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70ac5af7-3363-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1634926272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634926272, "uuid": "780ed411-f37f-40d9-b779-5a0ba0110e17", "comment": "Malware payload (Quakbot)", "value": "6dd575fb4081e2946812ffa942557edc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634926272, "uuid": "9bce5066-0176-42dc-a350-59bc10f46e35", "comment": "Malware payload (Quakbot)", "value": "9b30eafba4d4e1c9491ed31dbe7f9de2acf4e217d8fa162d471993bb05ec14fe", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634926272, "uuid": "b17b8a59-f95d-4487-ab43-1e640c5c63e2", "comment": "Malware payload (Quakbot)", "value": "a93c65cdfe016795dd72a2d8bd8a2a3fb53a7729", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634926272, "uuid": "abf07ce3-aadb-4880-b1b2-1c1ddb59d590", "comment": "Malware payload (Quakbot)", "value": "cdde6b3838658e5b348a860bdd510232847f6f6951076ed32bf8aa75e12d921eba9ba0b96a7de15265b45aef65a2b261", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634926272, "uuid": "731b504f-4934-45dc-aff4-2dd73eba7f29", "value": "T10645AE3033B64421F273033448F6C4A15FECB9629874AD8F7186366E0A9B6D19B6DB5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634926272, "uuid": "4c8f0ccd-082f-4a31-9be5-d4b62a732bf9", "value": "1a5119a1aa1907d9cf1064edbeb2ac74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634926272, "uuid": "4beb9c02-79f6-45ac-afbc-c6d88cbcbaf3", "value": "24576:m/o9iBRudBYZb/WqWletdadgndrqnq/wKkVW:YRuEbeqWYMqnFY2IW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634926272, "uuid": "43789784-ebc7-4d31-b4d4-01ac92536600", "value": 1211813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634926272, "uuid": "1a679420-accf-4003-be10-7b0c1925a1ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634926272, "uuid": "2d6960ca-be84-4d19-9888-eb20cf059097", "value": "b22026d045873d54eeffc181b0bd282e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "989ad917-3381-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634939224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634939224, "uuid": "57b1199e-0b63-4884-ae6c-d016135ae50b", "comment": "Malware payload (RedLineStealer)", "value": "61a4cfad52834c537ae1411a388e755c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634939224, "uuid": "7adc27ea-33b6-45d5-83bd-0ba8f3b1a2b4", "comment": "Malware payload (RedLineStealer)", "value": "9b6a7db9202742073407252d5db59ded5b938f7c2e2383b00e87857f122be3bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634939224, "uuid": "79306472-6d19-4f42-a646-31fc3d7cdab9", "comment": "Malware payload (RedLineStealer)", "value": "e6d3f757b47c458dcb12f739924e0bce1f4b0afd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634939224, "uuid": "86e17335-16cd-47e1-aece-e0f582610a52", "comment": "Malware payload (RedLineStealer)", "value": "3867754cf400e5040051ba459e09d47be532877232867a8fc92bf195ed3a60770279311e0a008d05de9d405be096af8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634939224, "uuid": "b325bfcb-9bec-4e57-8bec-efa426ccfb43", "value": "T1CBA4AE00A6A1C039F5F362F589BA936CA53E7EA1672454CF53D11AEE97346E0EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634939224, "uuid": "f7e7d5b0-fff7-47b4-820c-5bfee1fcfb17", "value": "bac67046644aa5e445c1272184462c49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634939224, "uuid": "4a258cf2-0761-41c9-88d4-88a6867e7aa2", "value": "12288:N4h87OqTg7qf1qxh8EiO+Dz3PuaU5rQgYDDM:Nr3CqwxQH3PPU5Uo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634939224, "uuid": "d943f998-c023-4578-a57b-93898f3cad7f", "value": 452096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634939224, "uuid": "d6632e9c-1478-4e3b-942d-c4c29e339558", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634939224, "uuid": "dacc5f7b-9b4b-4c7b-a756-39b86ba306fb", "value": "61a4cfad52834c537ae1411a388e755c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cad76b6-330e-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1634889839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889839, "uuid": "88c32f51-6930-4900-85d8-19247f60b137", "comment": "Malware payload (RemcosRAT)", "value": "ccb20ed4f2e000c0dfea6ffa34bda6b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889839, "uuid": "25cbedea-294f-4e7b-9e04-366829f7bd8c", "comment": "Malware payload (RemcosRAT)", "value": "9cf41a9b8963753aa8d20e7f1f3ecea05f5ff876b15487682663d115a676117f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889839, "uuid": "8a015200-e2b4-45ca-8a22-b52410262924", "comment": "Malware payload (RemcosRAT)", "value": "80f1c218c9a4f006ac26d03d834eaa90ebcf4a5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889839, "uuid": "1f5b2cd1-2df5-43fc-95e1-0873fd4d9a9d", "comment": "Malware payload (RemcosRAT)", "value": "9db415c8bff3e83c471f71b93ba81d48273c993e361535f096267dc67a9943789b72a65a099ec7b491497c0a5e184525", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889839, "uuid": "935fde9b-3705-4454-bcb6-e970e460cc36", "value": "T18A05CE0432A99B22E9B95BF41521444047BB7CAE683CEA6D2EDE34CB0F77F444A51F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889839, "uuid": "e708825d-a1f3-4233-b23f-b44ec1c7a9a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889839, "uuid": "7c4d971c-d39c-46ec-9624-e04062c9b79c", "value": "24576:ZBoxwIfsRB0bv1ZdlfD95HkZzQkwG5+Lc:TUwCgB0bdZ3MJQkb5Oc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634889839, "uuid": "d7e825f5-b693-4993-89f5-e6a9747112c8", "value": 800768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634889839, "uuid": "5e2e5bfe-9cb8-434e-b7d4-398855647546", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889839, "uuid": "a16d4ea3-05e8-40a8-b18e-1bc435d37c04", "value": "ccb20ed4f2e000c0dfea6ffa34bda6b4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fed3ec3-3318-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634893978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634893978, "uuid": "b43d7a0a-8b8d-4a9a-8033-b83e16e407de", "comment": "Malware payload (Loki)", "value": "ca66da9aeea970c1476519b769af2cf7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634893978, "uuid": "75b55054-3862-4f65-8772-9455065dcbea", "comment": "Malware payload (Loki)", "value": "9dc5001348a4990dbe44f7e41ca10eaa0d367acde6e2c3c8c62bce4aac61e78a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634893978, "uuid": "14bdb8cc-6e47-4f55-b402-f7f74344aea7", "comment": "Malware payload (Loki)", "value": "cd6af9d8f93867dc34d309e5de212d6be8425445", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634893978, "uuid": "a636ce14-7dfe-4d7c-8bc3-f0121fe35e30", "comment": "Malware payload (Loki)", "value": "f620297282a4ea83883350f8d9098fc01e17a4c7ab839235acd51bc76ed0e7a563a55764ba21fca57bbb8cc6ed5a8226", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634893978, "uuid": "186a7baa-54f4-4009-a666-3d7c720fb764", "value": "T1E794DF463148A1EEC63A5E33BD825E1C7B917CB29A07D24FB5C3B25E097D2968D311B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634893978, "uuid": "f4d38233-9043-4638-941c-cbe4e59ba5ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634893978, "uuid": "ececd07a-99fa-4c6a-911d-a2b7568fb42b", "value": "12288:3+SIcGnB/wY94oEUi2iNbNdGlwscwxZmkyO5g:OSo/z94oEUi11NQwsU0g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634893978, "uuid": "be90267d-ad14-46bd-8241-6d97d3b064c0", "value": 430080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634893978, "uuid": "b76bd0c8-11be-4393-802e-0e2ad199ca1c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634893978, "uuid": "a6706677-135b-4486-9d94-bd477ccefa81", "value": "ca66da9aeea970c1476519b769af2cf7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69185057-335e-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634924112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634924112, "uuid": "72b1d378-896c-42ec-bf92-e52481fd5493", "comment": "Malware payload (Mirai)", "value": "9106712369737d474b74457edd5cf4ea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634924112, "uuid": "c0923f21-bec3-43ae-9756-309cc56737f6", "comment": "Malware payload (Mirai)", "value": "9e17033f90270d677b2965961cad02b47130eba34bae760ffda6ac62270ee27d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634924112, "uuid": "6d1fde5a-206d-4990-ad7c-194c11f3bb83", "comment": "Malware payload (Mirai)", "value": "7743cefb559e3e0000ddb7edbb04a4d8a71bfcac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634924112, "uuid": "7fca28ab-dbd5-4b2d-b46c-da89e7669101", "comment": "Malware payload (Mirai)", "value": "30d7ed7753e30b0758a04cf1b3c64040a6cf061587db21baa32661c2592344817f723f18b4e8138bd409a0dbd70101a5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634924112, "uuid": "453946f8-a607-434e-9e68-732fac9f5310", "value": "T153933A07B71C0B53C59B5AF12DEB3BF08B69B9A013D76185A10AEFD40372EB12512FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634924112, "uuid": "3706779e-2067-4b75-88a0-2deb506f6810", "value": "1536:wQKNfnzXd9Hj5ViBjMBVcfCUCJ3li118BB4umXxVqDrstKfz9e:wFLTltVcfrMvB4umXxVqDrIKfz9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634924112, "uuid": "f12daba6-b7f5-4b74-ae24-e8422a1a0551", "value": 93899, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634924112, "uuid": "e93631bd-b299-4d2a-89ba-b01ae9393442", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634924112, "uuid": "1afd637a-e654-4bdc-b350-eed507883606", "value": "9106712369737d474b74457edd5cf4ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1ba962b-32ed-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634875701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634875701, "uuid": "6394439e-d9da-43d6-b37d-7fc53258408f", "comment": "Malware payload (Loki)", "value": "3750954d333d5af9c39566cb574580ea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634875701, "uuid": "69444b02-9444-4a37-87ae-316e9a8882c0", "comment": "Malware payload (Loki)", "value": "9ebc9d5b090a94f877575bdcdf4982c65942d4f08cef716c35aac27b88f28c81", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634875701, "uuid": "b597cec5-496a-4edf-947e-7ef94b1f177f", "comment": "Malware payload (Loki)", "value": "d6d7760846187f518aae46f3e3e9ca6387a59ac5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634875701, "uuid": "275bb8e7-b272-40e7-87d5-938b12ffd979", "comment": "Malware payload (Loki)", "value": "95e280622d55a7188b6e89a0e81fa0dcbdb5caec0e828c4c60d62051cad700db894803412dd7244d91a3c9c3e6730921", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634875701, "uuid": "2e747ac3-d27c-4c17-bad7-c8bd109d650e", "value": "T13894CF2B3558C9A4D2392A33BDCB930C2BAA7CF4A853C50D76C6B35D55B13B10C391AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634875701, "uuid": "8f1eca89-af1b-442c-a55f-7bfbd14d0ad5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634875701, "uuid": "b86495e6-74f0-4c60-843f-d113167ac24e", "value": "6144:im8DAwnHo1q6Uqd2GhN5fbLsPDAWf0VdajpG771KCiZwv1:imOIXUi2iNRLsPDd0jaF41Kxw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634875701, "uuid": "eeceb60d-35be-441b-a98d-c9a3baab196f", "value": 413696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634875701, "uuid": "4348bafc-9988-48cd-856f-fa591103727b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634875701, "uuid": "8552c972-4049-424a-b67a-ce3ed81a7335", "value": "3750954d333d5af9c39566cb574580ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b124e37-3320-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634897460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897460, "uuid": "b7d930d8-fb19-4eb1-aaa4-9d5e0dcc19f8", "comment": "Malware payload (RedLineStealer)", "value": "a96353df0e45eabeb5e17bd3690f3a4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897460, "uuid": "f4c2b804-9559-4991-be68-80d53dbb8f5a", "comment": "Malware payload (RedLineStealer)", "value": "a014acb67295264a4f9ac982db6b65d858f259ca46dd92d836091ef872f78b7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897460, "uuid": "931660a5-83c8-41db-87c2-bc629cda64d9", "comment": "Malware payload (RedLineStealer)", "value": "85ff9021d74a9ba459fdab404cb09a6e23005292", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897460, "uuid": "029bbd8f-030c-4703-b58a-dbce69068145", "comment": "Malware payload (RedLineStealer)", "value": "68799838fe8dda20daf7ce9ee913eba80af8ce5408e2e169d5076e86b678a4015211a45fa76e043fdb380d9491f90fde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897460, "uuid": "bcab5e3d-f96c-468f-b4f8-f5da2f257673", "value": "T154F4E010A6A1C039F5F712F449BA9378A52EBEF26B2454CB52E427EE07345E1EC3171B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897460, "uuid": "d99ba6c6-d9d3-4218-963e-4544573821eb", "value": "4af4742906d30c7889c195169379a2f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897460, "uuid": "e612e99d-a41d-45f8-bb20-d2ca9d78d213", "value": "12288:sadJSa7pzzNe1B2giZ2gy4SVgZ8FuUJt3hKdb10oG4T5EN8rnWgBdVSIGKkDGp3O:sGdRoP2ghpFuUJtR/oG4ZbWsSIGRDn3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634897460, "uuid": "ed579b1b-e2bd-47dd-80a0-10e84d8d1a00", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634897460, "uuid": "9a324887-f419-41cf-86a9-97dd9577b01f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897460, "uuid": "4d6563f5-883e-4b33-9151-166ce42b6a35", "value": "a96353df0e45eabeb5e17bd3690f3a4f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc337708-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928117, "uuid": "a9125f06-34ee-4153-965c-b7a05b946ecd", "comment": "Malware payload (RedLineStealer)", "value": "03f2f05fd23256e1e87c96107a388aad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928117, "uuid": "940e7304-e194-40ed-9285-170697f1a8da", "comment": "Malware payload (RedLineStealer)", "value": "a01644daf56c53fc12d8757a63d9ccf35929e30d17fe6f1076f6320d2e1115f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928117, "uuid": "aa0d62f9-9087-450f-8317-6132ffc85fa3", "comment": "Malware payload (RedLineStealer)", "value": "5f04ef9eb70f32a0245d9c752193693ffacf57fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928117, "uuid": "4e739c05-ba7b-4743-9ec8-4c4f859586a5", "comment": "Malware payload (RedLineStealer)", "value": "0a262ab839511591fe47e74564926d7ba501fa5f0d3e2271af7de5987402404f170aed4dff0b19b96454d7dd78d2e427", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928117, "uuid": "c08b2235-e806-4dee-9ebc-86ee5b1c83ac", "value": "T1CEE4E110A690C031F1F712F84ABA936DB53E7EA26B7551CF52D126EA46386E1FC31327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928117, "uuid": "9f54ebe6-b717-4db4-8f51-0ded4c4a75fb", "value": "0aa8675e96bbc2351e2af940f447c93e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928117, "uuid": "9f8ee4dd-5aa2-428f-b1fb-b8cec268dcdf", "value": "12288:3vxAUQlLg2TN17alCY239PYyp1EirrLzCFMyimPSOL9ZXePNsq+mlj:/FQlL9+gNPYypBrrfdmq4TXel1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928117, "uuid": "8ea45ead-b331-42ad-afcf-80fc3c06910f", "value": 669184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928117, "uuid": "6730283a-7c82-426d-b084-c2835e5c0eaf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928117, "uuid": "022de9b1-0f8c-4bff-8aa7-8ef63d976abb", "value": "03f2f05fd23256e1e87c96107a388aad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ebffe07-335e-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634924121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634924121, "uuid": "b50b5d02-3502-4521-8ef2-aeb83ce8efbc", "comment": "Malware payload (Gafgyt)", "value": "f295b210496a25c5a60ba67168cfe339", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634924121, "uuid": "4f89faa4-3608-4efc-8a2c-5c7b5cfb64d7", "comment": "Malware payload (Gafgyt)", "value": "a02d4bd3a6faf4fd4335293f2d33f445a96bb6b2c9b6c7d23026fc6f4c44ecdd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634924121, "uuid": "35ce9ced-9c9a-4839-b14b-f9816c6dc18f", "comment": "Malware payload (Gafgyt)", "value": "fa8774f3c97459c59a4120c5e579f2990e4394e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634924121, "uuid": "d52c2632-d2bd-47d9-9564-325e5dfe9aa3", "comment": "Malware payload (Gafgyt)", "value": "e6f44aa93688fcf2234c6b53043aa62f8c60d5ab5885e0fa98049da869348552dfbf1e24428d69cea492fb12d2359344", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634924121, "uuid": "163f33c0-2b52-47ae-8ae8-b01f15862d02", "value": "T13CC39517BB618FB7D81FDE33059A8902108DE58A12D96F6BB2B4C92CE74B94F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634924121, "uuid": "5a3a42a0-b007-4021-93eb-691f73936748", "value": "1536:/cHeT5CAms/Y8Zm3lKYA43gMJwSkJ8Epro1DzUh8rmW+IFB1Df11hR/:/cCLqAmgMJM8EhaDw8rmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634924121, "uuid": "c1d672a2-dab0-42ec-a441-254be0d892ff", "value": 126042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634924121, "uuid": "fe7d865f-8a1c-4ef9-b11b-82f9337fa64b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634924121, "uuid": "f500d227-52b1-429d-b63e-1251e4f33d32", "value": "f295b210496a25c5a60ba67168cfe339", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91b75adb-330c-11ec-843c-42010a9c0014", "comment": "Malware payload (CobaltStrike)", "timestamp": 1634888961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888961, "uuid": "7fef1510-46ec-4fcc-9f2f-a4d4113e6221", "comment": "Malware payload (CobaltStrike)", "value": "f2485164957992170b54c7d63b5f980c", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888961, "uuid": "b701faf1-0ad9-4751-b664-a657b7239a37", "comment": "Malware payload (CobaltStrike)", "value": "a0393d212d8c445c500982f9f9dd60e17f9b752bc278ad113bb53b789764d643", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888961, "uuid": "58c04214-1dba-4597-a446-ee23be488406", "comment": "Malware payload (CobaltStrike)", "value": "8218591fbf08ab822d1a297264cbe04889e2b984", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888961, "uuid": "b48480d0-3cb0-493e-b107-2db9758788e0", "comment": "Malware payload (CobaltStrike)", "value": "54426440dec067002ed34b1b3eee9f585a4debdefc26f0e93d55ae3c659465105f2e7a4d2659032057d30dd224069828", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888961, "uuid": "22999cc2-75a9-4ec4-baab-305076c478b2", "value": "T197952916B8E20ABAC57EF1358592936176313C6947323BD71F80AA6A1E75FD82F3D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888961, "uuid": "c5888a08-9cf2-4e8a-821e-86e5dcec77e1", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888961, "uuid": "20c2b17e-2f2e-438b-8361-b45e9b3843da", "value": "24576:wLrS8JlpeQUsqWZ3ViuVYrRmZQtHIMcqZabEUTcE1J:8JlpusqWZ3QuNZQtHE1bE2cE1J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634888961, "uuid": "8096cd40-b285-42ab-8611-b91554b4764d", "value": 1946256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634888961, "uuid": "1025610c-71e4-4b88-a954-4381e1701b74", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888961, "uuid": "d9a7fcce-b60a-47a6-bbfd-a0ca8695d1c0", "value": "a0393d212d8c445c500982f9f9dd60e17f9b752bc278ad113bb53b789764d643", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ef110b8-330c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634888957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888957, "uuid": "0befb2ff-83c0-4fc6-8673-afaf03297e80", "comment": "Malware payload", "value": "97a350cc357d28bf76cccaeabdb4e07f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888957, "uuid": "a229817f-a8db-4970-8632-6d41977f6c70", "comment": "Malware payload", "value": "a132c7776fdd1d661a7ca045a8296bfb51d2c4d9fc722fa39612e06dad9a92a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888957, "uuid": "0adcfa9d-0c3f-41ee-af71-e0c440cde57f", "comment": "Malware payload", "value": "5a882030ceb0d97fbc013ec9c45504851f3b260e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888957, "uuid": "0cda321b-a498-433f-9e41-f0717ba3f4a4", "comment": "Malware payload", "value": "19cc704265bee0b878708476db0ac262063c634b5b1cf40529776891047c4246a780607211ecd62594817fd5e64beb36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888957, "uuid": "da4fa6c2-3464-43b6-9cb6-cc7677dc9d81", "value": "T1EE853B4BBC9160B9D0AEC2308B65D291773178A5073363DB2B50A6BA2F73BD45F78364", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888957, "uuid": "fa091382-e94a-49af-af5c-d6bec3eeb726", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888957, "uuid": "e1f8b1d6-7166-456d-9fb5-50c113c6f850", "value": "49152:KgFcAeprb/TYvO90dL3BmAFd4A64nsfJsAo0uHMgv71zFb1:Kgfrd1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634888957, "uuid": "27fe0d69-21a7-49ce-a205-44c04987a62e", "value": 1751720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634888957, "uuid": "3f132b7b-535a-436e-ab75-e67905cb0b6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888957, "uuid": "dae4135a-5f63-42c0-87ba-3ff4f13b4d04", "value": "a132c7776fdd1d661a7ca045a8296bfb51d2c4d9fc722fa39612e06dad9a92a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8043613-332d-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634903280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634903280, "uuid": "c0dc25fe-2d18-47ae-93b9-43c998f03bf5", "comment": "Malware payload (Gafgyt)", "value": "752f83a7ac1a47dacd9fa20f6a51e6ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634903280, "uuid": "1187da81-0131-40b3-ab3b-360c1b3a5316", "comment": "Malware payload (Gafgyt)", "value": "a21acdfc9474060e1c6407ed45369318e96d7f8d5c4d986c47b0959f5c8b9829", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634903280, "uuid": "e3914ef7-fc85-4a9f-a81e-e7203e34bd50", "comment": "Malware payload (Gafgyt)", "value": "7689ac7920bfd74927779e285e6d7d6a85c908da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634903280, "uuid": "cd80ad90-80c9-4ca7-9a2c-0b8082e8d200", "comment": "Malware payload (Gafgyt)", "value": "a4fb6607d1cfc81dee9e4c9ccbd473362e58f2c41b0ca8ecb1d277515733737446a00ee907b7a91467732986f9825eb6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634903280, "uuid": "4aa87d20-d215-4f61-a18b-9f49b61b5559", "value": "T1ECA33A37BB130A23C0CA547212E30731BBB5D3D928FA5247BAA16DEC6F166803566FD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634903280, "uuid": "991bdb6d-d250-463d-b1a7-2a1e455373bd", "value": "1536:xfRuqNM5h7t/RiRt4nsphaQoRKzO6F6OXj6ufeRTe:OqN8jRiRDphaQoRKzO6F6OXGufcTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634903280, "uuid": "22624b2c-5487-4378-9b30-077709221429", "value": 102442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634903280, "uuid": "2a219430-5815-4ed9-a382-2800bb9dce89", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634903280, "uuid": "46179d67-56b6-4843-866f-b008a0f166e3", "value": "752f83a7ac1a47dacd9fa20f6a51e6ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7c0491b-336e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634931089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634931089, "uuid": "4e452c74-b388-4237-82e3-10dd01e6ee7a", "comment": "Malware payload", "value": "b1fdb02f9a318cdff5cd3a4a38fe7037", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634931089, "uuid": "a6bf40b8-c0ae-4c69-8621-0fd3c9532d04", "comment": "Malware payload", "value": "a24784cc4bd53f7d3ca9700802dd60d01bf245128e95800ccd60841f1e1075f4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634931089, "uuid": "e3498777-0e6a-4257-8fe1-4609e03792c5", "comment": "Malware payload", "value": "873896ece2ef8d9f918715eb1a15a5d30c66c25b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634931089, "uuid": "f518980b-6637-48b6-8e43-2cbff0dda426", "comment": "Malware payload", "value": "f77cf5cec8ad37ebe38ca33c35b61f9d44992d34b53126bf7082e5d2e169ba13256bbf5718d343ac5fb1f2e233336a85", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634931089, "uuid": "dd9c9973-2779-457c-9762-76a93705b5f5", "value": "T11A6633C1909D98B1D9D78F32DE6956268ADEFC2BDC70824E8D50AC2D2D605128F3FB74", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634931089, "uuid": "83cc585c-0dfd-4e82-a54b-673a8f4e8441", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634931089, "uuid": "b4a0ab4d-b75c-4ce1-9599-44422ddeea0d", "value": "196608:FG2uiMQB3oZJNJp39JNa1XfeFPIlIOYszyKXj0ru:FGBQBY7NJp81XYIXYvKXiu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634931089, "uuid": "f178ce99-601d-45ce-89c4-fa7ac78c133e", "value": 6522046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634931089, "uuid": "03f3ca76-100e-488c-b617-b98cea3560ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634931089, "uuid": "e355bf63-c1c4-4a2d-9738-d460786085a1", "value": "b1fdb02f9a318cdff5cd3a4a38fe7037", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0431c035-32e9-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634873692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634873692, "uuid": "645df098-ff4c-4d92-9fdd-9fa94674ba1f", "comment": "Malware payload (Mirai)", "value": "47cd8f185b564beb69cf983d063e2627", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634873692, "uuid": "76a708f0-176a-4f4e-8164-0fab09f629a7", "comment": "Malware payload (Mirai)", "value": "a2478d0b0c29a344ad3393305d1173b080c57f6d08eaa9447191bd439a5a8f5e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634873692, "uuid": "896adb0c-3cc3-4715-a1c7-2a6548ad3b15", "comment": "Malware payload (Mirai)", "value": "15c7944fc2291e506d19cd66789c91ff4f4831d6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634873692, "uuid": "8a0f3823-436d-4306-8a39-afd553605c08", "comment": "Malware payload (Mirai)", "value": "8e2037965745dd179c9767549bc3cf676fb2e7291abfda9a5a4e3505beb34d05e92224de65f020fd11b7dbca906d40e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634873692, "uuid": "69aba728-604c-4fa3-a074-d61845a80684", "value": "T150332981BC919A12C9C423B7FA2E01CD372563A9E2DF7207DE216F1177CA82F0E67556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634873692, "uuid": "16ea7779-0d34-4d6a-993b-ab366b8d6540", "value": "768:aw8hF5yjQQsLC3TfWvHbXFspnpeydNSwrfqUoOPbmBNOS9iVjySfR2MG:GhF5yjQ7LC3TWvHbXCGCSkfqp91", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634873692, "uuid": "8017e226-5260-4655-bca5-6cb3435ea1de", "value": 54268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634873692, "uuid": "df5bdb25-7a8b-4b48-8966-025107884256", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634873692, "uuid": "28e97a7c-3d25-47c3-acec-5af91f81ef69", "value": "47cd8f185b564beb69cf983d063e2627", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "904bc427-330c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634888959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888959, "uuid": "9239ed4e-315f-4565-9d0e-8a22903cb2f7", "comment": "Malware payload", "value": "fa0d597a0bfe579543507575c2e1846a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888959, "uuid": "73a7f998-8743-4c11-a6b4-ba6d04f06dac", "comment": "Malware payload", "value": "a388bd4824c6bff328249a86aafc9e7dcd036e148c99b76aa1e5146f635abb90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888959, "uuid": "7de66091-ccd7-4ad7-85d1-e8081bc4789f", "comment": "Malware payload", "value": "03f4f3a2f1b1742789477914c7b71ca6602c71c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888959, "uuid": "2ba441e4-4dbf-4d80-9ca0-da3108a0a93d", "comment": "Malware payload", "value": "9f6652bd417ecce2f521c6ab0c53e9de06b4fe639b661c221de3df69f2d44d5c48df5d0538cb3aaceaf0af57f04d517e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888959, "uuid": "23460bd9-fa4b-41e8-8afd-f0dde26610f6", "value": "T152855B17BC9094F9C4AAC2308AB5C2A1773178554B3363DB2F50A6BA1F72BE41F79394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888959, "uuid": "d9dc4f7a-8839-4d8b-8093-85d0d38a2114", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888959, "uuid": "5561638a-5b0c-43b4-a71e-55cb7263d7f2", "value": "49152:4bCM0kXrb/TYvO90dL3BmAFd4A64nsfJ2eIdBHcgv71JRb1Q:4b8F112", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634888959, "uuid": "80bf73d4-1161-4766-b7fc-2b22467e513e", "value": 1751216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634888959, "uuid": "7f43b949-ddc0-4c4d-a5c7-5c44e3bccb27", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888959, "uuid": "933321b6-7898-49d9-9a1d-f0effb0311ac", "value": "a388bd4824c6bff328249a86aafc9e7dcd036e148c99b76aa1e5146f635abb90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4f72b8e-3328-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634901020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634901020, "uuid": "cd1f9094-8786-4d46-9ae1-d90cd75f6537", "comment": "Malware payload (Loki)", "value": "64fb2c665aeaa8ebee0847d93dcd0e47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634901020, "uuid": "25323eea-f7eb-474b-9037-991a6ba79b33", "comment": "Malware payload (Loki)", "value": "a404a5137331f33c5398664ca84996ade49d3849403dc9037f74a5d5311a332a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634901020, "uuid": "1f432380-c92b-4459-91f6-a40674ace751", "comment": "Malware payload (Loki)", "value": "9cf26ab3b2d0b3c3babd2a08901401e740b08346", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634901020, "uuid": "39ea0569-bf7a-4ac6-89e5-de12bbc8b673", "comment": "Malware payload (Loki)", "value": "0de8899af88dde8f8136d4954f60b09b3c00411f9334f31de03dbe65128a609aebb5ba3816e7661575957c15a46fda8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634901020, "uuid": "c78b625a-c550-472d-82a3-fe1c9a41114c", "value": "T16F34236396D2B5BFD18722F06BA23F37D6375A4009A2E2C707B43F77D8205C6A616C52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634901020, "uuid": "1da3b7fc-a22e-4b33-882c-fa622fe09503", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634901020, "uuid": "c0203b1a-c542-4bb0-8989-10c5ef9d7058", "value": "6144:wBlL/cLODAoVKlKxiyI7Tb4z+6Gc7N77d13fcwqFCQFkZcI:CeK38Ez1GcR113tqkQFkL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634901020, "uuid": "3f2e9683-de8c-4e32-8ea5-aad603b54d32", "value": 246282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634901020, "uuid": "05927a0d-5929-40fc-a90f-4eb1ec417f2c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634901020, "uuid": "42b037ec-5cc5-4361-a1d7-500835b72ac2", "value": "scan_2210.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd8c23f5-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928119, "uuid": "1acbface-924b-4dd9-9e48-c532a99203cd", "comment": "Malware payload (RedLineStealer)", "value": "8b9e83c83ae81fcbd74ab39b85298c04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928119, "uuid": "c2ff1634-0b03-4813-9039-60b17917e9cd", "comment": "Malware payload (RedLineStealer)", "value": "a557f57a2434180c029c72ce310e2c4d1585c2f53aea58c375634f45754757a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928119, "uuid": "44d04642-80e2-4042-9bb2-a34c8b1ad060", "comment": "Malware payload (RedLineStealer)", "value": "53b8026213abed21634724f814d7f5d968ec8856", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928119, "uuid": "ed504d9d-1bb4-4e63-8768-4ed4b7861f2c", "comment": "Malware payload (RedLineStealer)", "value": "77fb81b683cff74d878128adbef14baaa44b2d1c983d2a0ee21c6e040e94c04c359a25efd8935a4baebe90ba5015aae4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928119, "uuid": "1699a685-ddb6-4ba9-9915-ec275c5676ab", "value": "T16ED40188B249C871C26DD570483597A4173D78617821817EB3773AAEEFF41A19EB23B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928119, "uuid": "ce619161-d39c-4327-a1bd-682f5458c8ef", "value": "96eae633c3835f4142e00d18fc3a156d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928119, "uuid": "acae62b3-4bdf-43bb-93aa-0e0501da93f2", "value": "12288:qKcp64AC6Gxbsta+EFNFZCYXUM3970nC9pSLEjeDM:q5MDVGKtv04YXUa9InkpSLEjx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928119, "uuid": "1caa8672-9e73-4f10-96ad-2d2e3fd33dfd", "value": 646144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928119, "uuid": "a4639ee9-eb95-48d2-8dfb-5509e0f5fa34", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928119, "uuid": "f8f4d709-591d-4de7-97db-360566527ce4", "value": "8b9e83c83ae81fcbd74ab39b85298c04.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf0ab2d3-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928148, "uuid": "795662cc-1302-4505-82c1-01a0ce413da7", "comment": "Malware payload (RedLineStealer)", "value": "43f12c2a963f325b228dffb75b8283e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928148, "uuid": "75378230-5de4-4803-b8a5-1535ecef3714", "comment": "Malware payload (RedLineStealer)", "value": "a56535178bb2c4e9fdaf4c5c6d26d58224b9bfac8b0c4be2b035b778e6ef6d9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928148, "uuid": "db9d933d-3d4c-4f43-93ec-d8a27c9be61a", "comment": "Malware payload (RedLineStealer)", "value": "8493b134fe922d69ca59b5b0aa77286d35a97268", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928148, "uuid": "386011cc-89cf-462d-a559-c3547bf9a9e4", "comment": "Malware payload (RedLineStealer)", "value": "1f6e63c3f7a1cf7527463bc0a5a69901d0c02d5a6da66f6a2791815dbfb6fb32cc603bc85c05c0678ce92f7c5d348f23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928148, "uuid": "6d9755a5-33b3-4ce8-917b-6f5a1adeedba", "value": "T1DFF4E010A6A0C036F5B312F44ABA9379A53E7AE15B2454CF52E51BEE47359E0FC3132B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928148, "uuid": "536df04d-3585-43c0-b76c-92704a5b4d08", "value": "9cccee30870eeeef9fd80f169e4bd55f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928148, "uuid": "54c54401-9189-4255-bdd8-746ae2277eec", "value": "12288:dmATmKpthXp79zkH8JgUN24zZuGnV6h5rxvmJf3vFgsZRzNSR8EueCyX:dRqKv559TJZRJX7z4R8pG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928148, "uuid": "2538c150-e296-435d-a098-7befd1e4a7ce", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928148, "uuid": "69069f20-8dce-4801-9435-7887c6659d6c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928148, "uuid": "4a324238-9454-4626-a881-9f46c8a65a20", "value": "43f12c2a963f325b228dffb75b8283e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3c7923b-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928103, "uuid": "e008cffd-3403-43c9-85eb-36cf88f996f6", "comment": "Malware payload (RedLineStealer)", "value": "bd70b2d9fe9a7f840a9923c096d32251", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928103, "uuid": "8adffc10-ed59-4f8a-baa3-ce18c8d18240", "comment": "Malware payload (RedLineStealer)", "value": "a5cbe2db9201e14b3f2b9997878351e28e3b51443e9410c2e680bb814c07befe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928103, "uuid": "16883a9a-b98f-4e7f-b334-4db019264f01", "comment": "Malware payload (RedLineStealer)", "value": "e5c61c8d88f5d9515f0f1b20cb56708d82fa60e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928103, "uuid": "a6ab97da-b0c7-41cd-b4c3-f4725591d7f8", "comment": "Malware payload (RedLineStealer)", "value": "781b6e4bab0298115d4161cd10111c49c834a37e78a56b240adc5bc32aac4106b32744631c2524492b4799449f628143", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928103, "uuid": "cbbe06cb-3582-43d2-b0ec-e0986ff380ea", "value": "T183D402D83288EC79D6A109310836D7D5173DB86178210136F79F3AAEEEFC2A05D6536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928103, "uuid": "270babdf-26c2-4a6b-a966-d3cf51e3709e", "value": "96eae633c3835f4142e00d18fc3a156d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928103, "uuid": "bbf91ae9-342f-44d1-a918-7713c2a78c83", "value": "12288:Ga8p6e9BVhpF0oJOSunvPipv5nE+eMzYAF++1QNt+75t4jLnCgtaUD+YeDM:GJMenVhp2oJLI6pvpE+RIONcLpUUyYx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928103, "uuid": "48d569cc-d8c4-44fa-a4d8-483f0a7ab505", "value": 646656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928103, "uuid": "68c8ff85-e0de-4ef4-bfc2-ff191856eb74", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928103, "uuid": "d33ebe4d-f009-49c6-b98c-509e3b06d923", "value": "bd70b2d9fe9a7f840a9923c096d32251.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f84bbe43-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1634928218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928218, "uuid": "5e29ab79-336f-49a9-9b87-439428aeb34b", "comment": "Malware payload (njrat)", "value": "ad0f6231d44f6d0e08379256a3f765c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928218, "uuid": "fcfe676b-3b85-4632-b7fc-17df42c31262", "comment": "Malware payload (njrat)", "value": "a665eae243d8d987de7378c95a9e7894d95b7ca6632e7455dcb9431870e67016", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928218, "uuid": "7aa7925f-c6a3-448c-84d7-a79793914968", "comment": "Malware payload (njrat)", "value": "765c2ba3990b9c2a603a0012dfac8e34e39eda38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928218, "uuid": "167ce580-78c6-474d-be16-b6661287be47", "comment": "Malware payload (njrat)", "value": "416c79620605b7ffabece3ac03c4e76c4f0b403fb8dbcc96247173ea39353ca368a1f4ba64bbe80da1a76353584918dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928218, "uuid": "45fc3ae9-9b15-445a-83f8-3d74b3af35bb", "value": "T18E94BD159A95BD21E8A7C6333823D100062492C19B729B5ED784B31FFA6F20F759E7EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928218, "uuid": "9480909f-3916-49b6-a9a8-160663ff38be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928218, "uuid": "6de446ac-ec88-4af2-a99c-84b616780198", "value": "96:fsDYb94x6pIEYaXcwhx5zWLYxT9FS7Z0epAIb+zNt:UEb94x8pYapz1WLOxU7Z0dcY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928218, "uuid": "3718335b-a9c9-42be-b8a3-4f610389bb2d", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928218, "uuid": "aa20db41-99e2-4e24-a957-a607ccac9e09", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928218, "uuid": "22920b9b-4369-4350-8fea-68d05d11b04e", "value": "ad0f6231d44f6d0e08379256a3f765c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fcec680-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634927989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634927989, "uuid": "ed04b661-ee61-438d-becb-db4c42c8783f", "comment": "Malware payload (AgentTesla)", "value": "96ba365981ceab9b90a1bdf5edeb0667", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634927989, "uuid": "3e1bbc55-bc90-4599-ab7e-999f3bcaa09c", "comment": "Malware payload (AgentTesla)", "value": "a6d4d40ed4005906347b782bf9b5625b9ac4adf0b2728b695e86f0e4c7cdf4c1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634927989, "uuid": "09e7f36f-3e16-4497-ab3e-3f7b9bb02d27", "comment": "Malware payload (AgentTesla)", "value": "723a587b705efc8b626906f72a0cd3931b9b24d7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634927989, "uuid": "5b457b15-1d4e-4c86-8a7f-f3356a98e525", "comment": "Malware payload (AgentTesla)", "value": "0eeedc801e56e7a62ddc345c4e4de49b6a633a1d170028cc6bc9ed1c72dac5e8a19641347e8bbbfcd9befc14bcb7375a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634927989, "uuid": "a0f774df-3b18-4d2f-81a0-572e2f4d0dfe", "value": "T150F46C7C3554BDCFC85B8F3545541C64A62268A7034BF34370A729DA8FAEBD69E002EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634927989, "uuid": "4c0b66a2-9f7c-4162-b9b6-bade53ea3af7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634927989, "uuid": "0d9adcd6-59f9-4394-9d30-92761c4a6dbd", "value": "12288:QjFBZpTIhqGLeYM52n6cjv83K+WFAaGN7LUM+LYc+jEaeYMEQBNj7mERLFW27ZYd:mnT/G/ao6Qka+hNH4F+j0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634927989, "uuid": "8c94084a-ced4-4d71-badc-64a2b5110e13", "value": 750080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634927989, "uuid": "099b8665-35ab-4fd7-a9f5-0cb20dbd7b54", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634927989, "uuid": "0a1254e3-d30f-479a-9c94-f9f9e358a520", "value": "1111110.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5c8ce6d-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928079, "uuid": "4a49297d-99c6-49c5-bfc1-5a090211126b", "comment": "Malware payload (RedLineStealer)", "value": "b4d859f6e7a3a8f6413cb2b62535676a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928079, "uuid": "7f587608-904d-48dc-b057-cee8b899f70e", "comment": "Malware payload (RedLineStealer)", "value": "a8289624c4e96fb3a3f30c3b356d32dda4a2c035fb2c469d005156b0ec3faafc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928079, "uuid": "637f38b6-1a4b-409c-a38e-10175f7fe118", "comment": "Malware payload (RedLineStealer)", "value": "3acc3baf174fd6db7ca916a5b3fd248599c1706d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928079, "uuid": "b6b11538-eeea-4371-9667-92d515ae757a", "comment": "Malware payload (RedLineStealer)", "value": "6344bf30e788236877ebd8c868184dbb514bcff913998c1e444f5181724f01dd733943a2e5e70f697753b628a292a05a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928079, "uuid": "cbe68f62-a179-44d9-bbe8-ae9b938455bd", "value": "T1A9F4E010A6A0C035F5B722F849B9A378A53EBAE15B2494CF53E517EE4734AE0EC30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928079, "uuid": "46a94365-a494-4e84-99de-632a0f340cb3", "value": "9cccee30870eeeef9fd80f169e4bd55f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928079, "uuid": "1d580e33-957b-4e85-b036-4433044ee412", "value": "12288:WhHYJd8LyarIL4QTw63IhUF/3rLQI12qWQJhYOTDPBqGAsAqnrz9LDiqRZejmp:W1whcIrTb3Ihg/7LQI1Y8YGPQArztDiu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928079, "uuid": "ae0b7ec8-6595-4460-a24a-0b985ff264fc", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928079, "uuid": "89090be3-aa1d-4f72-bbb6-aca043672ac0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928079, "uuid": "bdf809b1-db31-4e13-849a-3977f4da8a57", "value": "b4d859f6e7a3a8f6413cb2b62535676a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fdacd5b-3374-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634933411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634933411, "uuid": "75afc795-2e25-43ef-951a-e654f1866562", "comment": "Malware payload", "value": "2ea682eee8468fdee8f1361934625225", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634933411, "uuid": "c828d3bd-bfde-4878-ae5e-1c4d31946d64", "comment": "Malware payload", "value": "a8a39400f62a9033bc9c447cca7c5b69a66555fbfe5913a5d773503d9f1cad9b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634933411, "uuid": "d3b8d5f3-48e5-4f99-a978-ddcc19e119a0", "comment": "Malware payload", "value": "264c0d6f5722df8f4480ffd14a89ea8a982bfe3e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634933411, "uuid": "73388dff-fc63-4957-9095-fbdc168405c7", "comment": "Malware payload", "value": "11be6c8310b64a72ebaaef8f774639ada52f76e01197bca4882dcf2b91c2b160bf7f13348844c3f6c26ad85d37bb0e19", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634933411, "uuid": "e9b8699f-f2a4-41fa-a87a-f8e749282044", "value": "T1C094BF00AA61C038F5B316F589BA9378A53E7EE15B2054CF62D51BEE97395E0EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634933411, "uuid": "b024d960-4eac-4a31-91e7-51ffbe1a411a", "value": "bac67046644aa5e445c1272184462c49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634933411, "uuid": "0732eb79-1348-4091-8600-6a2e1e897a63", "value": "12288:vbRN4YywAwR2TlHAqNiw18kPKlGR0zp4U:v9N4/wR2hDekPcGR8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634933411, "uuid": "0e270d32-f45b-4cd9-ae75-a5fe421f287b", "value": 443392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634933411, "uuid": "84bec404-78cf-4a69-9462-da5613c54dc8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634933411, "uuid": "b594856d-2c33-49f2-a14e-c1ac680a0330", "value": "2ea682eee8468fdee8f1361934625225", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48616df2-3349-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634915038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634915038, "uuid": "68c6d10a-eb36-433a-b718-4695994e1a21", "comment": "Malware payload (Formbook)", "value": "e2827700e9676ad0d4b734d5f4a221b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634915038, "uuid": "d8cc21e3-64e1-4fe2-9ab8-3dc7ae7d5536", "comment": "Malware payload (Formbook)", "value": "a8ea6b5e7721a2d508d362f9e75fc38fe3b845375c358829ef0604cc2345aa13", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634915038, "uuid": "b68e19fd-8175-460d-a316-08c22d4852fb", "comment": "Malware payload (Formbook)", "value": "2997b29050c7e44072f886705cbd4be6a3edda97", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634915038, "uuid": "ae34ba5e-227b-4401-a6b4-dfc6566a7d08", "comment": "Malware payload (Formbook)", "value": "4193a1dc3552c68e6c3af902a05f5848baf5b0e62076371a33291a03ffda5bd4d15eea54e82cc2ecfb8052d0211fdb7a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634915038, "uuid": "88c50109-288c-4980-9da9-e4a480d36fd9", "value": "T127E45BBC3155BD9FC42ACF7B46502C149621B8A7020FF31361A726E94FADBD68E412E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634915038, "uuid": "096bab11-6c98-4a12-a4ed-f3b30efb96f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634915038, "uuid": "59420e84-6187-434c-8352-b450336a091b", "value": "12288:FRZHIUoN4rfIpj+fvRwIyizYi98wUpAeeqRVTHOi5xNZEraoosn:F3oUoNe8Knnyij98wieqnt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634915038, "uuid": "8b61726e-624b-451d-baec-a09742f31e13", "value": 701952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634915038, "uuid": "8031a8af-9772-42fd-91c0-12a88a635b8b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634915038, "uuid": "6ba5116f-2147-4a78-84bb-c25906c84753", "value": "e2827700e9676ad0d4b734d5f4a221b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94909bea-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928050, "uuid": "66eedbca-5636-4b6f-92d3-f244b21bca52", "comment": "Malware payload (RedLineStealer)", "value": "cf31ee0ce98bff8008855fbd27d148ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928050, "uuid": "92d81a85-919f-43a3-a548-1ebff910c95e", "comment": "Malware payload (RedLineStealer)", "value": "a908ce84a81128f72ad3a883a37b8daa5fa998366e35d2436b85dcc1d48798ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928050, "uuid": "f744a646-818d-4c00-b8e9-2728aad5184e", "comment": "Malware payload (RedLineStealer)", "value": "799e613e9b1637124d09fe20b52193b56984d2c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928050, "uuid": "1144f25b-6a96-40d9-80d7-61cc2fa39eec", "comment": "Malware payload (RedLineStealer)", "value": "333e6e669a7f1577195576a5bf67596b780f69af40993660ac72016eaf6f5e13517f0198f51b83f5abc1b37f5bc3055e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928050, "uuid": "bbb22e7c-f659-473d-be2f-8886a034e9ac", "value": "T12DE4F110B790C035E1F712F84AB69368B92E3BA2AB3155CF52D416EE57746E0EC3136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928050, "uuid": "a5df9866-1efe-4403-9fb8-0cfd45e8a705", "value": "25e96726029c322936cf0033b6a07058", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928050, "uuid": "f024d7e5-543b-46d3-a74e-d3a4da0ea8f5", "value": "12288:Uu7abr3+1srOtEsbBu0DxOQBIv/KXmwXNJOzipXxj:7ebr3T+EwBunQB2CXmk1xj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928050, "uuid": "4459e6d8-1203-48e5-94a5-76c5aadd8900", "value": 669184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928050, "uuid": "e67bcc3b-c76e-45e4-9645-019da93e14d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928050, "uuid": "028ed1be-b57f-4a1b-b66d-38e72ee5e2d6", "value": "cf31ee0ce98bff8008855fbd27d148ae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b70f4d9c-32e1-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634870556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634870556, "uuid": "b12bce56-5ff4-48b8-a281-73d4a1fc1451", "comment": "Malware payload (Mirai)", "value": "dab5a66dec7a668139021f4674ebc98c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634870556, "uuid": "88dcd4bc-d152-40cb-a92c-ebca5f5b2f67", "comment": "Malware payload (Mirai)", "value": "a916cf90dac3bd09a0370e1a4777717134b26fa1750862aaf3933cce081b7c2d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634870556, "uuid": "ad8c6411-a3d3-4335-8f32-5202cc5f7478", "comment": "Malware payload (Mirai)", "value": "b4e1d9324cc77690c50bf9dcdf683ac460153e26", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634870556, "uuid": "94d86528-eccb-406f-9f64-f4d8fb101bdd", "comment": "Malware payload (Mirai)", "value": "fb18a4e0b44b359e7581977c466a5af8f11fd5d508751a084992f6a469fb0a38a61d3871f817356889fcc7540a7b226e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634870556, "uuid": "40639488-6cc2-41ae-8018-add6ce9ce155", "value": "T17323E8C57882B639C3D057BBEE5F014E330497DCD1EA3357C8281B94BA8A94F1D66B4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634870556, "uuid": "33b28e03-9a15-45f7-b42d-accc8d598e76", "value": "768:oMjcmSayWpShJu7RvFZS1uM1LnjvGDoCerCGyR0rCfBUkeSU7wCVy/rCxHghW1/f:MmyyShJ3FjvuR0rCZ9nvhW75EtJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634870556, "uuid": "ae84c0b4-279e-4b72-a4cd-48b275e2248d", "value": 49496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634870556, "uuid": "cd241957-8f04-4a74-9a14-b4d705694938", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634870556, "uuid": "c3fa5c38-b0f5-4853-ae07-d6e4a3d484e4", "value": "dab5a66dec7a668139021f4674ebc98c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "266e48a7-3308-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634887063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634887063, "uuid": "6b646b3d-3b56-472a-bede-f9faeb95e187", "comment": "Malware payload", "value": "c83a3ac860c34c0df17b91ea18dd44c3", "object_relation": "md5", "Tag": [ { "name": "mac", "colour": "#285994", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "UpdateAgent", "colour": "#B10D2A", "exportable": true, "hide_tag": false }, { "name": "WizardUpdate", "colour": "#5BF7D9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634887063, "uuid": "a2d37b33-609b-46c7-bcf5-586bbfa9f1fe", "comment": "Malware payload", "value": "a98ecd8f482617670aaa7a5fd892caac2cfd7c3d2abb8e5c93d74c344fc5879c", "object_relation": "sha256", "Tag": [ { "name": "mac", "colour": "#285994", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "UpdateAgent", "colour": "#B10D2A", "exportable": true, "hide_tag": false }, { "name": "WizardUpdate", "colour": "#5BF7D9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634887063, "uuid": "ca31d335-964c-4ccb-8096-72e77400bac6", "comment": "Malware payload", "value": "92b9bba886056bc6a8c3df9c0f6c687f5a774247", "object_relation": "sha1", "Tag": [ { "name": "mac", "colour": "#285994", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "UpdateAgent", "colour": "#B10D2A", "exportable": true, "hide_tag": false }, { "name": "WizardUpdate", "colour": "#5BF7D9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634887063, "uuid": "7a3ceb84-d29e-4460-ae3f-75c350e28aed", "comment": "Malware payload", "value": "864bd66e9da4be6c79bf1d0e2c8a4e490cd3fa966d4e44128126626aafae66f4d72e6d175bcbd3304b1fcfb6d21acc4e", "object_relation": "sha3-384", "Tag": [ { "name": "mac", "colour": "#285994", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "UpdateAgent", "colour": "#B10D2A", "exportable": true, "hide_tag": false }, { "name": "WizardUpdate", "colour": "#5BF7D9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634887063, "uuid": "31ab6601-d698-414b-880e-22d5ce5398d1", "value": "T15F236503AF8D0ED6D51E423880D70BDB5733F4900AA7A7078BA0C0161F723C9A960E9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634887063, "uuid": "f68cc0e9-1f92-4880-9e88-35d013b51689", "value": "24:xKA/8j866mz8YxmMzqaycObLmJLyxjFqHS50ixMK3inLO7fecH57APMQxu6DjKQ8:xEXeh3mtyx8HS+UM5nLO7zH5uu6DjK/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634887063, "uuid": "d42a275d-761f-4408-a07a-b00221ac281c", "value": 49424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634887063, "uuid": "8e96c595-6121-410a-9040-0eac44975627", "value": "application/x-mach-binary", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634887063, "uuid": "492a8d6e-1b1a-4995-93ef-de572cedf603", "value": "OptimizerStatusAgent", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d42f7fb-3304-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634885545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634885545, "uuid": "41044d58-09f4-4d4b-9065-5ee1bcffe2ee", "comment": "Malware payload (AgentTesla)", "value": "62f42bfe28f4c5667bda900cfd49121f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634885545, "uuid": "2c5ebfc4-9a85-4219-a467-96f8f2babb4d", "comment": "Malware payload (AgentTesla)", "value": "a9b2035fdaf72654181c96552e6b93325bc994db347d8b41757066d34a235779", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634885545, "uuid": "ff74aa12-b3d6-42f6-83f9-005fc1f729af", "comment": "Malware payload (AgentTesla)", "value": "a41be8345afa9b6fcde1b68ae5062030e7f98607", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634885545, "uuid": "17f916fa-e851-4d05-9b2d-4a06832fd09e", "comment": "Malware payload (AgentTesla)", "value": "1bb18a882be4f12ec65ac1249ad5bfb80ae839db1a7a858f4f8d94d482f88fb4fe497e5725b55a119bfa8b41ab60d5db", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634885545, "uuid": "bd85e7f9-775b-4481-81cc-ff47a492a535", "value": "T1C0C49C0436B99B11E5BA5BF01631444497BB7DAE243EE64D1EEE34CA1F33F408A61B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634885545, "uuid": "c052e091-198d-43e5-975a-77632a86f11a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634885545, "uuid": "96c500e8-0f10-4f4c-b7b5-da02d5a34af2", "value": "6144:uGxhLQzB1vhV7euL0kzGYF/sTbMfusFnSsk1+E5Hu9i346UooMZS5ZxR6kcsGm:n+fLiLokToByEOH4CUooMZS5Zx+A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634885545, "uuid": "50f1ac4d-70b3-4847-a27d-4572341e54b0", "value": 558080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634885545, "uuid": "465e3eab-5134-4d14-91f1-a9f827e8f339", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634885545, "uuid": "535b3605-7893-4078-9c17-742be597d5c9", "value": "New Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "771201ef-330f-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634890205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634890205, "uuid": "318d3098-cf93-4ee9-870b-53461bac9a84", "comment": "Malware payload (AgentTesla)", "value": "6895cd6c93e282c5776c902af458cbac", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634890205, "uuid": "a91e92b0-72fd-4a8f-a0e2-3d79a3a5a0ac", "comment": "Malware payload (AgentTesla)", "value": "ab09a0694b65b155701d6efe5d08e1ed51b45d2b884496a4cb76703605cfcbf3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634890205, "uuid": "4443e434-63ac-43ba-805f-0dd792d4bffa", "comment": "Malware payload (AgentTesla)", "value": "6c1033e59d7396e8c3116428d1bdf28f6a868bc6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634890205, "uuid": "9209adf8-63e5-4e24-a03a-28748733102e", "comment": "Malware payload (AgentTesla)", "value": "0bd0bfe626294a884ac1ab3fb90479da0074a866ac62e50c71f3a7c5c3728379f02eb289329ab3c7a7baeffcca7d3ba6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634890205, "uuid": "3632568a-32be-4698-9db6-2e7b3a241ae1", "value": "T1D1F429082255C243E2743BF0C4252FA043636E6DA436D75B6D593ADBBFB3F8809527A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634890205, "uuid": "81e1939c-5b18-4278-ac7d-805f5b20dcac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634890205, "uuid": "ffaee294-f323-4a32-9349-d94f1f1a18dc", "value": "12288:e0RUzZDRJxRW2YjW4WsGs1l8i/8sCHcOtGr:e0RUzN7R4WsGs78iFC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634890205, "uuid": "b76944ab-bf50-4680-844a-809d1fafbcf5", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634890205, "uuid": "7bbd3cab-6dd2-4a66-ba74-0dc9fc3d40aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634890205, "uuid": "721ce6b2-8e39-431a-ae81-40347c2f88bc", "value": "DHL SHIPMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bb0f8e8-3363-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634926291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634926291, "uuid": "4c431873-b0b1-4678-8e74-ff5f3e1a07e9", "comment": "Malware payload", "value": "412fdeeaa926ada702cd351049516139", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634926291, "uuid": "fc40a330-43c1-4de2-b7be-93f3800a76ab", "comment": "Malware payload", "value": "ab0a3f2c0b0bace7e066433d4c3e8ad1dc253bb4b394ce504e50f15f43499ac8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634926291, "uuid": "d0da8a27-a61f-4e22-829e-dbb3862bd650", "comment": "Malware payload", "value": "717815a409b374922e7d140d97e796d5eac4732f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634926291, "uuid": "d2b816fc-538a-459d-a43a-1722101946a3", "comment": "Malware payload", "value": "b2573a25960f50fe55f162d75a922307e96790c8bcc5a054e168ffe66acde6745f83fd51c91cc7be157f5aed654317df", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634926291, "uuid": "07f4f073-c57b-4991-a95c-61143b9d987b", "value": "T109B4AE1036E18432E173263444B1E1A04EADB9325974ADCF67C52A7F0F7AAD1DA39B1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634926291, "uuid": "9f2e6f0c-7c24-4b66-92bf-3a6504ff02f7", "value": "dd5811bdddff753d3f05f6147d52b377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634926291, "uuid": "c3f9838d-1c2e-43d4-b0e2-c71dbaa95b36", "value": "12288:snygddonnhXo7TDSfLLeSlDH7g+BppSH9K1XB7LenS1LrumKV/8:0onhb1lDE+Bg9K99e+umKV/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634926291, "uuid": "b0331392-9e17-45b8-8c6e-3c4aacf5d722", "value": 541120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634926291, "uuid": "af8600cb-ade3-475b-8bbe-4c5485dc83ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634926291, "uuid": "884f6b35-2ce6-4efe-908a-b414edcbc40a", "value": "28f4003888bd4b8634f8e5c67f04ccea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf0cb8cd-3331-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634904956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634904956, "uuid": "491ccb07-3ce1-4736-9db5-2860672b81db", "comment": "Malware payload (Formbook)", "value": "17a6f526b20aa11aa8685b79176a440f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634904956, "uuid": "a2b5a4b1-b112-4680-a452-f1ed32c82054", "comment": "Malware payload (Formbook)", "value": "abb82e829e69a97f46c6a116d8c8996697508b9215bb3b2facac37156c4062d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634904956, "uuid": "7523568e-e15f-4630-92fc-f29da9048dfc", "comment": "Malware payload (Formbook)", "value": "af265b6b633f1ae0d9e45b913649d4ea9ceb36f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634904956, "uuid": "0c294db1-3889-4f1f-8288-cbd5bbfb491b", "comment": "Malware payload (Formbook)", "value": "cbbb71740915169e99f4d3e02cd48219074a514956af86306f1f4474e35c3515025210fc207dcf4e371e7ef045c60a72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634904956, "uuid": "8dba7c36-d039-4538-b0bf-9c57324dca3e", "value": "T1C844126220D4C4FFEAC90B313EBF5B7AC3BDA6490051A6EF87E05F3561A11C6C609587", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634904956, "uuid": "c6e21fa4-15c5-49ca-b825-a1486c9e5d29", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634904956, "uuid": "3f1f3581-1e8b-494f-9c8f-37a0d5e19d0c", "value": "6144:wBlL/caJNKQfAY5g28QFjaHWXJ4a2cqaplKYHPlFbfUwndzE0Ml:CeavTIYtjaH9cqklvP/dzE0Ml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634904956, "uuid": "806e9ff3-4685-4df7-bffc-8d072f0d614d", "value": 260567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634904956, "uuid": "34c8ade5-810b-4be7-b377-4e56d8cf5847", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634904956, "uuid": "403ab97f-34ca-475e-95e6-8c69b1ba6bf4", "value": "PO099761.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deb71187-3325-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1634899828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634899828, "uuid": "3179d057-d234-4cee-a890-1d4563f01809", "comment": "Malware payload (NanoCore)", "value": "1570be9489f6638e20884ea8b262f0a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634899828, "uuid": "169af4ad-bff3-442d-8fff-3081156f6b7b", "comment": "Malware payload (NanoCore)", "value": "abca0434af61ccbf707f5ea013f0c5f582106c9701552eeba5e64d678401dfd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634899828, "uuid": "7ffd40ef-c8b2-483a-8e57-92c76c9c9f18", "comment": "Malware payload (NanoCore)", "value": "2f627c510f7fc0808d8e06b9b309f934acb439c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634899828, "uuid": "701a9de4-b234-4afa-b222-ca0db1a9f0c4", "comment": "Malware payload (NanoCore)", "value": "b83342b32d7a509076b27407804b205c194090f380484bbc3e61ee5cb24ae688f0053a03a2bf4f7aa10a847ce6afe6d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634899828, "uuid": "d4cd90d5-18bd-423f-b34b-5f4e7468c1f8", "value": "T1BE64228B72C908F3CA06427194BAF336E3278525213652DF0B694E6E4AB13C7EE557C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634899828, "uuid": "5f24e451-8368-496b-9675-2eedef6b23aa", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634899828, "uuid": "987f5557-f121-4c2d-a1cf-4c9c6646372b", "value": "6144:wBlL/cBTySWgMMtHXaqILNcK/GZbGFwCHoLV13fRWP:CeASWgMMI/OGmEQDRWP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634899828, "uuid": "13b5cadc-ebc8-4f0f-ace8-836de7ac674a", "value": 307832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634899828, "uuid": "ce002abd-3a8a-4f65-9294-fd3939db0692", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634899828, "uuid": "666265c3-eb2c-4170-b3fb-828da2e1bc9f", "value": "Conform descrierii traducereProfil liniar355377.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c561885a-32f3-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634878311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634878311, "uuid": "fae3b44b-4beb-4bd7-a039-268db895bf18", "comment": "Malware payload (Loki)", "value": "7205f068ce8f358e659d706138779451", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634878311, "uuid": "05072b71-eeb7-4f3d-818e-cb3be8d4c7cd", "comment": "Malware payload (Loki)", "value": "ac30eae6f453702048d8010c3ed2c83cb99bcf2ac74245de518806e1888d40fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634878311, "uuid": "2dcc1f37-5def-47f4-932d-d7e96d5dce26", "comment": "Malware payload (Loki)", "value": "e1088006cfabba42c72507fd9ca2cec8229b2a7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634878311, "uuid": "7ce9d12a-5922-43bd-808a-5c0b71939c23", "comment": "Malware payload (Loki)", "value": "0a9bf96b626844881f4c064942866d9372eda1aa9796bca0408ec3cf3931523adc928a4771c9fc107489113ab4d4721d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634878311, "uuid": "d037325e-402e-4c1e-b476-abb7b8f08e88", "value": "T17094690436B95B12E5BAABF01632494453BB7DAE643DE60D1DEE74CA0F77F408A50B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634878311, "uuid": "6ee1a690-65f5-407e-91ff-ffeff76866f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634878311, "uuid": "327c7c90-d6f0-4403-a260-d4993804391a", "value": "6144:bGxhLeXOIBPvYZObljKuJWjk2VZbEvARKeE:q2B9OyGuJWZVZbjKl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634878311, "uuid": "c0c6fc8a-4263-4e8a-93e3-2f4dc58b5a5f", "value": 436736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634878311, "uuid": "f2d1a4c7-3f3b-4267-ae6a-0711daf73d06", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634878311, "uuid": "edfc2736-8289-4e8c-bdea-c78787308926", "value": "REF MOITB102121083-NJ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a579d1e8-330e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634889854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889854, "uuid": "01feb3e2-557b-489f-9d93-900e11ddd43f", "comment": "Malware payload", "value": "6174c8347814cc5091e7e93c83d9d0f1", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889854, "uuid": "e3a0a6a5-9cef-43bd-8dce-d03ed7555517", "comment": "Malware payload", "value": "ad1db81192abe5f6e5ddf13683c28ec42023c34b5b51599814dfe42f2bc315e1", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889854, "uuid": "8c74ed3c-1906-4d17-b9b2-1955a3d8f8c1", "comment": "Malware payload", "value": "c74ef2c4a8a620becc5609a2d629279bdb2f739f", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889854, "uuid": "532c9b2b-ef2b-4661-bda0-edd7a1a29075", "comment": "Malware payload", "value": "02ba1d438b17419d965e8c411c159bf2d765b53a26259eef20d7953e587ffc52cc233b555564f61bc2a115f8c0b40b36", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889854, "uuid": "efac89c5-35bf-49ba-be30-647370c40096", "value": "T1E9072297F36DE82FC8778032C9A60373919E4E015A4697372919B31C69F3AD48BA5FC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889854, "uuid": "65efad3c-6ee3-4eae-b2e4-713685bc134f", "value": "393216:YlbkQjZhK5LaotJUh84gWgPLka03I6XCHJ9TcrX8+fXcv:GQQVhK4oHUh8TWUI+6vQ+/K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634889854, "uuid": "a4e0b06b-5547-4289-86f6-2a8ab9b34db3", "value": 18333466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634889854, "uuid": "9e45ed7e-63cc-428a-a793-a4984de110fc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889854, "uuid": "084a22ec-b76b-4ffe-8808-21985bc7e082", "value": "com.appcable.jomparking.app_2021-07-21.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cd8c3b4-330f-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634890269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634890269, "uuid": "dd2947b3-7b3b-4866-9afd-d69a33e2b25e", "comment": "Malware payload (AgentTesla)", "value": "9a9edea8487b3aa7f0b92b131a2f100b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634890269, "uuid": "55125a36-a012-4432-b45c-96ba4b3afb6c", "comment": "Malware payload (AgentTesla)", "value": "ad47dd267e28398f802bab88cf1a9c75e9906e2c51eae57d0dcabad47540e700", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634890269, "uuid": "0364c757-ad5d-439d-8e7e-f23a81244326", "comment": "Malware payload (AgentTesla)", "value": "48e21000745dc66d5614b3a9f246e4fea1d1c8c6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634890269, "uuid": "f7b03f06-25fe-4965-a9e2-849bbea2165a", "comment": "Malware payload (AgentTesla)", "value": "cc7c0df292734c4f2d573c22812de14eef10a76fe854750630f1e1852be8ecc5a74f6f031973aa86c167467b1316050f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634890269, "uuid": "6e26b39e-d3c1-46eb-949d-a911bc44902f", "value": "T14174014620D0C3EBF84BCE70E6B6BBF6D5212D28203049871F90A797D9F776E1625989", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634890269, "uuid": "c9dd608d-9667-4036-8c59-f72366bca3b4", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634890269, "uuid": "f76cefbc-f04b-4ee5-b4bd-4fee809ffc30", "value": "6144:GBlL/TEarLk5iqn3F/nolR3RSczYFImQO5pguhHoL954mWB9:ENEuEiqnyzY2hO5pg54mA9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634890269, "uuid": "35df25de-5d89-4efe-a47c-fed5b3dc4bef", "value": 346492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634890269, "uuid": "0ff17fcf-32ac-4f10-893d-96362b6889c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634890269, "uuid": "63f50ffe-7e1f-4463-a914-0744b38c8f64", "value": "Dhl Parcel.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9d455d3-32e8-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634873674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634873674, "uuid": "3c73c523-aaeb-4cab-ad8d-985bd8ac9a2d", "comment": "Malware payload (Mirai)", "value": "7a3e0aa2b2528da57193687a6ec4d875", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634873674, "uuid": "cc5fda0f-4cbe-425f-b599-519f60f3e688", "comment": "Malware payload (Mirai)", "value": "add4190343a7e7e0cb62ceee84aaeeee2dbe3538335d6b5f4b4891b5b298172f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634873674, "uuid": "c5544cec-4b97-45c6-81d3-a0ecc00dc0d1", "comment": "Malware payload (Mirai)", "value": "8c156dc2e0b31bf1c84a91a47f19511bc5796da8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634873674, "uuid": "34f2fc23-c390-47eb-81e5-d123cc229529", "comment": "Malware payload (Mirai)", "value": "a1493694a4c108fd905e3544da5e213b3659eaac807126c63a0db4b244c97204b4866acefef0dcf283cb3ba9e2e32ea1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634873674, "uuid": "8d969296-d5d5-43cd-960b-5affcd57d6ad", "value": "T1243308C4FA8B89F5D90749304067F13FCF31D5B941B1C6ADEF9A9F35CA67542A20228A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634873674, "uuid": "166a9321-0c71-4981-80f7-6ef62d6c0978", "value": "1536:nfyMY0q0Yv5qP69Dj0MGNLbjIFtbL7YkOE1tP:fyMY6Yv5qP6BoNLbWtbfYBE15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634873674, "uuid": "eb856253-941b-4b07-b5f9-b8c6f735f5fe", "value": 54032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634873674, "uuid": "d81199dd-c501-49c7-8c17-db4981d4e479", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634873674, "uuid": "85e728f0-da8c-4d1e-adf4-68e290ecd444", "value": "7a3e0aa2b2528da57193687a6ec4d875", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93364034-330c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634888964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888964, "uuid": "70b1b84a-a0e2-4df0-b68c-09fd7680a482", "comment": "Malware payload", "value": "480a0e71db5794ee8101a4357510638b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888964, "uuid": "78735000-171f-4372-9dea-e2dd984ba175", "comment": "Malware payload", "value": "add5045922b0f280faed711a4cad46e0377df5cb26d948bbb11ab20351209244", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888964, "uuid": "2bd61e39-ed38-4619-85c7-066764dd9ee8", "comment": "Malware payload", "value": "5997e3c9672131b9d3fc37001e917d4f3d00e665", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888964, "uuid": "7175ce86-7c24-462a-a77e-a178c78d710b", "comment": "Malware payload", "value": "4f9ed97b7b3e8f82d8220edbb2980fc91b8e860722e2d3dfc3a86937a84e644889e3f03c59573fb03a40363224973fac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888964, "uuid": "b522caac-b28e-423b-9530-2bd1d92a78d5", "value": "T12D952827B8D30ABAD57EF130855293A17A327C6547323BD71E90AA6A0A75FD42F3D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888964, "uuid": "8510cbd7-7a74-4082-a0bf-ef77cf6fe125", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888964, "uuid": "6854a6ec-1fa9-4102-85b5-173ad7b873b4", "value": "24576:/IyelZajhLEPj0G9P3jH9pk7zgZNbtUQhE1Z:/mZa9EPj0avjHmQbtvhE1Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634888964, "uuid": "62265ea9-c73d-4aa4-842e-0e8983419c79", "value": 1949880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634888964, "uuid": "ecc9263b-6453-4de0-83d2-8582ac710b4f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888964, "uuid": "69e45d43-387c-4296-b56c-90367ec03e69", "value": "add5045922b0f280faed711a4cad46e0377df5cb26d948bbb11ab20351209244", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93a101dc-332e-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634903567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634903567, "uuid": "d0fee617-94b2-47a3-9c41-6dfcc81f28e6", "comment": "Malware payload (Loki)", "value": "5b55ecb0eb76dea60bdfe30fe32a82f8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634903567, "uuid": "cdbb5d79-e890-4b7e-bfc7-f20bcd7a3913", "comment": "Malware payload (Loki)", "value": "ae8189748777ae8df20e1b0d60ff9e896ecefea0f8b392ccb210d0688053a79d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634903567, "uuid": "03ebbc2f-794d-4437-87b2-ca37db25b3ee", "comment": "Malware payload (Loki)", "value": "14cc698e5da6d99758f66fade65a33270a96fc4c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634903567, "uuid": "878b61b5-79ad-4f57-b138-d85accf35111", "comment": "Malware payload (Loki)", "value": "7db12d5e22b9481a3d118ca3cc1cb55b1ccc07937ef972ee02f0d0c5b0d0a36454e711a675b832371b3c76151735e5d6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634903567, "uuid": "5a8e29e5-b77a-464c-9bf1-d7abdc14912f", "value": "T18894BF2B3658C9A4D6392A33FECB830C3BA57CA1A553C50E7AD7F25E05713A11C351EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634903567, "uuid": "74f83327-0192-4ed9-8abc-9ecf83f5dd2a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634903567, "uuid": "677476c5-e92e-43cc-a680-a02b12f40a2a", "value": "6144:YPBANKiW+6Uqd2GhNmIFLqneV/JjyPyDqfuOAL8jqHXg:YPBAgbUi2iNFqneTyPPfuDL33", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634903567, "uuid": "9e34338a-9fda-4694-9dd5-b99412d05620", "value": 410112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634903567, "uuid": "c81463d8-11a9-45c1-a445-36c1bb321f75", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634903567, "uuid": "438fc9c6-df10-4fdd-8846-ade9f606e5cb", "value": "5b55ecb0eb76dea60bdfe30fe32a82f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea4e74b4-330d-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634889540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889540, "uuid": "6967183b-4206-4851-9d1d-f517bde4771d", "comment": "Malware payload (Loki)", "value": "87f1720369d144e11f3b02db040475a2", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889540, "uuid": "6e178576-c363-4302-a7d6-b08b1ebfa54e", "comment": "Malware payload (Loki)", "value": "af84f3de0012cdf3569ee06363ec2765393b93b28b8ae08054268efea8f14ed3", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889540, "uuid": "cf5abf9e-023d-4fde-a7a2-638226d94c27", "comment": "Malware payload (Loki)", "value": "65f9d38d1e97412f4e1e15a68d015a8b633f8ee6", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889540, "uuid": "49264022-e5aa-4b60-9f6b-4d97dc074b27", "comment": "Malware payload (Loki)", "value": "f7f89837d13bd76c9e01d52fc3e828c572c4c8af33a9c840646e5d2b34890a4307623065c23f8df6a70ff4e51b365e71", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889540, "uuid": "b8d1c53e-961e-4f48-9fb8-65f56f6dd617", "value": "T1E084BF6E18598D13CCAF3771672338786BEA8E1BAA4C83D5471EB242557AFE24034C5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889540, "uuid": "16fac89e-4886-4277-8e46-9f88570624f4", "value": "6144:VYjHFRvbsa16qMO5rCItUEq42JyWV3hCV8wE5l63H4BiLW8G5NWfX:cHnvbf1NrCI6Efwhmalni9sN8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634889540, "uuid": "3a7dbf55-954b-469d-acf3-a80dd6938e53", "value": 378344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634889540, "uuid": "ec6df51b-55bc-4c3c-9d36-0174697e159a", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889540, "uuid": "911a6953-c1c1-4473-b6b5-abccccac0e88", "value": "Document2130779.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b08b4642-32d5-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634865391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634865391, "uuid": "2e2a4908-0697-4eb7-ae30-77233d59e23c", "comment": "Malware payload (Mirai)", "value": "5a8226a087cafd6d31cba3a2188ae040", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634865391, "uuid": "42ecb4b1-8233-4751-bfcd-8848668d09d3", "comment": "Malware payload (Mirai)", "value": "b030f496bc70675418c06768f0ee97f28be1b48d7574861067dfb300e47a9793", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634865391, "uuid": "928be0cb-b7d9-4a70-a63f-c2baa3ebe636", "comment": "Malware payload (Mirai)", "value": "34f40b79d1ce9999fec61741324b98186a232d3e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634865391, "uuid": "a4c1cac4-3886-44d3-add2-ded0b130bd10", "comment": "Malware payload (Mirai)", "value": "12eff63b8feccc921b68c169f3099a77532a78f3c6536ebac68a75b58289404bdc5f059d735e0b13201da4a1978c54b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634865391, "uuid": "b3909335-2097-4259-a547-4e27edb0c5ea", "value": "T19EE2E1236A503534E57C143865FADA96D3176ABD87A23A333B1015A9FFD5C483A3E207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634865391, "uuid": "55484a38-612a-4e2b-a85a-eba470ea2f1a", "value": "768:PJyUNrr1dZUqFnXzMxfRhIy9zpg459N2e75Ops3Uoz+:hyUNv1/UqFnXgxfRqy37fDz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634865391, "uuid": "32981fe4-5f8f-4da9-8e14-f5ce455615a5", "value": 32552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634865391, "uuid": "2a1f4853-14f8-47b0-93b7-27acbc2ccfea", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634865391, "uuid": "82232214-51ac-4483-a116-70cb6d91a91a", "value": "SecuriteInfo.com.Linux.Mirai.1429.15365.3177", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "943596c1-330c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634888966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888966, "uuid": "0524a372-df83-43c9-b766-dbdb00e2af11", "comment": "Malware payload", "value": "969043ca39eb03ebde46ef8fdaeaced1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888966, "uuid": "9e4a50b1-1bba-49c1-810d-12d063e3f982", "comment": "Malware payload", "value": "b1748860c98662d253da719fe4d172a69affc97d8f56f38885e373221c93ca14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888966, "uuid": "e345d582-9f1b-4b6e-98a4-4635cc140937", "comment": "Malware payload", "value": "aaca6fa341eab5df0d58093768272dc94ade9403", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888966, "uuid": "94145489-f736-4384-8375-c3886c5928a0", "comment": "Malware payload", "value": "9b40ae74e85a22ef28c02f06d420548dc21974938bcf30cb8977ed2d23736a926d5ad7220ad6ca0015905f02afdc9882", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888966, "uuid": "be507e9b-c1d5-4402-b13c-636fbb933b93", "value": "T18B855B47BC9160F9C1AEC231CAA5D29177327894073323DB6B90A6BA1F72BD81F79354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888966, "uuid": "021bd420-2105-4785-9259-613c75d29420", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888966, "uuid": "79dfb82a-4ded-435b-baaa-07d694cac6c1", "value": "49152:qh94yVrb/TavO90dL3BmAFd4A64nsfJ8D9HogvxRu1b1g:qhVYPRJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634888966, "uuid": "ff738f3a-7666-4d1e-a664-defcc670a4aa", "value": 1743024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634888966, "uuid": "1af636cc-34bd-4276-86d8-68b7f2de38e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888966, "uuid": "c2917ba7-44ec-4797-9787-1442afa4f54e", "value": "b1748860c98662d253da719fe4d172a69affc97d8f56f38885e373221c93ca14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bea5e83-331a-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634894830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634894830, "uuid": "58f4415b-5f12-4e51-9ac1-ee9e8696c1a0", "comment": "Malware payload (Formbook)", "value": "34df0e4d3d5863b1a86489be85a045aa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634894830, "uuid": "65fca834-4e96-4580-b73d-c75f8d48ec3d", "comment": "Malware payload (Formbook)", "value": "b3bc74c1f3673da08a95775af5f39dd116a249d8a7e597fcd8bb56e07ae3bcd2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634894830, "uuid": "658b7429-54a3-46c0-9835-89b0912d8235", "comment": "Malware payload (Formbook)", "value": "c899b3177bdf5811a1aa507a13d49fea6ba3dc40", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634894830, "uuid": "66aa8fe3-e980-459f-9a30-ed1a36309fa7", "comment": "Malware payload (Formbook)", "value": "18342b389df690b5a35e029acc98441e6655ecd2ad9a7443f8264d6412a8d54c4346bbcc4f8986f24df64e652b790d5b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634894830, "uuid": "13482645-e52f-4ce7-920f-36ed1ed06cb5", "value": "T153E47E12B9E38036E531273F9E5E2A2C240FBD756F3976422BDCBD449F7A28211526C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634894830, "uuid": "7541dff7-daf3-4e97-af4d-a89c3ff8591b", "value": "7c956dad9ea202d643355dc7895aa9c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634894830, "uuid": "422f0093-1fed-44b3-9037-29117a14ee71", "value": "12288:EdO8lwYc+Plun+IBTid8obF+OCefbtaKuRmDI:EUOTPlun+zdRaYbOF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634894830, "uuid": "1e82eebd-faf2-4caa-8b0a-73c64a7a2075", "value": 702464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634894830, "uuid": "9c115bd0-6765-412d-8e10-183e6a262c22", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634894830, "uuid": "2f63d498-3b4b-4dbe-ab00-d2048a6798c5", "value": "34df0e4d3d5863b1a86489be85a045aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e555cc3c-3361-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634925609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634925609, "uuid": "f10a9b8d-635d-497b-b083-35fa1db20874", "comment": "Malware payload", "value": "5a8be6a0d0a8ffaada767490046ecbad", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634925609, "uuid": "c95cd34b-dc73-4805-ad41-64e79f9fd95e", "comment": "Malware payload", "value": "b40bf2a6c73858171a88577350f6d22a96a52a639d3be8663ef4e87f59a64250", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634925609, "uuid": "1ef2d9ec-889e-499d-860e-063e8bec1b1c", "comment": "Malware payload", "value": "9909867b55f3caf0e79d1d3322d0029876a3c1b5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634925609, "uuid": "60883b48-aa1d-41a8-a3d0-3937f6186ed7", "comment": "Malware payload", "value": "b2dc0b7f3776fb4ca0b7c1a024d46832120ef94947a9028117f8212a7a6ed5e8693fc281f35aa2ab2e9b2a1ccbee077d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634925609, "uuid": "f54b2bfb-9a1f-44aa-9b3d-034b41268483", "value": "T158530C01AA418B13C1D31BBAF7DF43697B267958C7DB33456A297EB42B4379C1B39220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634925609, "uuid": "c7f8d86d-77ee-45d6-943b-a75ceab95d27", "value": "1536:M3Q0tzXfr3euK2Nxiv99Omce/pprXIUBzWQHlJoIXtr:2zXfq54g99OQp7WQHLoIXtr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634925609, "uuid": "cfece50b-4d40-4002-b6a9-97c67e334bc7", "value": 65445, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634925609, "uuid": "5a10b744-9a9c-4444-957b-30ce4306cfd4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634925609, "uuid": "8b1ef264-a36b-42aa-b314-c5774dc9f194", "value": "Fate.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b520ad26-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928105, "uuid": "8d310716-c17b-473a-b7c0-c6977d839ebe", "comment": "Malware payload (RedLineStealer)", "value": "547d11ba837a7014d3f02b34720ea720", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928105, "uuid": "7b77c0b7-48cc-4195-a49b-94104f7ec8d2", "comment": "Malware payload (RedLineStealer)", "value": "b4317319d3f416e121a934cee02da943d0759f04859147b7b28794d44adf9f7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928105, "uuid": "49b2ffbd-3946-4ba1-9d10-52b9e8bcd25e", "comment": "Malware payload (RedLineStealer)", "value": "d35e269e85df5ed767911136717d3cff082842cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928105, "uuid": "47639989-0220-4f78-bddb-29dde8f6ea33", "comment": "Malware payload (RedLineStealer)", "value": "63a3a71b8def6c030a7c2721046d556765aaebef65771962fc85b971f8375d4ccfd01ed0f41ae2f65cc949ef91670adf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928105, "uuid": "a801ae29-4559-49a3-b5bc-e22c48141d6f", "value": "T1F7E4E110AAA0C035F5F352F849769368B93E7BA1AB3554CF62D416EE1738AE1EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928105, "uuid": "37be1d78-c70d-45b0-813a-e92fa37ad38c", "value": "25e96726029c322936cf0033b6a07058", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928105, "uuid": "6fc2d24a-9049-4deb-81c8-e69f4db21acb", "value": "12288:kmHAFytpk1M+m0IYZJ5KYgsMMejqZ9UykTdzkX0mpDzYEVEUqu:7HIjmdCg2ejqQXhwX08fqu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928105, "uuid": "7141fc52-bc76-444e-837a-49d7b945bdf1", "value": 669696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928105, "uuid": "eb823c0f-39ae-4138-bb88-893c349a011d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928105, "uuid": "4ce79aea-cde5-4ab0-b8eb-9f1f7221c5cb", "value": "547d11ba837a7014d3f02b34720ea720.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1df4da47-335f-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634924415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634924415, "uuid": "bf8f6547-10c0-4524-be7a-d9c34afdc518", "comment": "Malware payload (Gafgyt)", "value": "ba30ddc46f8e578d5414e5ed37f4037a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634924415, "uuid": "e51c80c0-87b7-4a4f-a5b8-9b9ff2c6b270", "comment": "Malware payload (Gafgyt)", "value": "b4a39c7ca505a9972d6f3f6090674657684d1922fe7af46d24d37493500cc4c6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634924415, "uuid": "0ac5b0cc-c16f-482f-8132-1b6f5ae47141", "comment": "Malware payload (Gafgyt)", "value": "30471ab1f2691b8a1a5ff34dd6fcc0cd18077ddb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634924415, "uuid": "6efe6dfd-7b2e-4beb-898b-8fa2ad12073d", "comment": "Malware payload (Gafgyt)", "value": "72f5c9d181afe7ab7970ce40c5820651f69bc863c689247252587d9ef9d0573a958580428042d342e8b9305e86e8704d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634924415, "uuid": "1809e46a-9e93-4bc2-a979-927dc9342c93", "value": "T17A833B01E643C6F3CC8307B2029BAA665931BDAA1E2ADF4AF31D7DF49B128C47116F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634924415, "uuid": "0e251a41-822b-4909-9d28-b9e0af33fe96", "value": "1536:yD5b1hE4t3J6lreu5r4hWj8LgGDloRmF+wVOz+sXcfW7k:wb1hE4pJ6liuq0YcGoRmEwVOz+ucfW7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634924415, "uuid": "93105164-947e-4ae2-8f2c-1e92467845ff", "value": 84999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634924415, "uuid": "c64e7799-97af-4ead-aac5-06ce37f9c263", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634924415, "uuid": "49261561-f551-4513-a775-31a8a5489680", "value": "ba30ddc46f8e578d5414e5ed37f4037a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1771321b-3350-11ec-843c-42010a9c0014", "comment": "Malware payload (QuakBot)", "timestamp": 1634917962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634917962, "uuid": "2f1ca956-7bbb-406b-88cb-7de159e0e134", "comment": "Malware payload (QuakBot)", "value": "4f7a4448b2e7d0618b86ee1eb62469e9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634917962, "uuid": "21aba03a-5713-42f9-987b-5e27369452c8", "comment": "Malware payload (QuakBot)", "value": "b4abdad039b0eea9b5dae6f28c9945cb18d3603282866fb15c37697d14fff529", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634917962, "uuid": "20ab34e6-5830-43d0-87c4-42e7dd543ab1", "comment": "Malware payload (QuakBot)", "value": "c5854232e23a72caa5a719dfb1badb58a98cac3a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634917962, "uuid": "019af612-3e36-428f-b184-ffce8bf5364a", "comment": "Malware payload (QuakBot)", "value": "7e903d5c1ec98b4ddb04ca23b995f2d06848524078716bf2e40cc59920ceda432c5b81c0ab4b86b5197c2583c8d05027", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634917962, "uuid": "a33001ab-4cd8-4ecd-9ce2-d88008b71dda", "value": "T1E375163236A1E001D026B43FCE51D1FC67D67C29DEA9280B34DA2F5FF56A4D28E1275A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634917962, "uuid": "7cfa3232-d04a-4ffc-93aa-038fa9fcad52", "value": "4619867b7633409468e3e658c2c283f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634917962, "uuid": "2730c537-bd97-485b-9664-430e138b96c9", "value": "24576:W9mB+XxJ7zUqNS8KqCx2ffNrC0O60+bPzTk1wK7TpKsV:WUBav7zbS8JCx2fftCv6JLwJ7FKsV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634917962, "uuid": "3b93b755-012a-4705-a48f-f8c8e41e632b", "value": 1641472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634917962, "uuid": "d2e0fa45-e64e-4c58-9cbd-cc1d575b54d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634917962, "uuid": "e7d30346-9c77-4b3e-9c20-a3521bdd12da", "value": "b4abdad039b0eea9b5dae6f28c9945cb18d3603282866fb15c37697d14fff529", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1e80479-332d-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634903269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634903269, "uuid": "7b5a2deb-28cc-4d38-ade4-9a1679fbd857", "comment": "Malware payload (Gafgyt)", "value": "df2d834f32ba785b2e4f92b93bf0aa92", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634903269, "uuid": "503eb2d0-27a8-4a97-bd2c-1868a5960568", "comment": "Malware payload (Gafgyt)", "value": "b5f176e240d457b3fd1e08466f92b9c137858355008a036c98da517b9cb99140", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634903269, "uuid": "e26d49bc-db57-4409-a765-37bc1a96c087", "comment": "Malware payload (Gafgyt)", "value": "21ebc1a5dfbfbec01f1f01aa3a71aa7789b06a5c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634903269, "uuid": "824ab0a7-2c77-49f4-9b25-7e93bf2b4f16", "comment": "Malware payload (Gafgyt)", "value": "b463070a4b2c7dbf91b69e3819a7556f51fa66226260780a271b8b09f6b2ae690d2f5ab31031616ffaab13c2ce4e23c4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634903269, "uuid": "6011335d-fbf9-4854-8403-6442e286dba0", "value": "T1E9E34B09F6408B53C0D32775B68F534537239BA5A3DB33069928AFF43FC27A94E22955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634903269, "uuid": "62854371-74a0-4364-aef5-cafcdab8a450", "value": "3072:tdntU2haO5H1XacBoGmh9H5/5hDiGRvEM/9f9T637m5wTsL/Qpyn:ntVhaO5H1qEc9Hx5hDiGRcM/9l+7m5wS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634903269, "uuid": "269b9e02-2ee2-4f74-a747-01225f565413", "value": 156296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634903269, "uuid": "336449f1-8e9d-455d-971e-33be4a23b0f2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634903269, "uuid": "c8d79dd8-3251-43b8-919d-4331d2f26476", "value": "df2d834f32ba785b2e4f92b93bf0aa92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ac939d2-32fa-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634881058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634881058, "uuid": "4552cdfb-76bd-4b8e-825c-176b5a7bbd92", "comment": "Malware payload", "value": "551fde9593f19dc3fd9cc79f7f08e4cb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634881058, "uuid": "5fe7ad44-109c-4fa2-bff3-f988e38a548a", "comment": "Malware payload", "value": "b5fe0465468c4e7db32ba8d57f8d857a03b6e0a905d91627fb76e32aed85a4e1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634881058, "uuid": "b1513e39-1ecb-45bf-83a0-b6640f2c6076", "comment": "Malware payload", "value": "2a57ca45c2720dd7e08cc0e2b6ced80a782c54b3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634881058, "uuid": "64edb88c-7155-4a30-b079-5f17a35be303", "comment": "Malware payload", "value": "b5cc527e980a9c289e634fa8cbe54d9017eddc27cc89ef8fe8e91963706cf05c48bbe59f9a307883266a006c09f817c9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634881058, "uuid": "5cd2e1a0-1ae6-43aa-9e87-2365e816dd89", "value": "T12B41452221DCE19A78D59BB28BE33554C8B3B2FC3B364B583408D71B17D54A0BB29363", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634881058, "uuid": "83808fc6-158b-4c62-89bf-0999434cbf29", "value": "48:YOhTM7Lr1L+BsLTS7rot5uS1EohCOK7blIl+YBy:BA7/1VLTwGYS9CnBY+YBy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634881058, "uuid": "d4a0650d-e17d-4dee-b90b-f7fdc3f63558", "value": 2118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634881058, "uuid": "ad19132f-d7e4-4013-83cd-5e49487b65d9", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634881058, "uuid": "72cba9ed-693e-4160-bdf9-5c5c4570105d", "value": "Purchase order.VBS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f08d0d2-32de-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634869227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634869227, "uuid": "583ca6cc-a861-4991-8eb1-8f1b728e86b6", "comment": "Malware payload (Mirai)", "value": "4c220c216118d6815aa95b09a074917c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634869227, "uuid": "8b717635-2884-40aa-9bef-8e73bf38d376", "comment": "Malware payload (Mirai)", "value": "b613a1b3483d410003f7681920e24c0610aa063ccb7c08a41ffb444139d4c714", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634869227, "uuid": "658b2358-7a84-4f5e-902b-3c2438b6c393", "comment": "Malware payload (Mirai)", "value": "3b2b59e0b0562d2492410d492716e8b2ce21bcd1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634869227, "uuid": "80cc49a3-ddcd-41f9-9cd3-0857a0695e09", "comment": "Malware payload (Mirai)", "value": "282984cf543ff3459d9f53608f976c6611303b769dc1f1f60c7ee9ded59f74d4094abcdf180bb86d63e36f3b769535d6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634869227, "uuid": "0bd1eb5c-ae81-41ce-bd93-da30de0d5e64", "value": "T11F531A85B8819A25C6D113BBFE1F018E3316975CE2DE73128D145F647BCBD5F0E2AA0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634869227, "uuid": "c4ec0ff1-49b5-44ad-b49c-9390ab53058e", "value": "1536:YdnWpBh3cLDNoATqHjjr5yAMQ1fonWmLdI8niD7noKWp:lH3+po+qH74XQtom7noKWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634869227, "uuid": "3b3be5ad-d57b-4b62-8c9a-9dfb065a48c7", "value": 66688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634869227, "uuid": "835bbabd-dfe4-4a12-b67a-f3376c3d855e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634869227, "uuid": "cdfb8778-300f-4a58-b475-55117bd02f40", "value": "4c220c216118d6815aa95b09a074917c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8839fc9f-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928030, "uuid": "306ab886-3b56-4581-aa7e-c2a006b5eb20", "comment": "Malware payload (RedLineStealer)", "value": "b12da49d4308f358cd9be9da69e6f35e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928030, "uuid": "03274928-cd41-4552-81b9-3be9f2f91405", "comment": "Malware payload (RedLineStealer)", "value": "b6394bf12c7a055c6786e5640d1c6b8e34580e6b2544362ac5dc8b9bbce3622f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928030, "uuid": "671d0646-b3d0-42f9-98fa-cb8aa51ff86f", "comment": "Malware payload (RedLineStealer)", "value": "c6af89af96477e3e7757d8912372d69874bbf36e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928030, "uuid": "150e22d5-49e8-45ac-af09-d05d55604f7d", "comment": "Malware payload (RedLineStealer)", "value": "8696637ddcc5414f34210d1539fe32914833bfbd4512bfc6a37bc80c994668b9377609f82b65230f5c4e3f0ec70d8afc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928030, "uuid": "ef003130-3df5-405a-8af2-daa51f446469", "value": "T165D4019C72DCD8E8C292243099369BE5133EBC9178204176F6573AAEEEF81E15D31367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928030, "uuid": "da25b93c-e45a-498a-b068-6f3f93f0624e", "value": "96eae633c3835f4142e00d18fc3a156d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928030, "uuid": "f2c57104-6ee8-41dd-a6c4-9f4fcff4081f", "value": "12288:Oa8p6C7OyJFV/fTqFoVkDb6bYed19nMkxQUJVYbzHHn+MeDM:OJMCiyJFR7qWCDb6UedTnH3M7x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928030, "uuid": "20c8430c-2be6-4de8-97fa-8877bd5ff54e", "value": 646144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928030, "uuid": "60ee8796-0860-4558-8d7d-3fcd22e7fae7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928030, "uuid": "aaecce1c-bf48-4fba-9c5d-d1ce30fb0a9e", "value": "b12da49d4308f358cd9be9da69e6f35e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "269ed500-330e-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634889641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889641, "uuid": "b6f44365-1704-4b18-bd0f-4a2bb3da4148", "comment": "Malware payload (AgentTesla)", "value": "eb10234a0a4f57d5b23d17eb663e0a85", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889641, "uuid": "85b5e8fc-49a2-48f3-a557-408e79145e0e", "comment": "Malware payload (AgentTesla)", "value": "b6ed29e0da8d78835a66a6c4560548e37ae59ab79451429c6d818f8cc43173bd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889641, "uuid": "6418f379-b505-486a-9fcf-d5825cb3f614", "comment": "Malware payload (AgentTesla)", "value": "1dcfa0eaeff6d2891d5708c0598a8a4ee64b3a0a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889641, "uuid": "b5be07f5-9224-4837-8b6a-e7d137dd1cdf", "comment": "Malware payload (AgentTesla)", "value": "bf5d217d7cec7502425ddab2fcbb7b1d1255302ec34287533a069d58eea4cccb9bd07fe3ff08254a9aea7c3d8f0f6187", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889641, "uuid": "dc75994d-6a3f-4b75-bff6-256d8e4f0495", "value": "T12D74AFA0F295D897E8431DB6887BDC3150A7BA6C9874451E254E772A5EF334320AFE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889641, "uuid": "36950ed6-6402-46e6-a16a-2a46d6a133c1", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889641, "uuid": "c4b0d5ff-b864-422d-8042-af08873199c1", "value": "6144:GBlL/geA6j5Foj0lDDURNQEOYqzk350rzDjd6wZmX/o3u96C5Z:EieA6j5ij0lDANQSKrPKXg+96SZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634889641, "uuid": "a8318fba-650b-4756-af0f-4b6ac838ffa8", "value": 355114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634889641, "uuid": "1086b781-b57a-4316-968a-9209a8f649e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889641, "uuid": "319c906e-04e3-4779-89d4-62b80118d8af", "value": "Request for quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b63f1fa5-330d-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634889452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889452, "uuid": "474677aa-e864-4c64-bca0-83f15b1d735f", "comment": "Malware payload (Loki)", "value": "5f782c3139d89e3235c7c5cfdb971c84", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889452, "uuid": "7dae4fe1-9e0d-4898-bf15-402dd3370da5", "comment": "Malware payload (Loki)", "value": "b83b5c335af90d63a70414ec5d62190971063ae1b4dc6bb7184bc7484a31ee71", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889452, "uuid": "a25409d1-c560-40cc-9729-f9189199473c", "comment": "Malware payload (Loki)", "value": "4fe33e364b70bbddfb64b66ca4f3228590e8cbdf", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889452, "uuid": "5a6bbf7a-04cc-48c7-951e-3eae5a56ebc0", "comment": "Malware payload (Loki)", "value": "3d109d06d671c736b634fb5a661b84f52b1f3f388d58161a3661d81e9b8599afb5f5250f42aa765cb886bd9260abaa4f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889452, "uuid": "9107b120-7da5-48aa-910e-d2465ada7b1f", "value": "T12A34DB7DF19B0E888F4693B8171B2F41158CF55CF3D984B236A8DB3866C5E7A921293C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889452, "uuid": "9a75871a-167d-44d7-bbe2-14df97c73665", "value": "1536:CpbEP8HfgFuX7tfXZ1ZcH48WggGNFIljJ3gLsP2u8W9LS5etbZp:CT/gFs7tfCHtXzNF6jJ3gLsP2q9H1Zp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634889452, "uuid": "7392bb6a-a683-4c9f-84a0-65f4befc829f", "value": 246369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634889452, "uuid": "8f381071-c82f-476e-81a9-0e0a1dddc0f5", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889452, "uuid": "7c204a37-a360-4bbe-95be-604897527617", "value": "About company.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa0338fe-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928086, "uuid": "7f284585-707f-4da6-ade8-9281e650a715", "comment": "Malware payload (RedLineStealer)", "value": "5d10c182c54e9da6bb89eb3caea55c8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928086, "uuid": "6b5b4d81-57b8-4ec6-b622-5aef0cdd707e", "comment": "Malware payload (RedLineStealer)", "value": "b8c3325bc497649787f113cee57f95a63ba7a06138fac32329f0b89814b848b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928086, "uuid": "3fb54798-fcb6-404f-a163-24dcb7cbae34", "comment": "Malware payload (RedLineStealer)", "value": "943922b17869049f24a1d33a515ce5797b54699c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928086, "uuid": "d19cdb62-1cb4-4763-b116-c350f18ad882", "comment": "Malware payload (RedLineStealer)", "value": "061ef02d056a700fb1b463604ccd15d3371b6abf9fc115cca8bdef4589d51a59aa0f0998dfff246dea6a0c97353ce8f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928086, "uuid": "617700f0-8088-41ca-b055-867e91e90f50", "value": "T157F4E000B690C035F5B362F84AB99379A53FBAE15B2454CB52E51BEE5734AE1EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928086, "uuid": "b8fe706e-c2e4-44c4-bc63-f05a9083d00f", "value": "9cccee30870eeeef9fd80f169e4bd55f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928086, "uuid": "b4867dec-527b-4a42-b1b8-9b4c28a9027d", "value": "12288:strwQ2nrSVds8HLNvYjJMPgdAWDgdrnN1YWdWX8Iz98jT70ijwPP:sW5Qs8JfgQVNuHzejTgR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928086, "uuid": "f2439eb2-e102-4e23-b264-bef86fd2dcdd", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928086, "uuid": "bed5184c-c1ac-4ea4-b6c9-3330fcf78406", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928086, "uuid": "f0491c23-7396-4ab4-b45e-ff48e8503c79", "value": "5d10c182c54e9da6bb89eb3caea55c8f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95ae5f19-3320-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634897558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897558, "uuid": "e0a861f0-612e-4993-9064-b213d000bf18", "comment": "Malware payload (RedLineStealer)", "value": "a10a14af2021091a7cf32032ea91b84a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897558, "uuid": "0e049275-3804-4b5e-a0dd-40201a23dcf8", "comment": "Malware payload (RedLineStealer)", "value": "b93c3342ed056d702f68cda57ccdd6ea92c34addac671f174e7070477cf4c156", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897558, "uuid": "60274774-b286-47bc-affb-8c8392a85949", "comment": "Malware payload (RedLineStealer)", "value": "92fd172a7bf9aefda0e7a2800a2eedaa0152add4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897558, "uuid": "ae656d05-b6c5-4b08-9465-62a50b3a9268", "comment": "Malware payload (RedLineStealer)", "value": "4f953b0dc44aaba26d6897c9608c6e52c2ac31301f28d602a07b8be6a8503b14fb9374529aed6a841ace03e0c218da85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897558, "uuid": "ed88d8f7-59a4-4d64-96c2-d6bf459e6b53", "value": "T1A5F4D000A691C036F5F312F859B99368A63EBEE15B6454CF92E51BEE47346E0EC3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897558, "uuid": "1e252eb8-9880-472f-8ecf-2457b1b81254", "value": "4af4742906d30c7889c195169379a2f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897558, "uuid": "375cf701-45a6-480b-bc11-57059179cc97", "value": "12288:kydYQlrd8FRwHcuxgIA3xaWHH9chYCdDso+qbx6lqaw6LWkRdSS0bHxD+jhV/y:kOYQ1d8LwpGMIqYC2PexVWWfS0bRDX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634897558, "uuid": "50be4c4d-cf8c-40c1-aa59-e18bf99c4bc1", "value": 732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634897558, "uuid": "2de7179a-6ce8-4381-9f3b-22a48528d985", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897558, "uuid": "bdc393fc-3cc2-452b-b4c6-68464c56e2f1", "value": "a10a14af2021091a7cf32032ea91b84a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d42a0ac-3320-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634897436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897436, "uuid": "5c611fe0-a612-4d0b-affc-fdc1ec02d3a6", "comment": "Malware payload (Loki)", "value": "e3eadb2ae3da4c0c1aae66144a57c6bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897436, "uuid": "b6453fbd-f4fe-472c-959e-a64010d46707", "comment": "Malware payload (Loki)", "value": "b956abf18efefee9eefdde9925e2f0d906fd60f0fe33f4b4b312df4877aeffff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897436, "uuid": "f378beb4-27dc-401a-b1ef-3dcdad5f8115", "comment": "Malware payload (Loki)", "value": "71f85df87e5a89670faf4c0ab42916f934662b14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897436, "uuid": "70f72ee1-df76-4e24-bcb8-89abd748d7b2", "comment": "Malware payload (Loki)", "value": "3f6e25a84d4722e0598486f995691c609bb40c8758f59a91ae2051ac301d5e096fedc4dbec6be474e3dfe26e142a840b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897436, "uuid": "0a134724-a762-4622-855f-0aab7d38ceea", "value": "T166548E10AAA0C035F5F316F859BA93ACA93E7EA15B6450CF53D426EE47386E0EC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897436, "uuid": "fdd36c93-775c-4c9a-b801-f9094e2d8456", "value": "0aa8675e96bbc2351e2af940f447c93e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897436, "uuid": "43a09cbe-21fa-452f-9ff7-717cd253c11f", "value": "6144:wnfl1dIBXiMWXZT24SGTAYlDvC2zivJDg060759lrtEu:QfqApGuRhvfMgbg59lr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634897436, "uuid": "0e296790-22bf-4ec9-8ebc-673c275e44a2", "value": 291328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634897436, "uuid": "308b57fb-557c-4757-847c-e7c96f3d16c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897436, "uuid": "f65eb77e-81e0-4e82-8f5e-563f16d3dde6", "value": "e3eadb2ae3da4c0c1aae66144a57c6bf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fce3562-3379-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634935639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634935639, "uuid": "19128b22-4960-41ac-a027-f32152a9f00b", "comment": "Malware payload (RedLineStealer)", "value": "b00091e0d18e7337ce5dfd2694505857", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634935639, "uuid": "5f7c5762-ec27-4136-8744-4588757ceb2d", "comment": "Malware payload (RedLineStealer)", "value": "ba60a173e1935175aaddd6a07759577fa82f0b47f2ae978e6d27f0185ec6e560", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634935639, "uuid": "651a5331-bab6-4ec6-8378-0878c6d7f0c6", "comment": "Malware payload (RedLineStealer)", "value": "a04b9b77e5d0750994ed3cfabd9cf0e495773f02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634935639, "uuid": "791dc11d-79cf-4fd3-a6dc-25bd53b5255f", "comment": "Malware payload (RedLineStealer)", "value": "45a0298c756182d3fe56e8953f5fcbeb4e237c291ca175ec495925a9c599e75954f8ced713d59da9d323b8a47fb350ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634935639, "uuid": "01339e8d-4499-4d17-a6b9-2540fdea6470", "value": "T164A4BF00B661C039F5F722F44AB99368A53E7EA1672460CF63D52AED97356E0EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634935639, "uuid": "f43d2e2f-a05f-4f9d-aa09-e77d61a49d02", "value": "bac67046644aa5e445c1272184462c49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634935639, "uuid": "d763fe0f-65d5-4608-9962-7ae7603fd5e4", "value": "12288:K9/luXNmTRS3sKRAZlXOEFmqXH8vPtq3wVA7+eu:K7udmlSzRCXcvP03wW0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634935639, "uuid": "0ee10cc0-7942-43fb-a1f6-fa0828c543eb", "value": 451584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634935639, "uuid": "07203718-898a-4041-b579-2893a06e5ad7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634935639, "uuid": "1fca1951-9472-4d3f-8625-700e2d48895e", "value": "b00091e0d18e7337ce5dfd2694505857.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75c97b7d-334f-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634917691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634917691, "uuid": "d2980878-dea5-450a-9185-4e022c97861b", "comment": "Malware payload (AgentTesla)", "value": "8bbe66fe1aa1c26e2ef7b4d752998d3a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634917691, "uuid": "9d32bfb8-6124-4a4e-8a7f-3988fea26423", "comment": "Malware payload (AgentTesla)", "value": "bac1342206103fdc88c4c3ca8b2c30d73e46781d8e40f82f1ea4064547bbb76c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634917691, "uuid": "b18bdbec-6d8c-4599-9ef0-c2ee601920d5", "comment": "Malware payload (AgentTesla)", "value": "8df9097789d3b548c807d5c932c9a530cf1fa1a0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634917691, "uuid": "5f5f1630-e2d2-443c-b222-1d4d58cb5e5a", "comment": "Malware payload (AgentTesla)", "value": "6a8a72e9718a2ca17042c0f40d853d30e95e3894602863ff3391102d2006f16b7b4981fe5cc63d31e81481ba1e68e2c6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634917691, "uuid": "592f3f76-16e3-4d86-8520-8988a9fe73dc", "value": "T1B6B46E2C3AC15B72EF1E993849510B04BB663F03E240E9B267CB15CB874F9E66E45D8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634917691, "uuid": "e09a55a3-f884-4857-b683-bfe35962e3d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634917691, "uuid": "dfbc265e-b458-4a91-94fa-af702dd94cea", "value": "12288:0mky6kGLZ6suBxjiBeKa1iwclbx0KjlbnE7N:xxsUxj++1i7l+N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634917691, "uuid": "2e594169-d367-47be-aee9-955220191346", "value": 495616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634917691, "uuid": "66ba6309-2be5-4fe5-b4aa-6403a0732bdd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634917691, "uuid": "c5b9390a-d07c-4f38-99c5-70daac483ae3", "value": "MV. PACIFIC POWER - scanned.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59affae8-332a-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1634901752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634901752, "uuid": "b5d8007c-adad-4a51-a76e-48497afbcdc4", "comment": "Malware payload (GuLoader)", "value": "db45703941787a232e2eef471c8be616", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634901752, "uuid": "0ffc6396-479b-4443-b260-65c46c312055", "comment": "Malware payload (GuLoader)", "value": "bb8959ab353b415cd9f75ee326735225bebc593dea8d37e13cc8c7c29add7eaa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634901752, "uuid": "b0742452-f84b-4983-8605-fb08f8045ce0", "comment": "Malware payload (GuLoader)", "value": "bcdcb14d5dca8eff4eab884450988ae788eb4b7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634901752, "uuid": "3f667657-d5d0-4338-b4b8-d70e1c48a947", "comment": "Malware payload (GuLoader)", "value": "916618b5495e54cc6aa6592dfe58081444b2e3a78b9bb668b413d4d50dae7b14e93723ab686501747bb91315af058997", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634901752, "uuid": "2a255c57-040a-4c5e-8f03-4cbe171a6b33", "value": "T126B36B5EAD715D29C89F03705BA140ACC05BB9B160477AE23278361C7FF66DC09A6F8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634901752, "uuid": "e98506b1-8e93-4738-ba50-67c8741ba554", "value": "9a680a4ab9f2f92c6ce20903d7caa304", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634901752, "uuid": "0b110572-f3a1-4819-a771-a22cc6b42f58", "value": "1536:qNeEPspGLeZWP1pJg2qaQp4YAg91puj3GP8pff:qNdKhQtpJg4QtAG1pWFp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634901752, "uuid": "4220f35f-4f7f-47a9-ab09-1528850be5f4", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634901752, "uuid": "02781ef8-af4b-4536-a777-262d3a6e9a03", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634901752, "uuid": "5c58c537-ddbe-4286-a68f-53113e6222cb", "value": "Order confirmation+Invoice.pdf___.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84456637-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928023, "uuid": "a6bcff6a-dc14-444f-a692-c0e88d435823", "comment": "Malware payload (RedLineStealer)", "value": "e6f3897b738846eb3d58ecd0677668ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928023, "uuid": "64ae245c-c3c1-4659-98e1-d15edc99ee71", "comment": "Malware payload (RedLineStealer)", "value": "bbb52fa71217c68368d6b4d021227e325002e5bb7ecb248661aa4242bf773d8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928023, "uuid": "eb82aa95-ddb4-48a5-af33-22d7edc76467", "comment": "Malware payload (RedLineStealer)", "value": "d558f3aafcba39e5c568df3d26bed75d4e4fc335", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928023, "uuid": "0f93b767-cf28-4257-9081-83fd6c1a47fe", "comment": "Malware payload (RedLineStealer)", "value": "30e66134ec4c53bc9546afac7bfda18fbeb7afc5177d12f09b9bb067130769314e298a0b08ffa757213e39afb123bc9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928023, "uuid": "6fb5b7ea-3d37-4eee-8aa6-c1b751d13261", "value": "T196D4018D7298D875D191A0704939C7E4277EB8A17430453AF35B2AAEFEF82D05D3632B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928023, "uuid": "4ea29ed5-98d2-486e-b4f3-d6cfebd16a76", "value": "96eae633c3835f4142e00d18fc3a156d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928023, "uuid": "e0f8befe-50ff-484a-ab55-14082a29fbfe", "value": "12288:7Kcp6t2uLBndJbQCgSLLCRQfTwKNE22+oC7Mizz0JTSgXHBcaxCeDM:75Mt2uLBndguLCsTf2+9P0tlnxCx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928023, "uuid": "65ca604f-856a-4e4d-ad3b-5a4dc3d456b0", "value": 646144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928023, "uuid": "793eebb5-ae27-4d2c-8f45-a92d0019f72b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928023, "uuid": "2eb19c8d-9b0d-417a-b31b-d9e257c77187", "value": "e6f3897b738846eb3d58ecd0677668ef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57e6fe58-32ea-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634874262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634874262, "uuid": "345ffca3-618f-4e85-bf26-3087548463c3", "comment": "Malware payload (Mirai)", "value": "178c4e7697b6cdfaa4e352d92f28766f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634874262, "uuid": "9171dadc-e406-4606-9e8c-c519ccd7f271", "comment": "Malware payload (Mirai)", "value": "bbbe2db4a03990dc02ecd57dd687cad4ffbd24ff5d035b4f9a3ab68d65d35f3b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634874262, "uuid": "65ac39d5-7327-43c2-abe1-67809a3e29af", "comment": "Malware payload (Mirai)", "value": "a7e3dc437fc3ed5efc40f580617ceaa46f8834f2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634874262, "uuid": "d87aea8a-c4f0-47b8-85e3-92dec93b0f37", "comment": "Malware payload (Mirai)", "value": "b37b52749fc43f6a5ce5d0261ef5c547d30fe20c572f3cc00c95dae0a426720a326c834e85f966868c2c178a30c7556e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634874262, "uuid": "3252c595-d779-47d7-960d-6c9119fe1539", "value": "T1AF6371197F650FF7ECAFDD374AA9174620CC641A21A87B397A34D818B20B64B05E3879", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634874262, "uuid": "567d1c03-e4e0-4d5d-a157-f5608ee556a4", "value": "1536:EJ7dZCypJ9KoNPROvJpLSeAwdsWWj4MLZLd6s:4ZZCypJ9BROPc4u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634874262, "uuid": "092bb845-2040-45a5-bfe2-0c5d57c53c78", "value": 69116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634874262, "uuid": "4189794b-b16c-47e5-905f-917bb42e18bf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634874262, "uuid": "d2c33c6e-338b-4521-8b07-a7c3cd241f92", "value": "178c4e7697b6cdfaa4e352d92f28766f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8db3e19a-338f-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634945219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634945219, "uuid": "75e9b210-cd19-4c1a-ba1e-f4f01f96890f", "comment": "Malware payload", "value": "6b2a61536797c25fadf61b9e118a9764", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634945219, "uuid": "2d02f7bc-cef3-4b10-a4fe-96ccbd0280f0", "comment": "Malware payload", "value": "bcaa7a736371d8db89c5ae663c529635632e86d02273e430997a6373e8f8788e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634945219, "uuid": "84137d6d-2065-4c92-b6bb-142f0e197988", "comment": "Malware payload", "value": "cef336921af96c09cfb04b2992ca43354c78ec9d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634945219, "uuid": "0869234f-6d08-42c2-808a-13a01da98a24", "comment": "Malware payload", "value": "a97cbd737a0bd4ad1eeeea526ab0c81208c5c60bcbbdb48283d8bcc4e29004e6d2c2c1f9065bddc9c7dad65f33a70e8c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634945219, "uuid": "13800f53-0302-4c6d-8037-137de1758066", "value": "T159B4C0770216AF89EF7A5FF8980039801FF1B82B573DD646FE8B01A326F6950CA54D91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634945219, "uuid": "dbcbe9c0-119a-468b-96f3-c1555e3447c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634945219, "uuid": "132d16c7-99d5-457d-83ed-4286f6e01383", "value": "12288:Mq/RUvFqJFTPo3XL0tkHnOtUdJ36h7fLNeSWWSzcC6:ZuvFq4cmnOtUShNvW5U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634945219, "uuid": "6d4adfa5-ac11-4363-86e1-fbf3e76e469e", "value": 495104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634945219, "uuid": "93931bc1-020a-410a-86a5-873632cd28ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634945219, "uuid": "140a9dcd-e134-4533-8739-caf476d5b99a", "value": "PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d483118-336e-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634931071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634931071, "uuid": "0c11d9de-5f33-4e8a-a2fb-740481ca7e00", "comment": "Malware payload (RedLineStealer)", "value": "a345fd93f2fba33b4684bcefa32a614e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634931071, "uuid": "2b1b3dee-ea61-432b-81f8-cc128346c30b", "comment": "Malware payload (RedLineStealer)", "value": "bd49a745c03761b578007d77f1c82379af8f4ae324bb41a558477935beab05d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634931071, "uuid": "af30b1a1-248f-4dc6-933b-993a8c61b34b", "comment": "Malware payload (RedLineStealer)", "value": "7b56bf6c2f279ade03196a8e8cc73ea60b79bc0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634931071, "uuid": "23335242-51f8-4779-aee9-b058a194b7d2", "comment": "Malware payload (RedLineStealer)", "value": "9e748ecfbe3bbf1b0a85dbed21e1f8e40e67cf2d06d414262002d05c2b7757d0658c756692cb6964056fe4bf7f0ae7f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634931071, "uuid": "b94d800d-e255-481a-a29b-c40811b1abba", "value": "T185E4D000A6A1C03AF5F725F48ABA937CA53E3AE15B1454CF52D51AEE57396E0EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634931071, "uuid": "32c3d3b2-ee55-4a5a-9903-8071d051bc83", "value": "bac67046644aa5e445c1272184462c49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634931071, "uuid": "94e902d7-05a6-44f0-a01e-1e5fdef97335", "value": "12288:GItlqSjoeoMK40U+HNFoGiE7FUKT4OK0p9GQxfOzSHRfmdPotfCTCZcJr1eV8:GGroqK4+HTB9MOrGBzTQtfmCZq88", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634931071, "uuid": "d0ea466b-c2bd-4cf4-8304-88505134a015", "value": 719872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634931071, "uuid": "d1ffe3df-004d-4ad4-9447-36f02c65a7e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634931071, "uuid": "b8d31acf-5826-45e2-9797-99657bc3fab5", "value": "a345fd93f2fba33b4684bcefa32a614e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b329c98-3332-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634905298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634905298, "uuid": "091484b5-6428-4b50-9313-a7c79826ef3f", "comment": "Malware payload (Loki)", "value": "e03f4ad08fc0f342d85a78c2931d9123", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634905298, "uuid": "3b88a6a5-a150-4cdb-b514-7f65ac375fd9", "comment": "Malware payload (Loki)", "value": "bd7f706554d406bfe8f627cbda77555c6a255f952599f3b22399640fca5a3c9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634905298, "uuid": "3b6cc148-3b68-40b8-bbdc-917ae2dfaa20", "comment": "Malware payload (Loki)", "value": "b5cf0259ed3f1af5f150382a603fa07b50e56655", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634905298, "uuid": "b3e17cca-a382-44c7-a300-aa4851c320f7", "comment": "Malware payload (Loki)", "value": "6357fadd255034d6043dc6f3ddcd721bb62e17f452dc5efc6321890deda94f57ed22ad5a5e48541b6a7541569e8d2dbf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634905298, "uuid": "32dcbeaf-fa07-4496-a59b-754d43569525", "value": "T11934120531E1D4FBE88757B04E77E77AE1F584291726A2073F4A9F6AFD217C2E20A580", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634905298, "uuid": "2193b101-cde7-4729-90e8-ccbb842aaaea", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634905298, "uuid": "214ffb03-61b2-4f92-b06e-53cecdb29e72", "value": "6144:wBlL/cK00E317OnqTuU9mteavU7FUkhIlUZIf0zXXn+Zdl/3:CeKC17OnQm0avU7lhYgXXno9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634905298, "uuid": "a678e4c7-03eb-4037-9845-a63b1381bb68", "value": 245927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634905298, "uuid": "bed51971-aebf-4516-82f5-22f89b2d57d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634905298, "uuid": "6ba2b883-4848-4f4b-bdb7-3d1241a6e1c3", "value": "e03f4ad08fc0f342d85a78c2931d9123.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34c9867d-3338-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634907703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634907703, "uuid": "43148e6f-2d6e-4fa8-896f-41d4212d215f", "comment": "Malware payload (Loki)", "value": "6dbc6acca14919b37309c80b6ed82c07", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "wbk", "colour": "#09CA42", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634907703, "uuid": "ca78672e-5520-421e-8b31-fcd7a7f1fdff", "comment": "Malware payload (Loki)", "value": "be072be325a7009480aaa52fbda5796e9fcaf8909d5da001836b48a196c00ee8", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "wbk", "colour": "#09CA42", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634907703, "uuid": "628efa4c-9ea7-45cb-a12b-1166bf091f4a", "comment": "Malware payload (Loki)", "value": "327e1c2ed05b2ed85d30d25075ccbfe181bbcf0f", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "wbk", "colour": "#09CA42", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634907703, "uuid": "a2f221a7-793f-44c8-a5d8-db1d16d7f8b2", "comment": "Malware payload (Loki)", "value": "5687650fa49232d6c158220e4fa31311a8229974e7ab45c7baa55d6d002ab9aecfb4d47085897908e5de5c0b351b841e", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "wbk", "colour": "#09CA42", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634907703, "uuid": "9f9939cc-e0ef-4e6f-a2a8-e22ad07a17b2", "value": "T1B2A2FF7DF58B0E48AE56C678064A7BA5064DF51D72C440E23BB8DB38794D81B8B23D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634907703, "uuid": "68bb6a17-029d-4293-88a0-d7c5b5e6d327", "value": "384:6KVo4T5mczLhL1SgmH6sEJcNM4fVwju8upx+DvqrAyvU34jilPDs3:Ho4TcczL91SUbjdkLEyvU3KiK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634907703, "uuid": "eadea9f9-48af-46e8-b56e-038cd3a07fa0", "value": 22128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634907703, "uuid": "db33ddb4-78c9-45a5-8d46-5efb7af335d9", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634907703, "uuid": "c9940990-1154-4f9f-a6e1-5994a01fa00c", "value": "wii.wbk.......wii.wbk........wbk...wbk.wbk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd7d22d6-3310-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634890780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634890780, "uuid": "05f63562-49ff-4723-aba7-322a0b6aca2e", "comment": "Malware payload (Loki)", "value": "43040c5411616eb26e97dd9beac0a329", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634890780, "uuid": "ceec3840-d1d8-4534-88d8-0589db2bdf75", "comment": "Malware payload (Loki)", "value": "bf51512f62d8c050db7a0c5eb40c7c252fc01185f0ea6accf0a92a92e398b62f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634890780, "uuid": "351a929a-ea9d-49ee-925a-f054d26cd617", "comment": "Malware payload (Loki)", "value": "a6cffd44ad077c925975958e92bfb9058d02eaa2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634890780, "uuid": "5ef5b611-1e3a-49ec-a84a-0b6cd50a6026", "comment": "Malware payload (Loki)", "value": "72dfa3163157d4cb02748afb3f975885406f17e63254e66b3e8a360a65feb883cfefd4fb1e2ee6edfc2feae96c9f4ecd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634890780, "uuid": "053d375a-b774-495f-b8ae-a867fdaa711e", "value": "T1B894590432B85B12E9BAABF01532550493BB7DAE243DE60D1DEE34CA1F77F448A51B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634890780, "uuid": "caf8003e-2b7e-406c-8731-e57049d804c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634890780, "uuid": "5fd2392a-e287-43cc-80fb-d73a146ac922", "value": "6144:qGxhL+IB/vGCLP4R01wE2WgQdpfa9wLrI3RHOo/+:j5ZfTw05HVwaqEoG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634890780, "uuid": "8923f48d-43dc-4126-8149-64429102d8ec", "value": 443392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634890780, "uuid": "0faba684-12e5-41a9-8eb0-c1d152920b8a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634890780, "uuid": "d7f3c5cc-34b6-4f87-ac86-de487f327cf3", "value": "SecuriteInfo.com.Virus.Win32.Save.a.26327.20747", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4d8d3cd-330a-11ec-843c-42010a9c0014", "comment": "Malware payload (BazaLoader)", "timestamp": 1634888269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888269, "uuid": "13b626a3-fc85-45f0-84a5-4b56867be4bb", "comment": "Malware payload (BazaLoader)", "value": "e01f059a7ae83e71425a2a8f5b8345c2", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888269, "uuid": "d5db7410-3b3b-43b9-adc3-ec2b28acc11f", "comment": "Malware payload (BazaLoader)", "value": "c0308e66398561f2918c1cbf67e596d4d5de3de7cbf91b49b98afaed7efb30fb", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888269, "uuid": "71724bf1-7822-48e6-a59a-f320a1a7ee63", "comment": "Malware payload (BazaLoader)", "value": "9864dbf3fd520a290abe5ba1c82f4afc1b521779", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888269, "uuid": "3863096e-a016-4679-9ffd-93456569b390", "comment": "Malware payload (BazaLoader)", "value": "d44058255fde660df85b357d4c9eb205d2eeee7366d70dd1e46180e6ba171a53a6a75f5e879c464463912697aba51447", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888269, "uuid": "9eac5597-9fd4-4859-a8a2-fd1268c63f9d", "value": "T16686334A75E658FAE4ADE133C151A13EA6B274429309868F0F2CD619CF43780BE7E771", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888269, "uuid": "89b15e83-8e8f-4011-8a99-e1bfc6671aee", "value": "e1e8417f4591da7741a300229f9e8e8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888269, "uuid": "14283fcc-71ff-4934-89f3-fe0cd88a1730", "value": "196608:IufttJlh5vBHuiDPapjlJMA1iBd/Hq3uOkl4OWT3q889sa:TthciDajlx1mHq3uR+OQor", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634888269, "uuid": "d76829e9-3fb0-44ea-a417-a7f22235f481", "value": 7939082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634888269, "uuid": "ba9db431-be9a-4e36-b19a-545fb5e28355", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888269, "uuid": "9e8fc841-fc31-41ad-ab25-475b7e494b32", "value": "venom.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a9f1989-3320-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1634897513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897513, "uuid": "e96cd34e-225c-49dd-9c56-353f91d762b8", "comment": "Malware payload (DanaBot)", "value": "0b24b06fc8dd46d543cd12f15e182884", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897513, "uuid": "3b71db0f-7b2b-47b6-8a8b-059472474a6c", "comment": "Malware payload (DanaBot)", "value": "c0c908fdb5c67cd4ab56ab911320adaf68e4bc9a230a4a04eaf2cf6ae92443f4", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897513, "uuid": "ca59a38f-4b65-4993-821c-2dc5f07c503f", "comment": "Malware payload (DanaBot)", "value": "c4e01c51b4f17c644e85d308fcde80ac0d8f971b", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897513, "uuid": "58ce48b7-7eb7-4db8-8572-5e1a126b4465", "comment": "Malware payload (DanaBot)", "value": "4c6dc1439662bae9e38a3dc834a2f7b79bb32ad824c9e4c2d25adac5a26fbb62b13ddce35ab4eecf6c7cf8cfc91c0013", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897513, "uuid": "a3c0b03e-c504-4560-bace-837fa50a50c9", "value": "T154450100B691C039F6B716F489BA9268652E7AF19B2014CF93E52AED47346E0FC3175F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897513, "uuid": "40ad8b8e-528a-4b09-b2ee-cdb990213de9", "value": "4af4742906d30c7889c195169379a2f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897513, "uuid": "6372e8df-8ee8-420f-87cd-ef1ab59e7adb", "value": "24576:3E6SA9qpwr8KHRkQyPrbpzuaj+c3nz+7LFs4LD1Nv6mY9mWalBDN:gU822hPPp3j+mfo1tpYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634897513, "uuid": "eeede37b-e953-43d3-81d3-9cf2abb87d69", "value": 1273856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634897513, "uuid": "674ab2a1-d81c-402c-9363-a65e066d32df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897513, "uuid": "8ad1b6ab-e728-4b0e-a3aa-1fb65fabb088", "value": "0b24b06fc8dd46d543cd12f15e182884.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46bff9ba-3330-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634904298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634904298, "uuid": "937fba57-52af-4a27-bf3c-6e359e4627f2", "comment": "Malware payload (Loki)", "value": "8ac2bdfeae0ff6156bb667f42d832c81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634904298, "uuid": "49ef6413-c8bb-485e-9bf9-007404ef867c", "comment": "Malware payload (Loki)", "value": "c1403c854426614a4d7bf78afdb7687aa7f20e66024be5ad05d331cfbceab7ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634904298, "uuid": "de6d14fe-27f1-40e7-8911-700c2b556b4c", "comment": "Malware payload (Loki)", "value": "30e43fc578ca13150a5c85f7b899719619dcda2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634904298, "uuid": "2ebb26fb-498e-40d8-971f-3f4a7f15dfa5", "comment": "Malware payload (Loki)", "value": "49ecac3fb89727faff25d176373b8f9c289d6a43ee8242d12aa0ab82b1e5fff8fc57dd5903b9f9a94ed1d6b78876c956", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634904298, "uuid": "a989989b-c290-4c1d-b021-75c192e16402", "value": "T11734122332E488EBD7E64BF25DBA5F11C17A59109107E12FBB948DFB5F612C3C21A291", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634904298, "uuid": "b8d033c3-1adf-4c5c-82db-b0dc31704740", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634904298, "uuid": "e61ad9d4-fe76-48b8-a016-b7b1fa8802a8", "value": "6144:wBlL/cHco/HkHqs7IPcKbQMMz8vPMLFGZ:CeHcKsCcaMpFc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634904298, "uuid": "99d3fe42-ab4c-4eb2-9bbd-b4f97726249f", "value": 245220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634904298, "uuid": "4a10cedb-2cbc-405e-a0c0-2e714f4dad92", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634904298, "uuid": "0ffeee79-ad72-47e8-998a-0f7ba27f55ec", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1c9c6ef-330a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634888183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888183, "uuid": "ecea014d-a05c-45e7-9992-a40bc15ba5c3", "comment": "Malware payload", "value": "33591365763fe3566c1f72e228382046", "object_relation": "md5", "Tag": [ { "name": "mac", "colour": "#285994", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "UpdateAgent", "colour": "#B10D2A", "exportable": true, "hide_tag": false }, { "name": "WizardUpdate", "colour": "#5BF7D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888183, "uuid": "14ca46ab-4d26-4b15-b166-6e8fec877cb1", "comment": "Malware payload", "value": "c19033444f29cb397cb64feed48c8343010c07565eb9c74f570dd4bca6fecee5", "object_relation": "sha256", "Tag": [ { "name": "mac", "colour": "#285994", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "UpdateAgent", "colour": "#B10D2A", "exportable": true, "hide_tag": false }, { "name": "WizardUpdate", "colour": "#5BF7D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888183, "uuid": "e7596379-98f9-4cae-9b8e-334fa591989d", "comment": "Malware payload", "value": "66a6d65669ed9a48a20344ea524c06eb03aa0e71", "object_relation": "sha1", "Tag": [ { "name": "mac", "colour": "#285994", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "UpdateAgent", "colour": "#B10D2A", "exportable": true, "hide_tag": false }, { "name": "WizardUpdate", "colour": "#5BF7D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888183, "uuid": "bfae2c6c-6130-4080-8416-d7abf594ae62", "comment": "Malware payload", "value": "fdfea7200619727d5644e6b33e4093190b65e9f85d46b7a9a3f395ebe3a34be33c6a1ad98915189f9be61a0d10fd1342", "object_relation": "sha3-384", "Tag": [ { "name": "mac", "colour": "#285994", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "UpdateAgent", "colour": "#B10D2A", "exportable": true, "hide_tag": false }, { "name": "WizardUpdate", "colour": "#5BF7D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888183, "uuid": "0114dd9a-6d9a-4492-b5ba-2020449f0ac7", "value": "T12B52BF1A284B9950CF9913366AB60B3041D9592590536FEC4C7E7ACF4F9850CA72BB3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888183, "uuid": "ee77c78b-c114-49ab-9d60-a860cc14fa70", "value": "384:S9UogZ6iV7ej5RftO6C2+DI+wGho8Z6h1P:SdIR8Y6pzlh1P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634888183, "uuid": "595b2361-61d7-4bba-9d44-4deb670165b6", "value": 13829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634888183, "uuid": "8f907702-5a4c-4400-b886-563ae2604020", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888183, "uuid": "a68813a2-3e2e-4ec1-bfa2-685b86855f7c", "value": "c19033444f29cb397cb64feed48c8343010c07565eb9c74f570dd4bca6fecee5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "254cf568-3368-11ec-843c-42010a9c0014", "comment": "Malware payload (BitRAT)", "timestamp": 1634928293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928293, "uuid": "3b2c3145-c99f-4037-b3cc-d9e92c639f9c", "comment": "Malware payload (BitRAT)", "value": "339fec85857966c8aeec59f24584a7e9", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928293, "uuid": "5ea30f0e-b9c8-413f-ac76-965bf994ea59", "comment": "Malware payload (BitRAT)", "value": "c1dfcbaabdd34ccb5257c2856121211485293a7a11a23f61c50440fb27eb2b4f", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928293, "uuid": "28f8325e-4fb3-4390-a364-86ef6e1f4a54", "comment": "Malware payload (BitRAT)", "value": "c68f5a6f5fb129c8727480a628d9c45d25b2d2e5", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928293, "uuid": "adfa7a79-9f6b-4e2f-b990-72c05ac724c7", "comment": "Malware payload (BitRAT)", "value": "e3139962b9423fdde67e50eefd8d4a75a11a3458d2db443bc66b52ff6d4c6a91d2a9c2c1dece5744171bb918c6f6aabf", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928293, "uuid": "fbd20009-6baf-4711-976d-6f3e710dc716", "value": "T129F11F3CE60376DE741D5E2D09CB77295A10C0B5C953E6F9C740FAAC69EEB40AB51238", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928293, "uuid": "6fd5ade4-1a65-4cae-aa04-c028744f5bd2", "value": "96:P/NTJhS9INIKMVGQRX8+HLz9spiINIVIWjnCQRX8Lnaa:P/NT2INIRRX8+Hm4INIVI8xRXAx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928293, "uuid": "e1b99e0e-e1ff-4fe6-ad17-12114ee65443", "value": 7755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928293, "uuid": "08d52152-0771-4316-951c-2ec73f15b048", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928293, "uuid": "9e09749d-a1e2-4996-be2d-a7266ad30c50", "value": "Invoice #3392.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "859e9d23-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928025, "uuid": "6fc42f15-c9ef-4570-83f1-5080812e2ee8", "comment": "Malware payload (RedLineStealer)", "value": "57d667936cc7eb5a544aeb86e8db1101", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928025, "uuid": "536d70f6-6fc2-4ede-91db-a6a002cdaf8e", "comment": "Malware payload (RedLineStealer)", "value": "c331ecf4618d874138014c2adc7378767fac91e6de93f45393f559fff1e1fce4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928025, "uuid": "ad372c29-b83d-4bd3-8080-9015d5e45b31", "comment": "Malware payload (RedLineStealer)", "value": "c5eb290552a0cc3a7f572864f72c94a5c7c9ee07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928025, "uuid": "f78a3a48-9c99-40d1-8239-5c56bd26be36", "comment": "Malware payload (RedLineStealer)", "value": "d2bb044ffb48072adce4dc95de0e55953e9ca048d8d441a9fee67563bfe5fc80f8f40f1ff5d4636412e12f22fae0d607", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928025, "uuid": "43cbeed6-29cf-4e54-8146-6d26e82c827e", "value": "T11EE4F110B7A0C035F5B722F84A7693ACA93E7EE25B2454CB42D516EE4734AE1EC31367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928025, "uuid": "ef4f1a5e-fb26-4016-b2e5-f973277c395d", "value": "25e96726029c322936cf0033b6a07058", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928025, "uuid": "9c8c353a-a98e-4c07-96c0-3ec474a0d482", "value": "12288:T0Wnb7MVoSkcYnLmzqEQq7Qul/YdPZDzWdebNnwXwujCDIvz2V:wQbQVoSkQVQFulQLDzWc5wXwmkV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928025, "uuid": "068bed0f-27bd-47d8-9bb3-8b6e4dcd060f", "value": 669696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928025, "uuid": "4cfcad21-f212-4e8f-b262-98b1f3c826a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928025, "uuid": "7c37687d-2c7a-48da-8c08-91a8abf55011", "value": "57d667936cc7eb5a544aeb86e8db1101.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62b77b51-3332-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1634905203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634905203, "uuid": "e3ffa209-d561-4559-81fe-e679e21aa064", "comment": "Malware payload (DanaBot)", "value": "4708d7597f8efc46d22031ffc794047a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634905203, "uuid": "2cccba0d-4f80-47c0-9bf1-8fc617ac34ef", "comment": "Malware payload (DanaBot)", "value": "c45d421ef1cd52ccc0dfa8bbacd093af7fdca76d402c7d773e97a5b1f0c8522a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634905203, "uuid": "1c2ca5b2-1f7f-4e80-8e83-87e11dab7aec", "comment": "Malware payload (DanaBot)", "value": "028dd45e2fb27d82f53c14f1dc9abfa3573b8c15", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634905203, "uuid": "d2e230c5-1be3-4844-867d-c07acdf09510", "comment": "Malware payload (DanaBot)", "value": "35f315e815ebf36fd7fd9508bdf37c57c45e962c2a2324db1830c2e34c26381c4fa62e47e8fd8f2871bedbb62e63bf82", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634905203, "uuid": "d02168db-7c92-495d-83bf-72b4947aa102", "value": "T1A0563384A2CBEC79EF651530FD130977A675FE9C1E308E2A2322BC8E5837B41D4955AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634905203, "uuid": "062db334-134b-4fba-8726-9466f63559b0", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634905203, "uuid": "df118fd6-1a42-4873-88ac-15f89b0506aa", "value": "196608:2UNH4DqDRM1YJhAPCQQDI+GdfkoWJDN5APPRv3gwP:2UyDqDRk+IsDNGQpN5AVPP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634905203, "uuid": "3b68716a-c2ee-4254-bd67-9b032905c4a2", "value": 6323337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634905203, "uuid": "4a45e21b-6756-4b23-97f2-660315e2aa3e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634905203, "uuid": "6ddf4ef3-a367-4130-b1d6-50e1f0629a6a", "value": "4708d7597f8efc46d22031ffc794047a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22662a7d-3308-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634887057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634887057, "uuid": "94e97273-1582-4994-8c53-1a6240818298", "comment": "Malware payload", "value": "c5cef454eb27eb3b2a6f1b5ec4865753", "object_relation": "md5", "Tag": [ { "name": "mac", "colour": "#285994", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "UpdateAgent", "colour": "#B10D2A", "exportable": true, "hide_tag": false }, { "name": "WizardUpdate", "colour": "#5BF7D9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634887057, "uuid": "40da1702-818c-4a08-8520-7036c423f27f", "comment": "Malware payload", "value": "c5017798275f054ae96c69f5dd0b378924c6504a70c399279bbf7f33d990d45b", "object_relation": "sha256", "Tag": [ { "name": "mac", "colour": "#285994", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "UpdateAgent", "colour": "#B10D2A", "exportable": true, "hide_tag": false }, { "name": "WizardUpdate", "colour": "#5BF7D9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634887057, "uuid": "3f80ddf0-ef71-4607-9f38-43438424b2b5", "comment": "Malware payload", "value": "21991b7b2d71ac731dd8a3e3f0dbd8c8b35f162c", "object_relation": "sha1", "Tag": [ { "name": "mac", "colour": "#285994", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "UpdateAgent", "colour": "#B10D2A", "exportable": true, "hide_tag": false }, { "name": "WizardUpdate", "colour": "#5BF7D9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634887057, "uuid": "8d52a012-7af1-4447-8f22-d58c3a067ece", "comment": "Malware payload", "value": "e18b2c54caa6f2e062e9a8df16cfae6541026efac7ef0129be2e2e8d9cf6ba120b24f0de310bb0df8093d097f539e49f", "object_relation": "sha3-384", "Tag": [ { "name": "mac", "colour": "#285994", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "UpdateAgent", "colour": "#B10D2A", "exportable": true, "hide_tag": false }, { "name": "WizardUpdate", "colour": "#5BF7D9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634887057, "uuid": "cf0f19d9-3973-48af-826f-128901757dde", "value": "T1A3932D335776CA63C6CFB7B470877B1AC600FC926DE559E69768E9240EA0FCE5918B00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634887057, "uuid": "a15132b3-9547-429d-9e3a-e7e6af5e51d9", "value": "384:Piql0phUmGCEw9Bu6zTTupc/elEfcQ4O6fg2JNMwal+qJSaP5zA74zKNrYDW+Ube:Piq+phUmt9MRFS7N9JSaPN9M8iENTHf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634887057, "uuid": "d8901bc9-7fe9-42e7-9b17-09ec4225fc66", "value": 90760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634887057, "uuid": "a10a4c41-b584-4c97-85a1-f87eb75520f7", "value": "application/x-mach-binary", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634887057, "uuid": "ac9a0ecc-cc30-42e9-b2d2-13233fe257c7", "value": "c5017798275f054ae96c69f5dd0b378924c6504a70c399279bbf7f33d990d45b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f7d7f38-3318-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634893951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634893951, "uuid": "1e68f673-0d16-4dc7-a1f9-0f5492f24274", "comment": "Malware payload (Formbook)", "value": "940fb7ef71682b6110d7c2d37a92f5df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634893951, "uuid": "9e952cef-7754-41ff-9ac8-012f363f9553", "comment": "Malware payload (Formbook)", "value": "c87415b188828e354d7f87edc4184c94adb757258e79ab5e1e6e200a8c8df52c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634893951, "uuid": "3c383d37-fd5f-48f4-afa9-f5ef7f9b114e", "comment": "Malware payload (Formbook)", "value": "f399fbab1d1db9c10294a3cb23d71c33947d286b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634893951, "uuid": "e12abce4-c9d1-47cc-be34-442919708f3d", "comment": "Malware payload (Formbook)", "value": "beb0e47d8d1b871108b164b033f64c1a89def04e7a1a24f199ddc7a9aae2a6f8843b4484497d32702f8786867f96137a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634893951, "uuid": "84e5c149-094c-4ecc-b18a-856a43336d27", "value": "T1A774AF10AAA0C035F1B752F84AB693ACB93E7EA16B6455CF52D427EE47346E0EC30717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634893951, "uuid": "5d150146-58ff-4a8d-ba86-c9dce84c8a97", "value": "25e96726029c322936cf0033b6a07058", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634893951, "uuid": "ec00a01f-d3b1-48d3-b62e-a3e974733db5", "value": "6144:n7+kn6p2xtxqlkFx6MPLYp7q9LwvzIn+fPlkFQob7aLaArbEk0vJtEW:7+k6c1qK2kY7btABbmHbVIJtE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634893951, "uuid": "e16d7986-0ed5-4647-af2f-5fdea2fd572e", "value": 358912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634893951, "uuid": "9d4a7752-1397-487d-864b-58c0ac8e91f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634893951, "uuid": "b034a525-cc23-4a59-b7db-64f4a7fa3f40", "value": "940fb7ef71682b6110d7c2d37a92f5df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af3a1ddf-3372-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634932820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634932820, "uuid": "143056c9-692b-40c7-86b3-992f5828e682", "comment": "Malware payload", "value": "34675091ac031b8c43327239a1929dd0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634932820, "uuid": "39372fdf-0ca2-4953-8440-4fefab8018c9", "comment": "Malware payload", "value": "cbf031a1dbedd7a1e8f5b158cd6f9af3995fb4e815caee4723fc3ab03b900b19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634932820, "uuid": "666bd2ec-58b3-44ca-bc7e-8e777366574f", "comment": "Malware payload", "value": "38984bb6cc0e96425cdfd3fb67592a9e4670b6ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634932820, "uuid": "da42cc5a-e1a3-4407-a602-e7b06a286902", "comment": "Malware payload", "value": "ea457a17b7b24745be9599cbd7f80779212f675420264ec2093bafd520ce5df14eb1cc8868c7e46f178cf01658834c03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634932820, "uuid": "e8fcf01f-9195-4f24-a6de-49c2985ec9a9", "value": "T121E3F680C98255F0DBE9EA765F37C83197324E7E2521C09601F67EB33DAE927443B962", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634932820, "uuid": "401db50f-6652-4cee-a0ad-b0b6fa0ad62b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634932820, "uuid": "484a83c3-f15d-465e-a8fb-381bc33271d6", "value": "3072:FHDS/i61Wdn6hpOoU1cymfbmmo6H/BA0rqb6tmb:FHDBNn6/1U6xymrfKgqb6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634932820, "uuid": "942155b0-c6e1-4cae-a45e-070ca4510623", "value": 151040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634932820, "uuid": "a1e103ea-da72-4986-9c89-2630634dcf9f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634932820, "uuid": "e9404473-42ca-4a76-985e-3e2bee570f40", "value": "DHL_119040 documento de recibo de la compra,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13c0af5f-32f9-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634880590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634880590, "uuid": "ba259d12-bcfd-40fc-934d-f234eabcc04c", "comment": "Malware payload (SnakeKeylogger)", "value": "43f6b23871c444e83c21659cdf178432", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634880590, "uuid": "f27f2f7f-4b18-4e99-8377-32e183f82ced", "comment": "Malware payload (SnakeKeylogger)", "value": "ccb998b0a850d4c9cd99f43f12abe761606ebb47b2d2f010133825561abe79eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634880590, "uuid": "b9bf0f81-cadd-4c5a-a27e-2f507785c21e", "comment": "Malware payload (SnakeKeylogger)", "value": "3e36823c8c0559c999751c60108b92c94d1e01bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634880590, "uuid": "ae3869d8-22e0-427d-9ef7-8ccf6ef0873c", "comment": "Malware payload (SnakeKeylogger)", "value": "5abbb113f1ddcfedae2c88f636f83b70eb651b33e891e10694809c120ba6fe873643087d7f749e893ed0683d9bbba539", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634880590, "uuid": "afbbd98a-7d1c-441a-95bd-29ff460c2a1c", "value": "T17CA46A0432B94B02E5FA6BF01672594493BB7DAE1879E24D1DEE34CA0F77F444A61B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634880590, "uuid": "57f7162f-f3c5-44b3-a35a-ff8a15a72769", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634880590, "uuid": "662b0ad4-0014-4865-887e-ade76657553b", "value": "6144:8GxhLHI5iv1zNXtHA0tMXgC/pN0LUkQpzY7twmHaqzJG/RN/:VwsXtHA0At//kQpMtDHaqzAT/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634880590, "uuid": "7f074fa2-7bdb-48c4-8daf-f98fd8f9193e", "value": 456192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634880590, "uuid": "fcbab389-56e5-41f9-a11f-d52e7bf4108f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634880590, "uuid": "eb59f801-388e-4bc4-8577-62da21e292db", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0413e555-32d0-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634862954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634862954, "uuid": "b501ca03-3f3a-45b6-a35f-178bb86a0b78", "comment": "Malware payload", "value": "f68933c356a89c3901e5691d5d9a2062", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634862954, "uuid": "a97e7fc6-d332-40b2-96ae-a6b96282d065", "comment": "Malware payload", "value": "cd17f3728da174d01821fa9053f3e6e60d933b73dea129cf62de20b6121314f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634862954, "uuid": "908893c8-b316-401b-b9ac-84b156c6f77b", "comment": "Malware payload", "value": "70a3c066b35d08b87bdab049aecfcde8a3f986ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634862954, "uuid": "1e2157fa-16d4-4700-84cc-e676f8cfb4be", "comment": "Malware payload", "value": "34d900ad35da225ea93628c87220d329526e2d9a5be3a3f1c3fcee40b32f744a47f9d027008a8108882052f9fc3b3a9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634862954, "uuid": "753b88cf-926b-4277-96f9-21de67a93cb4", "value": "T1329533FB4DD6F076C36D0DB94C128A5F709411D60DD40337E6B79EA52F282BA181ABE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634862954, "uuid": "084510a6-825e-4049-be70-92e17c6ad4da", "value": "02549ff92b49cce693542fc9afb10102", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634862954, "uuid": "70ac9f63-0224-4310-ae0f-82d36e03637f", "value": "49152:PG8aYgeHsSH9ucrquRrXU57v6rnT+7df/vJ22cLNu:PyPOuKNrema7V/vwz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634862954, "uuid": "dd6a77de-f872-4898-a921-3162a3a2716f", "value": 2042880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634862954, "uuid": "d8db7b5b-3fa9-44de-99d8-b7d0db60ee77", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634862954, "uuid": "10445727-a4d1-41c3-93b9-84a950f593fb", "value": "IMAGINE TOKEN GENERATOR DISCORD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0eb0515-331f-11ec-843c-42010a9c0014", "comment": "Malware payload (BazaLoader)", "timestamp": 1634897174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897174, "uuid": "bb0fab7e-67e9-440a-bdd8-60885af571f0", "comment": "Malware payload (BazaLoader)", "value": "64a5774048b74fc220ddfd6dc411a48d", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarBackdoor", "colour": "#1E24DF", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897174, "uuid": "e4a1954f-65ab-4225-ade6-053b2a72ba42", "comment": "Malware payload (BazaLoader)", "value": "cd18e2bebc72f731a5dbe0588ab3633b0421f45fa205cbb674f231d56f4a4e5a", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarBackdoor", "colour": "#1E24DF", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897174, "uuid": "0a997450-99eb-41d5-b4c5-d77dd318c983", "comment": "Malware payload (BazaLoader)", "value": "d0f82e46e869f59b6127aa7d239a392019c35e88", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarBackdoor", "colour": "#1E24DF", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897174, "uuid": "902dbe91-9461-4fc5-a71d-0dd196c49ae2", "comment": "Malware payload (BazaLoader)", "value": "a2d3428c9e32e4587fced03222f0a8768001667a7b0344020407360632e579bbf4e7a1ea6f31651ac67a49ea71726deb", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarBackdoor", "colour": "#1E24DF", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897174, "uuid": "1f2d519c-50e0-4df6-95e4-5bfce4c81633", "value": "T1C7746CA1A5D13990E9C2D87E861BB372EA4B54332FA1E0C271A70BD3452F4D5DF52E23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897174, "uuid": "dabb0a9d-a0d2-4e2b-be7b-e4e069cfdd99", "value": "8fc81352ac718681e376edb5b78a04b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897174, "uuid": "676b4b2c-7c3b-427b-8a37-4ffa30e2e40b", "value": "6144:u55lc2c9mVV7pM3RRVru0hoy4Ip9b/mOawHSjQ5:u555c9A2DVru0hoy3p9SVjo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634897174, "uuid": "ec701f76-0e54-4fb0-b7e0-b48ce70fd8c7", "value": 349322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634897174, "uuid": "037489c0-2859-4cf2-8d20-fb3ac3c1ee37", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897174, "uuid": "b9d42641-2f2f-4bb4-9c6d-3dfa1303766f", "value": "64a5774048b74fc220ddfd6dc411a48d.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7104dad-32d5-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1634865375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634865375, "uuid": "40794378-cbe5-4560-a0b4-3fa177001ff2", "comment": "Malware payload (Smoke Loader)", "value": "bb0d09552bac832dd5249229f9e356ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634865375, "uuid": "86071532-f450-4b6d-af61-c2e15d9bace6", "comment": "Malware payload (Smoke Loader)", "value": "cdf95cc4da03cde567f3deff3fb0d483b91fbf8277313acab2a191fb29b614c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634865375, "uuid": "2d0af440-3747-4f74-a111-0ba8cf57067d", "comment": "Malware payload (Smoke Loader)", "value": "9663e2ab46e1ae68887b80ba0e6c78f843f5609a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634865375, "uuid": "0b413bbd-e7aa-4585-be22-9f02cae64565", "comment": "Malware payload (Smoke Loader)", "value": "4269cb170acd9fce8928609fd0c872b52bb25e49ba0ebc7591b76285423b19e6ea0f7eac134c6feed7be9ce644dd2055", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634865375, "uuid": "da5b91c3-04e8-49e5-881f-4998e09ceb60", "value": "T1B6548E10AAA0C035F5F312F899BA93ACB92E7EB15B2554CF52D426EE47346E1EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634865375, "uuid": "bff563d1-6268-4ae5-8a51-60786030aa1d", "value": "25e96726029c322936cf0033b6a07058", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634865375, "uuid": "501335d4-42f5-4354-81bc-0ba776443cf8", "value": "6144:LnjozYIyIiGOURa4vkbC7wxAwM0ZnTV2h:zjmviD8zvybAROnTV2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634865375, "uuid": "2e2e75ea-6f81-4be1-a652-9c495219444a", "value": 291840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634865375, "uuid": "e3415f4c-3080-420d-ac48-06a68dcd7e5b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634865375, "uuid": "1d8289f0-f405-411e-8538-e8bdff79a0ed", "value": "SecuriteInfo.com.W32.AIDetect.malware2.8342.27912", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f3e0e59-333b-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634908983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634908983, "uuid": "a845df2c-ab8c-4ee9-ba40-e3815aaa791d", "comment": "Malware payload (RedLineStealer)", "value": "64420e27dd8930254ff853f4bbcfbbf4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634908983, "uuid": "c5da87aa-2017-42cd-95b7-c50043638af5", "comment": "Malware payload (RedLineStealer)", "value": "ce15f44e49d68e40d5968e43cee8ae82458fd08fe2173a9c74f552ac6e314457", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634908983, "uuid": "cdda121e-c14c-4b18-ad3e-389efd3037ce", "comment": "Malware payload (RedLineStealer)", "value": "8be849e123a4c9cb877ae1f147e32df89ec92b06", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634908983, "uuid": "599620eb-fcb0-48d5-a1ae-b67123745399", "comment": "Malware payload (RedLineStealer)", "value": "d03a88c8cc243de2cf031d7087f8a9a15982f418048fcc3f01f22df519ac1aec9a59a08533427425ef610de5c497a8ce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634908983, "uuid": "2dc3ffc2-f6f0-46f2-b064-822b13217b8e", "value": "T1CBA25C28B7498535DBB9833EC9E384447338E7836422DF2D39DD615B5DA32962D323AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634908983, "uuid": "e02c2487-078e-43a7-ae04-b94c20b7ccf1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634908983, "uuid": "bdd0cfe5-49ae-411b-8d57-23e09f0b957e", "value": "384:Kz819sO9kzbUIxbgUjmWERIfX6cuvuTY3PpQ6bn8l:jkzbLbgGbfXbY3Pm0n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634908983, "uuid": "26c2dcc4-888c-4012-8e9f-edee9efe2809", "value": 23040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634908983, "uuid": "227f5f80-36a2-4112-b30b-a8adc7555f39", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634908983, "uuid": "af3fc487-41f6-407d-8cb0-9ddb80c98756", "value": "64420e27dd8930254ff853f4bbcfbbf4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cabc4d78-3352-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634919122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634919122, "uuid": "15c2c3da-be75-43d0-8bc6-41d8cdf4a6fd", "comment": "Malware payload (Loki)", "value": "9874f21e0e3ee7dd020434173334e191", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634919122, "uuid": "1ae5d021-5900-4e6e-a372-68df41515ba2", "comment": "Malware payload (Loki)", "value": "ce7e05df71270d0aed71ab8af1de1f152fbdfeb10d781fe26e3f8c58c3fa899a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634919122, "uuid": "1bcdc785-0aef-41b2-8150-4e6395110677", "comment": "Malware payload (Loki)", "value": "5a4a29b0980ea0b5b42da76d878102bf7a00807e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634919122, "uuid": "c595f572-1146-4141-8905-8aec581b7221", "comment": "Malware payload (Loki)", "value": "1b33e63346223abc0e22c576ec02610b91cb90b11d4269c973e9bbbdaf105bb073947355e73a3a7bffe58a13f7063709", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634919122, "uuid": "d1bc7b0f-2ba6-4054-b587-48f99d14fcf0", "value": "T119746C00A691C039F5F326F48ABA9368A52E7EE16B2450CF53D52AED47356E1FC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634919122, "uuid": "03f0adff-5db0-4553-8d3d-f51658fa9a3b", "value": "4af4742906d30c7889c195169379a2f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634919122, "uuid": "6ca51c8b-129b-421d-8eb1-234fbfb207dd", "value": "6144:XrydTW3AHIooGEArx3i6VaiGuBKIugXd2qP4XTMDV/xkAkLOoT:XGdKQHIoTEArDQNIugXd2qPaMDV5kvD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634919122, "uuid": "8661e822-8766-4e0b-a38d-d8c95041e362", "value": 353792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634919122, "uuid": "16342c2e-0f35-49c2-8199-ada306002d2b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634919122, "uuid": "4e3a2504-91e0-44e5-86f4-5c6b9e5e136d", "value": "SecuriteInfo.com.Packed-GDT9874F21E0E3E.18172.28183", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "385a2909-3307-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634886664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634886664, "uuid": "fdb6590c-8fda-4cd1-8103-5b0a7ed246c1", "comment": "Malware payload (AgentTesla)", "value": "365407f16ca457e0c46a0bbfd1333efb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634886664, "uuid": "3cd2f063-3a50-4427-97f3-9b26449f7fe6", "comment": "Malware payload (AgentTesla)", "value": "ce845b0a702585cfcae3fbd0b2f87e620622f1ecc2d793c1eb663eba7355ae6b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634886664, "uuid": "ce59386d-9b25-4838-be00-5573b1ef8dc0", "comment": "Malware payload (AgentTesla)", "value": "48d78f7e3f150b797ad4524471282a6081383471", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634886664, "uuid": "16a5aee2-d682-4f3e-a3ac-ed34ab133402", "comment": "Malware payload (AgentTesla)", "value": "ea71288deb54474b3a507296cac709bb1cf4f4595aac28227270118d98badbf4db6980987b40f6469b01cef5607596ad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634886664, "uuid": "54dda0d7-066f-4b16-a9d7-819207b29364", "value": "T16A15CFF22E06BE85EE6A1FB87400287C5EE3BC275B69D656BE8BF16716F3410CD10941", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634886664, "uuid": "f89efe1b-6a55-45d9-840a-ef16fdc155af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634886664, "uuid": "f44b07ec-2d47-4f4a-8341-cc788306d2e3", "value": "12288:nqUyBKvFqJFTPi4c8IKheIUlDsrdTkD4FUPKWXP998v9:L/vFqe4zHUlDewDbF998v9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634886664, "uuid": "a3412a84-9554-4742-95b3-f63e94e71366", "value": 900096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634886664, "uuid": "20618bc1-6eee-4d50-a578-831485f9c3df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634886664, "uuid": "b86aeda9-fa58-4d61-ad2b-270f24c30803", "value": "SecuriteInfo.com.Suspicious.Win32.Save.a.5480.4695", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edb51c63-332d-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634903289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634903289, "uuid": "eba04f78-21a9-4744-809f-45e6b6bf9b5a", "comment": "Malware payload (Gafgyt)", "value": "15fe1be0181a3eb3cc0c9eca795e1baf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634903289, "uuid": "08ac0554-0c03-4127-82f5-e7c2f964d5d1", "comment": "Malware payload (Gafgyt)", "value": "cece82b7a8d4d9d778549a6be2818fc7bb8ce944335162f8408ad817b6e2de31", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634903289, "uuid": "5dd63185-695c-403b-8e41-622fb34325c7", "comment": "Malware payload (Gafgyt)", "value": "ae6b11f234e6112c0e1e166731cf27189393d150", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634903289, "uuid": "b480dc0e-32d3-444d-80ab-be0ed73d2f33", "comment": "Malware payload (Gafgyt)", "value": "50a14aea400543071c5ffe62eb5e93ec779f9b23ef21795f69d6ca637a2d10f6bc87ed5066823b3ad3a5c0c132c3c920", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634903289, "uuid": "3c0e694e-9134-4e9d-87df-e17ff48db851", "value": "T182C33B06F5108753C1C2177AB79F561A77232BF897DB3312A6247FB82BC279A0E39950", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634903289, "uuid": "11088ebc-fc2f-463f-9e4c-839f3bfa6836", "value": "3072:idwracAAviNmLpMQ1xr5hKHKSrbqlAdmyDQUJ1UX4Tn:SwraFgikxr5hKHKnlAdmyDQUJ1a4Tn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634903289, "uuid": "2269a208-ca65-4f92-bca5-19ea3b8f9c3a", "value": 118932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634903289, "uuid": "80d341be-d605-425e-b906-324156e8cd6a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634903289, "uuid": "02815a4a-3e68-4b0f-8cb7-72aa8b2bd737", "value": "15fe1be0181a3eb3cc0c9eca795e1baf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c64c534-335e-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634924118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634924118, "uuid": "8918be72-c79c-456e-bbe6-930183dfe86a", "comment": "Malware payload (Gafgyt)", "value": "914da5dbf7c078b5a2d237dd2397477e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634924118, "uuid": "2b99a203-eff6-4140-b287-e9f32250e258", "comment": "Malware payload (Gafgyt)", "value": "cf0926b505f37d466587cc348f811e12070d6e1a036b41bb58126e60c25da7e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634924118, "uuid": "8359b65f-11f3-4451-bb7e-6d72408e50e7", "comment": "Malware payload (Gafgyt)", "value": "a3eaf013c369025b3dc0a892313022617fcff9ba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634924118, "uuid": "e08c9906-c06d-479f-ab40-800eb0db9db8", "comment": "Malware payload (Gafgyt)", "value": "6a2c7902fd1afad1e4a71547823d9417a5e08a866d325b20ebab7c9c6cfd1891fd08df1871877f2edccd3ce5d6c2670e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634924118, "uuid": "9971155a-c74a-498d-8e1b-affefd106ccf", "value": "T169833B47E9A19FB7C0866A7565AB5E300B13E9912B4F1A4A303CA7F8434F4CD790EF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634924118, "uuid": "30a63bb7-c4e6-44d0-b81b-d13b2c0351d3", "value": "1536:SlN9QyOXa0yrck9BIqKWgkKfDKJC5WjE6PFLmkxVqOEeofzee:QLOXa0yrckWWzJalYLmkxVqODofzee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634924118, "uuid": "d3817ca4-9f86-415f-a80e-0eebad693b5c", "value": 88733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634924118, "uuid": "bdcaeb27-8192-43bc-9dc3-38d62b58079e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634924118, "uuid": "0221c971-2c37-4501-a88a-1e7e1db4a8db", "value": "914da5dbf7c078b5a2d237dd2397477e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0b13214-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928124, "uuid": "65055865-130f-43ae-94d5-a2b050d438ae", "comment": "Malware payload (RedLineStealer)", "value": "4275c7550e4e0523a6dfe9e96c683ea1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928124, "uuid": "6a7efcd6-cff6-4b91-aad9-bb18a1d5b42e", "comment": "Malware payload (RedLineStealer)", "value": "d07f1d2413b44397a3c6dd591f04ed1d7e86ebc18f1c981d77f2fc0decfe211b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928124, "uuid": "58c48995-dc77-4b1c-8357-1a96a204cf06", "comment": "Malware payload (RedLineStealer)", "value": "9b73a9d76fb28dcdf525d6061a59323805f112e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928124, "uuid": "6ff36c3f-cc19-440f-89ef-2580dd74a8e8", "comment": "Malware payload (RedLineStealer)", "value": "c2c6e1db336ebbb2dc166c1a56165f20c5d8a629d12cbb6d711fc795ee01674fbc18a0b71cc06247eb582a5542f3faf8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928124, "uuid": "e440ab02-9411-493a-ae47-eec6b39b4af8", "value": "T1DAE4F110AB90C035F6B316F849B69378A53E7EA2AB2555CF53E426EE07346E0ED31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928124, "uuid": "82bf6ab1-0e16-45dd-bde6-2fbc9a3064a9", "value": "0aa8675e96bbc2351e2af940f447c93e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928124, "uuid": "33b20de5-a396-4eb3-880c-82da9e144791", "value": "12288:9MYYVUbbBx2uSuw1bqNd+rCylLnnfVeJMQuxtMVLRjsvnvxqXUChdde+aZK:iMXaRu2ud+OyZnEGtMVuvIXUUA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928124, "uuid": "d2bd0d0a-1d42-4388-a93f-e39b90866e23", "value": 669184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928124, "uuid": "a7ab8fe5-fa4e-481c-8495-da6a7d56ed2c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928124, "uuid": "27d7de5b-617d-4297-85ef-2669db37262c", "value": "4275c7550e4e0523a6dfe9e96c683ea1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb0dd801-332d-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634903285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634903285, "uuid": "50f7d371-e4fa-450b-8a79-8b706b50c855", "comment": "Malware payload (Gafgyt)", "value": "b6d7f1dd32701efe6c6fa1dada1c9829", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634903285, "uuid": "4bf8d80f-c1bd-42c3-9c78-e5798174756b", "comment": "Malware payload (Gafgyt)", "value": "d1b9aa74142ebc02fcfa0e46c88e1e094aed9e6e55650306aabe7c8c75b50ed6", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634903285, "uuid": "4ffbce50-72e8-4b0e-8025-00174c35caf6", "comment": "Malware payload (Gafgyt)", "value": "75623eb9a4d1d46148fac30d148cbf5a3b61c7a1", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634903285, "uuid": "9f0981d8-b4fd-4172-81bc-c1c34a115477", "comment": "Malware payload (Gafgyt)", "value": "bf7de7936f56044132059e04d1b93c2791d11e0070689d870df03d8d1f915fed1501feddab0db319b0eb1a71fc0fbacd", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634903285, "uuid": "8123356e-022f-48e4-8fc7-34046a29dbc6", "value": "T199934A17B653C6BAC0874BF41BDB9A314923B8BD0B227206B3D4BCE67F165A61D19F40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634903285, "uuid": "b0eaafac-6521-4ad9-9799-c4a2c8b3000d", "value": "1536:p7rHXokXsWFVSzkfLEkZAT5ipG5v33phauH/SPNlDDUg6I9um2Xj5YZb0e:pcCPOkfQfNipGd3phaE/AVog99um2XFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634903285, "uuid": "60058bb8-3103-4fe9-8ae8-75b7502b5718", "value": 94012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634903285, "uuid": "92a278c5-ee3d-49d9-b2ba-84598e5a7df0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634903285, "uuid": "dccc48ab-d6d6-40e7-b6ca-62032528004f", "value": "b6d7f1dd32701efe6c6fa1dada1c9829", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ff8cdc2-32d1-11ec-843c-42010a9c0014", "comment": "Malware payload (Mercurial)", "timestamp": 1634863457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634863457, "uuid": "422f8d09-7233-47b0-9b82-e81e15d8f176", "comment": "Malware payload (Mercurial)", "value": "df01a8c7077dbe40e68979f486ad29a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mercurial", "colour": "#79A0AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634863457, "uuid": "197f942e-6cc9-4692-9a1e-224b58c2ef26", "comment": "Malware payload (Mercurial)", "value": "d361b54090cffa37e08b270d91a6fa1aec4f78347f38ba930328c84733a233cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mercurial", "colour": "#79A0AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634863457, "uuid": "d7bac44c-0113-4f0f-9dd8-8107b70d7e01", "comment": "Malware payload (Mercurial)", "value": "0f335a9a6ead9b8961a57bc724c93fb672ec14cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mercurial", "colour": "#79A0AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634863457, "uuid": "83ab0130-c2c2-4a18-8e2a-9aca7396d396", "comment": "Malware payload (Mercurial)", "value": "6767935594298450a3647bd85fe1cc8f50a52d46aa3229c4083369ba0879b7d379215d145c07182356f939b30897b304", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mercurial", "colour": "#79A0AB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634863457, "uuid": "df87b885-2132-4bd1-9d7f-95db2d468b8f", "value": "T137434A0977FD1608F3FE977A6DB18054467AB9625C21E74E1DB4A89D0CB2B808E50FB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634863457, "uuid": "16bb15d7-830b-485d-a751-5a54dcb0aa4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634863457, "uuid": "75c27d0a-ac1f-427d-b7ee-31b065a61d34", "value": "768:yrLfRHhf9uZ+LMmTjWKZKfgm3EhI99clYC3VVyAfe42TevR7u:yBhfJLMmTaF7Ei99cLVVx0T8B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634863457, "uuid": "b62d87f9-d4b6-45e7-85fa-863590cc465f", "value": 58368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634863457, "uuid": "7f8ad58c-da7b-456e-9a66-d6205ca9c722", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634863457, "uuid": "894dbf34-388c-48f7-b857-dfd41966663f", "value": "DiscordSniper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4873b0d0-3365-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634927064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634927064, "uuid": "1b281bcf-2de1-46c4-8685-18a49795e90d", "comment": "Malware payload", "value": "e3e50e67b391094d20138fc23069801c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634927064, "uuid": "22cf63ec-e3db-44a1-9828-94cbaa375c4f", "comment": "Malware payload", "value": "d3ae130dbe49ef7c5b9a8cca96fc259b37439690fece2c8b78978ac1c3e9218a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634927064, "uuid": "f512e95e-05cf-4b6a-8ccd-4d0a3a26e1d6", "comment": "Malware payload", "value": "782e6eafef71417c8a23af5c71722befeda4765f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634927064, "uuid": "9f6623d7-98dc-4d65-8259-2926fb8d90a2", "comment": "Malware payload", "value": "340e50494ee89e17bfde31407b58d4592b87c7d162ca8d1f71639a7bf219de2f415f742d20ec55406743512d1c22a336", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634927064, "uuid": "eaf239b5-d1a6-4fe6-bdb7-7a659ce0bee5", "value": "T13EA4AE00AAA1C035F5F322F84A7A936CA52E7EE16B2450CF52D51BEE57356E0ED3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634927064, "uuid": "0f45d0b9-da4c-49f8-9d92-70b97ba9d0ec", "value": "9cccee30870eeeef9fd80f169e4bd55f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634927064, "uuid": "8e73116f-3ad8-4365-8230-b45ce80bfb80", "value": "12288:Lt+zkr+f7tVq8FHxw2xwDVCnd+wzQOFt:LgI6fxVq8PWDAndRXn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634927064, "uuid": "c17c5d99-f72f-4a64-a2f3-f74178930fcf", "value": 454144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634927064, "uuid": "964db50b-355f-4e0e-b66b-62a20508e1b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634927064, "uuid": "a9b45126-515b-4526-a52e-2180afa7ea1f", "value": "e3e50e67b391094d20138fc23069801c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6d46905-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928135, "uuid": "4c02f29b-9db8-4d23-ba51-eba37c1267f5", "comment": "Malware payload (RedLineStealer)", "value": "28f6bde1a067594cae249bd74c800725", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928135, "uuid": "c350c431-ce74-49b2-8243-9b7ea83d770a", "comment": "Malware payload (RedLineStealer)", "value": "d405ff2a077d0fd388e154ca2ed6b1c1edca639dd16db29f365afe4fcb5b08d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928135, "uuid": "2b48f114-e11a-49a6-a0e8-4da05fa34e2c", "comment": "Malware payload (RedLineStealer)", "value": "9bab3f929fcc1b073eba86f1b19efb5cb491a35c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928135, "uuid": "919248bd-0c82-4c58-8113-6612725a84d6", "comment": "Malware payload (RedLineStealer)", "value": "467a057e75acab9c640c0b42bddfc6b917fad26a66150a82014f1818a8ecfde604e900775e2988422009c20ac66ecd57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928135, "uuid": "3516add9-d08a-4a5a-8c38-acca2f01b67d", "value": "T1ECF4D010A651C039F5B312F849B5A379A52EBAE25B2450CF93D41BFE4734AE1EC3136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928135, "uuid": "da605318-0366-4aec-9bd2-0c9ab2c41fd3", "value": "4af4742906d30c7889c195169379a2f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928135, "uuid": "07a35308-e913-4b85-805b-8104fee3df89", "value": "12288:6CdEPlISfCb/cmd4oIAi5xz6leJKGArW0IqJ+xRsx4icWMldfvj53ZDS534q:6+EP+SfCb/6NJisKGACzOoWmvj5JD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928135, "uuid": "a3373ab7-e1b8-4dcf-aa1d-a91dc20747de", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928135, "uuid": "4e728d4e-6875-489b-a08c-1c3413869a2d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928135, "uuid": "03d77d55-8c38-47e9-a5c0-eb9a87934864", "value": "28f6bde1a067594cae249bd74c800725.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c543f4f6-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928132, "uuid": "d7c42b8d-79c2-41ec-83a4-6aecdfc62bf7", "comment": "Malware payload (RedLineStealer)", "value": "beb3b24c5b0cd84628b57a4a743d1cbe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928132, "uuid": "867fc19e-c0df-4096-b107-b846220123bb", "comment": "Malware payload (RedLineStealer)", "value": "d54cb4561c05ca753591983eecc6f66fa056c4b9b9f7447b718933cd238814a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928132, "uuid": "097d21ca-0752-45cd-9cfc-c626d54b294f", "comment": "Malware payload (RedLineStealer)", "value": "8f12e4f61c522f3c482448a40c8555c13c4b2e68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928132, "uuid": "0a7cd862-c168-45b1-afaf-8d64c301e841", "comment": "Malware payload (RedLineStealer)", "value": "4b2a533a4d4d32bfcdf0bd5ed63268a0cf93cb461814d4a012e2ad6bf672e07ad4db35307cf299e30f1cadda14eb05b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928132, "uuid": "965fa75b-90f6-44dd-ad3e-413aa4a4afdc", "value": "T1DAF4D000B690C03AF6B312F849BA6378653EBAE15B6454CF92E427EE47355E1EC3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928132, "uuid": "e686be38-d9eb-4df1-a951-3b9bdd972ad7", "value": "4af4742906d30c7889c195169379a2f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928132, "uuid": "53c1ae5d-322a-4fa4-9e96-e0ba37ab4bf4", "value": "12288:EadLEsu/SFETZQNPFHwFgD40ZR/8WdHdJhAm1S5Y3sTUWghdSh4aRUDmzM8y7:EG4jEE4FHygUs/ndHd7f1w4Wjh4aiD9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928132, "uuid": "ba78f2bd-ee16-4f63-bb19-09f2069144a4", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928132, "uuid": "d58813b9-8446-4a7f-8727-1535e5529a24", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928132, "uuid": "888678de-4d4f-4fd2-a4ef-d958687c4394", "value": "beb3b24c5b0cd84628b57a4a743d1cbe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a26493a-3364-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634926610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634926610, "uuid": "a83ef752-1904-40d3-862f-99f26883fe4e", "comment": "Malware payload (SnakeKeylogger)", "value": "5c463c3e03c0bd04fbc44d991d0aa824", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634926610, "uuid": "5dff9c41-059f-437e-99f0-a5753c4a8f27", "comment": "Malware payload (SnakeKeylogger)", "value": "d5a760147bf03d771e76984af79221d7a8f6e0b9ddd8d542b39d782c1abf9d3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634926610, "uuid": "934dd43a-836c-447a-9889-c0bf412f9b58", "comment": "Malware payload (SnakeKeylogger)", "value": "3febac17371779aafa86cabc63fe7db013274c09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634926610, "uuid": "81ed373e-8892-4a62-b67d-4eff59c26c57", "comment": "Malware payload (SnakeKeylogger)", "value": "166f9d242d8c94e46ddf87cbc3de3312dfc1017ab8cfab9402aef5654c97140e4c9c34cda59108350e5d6a3dce2bf7c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634926610, "uuid": "89ed1c64-85cc-4785-a0ff-0a4c5aefa5c7", "value": "T191D217263798C588E1D48E728CC3ED604AF1FD731411E6AA72D13B6F6E33B96E607245", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634926610, "uuid": "15cf1263-9ff1-42ba-b661-6bfc6aaf0d77", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634926610, "uuid": "3e5dbe91-5698-406b-93bb-72ed47e300de", "value": "384:7Qv5/pfo8ZmiFufsASfXiPG9T6nRqRZdqiOs6JNp9IKDQckRKDVbJapdKDGPGAni:Uv5/do8ZmY5AqanRqRZdqiOLpJ90PG8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634926610, "uuid": "bb2c4f48-0130-44fc-a78a-c0b18351157b", "value": 29696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634926610, "uuid": "5306b7fd-9807-41a5-a534-05d38d284509", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634926610, "uuid": "7d7e2827-f1bb-47c0-9e21-1a40de9a0677", "value": "Q-700004637 1004913.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a07ec05-32fa-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634881244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634881244, "uuid": "5fcb2368-6098-4609-a341-1017e772bf13", "comment": "Malware payload (AgentTesla)", "value": "8a366641fd68e8e1f9a95c70b033e065", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634881244, "uuid": "6665c763-ab46-4525-a7ce-86aa10f5581a", "comment": "Malware payload (AgentTesla)", "value": "d74b6c8662bcd8d74ab69f4959f4cc7e0c9298860d7b782c4bc8a810cb411353", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634881244, "uuid": "cdcb0a4f-588a-4757-a488-51fbae1c58b8", "comment": "Malware payload (AgentTesla)", "value": "77180d284883d44381d9e900c3b5dedde59a43bf", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634881244, "uuid": "1312111a-6d17-49c5-9bb0-86a322c144a9", "comment": "Malware payload (AgentTesla)", "value": "0807b333c18849aa9dea379823c952ca23c392bc465e3bced28ecde581fb48072f5191dcaabaae51b235b8cf3995af46", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634881244, "uuid": "5e44da75-8d9e-45eb-a692-d9811401027c", "value": "T1C9942311A0FBA81B7165EF7F2C05CA8243AF44F6959942E31D06598D637078BDEBFC28", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634881244, "uuid": "1821d070-7cd7-408a-b6c6-4a3e8c425e39", "value": "12288:W3teyBc/VdiQtSBrtt8st0sXOzoy4mHVACKo:kPBcyWSZEqxe3D1ACx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634881244, "uuid": "6e8aabe1-a6e2-4aae-9a42-cdabdcb12b69", "value": 436830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634881244, "uuid": "ac2e344d-d33d-45fb-9391-ac1ada53b953", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634881244, "uuid": "28f99c17-56b4-4f8f-97ae-bd5e828f367d", "value": "DHL Receipt_AWB#2045829822.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcf42518-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1634928226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928226, "uuid": "98179762-cb0e-490f-8a27-64954497e7b6", "comment": "Malware payload (AsyncRAT)", "value": "6d05808296262dcf235b73b3159265e1", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928226, "uuid": "3a4f2a9f-4e17-4467-a3cf-288797f543ad", "comment": "Malware payload (AsyncRAT)", "value": "d8268b80725c40ea018ec8cd973816ba0719d11d78ff8904e980f3060deece7c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928226, "uuid": "2e1b5a70-ef41-4375-b6ed-a0342ca85097", "comment": "Malware payload (AsyncRAT)", "value": "81df3f46c706d0c5b81f283d971b336f4fcca69a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928226, "uuid": "277f03a1-8844-4d51-82dc-a8c7f6ef5e64", "comment": "Malware payload (AsyncRAT)", "value": "aa30756b5b5fb65440d50983d54d6fec7f4e7bbd3799551f4b9a372be7a206f03daf86f5a795f1c20262b7932140fd7b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928226, "uuid": "1df3cd9b-1034-49fe-974b-29d3a7e010ff", "value": "T104C3F16997D88177DDFA6F3298A1C602A730A7037C53CE3F84C981A50DA324359B1BDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928226, "uuid": "d9291e71-422c-4a36-8ee7-30904e1a9fef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928226, "uuid": "3ebabed9-3e1f-4f4d-b85b-8ded9a547146", "value": "1536:s6zs2TwpOfE71rwumR5e6kE4+0PvsFvmOw38ABVGKPP9ey+V9DkYdWLnudb7UfN:zYpO+rwumRE6Q14vmOw38a9Mm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928226, "uuid": "9dcbfdbc-fab9-45be-a6cd-9ef885b9a2bd", "value": 121712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928226, "uuid": "85a4b1e9-72e4-42dc-b587-0b79fe1348de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928226, "uuid": "e8f0c4cd-c009-482f-9067-5c3767271fb7", "value": "HalkbankEkstre20211021101606507653.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccc7f61d-32cc-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1634861573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634861573, "uuid": "a90ba18b-aa5a-4576-9031-960ca7acde65", "comment": "Malware payload (RaccoonStealer)", "value": "e1acbd5a6f99723b593c01d66db26b8d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634861573, "uuid": "4dce9578-ce72-4aeb-a7ae-49371546d3e4", "comment": "Malware payload (RaccoonStealer)", "value": "d88640b60a99a39f22a11731d0fc886fd2c9fdfb094f42886e6ba419025e69ec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634861573, "uuid": "976c931d-bea1-425f-a543-91cc2fd33fae", "comment": "Malware payload (RaccoonStealer)", "value": "b3101df9e1c686d2c92814106c414eef586e7589", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634861573, "uuid": "1efabfbc-471c-422c-8fce-bdb4abab38ce", "comment": "Malware payload (RaccoonStealer)", "value": "18cb96761fff87d11a19cc981d295a175ef29030fa577eb00408418e40d267f2bda89f216060d81240b65035f950cbaa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634861573, "uuid": "be17e3b0-d809-4413-8bf4-9628442d6dc5", "value": "T14635232F9BB43160D66A9176F542AC005781DF42BC6CFE707297AF0D6626BDBC702E81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634861573, "uuid": "226d00f0-9d3b-4854-8129-ac915322ecea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634861573, "uuid": "573ad1e6-b282-48e3-8920-d0b6a1a26448", "value": "24576:w06qmrWqPh8mEa3H1WG+34OJ0CFpD0Yn+511xRZ8q2XoHWwb:8rWI8jYH1m4OJ0gpD0Y+rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634861573, "uuid": "a1d19e38-7db1-414b-9209-e5ed33f6f378", "value": 1117696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634861573, "uuid": "79ee3f79-812c-4406-afb4-498cf10bd7bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634861573, "uuid": "7adacb13-da04-4588-9925-b5ba61b0c30f", "value": "e1acbd5a6f99723b593c01d66db26b8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f09a64cb-332d-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634903294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634903294, "uuid": "d30d462d-0401-47c3-930d-bbaf6b3b4b1b", "comment": "Malware payload (Gafgyt)", "value": "ce2fd4651312527685b4f7208b51ec88", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634903294, "uuid": "be2d9c90-ed50-41fc-9d0c-f15f770dfd8d", "comment": "Malware payload (Gafgyt)", "value": "da719e8bb3efd4060f09f6c584445419ad0e10b2f8a075d5f6c79fb4b0bea3c3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634903294, "uuid": "47478e57-9047-4d66-a1b2-ee5e8b3c9faa", "comment": "Malware payload (Gafgyt)", "value": "96576cf9d4c61568d6c58ff2d376f7325a37df9e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634903294, "uuid": "2994ea4d-a059-4826-add1-e9e92b7c79db", "comment": "Malware payload (Gafgyt)", "value": "c0c88896d16198c1ad01e6ad88df8c223b2d43035f1227d9f332f81b4b1a559da1ddc437da8a8cca005f09e09ed69620", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634903294, "uuid": "9ab7a898-3da3-44cd-b074-5d1c03a07c08", "value": "T112B3E857FB11CEB3C85FDD730AA68A01108DA99746D57B6BB3B4DA5CE74684B08E3C80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634903294, "uuid": "b26a8221-63dd-4650-b550-147d94c0b735", "value": "1536:Tgz/qzNLW/fMiZIX98U0I/QwErQNOv5hVwbfKdwwjF9GhCPR1Ae:Tgz/5f5g8utgr5hVwjKdwwjF9GhsR1Ae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634903294, "uuid": "0d0cba1e-85d7-45c7-8aa7-3b071064e70c", "value": 116647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634903294, "uuid": "8d46fab7-3d24-49a7-b286-ccd9cf5f4243", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634903294, "uuid": "6dcaf92f-883f-4f43-aa37-0e6c27e13cd8", "value": "ce2fd4651312527685b4f7208b51ec88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84c434ca-32e9-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634873907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634873907, "uuid": "bfd39f75-a77a-473b-9d86-7e7a2210d29f", "comment": "Malware payload (Mirai)", "value": "ba1b112431e1f272bf68823da374fc8e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634873907, "uuid": "168b9882-6383-4192-a4f7-f3dc90d40972", "comment": "Malware payload (Mirai)", "value": "db002ede498a5af3efb83d627392ccfc45145036875f64d13118ef5b166467dc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634873907, "uuid": "0cfb26dc-f5de-41ed-9393-3d6cc7bf3a74", "comment": "Malware payload (Mirai)", "value": "a23ffb73fa7692d53d3028753aed3dcecf05cbc6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634873907, "uuid": "500e6793-77f8-4870-b7e1-c22137140f32", "comment": "Malware payload (Mirai)", "value": "ba338a62db725289da1f4ae56bdf3851893121932d07e76d6706cd6eedfa3527082390b464701b0b886ff54a53a5d056", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634873907, "uuid": "0a1cb0c2-0f52-41a0-b0bc-2cc32d002b58", "value": "T1CBC34C46EB408A13C4D51775BADF424A3323E755E3DB33068918AFB43F86BAE0E67506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634873907, "uuid": "8cc87252-a938-44f4-93bf-8ed082d19b36", "value": "3072:+KhtPUfCBPi49iuFcpQe8ZVu6h+amQxVTGyz:+KgfqPiSiuFcpQTVl+amQxVVz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634873907, "uuid": "024f3166-5262-4bcc-b2ed-a58da537c066", "value": 125754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634873907, "uuid": "29163963-d47d-4f2a-a2fc-d8781b059fb4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634873907, "uuid": "a454e833-3707-48de-88c5-97b982266407", "value": "ba1b112431e1f272bf68823da374fc8e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "152fc1a1-335f-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634924401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634924401, "uuid": "422fbd32-a88a-42b2-9027-2a4fb82a144c", "comment": "Malware payload (Gafgyt)", "value": "8ae6ced0270be2a070d34debbffa8240", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634924401, "uuid": "0bd7735a-2e65-4ddf-849e-a7c299749d52", "comment": "Malware payload (Gafgyt)", "value": "db4ad00c53bb4d6a5133785df6b224ea640240076f99994f4e6da6288b897105", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634924401, "uuid": "72222d42-e625-4c1c-a3d0-d42769c939fc", "comment": "Malware payload (Gafgyt)", "value": "d30d273fc3714030cc8711de3676a93426fa93c6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634924401, "uuid": "777aee11-7f23-47e4-9340-27e0fd2bbc2a", "comment": "Malware payload (Gafgyt)", "value": "a66b5e7545ef795940c9cc3f193ad7a430feffb7924e7be837ca440a2683e2aafc3f727dd4939dd49797edb1dfe7ea8e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634924401, "uuid": "3def1f19-f465-4cb8-9125-65823c1955ef", "value": "T19AB31845F840872BC3D327BAE78F479D3B36579467DB33116938BEB42BC17892A29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634924401, "uuid": "fa5ed276-b362-41d4-a8f8-4da5ad11485a", "value": "3072:NSs+s6m1qL6HxfOEPDi5fyAmkZrQAhPDCXFke:t6mgWHJOEPamkZrQAhPDCXFke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634924401, "uuid": "26d9e832-7de9-4186-81be-fc4b57bc1bc3", "value": 108417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634924401, "uuid": "1f9fb519-e2fa-499b-afcd-f40fd72bb766", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634924401, "uuid": "816e9c4f-e86b-4fa9-9013-b1093709958b", "value": "8ae6ced0270be2a070d34debbffa8240", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4982d9b-332d-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634903274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634903274, "uuid": "fd643d67-8845-42a8-88bf-5766675fc492", "comment": "Malware payload (Gafgyt)", "value": "79628b63fdd443350f80e0b4760bc38c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634903274, "uuid": "f7681548-fa26-41a5-b95e-09204d54c3c4", "comment": "Malware payload (Gafgyt)", "value": "dc0e70fd690218da3ee124cdbf137f9284bb8299253ca7dfce1f0bede45fe0a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634903274, "uuid": "f5ccd913-855f-4ccc-9a02-446b8a8fc0bd", "comment": "Malware payload (Gafgyt)", "value": "bc36b0514824220b710990bac65e6b3ed74d59b8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634903274, "uuid": "9414153c-7256-4d72-a74a-69b04ca5a9b7", "comment": "Malware payload (Gafgyt)", "value": "1fc27fea9794cf4fc699166ef4bfb31fc5bc43cb92011260d44b76c3454302dc053717f68b6ed48e9b3766f5b410f768", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634903274, "uuid": "eb06ae63-d5d3-4060-8712-d979fccf13d2", "value": "T123934C06F8419753C1C327B6B7CF47093B3667B957EB330266386FB02BC67991A25A50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634903274, "uuid": "21054335-7677-495f-8651-0a4bffccf072", "value": "1536:ZvgGLI1gX3JGQxPuwjxtOZyT5hXNKV6T/Fo2kjvVqQEqn/lJXCPe:tIHQjjX5hXNKV6T/cjvVqQEqn9JXCPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634903274, "uuid": "7ac99ee0-3f32-403b-815e-29e1a2613f19", "value": 96620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634903274, "uuid": "e926f57a-f1d0-4e95-a71c-1b0e2cf4d7d4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634903274, "uuid": "b13eaf59-c5eb-4b3b-b251-a580426d60bf", "value": "79628b63fdd443350f80e0b4760bc38c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73af79af-3353-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634919405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634919405, "uuid": "16eb6bb1-e44c-4c35-8cc9-aadb1b0ab856", "comment": "Malware payload (Formbook)", "value": "81a206a5a263321b91e2714830fb07f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634919405, "uuid": "1b427599-f5b6-42c3-af81-27df4ec3ee6a", "comment": "Malware payload (Formbook)", "value": "dd4af1effdd1081fccbd05d035c4dfac3b992a358e2a6a6140095d0385ca7f5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634919405, "uuid": "d2a294c8-9558-482d-be30-9a718edb69a7", "comment": "Malware payload (Formbook)", "value": "56163d7bdda557962d9f769f06378d61994585be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634919405, "uuid": "8806ef6d-c10b-42db-b716-18ea9ccb2a93", "comment": "Malware payload (Formbook)", "value": "2073acd31c2864e62f3945255eee457404cc9530a45e151d451e9785577c1a55a1e507705f5fa59fbcb70ebdaad6d4ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634919405, "uuid": "aa9af519-2468-418c-88d5-c2a8ee2f2a87", "value": "T165534B61F397C589DDF50B346D3BEE980A7ACDED09B19A2F20B8322CEC733926541194", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634919405, "uuid": "1e524836-0b7d-4cd0-98f8-cb0a389b4d41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634919405, "uuid": "ab748f2b-1647-4804-900c-ba1f88e73fc7", "value": "768:lqS8QznN2y2daur1k6IwVlj7ceKguXgcKmxDERgXl+28BeJ:AS8iwpdzrRVcn7X4mJYtBeJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634919405, "uuid": "0df434c8-977f-4ae4-b0e6-8d3bf597d626", "value": 66048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634919405, "uuid": "a763b425-3451-433a-b96f-915a10cb9517", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634919405, "uuid": "6bc761ba-2de9-496b-9b5c-b2afaebc9274", "value": "notification@dhl.com,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd6d6391-32fa-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634881304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634881304, "uuid": "79e99fc9-3360-48bc-bcdf-669a614046bd", "comment": "Malware payload (AgentTesla)", "value": "c953fcff4f8d8367bad8cb16bc86b71e", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634881304, "uuid": "127e523c-3483-45d8-8226-8c27806d4899", "comment": "Malware payload (AgentTesla)", "value": "ddc8c1c38c617c6a99201d722284707dfae2a1f76a3cd8858c64b95483729f28", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634881304, "uuid": "c28573c4-df8c-43ba-a75f-2dc15b67e513", "comment": "Malware payload (AgentTesla)", "value": "3ef3e2dff28483536d952c2dcb8181094b92e885", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634881304, "uuid": "dce390d1-c721-4d80-aa59-c14a5f4ce135", "comment": "Malware payload (AgentTesla)", "value": "1d547dec126dc680a7cffb19e6d60b24af0e9e878fcf6866ef2cf59a56c9165d85448f84cb5a0cae830750b7144afa76", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634881304, "uuid": "2fd55280-114c-4ea9-b406-bc0eb6f0e130", "value": "T1F9942349685F3C56CE44626F1B7239CBBE3B676F983292DBF4305AC29CD1021984F369", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634881304, "uuid": "60a493ff-446f-4cbf-85c9-9aa4f03fcde2", "value": "12288:8nXZ8nBEJo9x7w+F5P90j32rHIEHidWr45Xx:KX6yo9R6jmrHIEAWk5B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634881304, "uuid": "c4f2ace9-9813-4ba0-8c69-50bc08ce0e87", "value": 437360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634881304, "uuid": "d477b731-b5af-411c-a644-924e61dda66c", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634881304, "uuid": "e6e6b4cb-c25b-4222-ab61-504e7ce5494b", "value": "Payment Copy.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "384a7dc0-32cc-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1634861324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634861324, "uuid": "8b000a28-2e9e-4274-ab0e-5eb280fd745f", "comment": "Malware payload (Smoke Loader)", "value": "926ad41a2510aea2737d0cce24e30a01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634861324, "uuid": "64f67051-ab95-4f99-96bb-c742bf01701d", "comment": "Malware payload (Smoke Loader)", "value": "de9157c0dd1ce54551ac3201eda8241241afc85de60ddf6a125ffa03ff9b5c20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634861324, "uuid": "0e9c5dcf-58a4-4f32-aa92-08597244d6bc", "comment": "Malware payload (Smoke Loader)", "value": "969915c3ae86dd7cf5591e985a2fc45f5c00a04a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634861324, "uuid": "4e457d64-d681-4e6e-a4f9-e58f1ef691af", "comment": "Malware payload (Smoke Loader)", "value": "78b30599a15019c1a69535844ccad1d265b07165dbe84b31726af4a2b06a34e096c433c86b1486cd42c55cc91573dc68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634861324, "uuid": "daa36a6d-7953-446e-8dc6-d0aff2a16b06", "value": "T1B134AE993298D878D49515308835CBE8272EF891B8685537F3AB366FEEF82C05DE1353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634861324, "uuid": "50136d27-7e10-43c5-a8cd-d6de052d294a", "value": "96eae633c3835f4142e00d18fc3a156d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634861324, "uuid": "452c2d4d-2689-42ac-9e21-f0f28065cbf4", "value": "3072:FGhKSUgxInv9/zRt2aKcyQD6P5yiRMZINT44+CNf4/AWaSkSJu98vd:hgxInv972aKcyd5yiRIINT4CIADG8el", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634861324, "uuid": "0612a177-5268-4ad8-9612-a21acfb64363", "value": 238592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634861324, "uuid": "4ec8a3be-3c65-4ff0-bee1-cba7b9abdeb4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634861324, "uuid": "40018327-2474-4f0c-8b8b-d1e49bacf651", "value": "SecuriteInfo.com.W32.AIDetect.malware1.24671.14853", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbe645db-32e1-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634870564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634870564, "uuid": "9eeee1b5-6776-4dc8-ae25-80250ac25116", "comment": "Malware payload (Mirai)", "value": "18fe913ce8856fc1ea6ebc0412e09da7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634870564, "uuid": "8696a135-335c-41c3-98a4-13109fd7c5d5", "comment": "Malware payload (Mirai)", "value": "dea614c4a0a319bb53e0d5d9b77d360e23d79e43e4c7a5179c9c3f6b66c26e74", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634870564, "uuid": "7996c7ce-66b2-4bb0-8d93-897726d4c42d", "comment": "Malware payload (Mirai)", "value": "ff1494dd42dcda452120a9af38a1f5550bd29c55", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634870564, "uuid": "971eae13-f1e5-4af6-ada5-7b60b1fa306b", "comment": "Malware payload (Mirai)", "value": "e2147510a9b321fec1c45ce7793854de08505bd304d466aea7b1bdc22c96412abd7ba0ca6ca7bda13e2c6b97ea153623", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634870564, "uuid": "201f9c68-9b95-4eff-a171-5ffcd4af6228", "value": "T1DE63C81E3E219FBDF79CC23847B78A21965837CA36F1D1C4D15CE9016E7024E645BBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634870564, "uuid": "5083bdab-5042-4ea4-b3ea-8a104f720a00", "value": "1536:WkvDSnAd6mYoPdd8TVs1o0vB1tA0iLuYw2+O/82:WkLSA3vGko0pTAmYw2+OE2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634870564, "uuid": "7f1bb4a1-c600-4877-bc4b-54e24ce18b5c", "value": 71764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634870564, "uuid": "9746d02a-bf74-4472-9e3d-f36873867300", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634870564, "uuid": "078a8aaf-da47-4fb7-b688-aa8873c4eee0", "value": "18fe913ce8856fc1ea6ebc0412e09da7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13670c41-330e-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634889608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889608, "uuid": "a6c4ce9d-ea40-40e2-8a47-66ecbfe0c5d0", "comment": "Malware payload (Loki)", "value": "ac76725b3ca48758fc132b92f8d693f8", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889608, "uuid": "24e0cc6d-2a54-4af5-8bc9-b49f2f715eaf", "comment": "Malware payload (Loki)", "value": "df434a4c7e54dd751dd804fc7a6104788bedc23c291b206a97135ef6e8d76aed", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889608, "uuid": "66a4f94c-750b-4c2a-9f6c-dcf1eeffbc22", "comment": "Malware payload (Loki)", "value": "1c15b3fea5bfd58a20c47197a1cc7c2e2fc66da1", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889608, "uuid": "b3c3c84c-1740-44ec-97d3-705b4251e7ec", "comment": "Malware payload (Loki)", "value": "ca4e1feede91718e7d391232daf16ecf6cb241266c0c2ecf9d52681be3992ac0c4d62f3b48ecb2c0990c075ee4290265", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889608, "uuid": "43d9bdb8-cfaa-4bf2-a74a-36afac23327e", "value": "T1E784D0F02F221526F98FAEB2704D568F109BDD4AD3B28F5929CAF50C81B33670F1A556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889608, "uuid": "e6c6e51e-c341-4d18-8ed4-312114fb09fd", "value": "6144:Y2Qd2Dq0TnsQOx4F0aPnF+135WCrjh2SWRLtIJ1i6higMG:2GqgsbxVaA13okjESgY1iEiDG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634889608, "uuid": "d1a68cd5-0609-498f-977f-02853648276e", "value": 378424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634889608, "uuid": "ebfac012-91ca-4629-b370-fce34a912197", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889608, "uuid": "73572062-2a66-4605-a4e4-02786805274d", "value": "bank details.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cca4c41-32f8-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634880283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634880283, "uuid": "2db6dca4-7349-4a9c-a410-827ac39f931a", "comment": "Malware payload (Loki)", "value": "101432a1a18a5696344be741f620349b", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634880283, "uuid": "483f889a-de87-486c-b7b1-d9438b18bcf1", "comment": "Malware payload (Loki)", "value": "df5250f5c309c55ca165ac4300ebf6fc63dd4988c01e73bd3e50cb7753c34d4f", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634880283, "uuid": "461bd749-2542-4df1-aa62-0ca361a12b8c", "comment": "Malware payload (Loki)", "value": "36bac688d43e4c924d02c9f15580bcb9f70bb80f", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634880283, "uuid": "f7c93e54-24de-4549-8086-b213f20a50a9", "comment": "Malware payload (Loki)", "value": "a2d99e2918da4903cbdc083fc9d382f052848a91e603364adb9b8e2291f672a8527511a32a28ec381bf1af2d6b062664", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634880283, "uuid": "2b2587d7-5a75-430e-a6d0-475aa6010a8c", "value": "T1E3B2307EF59B0E48AE57976C060A6B65064CF91D72C444A237BCCB387A5C91B8B23D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634880283, "uuid": "b57ecc99-2eed-4684-a98c-8bd378bfe95d", "value": "384:vaOWTfsqLvwL2AxPNKsQcuiJcGcldGT9nxRimlEQ0t+28aRPa2PB9obP3+IqcEw:yhTfLv2HPNK7dGT9nxRivQ0tAAPa0W8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634880283, "uuid": "911413a5-82f1-49f9-bb96-62e8cc5b556b", "value": 24385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634880283, "uuid": "b5385681-82f1-406f-91d9-410b83ca1bbe", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634880283, "uuid": "d3ed056f-5396-458c-93d5-1943f216be7a", "value": "101432a1a18a5696344be741f620349b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30178ad4-330d-11ec-843c-42010a9c0014", "comment": "Malware payload (DCRat)", "timestamp": 1634889227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889227, "uuid": "08510e13-eb4c-4cbb-94be-5c359ad49b55", "comment": "Malware payload (DCRat)", "value": "f44d9910d716f5d7fdf542e25ca41b20", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889227, "uuid": "62d3febd-a135-4419-b64b-752472714627", "comment": "Malware payload (DCRat)", "value": "dfe1f7602fc303b7a0f7427deca31f31aa44493ef8d129a631ce0ad770b9690b", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889227, "uuid": "ea959e1a-51aa-48ca-acc8-1c2b2629fe3d", "comment": "Malware payload (DCRat)", "value": "f7dc32448961dd681c73594952ef881bbf36c7e0", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889227, "uuid": "708f7ad5-3599-4c78-a2ca-590cb47d8e06", "comment": "Malware payload (DCRat)", "value": "dcc9c25d14a39f9d629fbb51029a9db1f0c25645bcde66711e41160223e401db2bc21c88519154ae5df798be0064071d", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889227, "uuid": "74ed8265-5f1d-4bd0-8b35-14e74a2e1da4", "value": "T19BB42833E642C658C53093FCC2AB738313645D12E9F5DA1E1A663195073AFD228BF6A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889227, "uuid": "6577a006-ebcc-4860-a262-8a39e87c28a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889227, "uuid": "b7f9cf1f-38b6-4852-b01f-12dfa2b81a5d", "value": "12288:byrjnZPxkyx8gmoYSZtIEOZU8HocYnKrTSO:baPx9dtIEOZU+ochG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634889227, "uuid": "b48bab34-2a10-4f2d-be7e-2d2019200140", "value": 503296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634889227, "uuid": "797bcab5-4d8d-45a7-ae36-76f1828636b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889227, "uuid": "e43063e2-237f-42e6-b286-cc87a2122ef7", "value": "IAENMAIL-A4-211004-0830-0002036.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41c90436-337a-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634936072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634936072, "uuid": "5f8e1960-fe33-4578-815e-9dc18c168eda", "comment": "Malware payload (AgentTesla)", "value": "247d01a8a4a8cbf114d54191f2b7a489", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634936072, "uuid": "d463b387-284c-4a1c-8a90-7762d54fc56a", "comment": "Malware payload (AgentTesla)", "value": "e17a417f8665f67a18924fa21085bb9940af322c8617ef28c1453a8959491a14", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634936072, "uuid": "84289b48-ad2b-4ae3-a173-555ec0b1c2b2", "comment": "Malware payload (AgentTesla)", "value": "e075551dcccb4a62018fb5c8930327f7f6607ce7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634936072, "uuid": "b3f27469-b68f-400c-a7ac-166bcf722d6a", "comment": "Malware payload (AgentTesla)", "value": "76621aaa9b83ddce73f6a7b236ac1dfc627d30f9b18c482d02dc642a2451c19460d9c9e049accf0f80d1af25526b560a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634936072, "uuid": "b4bf61ac-aef3-4a25-86c0-409987a51661", "value": "T12EF46DBC3144BCDFC86B8F3545545C24962268AB034BF35370A729DA4FADBD69E402EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634936072, "uuid": "b08f7d0d-fa77-44cf-91fb-3a666e560ef5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634936072, "uuid": "a0befa52-623c-4f38-b776-47fc6f93537b", "value": "12288:IxIdYmgrbZZEj9OvfgqEdodsXfjs1pYwmwfcArlZiDMfT80EgY91xaE3Ep+P8h:AQgXhoHg8YjJ9NlZSA5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634936072, "uuid": "75145f57-1f5d-4f6b-9a30-c2789769d38c", "value": 750080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634936072, "uuid": "a292ca4b-17c9-4e80-96df-e946e6fda4eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634936072, "uuid": "abd68d3c-cb09-4c68-b367-dab1a1d64cc9", "value": "le32xV2d1fLi3Ly.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5202d183-32ec-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634875111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634875111, "uuid": "b28c0203-d2bf-49b4-8a4d-09e089095629", "comment": "Malware payload (Gafgyt)", "value": "d803bbf361ed4a8ee5550f4b3232ae04", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634875111, "uuid": "1a7aeb62-453c-41af-ab32-e24aad5e189d", "comment": "Malware payload (Gafgyt)", "value": "e31ab1eaecd6a41c0e7288aa8d3a353ec5386447a05adf480dc63cd9dbe8ed64", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634875111, "uuid": "6912a9cc-e6a1-4e1a-9c50-dd53b0fd2ed4", "comment": "Malware payload (Gafgyt)", "value": "b77374a5da17d1610af82abf80c0ec9423401525", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634875111, "uuid": "d40214d5-512c-4d85-8083-13c39fb1baec", "comment": "Malware payload (Gafgyt)", "value": "ed3cb93c0d8809493173216adb5ebc49022a23717f20c4b0fbae023ad274aa98b1b9bd03c213fae835da4dc59c3480d5", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634875111, "uuid": "374772dc-2798-4922-b20e-cf1fc319a01e", "value": "T1C0836B23A651C6BBC0875BF91BDBD6615023B8B90B33720A73D8BDA92B36DC45D5D302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634875111, "uuid": "76bd15fe-b694-479b-a266-4765229d8dfc", "value": "1536:UB7crF7FePF5tZuEqdPUq0aJb9sqx3CjrM3X9uWIr8UmoIYuOVje+ZNne:URQFet5O7dPr0oSwyjr4X9uDnmrYuOVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634875111, "uuid": "16c56504-cc78-4e21-88ef-37270f0c0902", "value": 85803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634875111, "uuid": "80fcf215-d565-4342-bb96-e8dfbf859fbd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634875111, "uuid": "065f86d8-b573-4796-bb17-2e38fda7e8b8", "value": "d803bbf361ed4a8ee5550f4b3232ae04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c8e4491-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928064, "uuid": "29983149-f06a-4402-8f53-fe3b58a96af2", "comment": "Malware payload (RedLineStealer)", "value": "33312ed9ae90f5bc1158f5d77db9e2f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928064, "uuid": "119b8c83-e514-4bb4-bdff-4ef44a2a746b", "comment": "Malware payload (RedLineStealer)", "value": "e3cc1d9e6c4d4c641410780650e30c1719e66d2885c82dbb1042767de4f25de9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928064, "uuid": "93adfb9b-435f-49b1-93a5-91470ff8cdc1", "comment": "Malware payload (RedLineStealer)", "value": "55b3b14afd90d8fb09dc4017a30960cd41da3a4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928064, "uuid": "e5dca41e-2a81-4d52-9177-efc5b83cd409", "comment": "Malware payload (RedLineStealer)", "value": "54a18fcecb8156ecf90b5fa4cabcffa3221ee6c092e88c86e5ba720332847d84740b493e4bd812c6345c76d11cbbf2a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928064, "uuid": "d43fdbf5-467d-4bef-8715-e2d7c68c6e87", "value": "T1BDF4D000A691C03AF5B322F84AB9A37C653E7EA15B6454CF52E51BFA57359E0EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928064, "uuid": "c0330034-97fa-4323-b1df-5aa6e42ba8dc", "value": "4af4742906d30c7889c195169379a2f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928064, "uuid": "ec25872d-a088-46f0-9171-59eaabca04db", "value": "12288:Obd2xjlzZALVp5peUuCQI+qSu57GP+CeUTxFe/fQZUpB1qWNFd6iT2TGDS+nZr:Opy1uZzpNh+Tu5aPncfxEWoiT2SD5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928064, "uuid": "ab23278b-5c1b-4ff3-a730-37455df77a1e", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928064, "uuid": "3edf5ecc-aede-4030-9b20-c9e7118a510a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928064, "uuid": "0cdcbc09-787a-4e99-a465-7348af8ddb30", "value": "33312ed9ae90f5bc1158f5d77db9e2f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1080875-330d-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634889443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889443, "uuid": "bad5862c-6d17-427e-bb49-bb8a110f8a7b", "comment": "Malware payload (Formbook)", "value": "372d9e8901c4f72bb4ea3c99ae945c2e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889443, "uuid": "8fe56890-9870-4428-8fd1-ce31d26f890c", "comment": "Malware payload (Formbook)", "value": "e4afa418ea32e2ef83411d5038f64aaebf7783812eb1517f0bcdb813c5c3c544", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889443, "uuid": "d4ae8936-38c1-4048-bc70-6cc500b892bf", "comment": "Malware payload (Formbook)", "value": "5e6a28f10bd813f5a0133c3d14b527c3a0a18f30", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889443, "uuid": "c5071f59-dafd-4520-889d-140cb23571c6", "comment": "Malware payload (Formbook)", "value": "4aca1272d19088f6460f78da8d59eb4c5a21a734acfe59e761e1555a0537b1e58acde5e670769586267ec139e38011ec", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889443, "uuid": "17574e61-9a5f-455b-a474-5e9e55d66983", "value": "T151A4E065ACB88FD6F15B503A4D68CD2D0F52CE24F98A9CADB301B7278E3261507C1F69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889443, "uuid": "f9367da9-8b59-4321-8e3f-a639a3d6cced", "value": "12288:qQ2YwJJUku9Mbj0vzDYtBI5l1nWh3XzbGG0ZHEE6qou:q0e13CYtaEX3JoHSO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634889443, "uuid": "8026d568-4161-4b47-940b-01a4fbdf70dc", "value": 472424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634889443, "uuid": "50d3dcc8-c6d5-4e23-abde-b66a913cf4b2", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889443, "uuid": "eea7c5d7-35f8-4900-8f80-9b874cee7b54", "value": "Order_21518..xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10bddd1a-3302-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634884450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634884450, "uuid": "b4dc6218-6a9f-4178-a5a8-8ab057045f3a", "comment": "Malware payload (AgentTesla)", "value": "f1e3f54edbeffd5786fb49487872f2e3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634884450, "uuid": "c4585764-f47c-4f3f-80f9-52cecc5329d5", "comment": "Malware payload (AgentTesla)", "value": "e66ed8d87430588f029d4ed6787d54de508b271fca3d2266023ae1f0c69d75e2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634884450, "uuid": "c18ba6cd-54e1-4097-84cd-7d6b4faa5512", "comment": "Malware payload (AgentTesla)", "value": "22418d61c9a779f6a1e651928ba86b36755abd78", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634884450, "uuid": "56eb417a-6dc0-4e2c-9933-b427df37a113", "comment": "Malware payload (AgentTesla)", "value": "3f934fdb9b61ac666486e106349d20d7400b7a37881e665366617ca3394289673cfd0f5ce396e577f54336d2cf997292", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634884450, "uuid": "566ad7b4-19e8-4bf2-9d9e-b7a785acc444", "value": "T117A48D48DB52BC2DC09646F9ED274DBA2C6E1D8042E180FF2508BE1E2A36DF7D54CB56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634884450, "uuid": "67cc93b7-e287-48e5-b9a3-26f3a46767d5", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634884450, "uuid": "3cd701f8-ea94-4542-a7f4-b50feef90f9b", "value": "6144:pBlL/cC95z7t6MRObOjPnEezm7m6mBmtRm+mQsUKCI887/+JUrhoItI8SCjegF5A:PObbazoTFQ99qX9NZQZ3The", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634884450, "uuid": "ddbf4e41-9c20-43f4-972b-c019e85ce3f7", "value": 464619, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634884450, "uuid": "807cc58b-6517-4022-8520-dfd48715b769", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634884450, "uuid": "7c5146e0-1e6c-49ec-a231-08cecc171af7", "value": "POIM101385.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20d5fb8a-3368-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928286, "uuid": "a17856b8-7455-43a5-a303-c9912addd0f7", "comment": "Malware payload (RedLineStealer)", "value": "f27bbd676025bd515c3202b94dff8ef6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928286, "uuid": "53866c44-c7e5-4b3e-80ca-6539b0c52574", "comment": "Malware payload (RedLineStealer)", "value": "e6d90883fd0e3c7576c140d6f12e04e1e54c3789ec4b2bdea925c9bdb6aa1f43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928286, "uuid": "e75f8111-bceb-4d3e-9027-e2d822cdd97f", "comment": "Malware payload (RedLineStealer)", "value": "39949785532d90fd4ace3faf87ace6311b15ff22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928286, "uuid": "b5c5160f-2f23-41a5-95cb-c24b8ae34af9", "comment": "Malware payload (RedLineStealer)", "value": "806099feb7551c7a78acf2b31418250e255e4ba3de3f3839738c6fe05346058ee81eb2e018514ab53f02e5bf33430d2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928286, "uuid": "1a545bbf-de25-4d85-95ac-2d100e51ce9c", "value": "T1FD051239A241847BC0620935955B93BAB53BF7001B7D58CFB7CE4E6C8D332892A653DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928286, "uuid": "09185d6c-3a68-4cdd-a197-187e140416d6", "value": "c9adc83b45e363b21cd6b11b5da0501f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928286, "uuid": "704fb51c-78ed-4cea-bcdb-6cdc73b19aa6", "value": "24576:pAT8QE+kwrcszsNcf7fZhB0xxq+SxHKTcFX:pAI+3zsO7ffB0xr0qw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928286, "uuid": "ba10c429-8518-456a-ac69-322602f0f141", "value": 822146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928286, "uuid": "9ed7a11b-033e-479e-b4cd-70a00d106366", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928286, "uuid": "6924b159-5421-4abe-a59a-be0ac34d685e", "value": "e6d90883fd0e3c7576c140d6f12e04e1e54c3789ec4b2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1c8bd60-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928073, "uuid": "0a779f03-f8ce-4a2b-99cc-a9e0eab0c697", "comment": "Malware payload (RedLineStealer)", "value": "fe803ea3f3af2409f1c39331dc0d02fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928073, "uuid": "09adbceb-1a43-4a16-b98c-71cfd0e541f1", "comment": "Malware payload (RedLineStealer)", "value": "e70637e0f44ec169c93a2634b8f7750bc671044651bbbbf48a622a82dfd319b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928073, "uuid": "fd96e136-eda8-461f-a4b2-0cb60ce68ba3", "comment": "Malware payload (RedLineStealer)", "value": "7d9c231e4e029ae71e647e1943e671a942755c5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928073, "uuid": "2ce4fe5d-ccf1-443e-bcbe-5f145e889d93", "comment": "Malware payload (RedLineStealer)", "value": "fe99dce8d81ad1a0ea2bb92757a533855235cd549d9679ac324b9bab3a4e29bf90f3300596a82dae283c1aaa7624dcf0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928073, "uuid": "2a220493-e152-48a7-9301-6d495a435d1d", "value": "T12BF4E010A690C036F5F326F44AB99379A53EBAE25B1454CB52E417FE4735AE0EC3132B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928073, "uuid": "3ae1e11c-546c-4aea-a44a-5320c37ec04a", "value": "e596e558b61473706e14db7e3ed0b8fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928073, "uuid": "cc562420-9836-4ae3-9e4b-67baa976cc4f", "value": "12288:kkYMHykY6/gYMsDuWDlHIPlX8xWU5eR2Fgp7czp707VqjRhKr7:koHykJMsTDlcX8x350IzF07UCP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928073, "uuid": "eb6fc150-997c-42f1-a413-63ce079a051b", "value": 730624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928073, "uuid": "000f2b73-6ca6-46d4-8a68-295831a8de56", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928073, "uuid": "05f0f16c-725c-4fa8-8561-4e9096110539", "value": "fe803ea3f3af2409f1c39331dc0d02fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78e48ac4-333c-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634909536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634909536, "uuid": "0945605b-c66f-4f0c-8a35-e9c1a2023196", "comment": "Malware payload (RedLineStealer)", "value": "0680fd1ef21a489b3812b4ef2f9a8f40", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634909536, "uuid": "f0fa5fd9-0a93-4193-90d7-6e52e2f77662", "comment": "Malware payload (RedLineStealer)", "value": "e7074780e695f4ee45a1999d5035e3a8c799fe647c7464ca85375dd9d18a3ac8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634909536, "uuid": "4b5df596-fd04-4c02-9116-9ff0f6236539", "comment": "Malware payload (RedLineStealer)", "value": "d44346e505d925bd5f423606298e267716f7d64f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634909536, "uuid": "91d833fb-cf79-4fd3-b6f1-8634813fffc1", "comment": "Malware payload (RedLineStealer)", "value": "fa5e0ecb762c782c4570f3747dbc1e42a2e9323f3e4be42a48b2b0c9994896f83cf7d5e52372359408b499ff83a8857b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634909536, "uuid": "e51246e6-5140-4069-af37-fb34d915b66b", "value": "T101B533AD2674C941CB1F2D78F66FB5800A707D924392FA3856A2BE0D0479B14FEB534E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634909536, "uuid": "928e240b-dd1c-4f00-89a3-ee42cf8227de", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634909536, "uuid": "e80896c7-9170-4a78-a045-9caee6e2ebc5", "value": "49152:uFvngHkN2DZOZtdHuw1E9pvj+TE5jEYUPnSjOwY8DH1O:udngHK2NCOwy9pL+ISYUaKwJDVO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634909536, "uuid": "20256d8e-e2d5-4d89-97a7-dc71885cf927", "value": 2348032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634909536, "uuid": "9f51646d-1ce8-4676-b376-0b0fd824b965", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634909536, "uuid": "b0c3af99-08d5-41a4-8cf4-477f36881995", "value": "0680fd1ef21a489b3812b4ef2f9a8f40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82c20203-330f-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1634890225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634890225, "uuid": "2548548e-0e2a-4b6e-893f-1e0aac677f1e", "comment": "Malware payload (RemcosRAT)", "value": "052f9ca00b96e53de2d50745b56322f9", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634890225, "uuid": "dddec1e6-cd6b-422f-8ba1-810604a27a00", "comment": "Malware payload (RemcosRAT)", "value": "e7de0f165f8c5b38c60cf57edf5277ce09ea31bf46aa31f1b6bdc011a5e248e3", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634890225, "uuid": "b2819f77-8b23-4b69-a68a-b65775149729", "comment": "Malware payload (RemcosRAT)", "value": "e50a85146587f30aea48e9ec5ca7044d2e997728", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634890225, "uuid": "9f1c0a8c-c988-4871-b5f8-d6a102bcfb97", "comment": "Malware payload (RemcosRAT)", "value": "e04179e44a490731057bccdef7bd8fcba620e300623e3fd81a48aaaebd5965e7b0eafe4bf6183e33115d5d66a0e3ad48", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634890225, "uuid": "1c33daed-9b3d-4b8b-9773-5f4ffd9ebac4", "value": "T162E48D06E5971C33D17285365D3EB27C5E35FEA21C3936072AF67E0D0FB76A2242528A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634890225, "uuid": "5b8d501e-5ae5-43be-8191-19c46cbcd0fb", "value": "7c956dad9ea202d643355dc7895aa9c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634890225, "uuid": "7c5f1111-1a6c-4432-8a22-1fd1a4ab2e19", "value": "12288:EdO8lwYc+Plun+IBTid8obF+OCefbtabuRmDI:EUOTPlun+zdRaYbvF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634890225, "uuid": "587dadde-30cc-435f-bde4-2572b004b838", "value": 702464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634890225, "uuid": "239683df-f16d-4be7-a443-08c74a0755b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634890225, "uuid": "8e946f76-369b-4cd1-a111-6b0e95037c33", "value": "DHL_119040 receipt document,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2504143e-3342-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634911972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634911972, "uuid": "99661e71-9472-42a3-8867-87aec52db0a4", "comment": "Malware payload", "value": "f73b626804bbad1487e70368b18d2a0a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634911972, "uuid": "e21d2cf5-227c-4bdc-973c-ced2d72897ff", "comment": "Malware payload", "value": "e9570cfb88a27c2b72f682cf365a62eb30dfca343f4efbbdac2a6a05f90bb95d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634911972, "uuid": "164b4b6d-56d4-4ebc-88ea-4541172ed011", "comment": "Malware payload", "value": "02a521a3ec17d0c7b32fa6d1bf27df9f8284e7d4", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634911972, "uuid": "64582aa6-a64a-4368-afff-26bdea1c66ac", "comment": "Malware payload", "value": "d1119e49b813df5138cff853fa7a0b10d03ced337e6fb6d0525cd491940729ceac5828d976ad0a071b1031a101d21abe", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634911972, "uuid": "f2166699-6ebd-4558-ac5f-c6ea93c1ac15", "value": "T1C854229C4764BE86F8BF72EC2D06F2B0D4A3602F99F7F411D66A45EA1085A41F0F5839", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634911972, "uuid": "8b3ca985-7be1-448f-975b-3180998520cc", "value": "6144:vDLv4PbojPBH6dWDO0cR2eztOtx+8qRDoW+Hk48QNErgOGTRYywdp:vDT4Pbo7kdANcRBBV8qRDo+QNErgoyGp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634911972, "uuid": "1a2d0962-45da-4c6b-ad73-658acc09b1c6", "value": 301517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634911972, "uuid": "99bb9b43-0efa-4259-a63f-23f27dbf5754", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634911972, "uuid": "d05245f4-ca5b-4754-bfbc-7f165e5cf46c", "value": "4775443602505728.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dc13cf6-3320-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1634897384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897384, "uuid": "e79ccb46-2767-4187-bcb5-81099199e141", "comment": "Malware payload (RaccoonStealer)", "value": "de29cc9b8ebddd428617359ccdf9eb04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897384, "uuid": "747c45bf-7005-4d80-8e95-803c320af872", "comment": "Malware payload (RaccoonStealer)", "value": "ea35181753363a426ec2114c24bb445b642445698b5c3e419314b964ce60defb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897384, "uuid": "1614c513-293b-42be-9dd3-726b07c8a242", "comment": "Malware payload (RaccoonStealer)", "value": "73838074167d961f2fb34af4ccbaf1135ab31d54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897384, "uuid": "ee9c1c1b-e995-4aa0-b639-7742fae57694", "comment": "Malware payload (RaccoonStealer)", "value": "e94a774f57bbbd41a9efe5d8da1339d125a5f77b9d53d7361badeefd420a5c23a6fdb60133260b13e0d018d61b0f268c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897384, "uuid": "2ee43061-fe0d-4af1-a7da-27278c76c4e3", "value": "T192D4C000A650C039F5B326F84ABA936CB52E7EE1676450CB62E41BEE47356E1FD3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897384, "uuid": "7a42e1cc-6fea-442d-88dd-130932d07a60", "value": "4af4742906d30c7889c195169379a2f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897384, "uuid": "f8ed37ae-e82e-4d77-92c8-3a449eba3b1a", "value": "12288:1XdSQLfW3i7ExfhXbP5fI0G3OXwbVgLz7cE7odJjA0gZrRZo1GI7dj/R5zamDIcY:1tSY0i7Ex5XbW0G+P7J7CJs04qGm/R5v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634897384, "uuid": "17e855bc-40c8-4fe0-837f-0b674af3324e", "value": 608768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634897384, "uuid": "23911a35-aae7-4f22-8f35-cc4aae7107b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897384, "uuid": "421831c0-090b-4799-951e-7813f7271a1f", "value": "de29cc9b8ebddd428617359ccdf9eb04.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6a43dca-32ed-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634875709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634875709, "uuid": "7e889c90-bf86-469b-8e1d-34add1d54055", "comment": "Malware payload (Gafgyt)", "value": "929812dc36ee73fef59c2d823622ae91", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634875709, "uuid": "de58fee0-c74f-4f2c-a661-b2f8c44d7c0e", "comment": "Malware payload (Gafgyt)", "value": "ea3b74c9613a90f0402de413c92dc96792c17de73883d777677a7888279883ee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634875709, "uuid": "1e4e1c59-05c3-4277-b99c-7d30dfcc1285", "comment": "Malware payload (Gafgyt)", "value": "1b1eb917dfefb6b13b28ed564cccecf512d8dc8f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634875709, "uuid": "2e49052e-79fb-47cc-9872-eacfdc5271bb", "comment": "Malware payload (Gafgyt)", "value": "d0a156df30f216c389483831003ddc7dd482392d47991ae2d931ab9ee59034df9ca678c9a0cd210dcf325b2ef62930fd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634875709, "uuid": "b4f55aba-0a42-4da8-b97e-2e4a808c2cec", "value": "T141733A02E652CAB3C8930BB602AB9B664631FD2A1E2B9F59F31C7DF49F124C87117355", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634875709, "uuid": "4d7c9f7c-be24-4c21-9bc4-39a0030bdfca", "value": "1536:nm+c5osQWiKLoxKFn6pD+OTxzMnMmLI2VOCjXUfJRk:45omr0xKFn6J+OIMmU2VOCbUfJRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634875709, "uuid": "a9a41d20-c919-412c-91c4-8713f89dfce6", "value": 74024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634875709, "uuid": "35fae9ab-32c1-4571-9613-af99264183ad", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634875709, "uuid": "c66ff2e7-4836-451e-9359-5fa42d111f70", "value": "929812dc36ee73fef59c2d823622ae91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2caeedf0-3308-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634887074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634887074, "uuid": "eda63fa4-1d49-429a-92fb-9e0bb6f49ecc", "comment": "Malware payload", "value": "86573e80380c6986dde4dcbd0802bdbb", "object_relation": "md5", "Tag": [ { "name": "mac", "colour": "#285994", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "UpdateAgent", "colour": "#B10D2A", "exportable": true, "hide_tag": false }, { "name": "WizardUpdate", "colour": "#5BF7D9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634887074, "uuid": "35c56f9b-f051-49bd-91dc-9e26972eb5c1", "comment": "Malware payload", "value": "eafacc44666901a5ea3c81a128e5dd88d0968a400d74ef1da5c2c05dc6dd7a39", "object_relation": "sha256", "Tag": [ { "name": "mac", "colour": "#285994", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "UpdateAgent", "colour": "#B10D2A", "exportable": true, "hide_tag": false }, { "name": "WizardUpdate", "colour": "#5BF7D9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634887074, "uuid": "7bdd9f49-8987-4471-b906-827213b52d4d", "comment": "Malware payload", "value": "973fa6999894497cfe7dc87c4fb47ca641192833", "object_relation": "sha1", "Tag": [ { "name": "mac", "colour": "#285994", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "UpdateAgent", "colour": "#B10D2A", "exportable": true, "hide_tag": false }, { "name": "WizardUpdate", "colour": "#5BF7D9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634887074, "uuid": "07fbce1a-9505-4c6d-b243-3f94ba40bcc0", "comment": "Malware payload", "value": "91ad80649be5b118c18a4f9c37678dbb58e323f0a5385d92652cd3363c5b87785246475e5d1e85e2117f398e460a53f3", "object_relation": "sha3-384", "Tag": [ { "name": "mac", "colour": "#285994", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "UpdateAgent", "colour": "#B10D2A", "exportable": true, "hide_tag": false }, { "name": "WizardUpdate", "colour": "#5BF7D9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634887074, "uuid": "1a98fedc-af0b-4d00-b682-35970e3b5af2", "value": "T19E41D03103B8BC2824D9747B268C95C83CB5601F5AB852D268525B67FBFAB71733124B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634887074, "uuid": "aa6f3cf6-d090-448d-b7c7-1b88d50eaa04", "value": "48:kQuylzZxqk8avkMhPCfNtT7GNGbHfyEokUINvGcVb:RBlzZaasMhPCFtT7CGbyNhsb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634887074, "uuid": "a57391e0-75bc-4dfc-97cc-153800338cfc", "value": 2219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634887074, "uuid": "da7fb137-7682-4452-8877-e0ffd59b13a2", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634887074, "uuid": "28cce78a-a848-4bd4-a000-0bc635c15dae", "value": "service", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d2e81af-336a-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634929353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634929353, "uuid": "42e4b29d-9a83-4e62-a939-e00b2cf39fd9", "comment": "Malware payload (RedLineStealer)", "value": "f228e716ce479fb59bc1d9464fcfde77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634929353, "uuid": "d2f34c04-9195-4b17-ac2e-186269b19ca3", "comment": "Malware payload (RedLineStealer)", "value": "eb57afa354c464f74e950d4d08ad672a0e242693dcd4f9ac58b5402d5ed649a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634929353, "uuid": "d320d2ae-b523-43a7-bf8e-24f99deff1b1", "comment": "Malware payload (RedLineStealer)", "value": "92dd72036bb7b51d9e0e3d1784a12bda13dfb75e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634929353, "uuid": "ec5aaeb6-85e1-4e50-b7de-37fb6ca6e09c", "comment": "Malware payload (RedLineStealer)", "value": "1ee4e6d1de1f58e5579c59fe65bf1adc150e530433da9a608d58a3539de0fc3c8e913167bb02e5c9a3e737e6d91c59de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634929353, "uuid": "dc2b4168-de95-4721-a07b-25bfcbf9a08b", "value": "T1C3B32B1863DC9B29E2BD0B75B8B0622543F0F0C76822E7DF9FC164DE1E257819915AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634929353, "uuid": "0083eeee-070b-4f09-8d5f-a1d7d7f38b5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634929353, "uuid": "4a8bdfb0-7277-4f82-86c7-78a3c700f418", "value": "1536:Rcvdb0ap1a15LoJ4tRk8lHRtbMuP6dgkvyTFd8jGDLzGEWZNQ:RWd/p1/oRk8pR9Odg0ypOInBQNQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634929353, "uuid": "e36d2880-e6d8-44a0-9e62-a3ce7a0a5764", "value": 115928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634929353, "uuid": "26a31947-7466-43b4-b870-89832c566bfe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634929353, "uuid": "4152a896-490a-4efd-9e54-9d62a5e77709", "value": "92dd72036bb7b51d9e0e3d1784a12bda13dfb75e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a8876c8-3319-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634894399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634894399, "uuid": "527e4948-0408-4a81-bb3a-fa4111d641d4", "comment": "Malware payload (AgentTesla)", "value": "5fe507eb6a76faf15380d259508346f4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634894399, "uuid": "f034eb04-343c-4581-b8c7-7aae08832e0b", "comment": "Malware payload (AgentTesla)", "value": "ec75c480db2874572e44afbf2bd961b1f744a45dc4eb1f2557c5d299093089b1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634894399, "uuid": "18bc4993-63f7-4bc8-83bf-b8135f5ee1dd", "comment": "Malware payload (AgentTesla)", "value": "0050d63477be4f3d5d807d1cea67a5bad03edb38", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634894399, "uuid": "0c9be25f-8fa9-4ed1-ac4e-ec91f30695c9", "comment": "Malware payload (AgentTesla)", "value": "371b83f28889855c8bee36098c3bd597d442417d970896da97c00eeaf48746544bc4954dcf95cfd3d476c2c39b89a7c0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634894399, "uuid": "d43e36f9-9371-4503-94b0-494bf2fc15c0", "value": "T1B074F174219188B7D31B1CBC5DADCA1522ABEC3C1550760E375ABB1F48723A746EE42F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634894399, "uuid": "00435e27-aee2-4092-b4d5-7799aaccdfe8", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634894399, "uuid": "241c0b55-681c-4011-875a-bf067ad3d6eb", "value": "6144:GBlL/J6M1/BLB1X2Db0jllIf8Tu0NuYPUcb2RuMzbA0otv9vFQ:EyM15Lf0sllI0Tue0kmHA3K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634894399, "uuid": "902dee45-f1d8-43df-968c-62ed7c30d383", "value": 354650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634894399, "uuid": "17282536-84ed-49c0-bae9-f90569ac8e9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634894399, "uuid": "01c38d7b-6d62-46fb-ba7b-302a2ac52764", "value": "Documents Of Shipping", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ddc062e-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928066, "uuid": "2f6d0b69-9461-4e7a-8c8a-cffd4e87b761", "comment": "Malware payload (RedLineStealer)", "value": "4b8de5b9bdfe7fc19a8be9362d8a7c46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928066, "uuid": "74d16aec-92c5-4413-a728-bd9ba07f15f6", "comment": "Malware payload (RedLineStealer)", "value": "ec7fc86a7f182e78363c896ea087698ce07aac3e5c0f60ae8e223bc58ad2ccf4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928066, "uuid": "b520ea39-db16-4d4d-9160-b0197fef9c9b", "comment": "Malware payload (RedLineStealer)", "value": "08b89cd1b867952c5c0d96a934c44ea2fc10f69f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928066, "uuid": "80247425-5381-43e7-a0ba-37558d3a7ef7", "comment": "Malware payload (RedLineStealer)", "value": "9f715a2eb36859abf8e90d6ccd2c8524f02f22419088dac62a9b5535cc48f5f684af34867c1801184909c985acdb2502", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928066, "uuid": "36f5beb3-6998-4d5c-bba3-edec6e017e94", "value": "T199F4E000A690C03AF5B712F889BA5378A52EBEE25B6454CF53D51BEE47785E0EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928066, "uuid": "8361c899-56e3-4728-973c-29f6b0d04d72", "value": "4af4742906d30c7889c195169379a2f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928066, "uuid": "13b11200-2b40-47e4-b3ea-1f448c8744f8", "value": "12288:lddV7e+QHsTmls/eM7agY9N0XPCLLvwQK6TmLMCV1D7C4lLz50dMYaWghd1hYYkU:lzV7fQSmlied5ePovwQKGMMCDjl5dWsx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928066, "uuid": "f9330cc8-11fb-430c-a13e-dbadc21cfc90", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928066, "uuid": "21adcd3e-8578-4271-be92-da54d048aa98", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928066, "uuid": "f1eb706c-c06c-4010-9fd6-518e8c38c36d", "value": "4b8de5b9bdfe7fc19a8be9362d8a7c46.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac20e19a-330f-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1634890294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634890294, "uuid": "016e4aeb-0b8b-4c1c-8009-5a7c1dee70eb", "comment": "Malware payload (Vjw0rm)", "value": "70248b64f0da47a78531964998bd071a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634890294, "uuid": "4d23faca-e680-4061-bf4f-4cc6619de275", "comment": "Malware payload (Vjw0rm)", "value": "ec94a85166da6bff3051c6960ff02eb964ed676d15a7d426b4a075c32d892a70", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634890294, "uuid": "ad604ca9-93cf-49a8-86a6-6391a66470db", "comment": "Malware payload (Vjw0rm)", "value": "761b6341377def95d8558e806e6516b4548f8566", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634890294, "uuid": "bce04fb3-20c9-45e7-92c8-0ef04c045417", "comment": "Malware payload (Vjw0rm)", "value": "0fc25bb31dde30a6a655819252a2712cb18a36c67feec62621878ef21e444048e39869bf57296cb2668305336c63a67c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634890294, "uuid": "2915438e-7e1a-48ac-a9f3-90408cf705b8", "value": "T12A81209C2C4BC63C53D27B8A802DD149CDF948B47E28D2B5148CDAC5360E979C7B19BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634890294, "uuid": "1482da21-ec18-4c71-9dd2-d22f562868bf", "value": "96:SABNo5DRk2c24ZRMHXE6/BIE+Ys+fJg4DdQqR7bJyKh4OS4UK:zSa2c24ZRMlBI/Ys+fJg+fRflp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634890294, "uuid": "7bc9034d-6465-487d-a647-fd44f74ce50d", "value": 3888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634890294, "uuid": "6ce21182-1a5f-4dc9-9243-b6bfba8ed2da", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634890294, "uuid": "17304bd0-1afb-4378-88af-8dea44c02061", "value": "Interac Payment.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "142f05a3-330d-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1634889180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889180, "uuid": "539a8259-2233-4d32-a98b-a9086779aa67", "comment": "Malware payload (Metamorfo)", "value": "ed3edf8fdb2cd2f027127f4fb1fe7019", "object_relation": "md5", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889180, "uuid": "f6f0e505-cd96-47f9-b349-80800228ecd6", "comment": "Malware payload (Metamorfo)", "value": "ece2bea42a77b9c098899150a002e9f702cc7cf5b43bc8f674c61d5adaf905d3", "object_relation": "sha256", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889180, "uuid": "d9c85d82-4748-40e1-acba-099907a36946", "comment": "Malware payload (Metamorfo)", "value": "e876622ade868b5c8461b80a9b8e4961e9427b2e", "object_relation": "sha1", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634889180, "uuid": "7cd1eee4-2cd8-4088-ba72-4633957022ac", "comment": "Malware payload (Metamorfo)", "value": "52b0346b154d4f084b815554c3f543bf0df848f8f8cedf8f5a7c444d47511c7817daaa28cfecbdfe3c700acca177c100", "object_relation": "sha3-384", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889180, "uuid": "842d101b-7064-4d1b-953e-7807fa1b7ed8", "value": "T1FB447E06B3D5437AE4DB03721B8F93628A72EC788673412B1249760E2EF1554B7B73E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889180, "uuid": "f166d78c-b18f-4c8e-8e55-cc9f1bfe4eb2", "value": "3072:XmWqcL903DaYlA8wgz88ereWn/7w05g0HMcB3RUN46ILJ9+ZB5yOanfN:XmJ3DaYlAN8er1nzTqrYN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634889180, "uuid": "94d6922b-96cd-47d5-ad4e-a7ca733f6e79", "value": 270336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634889180, "uuid": "841d70a3-f941-4bc8-ae6e-deeba5cf6973", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634889180, "uuid": "c0855f7f-08d5-4cf7-8c4c-3160aa53597a", "value": "ed3edf8fdb2cd2f027127f4fb1fe7019.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d2bdb8b-3332-11ec-843c-42010a9c0014", "comment": "Malware payload (LimeRAT)", "timestamp": 1634905275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634905275, "uuid": "61685a10-8a6c-4114-8957-056641611fd5", "comment": "Malware payload (LimeRAT)", "value": "72a80f214a15360ea3b4fe3cf38a99cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634905275, "uuid": "6770056b-52ff-49e6-b9d0-305e1a86bcfc", "comment": "Malware payload (LimeRAT)", "value": "ed105f2c43643335bcaeb304c932a5d484c4ecca3ce992f11c79fefa1be250d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634905275, "uuid": "383c85bf-af37-49f1-a80a-52b8aacd1109", "comment": "Malware payload (LimeRAT)", "value": "a00e93071fb481a0606efeac3850997c74fd51a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634905275, "uuid": "e49051ce-c4be-491c-831e-6e947274591a", "comment": "Malware payload (LimeRAT)", "value": "4afcb9094be3228e40adf29c87a4d3d5b4424aa5fe517a3e6fb6930860daa758d7b7c28f94c95281e7c188e77c42c317", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634905275, "uuid": "7524d01e-6891-4eff-ac0d-32cbf68475ab", "value": "T103C3F16897C88233DCFF5E3798A5DA01F730AA07BC52CA3FC5C881950D936535AB1799", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634905275, "uuid": "1075f3ab-b28b-4a03-9999-05a79f28c21a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634905275, "uuid": "317db054-beb5-4889-acd1-bf8dc4ad8353", "value": "1536:j6zs2TwExwB57SywumR5e6kE4+0PvsFvmOw38ABVGKPP9ey+V9DkYdWLnudb7UfN:SYEwB4ywumRE6Q14vmOw38a9Mm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634905275, "uuid": "2a9ecfe1-e93d-470c-9906-e2211002a41c", "value": 120688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634905275, "uuid": "656797f8-d1b5-4415-a86e-d8d9d1ee21f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634905275, "uuid": "2a795e02-c509-424f-b840-c3823d822339", "value": "72a80f214a15360ea3b4fe3cf38a99cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37c45622-331a-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634894823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634894823, "uuid": "55579f1d-f0a1-4c05-aa04-55c690356e21", "comment": "Malware payload (Loki)", "value": "1edc5ae8174533de1c038341b84685c5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634894823, "uuid": "ce8300eb-88c6-4635-9a8a-296ce88e43bf", "comment": "Malware payload (Loki)", "value": "ed2e98f8f8ec37bc3185c9f07a8d0595122fae501215977b3827868102470f4c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634894823, "uuid": "359846f8-761d-49f1-8af9-d95de444bfaa", "comment": "Malware payload (Loki)", "value": "651a959c0e1052653d5e59836b856fe47b9b9ae7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634894823, "uuid": "db9e9191-a529-4f40-bfa6-d5bfe8802eae", "comment": "Malware payload (Loki)", "value": "ddf57ff40520744bfd34e4f97f40c694c78231012f5754248742fd446e6365d613082256749ecccdfe1b1de1b7441e42", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634894823, "uuid": "3bfdf43a-070a-4c60-a08a-e02fccaea6ea", "value": "T10994690432B94B12E5BA67F01632594493BB7DAE243DE60D1DDE74CA0F77B408A61F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634894823, "uuid": "59812c69-f135-4a89-94ee-735a53f4b68f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634894823, "uuid": "bb890589-044c-4c99-97c3-462c100fbdf3", "value": "6144:vGxhLpRI6hv9emJQN60HNUfWCnul/3oehlEiS1ZW8pjLJ:e0iQ60HNwnul/3oeMfpx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634894823, "uuid": "b16a1d49-5ddd-454d-ad9d-61f1b3d189e3", "value": 436224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634894823, "uuid": "fc5ed1a2-2223-4d6c-88b5-58cd054ad6d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634894823, "uuid": "b458ede4-6c45-4c4c-b088-f1e65f6c9934", "value": "1edc5ae8174533de1c038341b84685c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0df4c5cf-3339-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634908068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634908068, "uuid": "523f51d5-7b2b-47ba-b11f-f869ce49afe2", "comment": "Malware payload (Loki)", "value": "a2d9fc8023e96b2d9ca5ebba19af7c6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634908068, "uuid": "b8109b66-81f7-430b-b5af-7cee8e0d7ebe", "comment": "Malware payload (Loki)", "value": "ed73afcf32db34f4ba8abba9dbe2ea569732b58bb0632b109527ca68b8314ca4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634908068, "uuid": "9f92ad70-5737-4692-8c79-6881e9a4f67f", "comment": "Malware payload (Loki)", "value": "a52f9b542d51cf54199e0c591da38a6c93da7303", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634908068, "uuid": "88ecf45e-ba0c-40ae-a871-dfd3f15650be", "comment": "Malware payload (Loki)", "value": "6cf79d31eb7302773aeb3b1e1f208af7c9ede4e49b60b9e93f60f52d2311e4328068377e6bb42aa119ae576a98a6d217", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634908068, "uuid": "e6179118-e7f0-4085-99d4-fc874c3cb158", "value": "T1D4548D10ABA0C035F5F312F859B693ACAA2E7EA16B7454CF52D526EE47346E0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634908068, "uuid": "b2b96582-742f-4a2c-ab25-378d6032944a", "value": "25e96726029c322936cf0033b6a07058", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634908068, "uuid": "04da92b1-3324-4c8a-b455-fb853971ea81", "value": "6144:mnqAQGF+KDDj13kGWHjKOvsbC7zxpws0ZwOaS5p:GqkBjaDDtvKQpBuwOag", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634908068, "uuid": "b0de9c2e-bc11-4e68-9719-cc8fe9333f6f", "value": 291840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634908068, "uuid": "50b1f6c4-31bf-4b10-ad65-2b609b49f220", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634908068, "uuid": "28003efa-3527-45cb-adcd-4f5b3158f0af", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38125924-3322-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634898260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634898260, "uuid": "55cca866-4643-4da1-b3f3-59636605d891", "comment": "Malware payload (Loki)", "value": "65c84a143ebe579a56d16b9628e042ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634898260, "uuid": "5d826686-c3e5-4414-84d2-7d7480ff4e21", "comment": "Malware payload (Loki)", "value": "ed84a6cb70969bc490e4b72bd028652cde787dcda41b5cfa7ed18ed7f592b9eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634898260, "uuid": "8385d714-6373-46d9-a9ce-bea5bc0450ab", "comment": "Malware payload (Loki)", "value": "ce988611870cdabd04fba38176555ca4815ffd4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634898260, "uuid": "d82ed491-fa98-4b30-a818-77cd93f7463f", "comment": "Malware payload (Loki)", "value": "9aa95840340f7f280794231304ba4e5e0baa9ffd821f0da9d6570d298999227f47cc3c42818a5d50dc70c2cde779f8d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634898260, "uuid": "72f68e15-78c2-46f0-9265-5791db7a64e5", "value": "T15C84CF2B3658C9A5D3381A33FDCB820C2BA97CA1A953D14D76D7B25E05B13B20D351EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634898260, "uuid": "7a04ced4-a9a5-426a-a195-12c19a4ed65c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634898260, "uuid": "ba3410a4-c2e7-4678-ba39-27fd4741d4b7", "value": "6144:hsonJH5wognja6Uqd2GhNBSgDh0kBE7woo3eDYCFwdjLvgSHKAm9:PHgjUi2iNtDuk67ZPDfFwdLvhM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634898260, "uuid": "fce67cda-2ba5-413c-a680-7da4cac771e9", "value": 404992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634898260, "uuid": "83d3d706-983b-48b7-bb75-7d942070233d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634898260, "uuid": "943654ce-815e-47f7-80d9-2478d115e721", "value": "RFQ 001008102021\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "080e8069-3368-11ec-843c-42010a9c0014", "comment": "Malware payload (CoinMiner)", "timestamp": 1634928244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928244, "uuid": "5c7d3224-c137-4629-a69c-b996eae9a6cd", "comment": "Malware payload (CoinMiner)", "value": "af8af919173d2af2b99ec479cb6f887b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928244, "uuid": "f98d3aa5-935f-4483-b8c1-d4f32dfe2188", "comment": "Malware payload (CoinMiner)", "value": "ee469f144571531a0b2961a624141b76c6ed18ec2f6d72badb86bd46ad430b44", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928244, "uuid": "0d0edd86-123f-4cf6-bf0b-351e644caf98", "comment": "Malware payload (CoinMiner)", "value": "8961fbdbbf88256438aea61106f91786ac99a3e7", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928244, "uuid": "4b9ed611-4621-47b7-bfc5-c33dbc60caab", "comment": "Malware payload (CoinMiner)", "value": "83095e211bcc65dccc245a45cd53a6ec1056054db87fc73beae9806b20a24470247b6a9989b453be623e67b0b3a37eae", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928244, "uuid": "e5e00078-e2f4-4469-af87-68ba082cf012", "value": "T13B746C00AA90C039F5F316F446B99368A53E7EE16B2454CB53E52AEE47386E1FC3171B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928244, "uuid": "153fcb82-992e-4e6d-898e-664957d3cfaf", "value": "e596e558b61473706e14db7e3ed0b8fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928244, "uuid": "25ef1408-1d88-4a00-aabb-390e70c7de96", "value": "6144:GAlImwCCVhV65Pz/nSXq6TWXRrogNO2R7Vb1rmrLUX/f6QjClLXn+:GSIJC4n65Pz/nSXq63e5RRb1rmr8f6ef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928244, "uuid": "d6326552-4dff-45e6-a0a5-54307932d9dc", "value": 352256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928244, "uuid": "c6047cc3-90de-4157-b2d9-b20090e862d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928244, "uuid": "6e727d2f-bc07-456d-af59-9eae452be319", "value": "af8af919173d2af2b99ec479cb6f887b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2b9119e-3361-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634925605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634925605, "uuid": "d7fc495d-86d2-49a4-af81-fa4edc0f129a", "comment": "Malware payload", "value": "5a41b7e0b5d73f7c05086a59ebdda4a0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634925605, "uuid": "619d08b4-7132-400c-bc85-638ad95798ac", "comment": "Malware payload", "value": "f047ce90931f1fab097ae2e040b3f7d916db05964d620c6584662a6e00cb87fd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634925605, "uuid": "833d50e4-05a5-49a2-b789-526a5574f4a3", "comment": "Malware payload", "value": "0cc9a37081fa8b0a114174ec6cba1a1a5acfd476", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634925605, "uuid": "0450d0e4-a660-4fa3-84aa-619021de33bf", "comment": "Malware payload", "value": "a3ca0589ebfed573093c11342c76056b9406d60d9f5511d2b166300525952066528965a7a464828b5687647e2ed03430", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634925605, "uuid": "ee1a3595-585e-4c1d-97c0-d5b96380f75d", "value": "T13F23D843AA42CAB3D9931BFA02F75A254632FD2A0E1A4F45E32DBCF4AB435C87117355", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634925605, "uuid": "bd57118a-05da-4bbd-ba71-6da125e7d572", "value": "768:2eG26/QVWkTyR+BN2UuHqil0JnzDwPq7Vgd+IQo1dzBehYGslKgVZNKgLGe4VPZ1:j6/yW7+JuH50zKd+S1dkhSlRVPKY94VX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634925605, "uuid": "423707a7-68e4-4425-be28-c2b81d5b1f8c", "value": 48739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634925605, "uuid": "5f07aeb5-98ed-4f6d-849d-bef36847aee3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634925605, "uuid": "a69e4abd-e7b5-4391-8d91-03f620128505", "value": "Fate.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9733bc3f-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928055, "uuid": "36743f54-4469-4ea4-a3b9-113fdae348d9", "comment": "Malware payload (RedLineStealer)", "value": "b37e7d6f16f8a4989a76124eaf021cf9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928055, "uuid": "99984590-a97e-44a6-89a6-2cc81a0e93c8", "comment": "Malware payload (RedLineStealer)", "value": "f05646c286f17029139c4c6b092b6b9a4a85c395916f17f137b20c4e018e416b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928055, "uuid": "0a9d678a-cd1b-479f-b1a1-887f1c24444a", "comment": "Malware payload (RedLineStealer)", "value": "fd218d216f872d92a923bdf098898a02539a8db7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928055, "uuid": "67599c12-be32-45b2-9bb6-6482f5a63784", "comment": "Malware payload (RedLineStealer)", "value": "283ec4e63202a0069f364705106764cc200a30e78c3a264c1b174e665545a379c2f90ed336c1e640c189e8c1a284b634", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928055, "uuid": "1b3d435e-22c8-4d8b-9c16-f23dad89a9e7", "value": "T14BE4F110B6A0C035F1F756F809BA926CBA3EBAB16B3551CB52C416EE5738AD0ED31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928055, "uuid": "dd1717ca-5248-4987-b19b-116513d29703", "value": "0aa8675e96bbc2351e2af940f447c93e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928055, "uuid": "ff047ccb-b6ae-441e-b68b-c8d91749af00", "value": "12288:/YUZK6zbkyf8QL5yKNfR5Hl68RNad/HCGZq8bI7tX2LlyoYXj1R:QUZKgk008RwdfCGNUhX2xeR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928055, "uuid": "2b0767bd-1fa4-4704-8cd1-82b92dcc62ce", "value": 669696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928055, "uuid": "3b804a9e-11d8-41f7-8939-012b7c2708a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928055, "uuid": "7546b117-0af1-4ca2-9f76-c571d700dbab", "value": "b37e7d6f16f8a4989a76124eaf021cf9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13024a88-3368-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928263, "uuid": "c42373be-25e5-4d06-8a69-4511f0885e47", "comment": "Malware payload (RedLineStealer)", "value": "04ec8239792ff38a0daa275b9fc36209", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928263, "uuid": "5b7adf23-e026-44c8-934d-5547140b0ded", "comment": "Malware payload (RedLineStealer)", "value": "f0bbc262741c8885098c6b4b85b9eaebc063a7d65b4c1f7bbb381520bbfc7382", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928263, "uuid": "be41044e-bbf7-4961-b6ae-9daa276bb77e", "comment": "Malware payload (RedLineStealer)", "value": "1014d074388aafb17607021d0cfb6a3f37b37e75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928263, "uuid": "b8c4af9e-0439-43c6-8f45-65d9852ffa3b", "comment": "Malware payload (RedLineStealer)", "value": "1a1cbc622626b4193da164d31fe40a95bebc5f766561e29cac90d31e2d02c9fd15977fa0f0caf98cdc8c886742b191f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928263, "uuid": "f71ef45e-a9da-4c52-b84f-a0673147dc1e", "value": "T1DA448D30A7A0C035F1B712F949BA936CAD3E7AA36B3490CB52D516EE56356E0EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928263, "uuid": "37e7e4b9-3fc5-43cf-8dda-8273715b4d80", "value": "b2b1ce057c4a3ad8c1ee685e46521866", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928263, "uuid": "ac7fc0e1-b563-418c-bf2f-972f1ca85d58", "value": "6144:sczR3TNhoEFdyyar2ey9A3WSHozV0p0o:BzR3pXHyyar2e3zHozM0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928263, "uuid": "2b451e18-ea11-4621-83bd-78d0b6bd2584", "value": 267264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928263, "uuid": "1e5cd841-607a-4253-9659-2e4f57f24e4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928263, "uuid": "e7c4bdc0-99b8-42e3-9913-4ec29a7e9160", "value": "04ec8239792ff38a0daa275b9fc36209.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "742e36c6-32f6-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634879463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634879463, "uuid": "68de5f2a-d7e4-4462-bed7-acffe4f3f6a3", "comment": "Malware payload (Formbook)", "value": "2d0ac0a8f2d2aea1f05429585c1bdc4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634879463, "uuid": "f08f846a-fab5-47c0-902d-92d1a512fd28", "comment": "Malware payload (Formbook)", "value": "f1d7ead1ca0f3e39c12bf5b67bb35cfc745acf0f587c2d6ce45eb2904f44aaa7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634879463, "uuid": "bf765d01-ac31-40ac-bd07-e0da54351e12", "comment": "Malware payload (Formbook)", "value": "3657594459b01c0c918e0deeaf3ad7f05a4efd90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634879463, "uuid": "09dc8088-1cd8-4441-8189-f905a7711205", "comment": "Malware payload (Formbook)", "value": "b4c3b75b4fbb8d9895c43a1f4f89cc6fd7dfd617292eebc83a888180b5bcad13ec509455711620207fb6e30927f491e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634879463, "uuid": "1203a336-88f1-4ece-a8e2-1fd5f765fdcc", "value": "T1DF44121FF1D8903BFC7757B002A7A7B2EB7B416805D1418B6BA49E7B1E611C3EE1604A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634879463, "uuid": "1a6f50bb-8ee8-4986-907b-a15de1112792", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634879463, "uuid": "1737c807-e6a8-4fa1-956e-1cdd1bb292e2", "value": "6144:wBlL/cY0AMznI2l481Mzgem84ITAI43r3i0HkAEQhYW:CeU2lv1MMDZi0EJeYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634879463, "uuid": "14817ede-88e6-410b-9731-a4bc715ba6ad", "value": 255622, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634879463, "uuid": "977b7b20-e580-4af8-bd31-8b270113d5d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634879463, "uuid": "d39e5981-ccb5-4dde-b7c1-a29c12d90b3f", "value": "Shipping_Doc190dk0lwt837.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "956901ef-330c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634888968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888968, "uuid": "7dec8b6c-e240-4ea2-b8ca-426c14d9d549", "comment": "Malware payload", "value": "220a72db5a61a463a6056f852b70aaef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888968, "uuid": "172ce1da-15f9-49a3-8c25-133ce39b4a64", "comment": "Malware payload", "value": "f20d91a10181609a8c7b3d7581f415c76a3a6cb6d4878da84c006403dfc9969c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888968, "uuid": "907063df-7144-44de-9597-a7ec6ac11b6f", "comment": "Malware payload", "value": "6d98660838ba244c9fc53c838dbf5f01473075a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888968, "uuid": "476b491e-e5a2-4c98-9bf7-b1c9bea3ab26", "comment": "Malware payload", "value": "e3fed936a015711d868641ef259e53ec4022144c397052ca2a67b7c1533518d36f852f0ed9488a273e8ef9a6a6bebe28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888968, "uuid": "1c7b8262-f76c-486a-94b0-d13001c80374", "value": "T1D5853A07BC9160F9D4AAC230CAA5939177317894073363DB2F50A6BA2F72BD81F79794", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888968, "uuid": "df7b6c88-859e-49cb-b4b0-4bed6c2c5e53", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888968, "uuid": "5c6bcd3b-1f93-4a05-a2c4-11eed5f091ec", "value": "49152:qLjR+QCjrb/T4vO90dL3BmAFd4A64nsfJrjXKXHNgv7199b13:IjpaP1d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634888968, "uuid": "7415d96b-1daa-4f24-9cc0-9626f8cde358", "value": 1749192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634888968, "uuid": "ab7183fa-6f02-4777-952b-781c7d6fe452", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888968, "uuid": "980244fe-1bea-41bb-a9dc-ce536d696c5e", "value": "f20d91a10181609a8c7b3d7581f415c76a3a6cb6d4878da84c006403dfc9969c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30032631-3308-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634887079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634887079, "uuid": "0874679f-8b0d-422c-8c7a-85dc63324340", "comment": "Malware payload", "value": "afa95f00853ace692f790c09e3fea3d8", "object_relation": "md5", "Tag": [ { "name": "mac", "colour": "#285994", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "UpdateAgent", "colour": "#B10D2A", "exportable": true, "hide_tag": false }, { "name": "WizardUpdate", "colour": "#5BF7D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634887079, "uuid": "c15c1008-b54a-4ab6-99c9-869121a748ce", "comment": "Malware payload", "value": "f2d2f7d133309fe0afacbfac26475ac269c7413a97bf695c1360e0b468faf8d6", "object_relation": "sha256", "Tag": [ { "name": "mac", "colour": "#285994", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "UpdateAgent", "colour": "#B10D2A", "exportable": true, "hide_tag": false }, { "name": "WizardUpdate", "colour": "#5BF7D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634887079, "uuid": "722ce2a0-c3e5-44c2-b684-3acda6e2cab2", "comment": "Malware payload", "value": "8263b80e7581f50c27f830eafdb19a9863d6d3e9", "object_relation": "sha1", "Tag": [ { "name": "mac", "colour": "#285994", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "UpdateAgent", "colour": "#B10D2A", "exportable": true, "hide_tag": false }, { "name": "WizardUpdate", "colour": "#5BF7D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634887079, "uuid": "24cddb2c-c1f7-45cf-937f-40940e249555", "comment": "Malware payload", "value": "47e1bd9efd3f33d257de4fdd1e5540733ca2db7418d60f8659bb7e56561bee75ec8b6b1bd77a8bda098dcb561c7d8199", "object_relation": "sha3-384", "Tag": [ { "name": "mac", "colour": "#285994", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "UpdateAgent", "colour": "#B10D2A", "exportable": true, "hide_tag": false }, { "name": "WizardUpdate", "colour": "#5BF7D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634887079, "uuid": "dd97f9d2-a5b6-4a8b-8da7-8e6c2c97d7d6", "value": "T1A82633B7DAED62ADF605D83151012305A2E8FD5974C2E3AA3E062A5D9DFB040FB903D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634887079, "uuid": "a61d74d4-cadf-4cb7-88f7-4f48fbca226f", "value": "98304:Ywld2gKpbl4YCQddYhPFbPKG6CU9PFrx9HkkolJj2X:ANpbl4YzT2RQCkFi6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634887079, "uuid": "2566c781-5962-45d8-8cea-9909c39c8ff5", "value": 4596954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634887079, "uuid": "3d6a4df7-4336-478f-8c9e-ddcb8f0fba56", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634887079, "uuid": "3e6b7a15-c2a9-44ae-8708-c41c8132b057", "value": "InspectorCleaner.app", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ec8f2c0-32cc-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634861308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634861308, "uuid": "377c56df-2eaf-491c-8fc8-e2965251556b", "comment": "Malware payload", "value": "24b6d39e6a0da9b67c348013d2aea243", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634861308, "uuid": "bbdc2009-41eb-47dc-b506-ecd65d5086cb", "comment": "Malware payload", "value": "f35dfefe66fadcf373928c4bc4b941964233fc05831ca8e8503c7b7856aa1c1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634861308, "uuid": "02fef859-689a-467d-9f7a-dcc471e4e526", "comment": "Malware payload", "value": "a25fd8f2cfa926c6db6e3102b0a3479c66d8aeee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634861308, "uuid": "6c6250ac-7aae-4874-a9df-2839fa50acfa", "comment": "Malware payload", "value": "1e8421186c537c53c51aa209bc8de0654093ee6f38e55a03e2fa139a2b6c5c36943db81814b2e38506a050702b3f0724", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634861308, "uuid": "dc6532ac-8d97-4685-84ac-68e8077e37a9", "value": "T116D5332076E85573CB69B5FB580B6C2153F222C2D431DA9F129316B99180F70879FEAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634861308, "uuid": "098dcf22-cc31-43de-a14d-4385cfffe320", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634861308, "uuid": "f93a6ba8-b342-44db-b8dd-bdbf9af392c7", "value": "49152:osmhnqAs9pJc0dnKh+Q0N1rs+vIUSg+6+8ohnRh1Na1OKM6nYAKhFQpSH3Oh5gxr:CqXpy05Q0N1rsYSZ6BoXh1kkypSH3Ohs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634861308, "uuid": "e8dc05bb-0013-4f0f-9663-9ffb267dafbe", "value": 2978304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634861308, "uuid": "032fda1a-59da-45aa-a1d8-d10f77e45a78", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634861308, "uuid": "9b7888c7-ef0e-4992-a048-3a4eac0af76a", "value": "DiscordNukerV6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddd5f2b7-32da-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1634867614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634867614, "uuid": "f4630bd1-a2cf-441a-8ec1-816c6fb6a202", "comment": "Malware payload (RaccoonStealer)", "value": "2354d9753f0f741bd358dae604e48c3e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634867614, "uuid": "5d25b969-ef5e-499f-9b75-effb41b976d8", "comment": "Malware payload (RaccoonStealer)", "value": "f3be725453067dd4fd33c93d841f8bc707334cad295708f36319294405066346", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634867614, "uuid": "ed0ae9e4-a448-47e5-9b69-5eda55c47102", "comment": "Malware payload (RaccoonStealer)", "value": "f128c560612c22c30ff0a3593bb66794ae7774d5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634867614, "uuid": "8932ebb3-fedc-418b-858d-4e683e5285f7", "comment": "Malware payload (RaccoonStealer)", "value": "ac932c845322f2e58a86df82d5f314abf90c19fe92140deddfef99e162eea0c651e32a8387631191f8941a6f4f55bd3a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634867614, "uuid": "f7d3691c-0374-4bd1-abbc-179024d9c5df", "value": "T14025011A2D7B0563F0054DB10BF096F61BBDFC533492DC1F9B45AA4818E2B8A68D1B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634867614, "uuid": "8d1180fa-887e-4116-a049-33ad022a33a4", "value": "38bbd7b6af738c50eec8bb509ccc9556", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634867614, "uuid": "0dd47c10-616a-40a3-8e1d-2cb5cab8f7b2", "value": "12288:hxt6hRd3GUju9Al4QMe89d18EbVAXMJrQF0p4v9TH9yzsN2j33+RgshWtqU59d3i:hxQhf3DcA78DbVAXWQF0p2hNIeQqU5w1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634867614, "uuid": "492e6464-5600-4134-987d-1e9eddad44dd", "value": 1036288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634867614, "uuid": "d979b8c0-9239-494c-9c87-bc7dba8715ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634867614, "uuid": "10a600bc-e772-4559-87e8-edb7a42a98bc", "value": "2354d9753f0f741bd358dae604e48c3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de133684-3326-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634900256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634900256, "uuid": "b09d7ac4-d9b4-4330-86b6-77f0a756912d", "comment": "Malware payload (Loki)", "value": "4a01bb13ad043b84697166d7705b1028", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634900256, "uuid": "f7c3693b-b134-4a09-99cc-aa3ee2ddc807", "comment": "Malware payload (Loki)", "value": "f6ac542852beb59ae8f01a9290d359cc0b5487c8926264b29398bba0ce73c474", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634900256, "uuid": "a3b0c15f-9441-4eeb-b97e-fcaa7bd5b064", "comment": "Malware payload (Loki)", "value": "49d117f3df6e205bb6899e57255b249adeb4f965", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634900256, "uuid": "e90e0013-10a0-4708-8f24-b3ad793304c0", "comment": "Malware payload (Loki)", "value": "9430442ed54d3126e1a8d36bf482ef184be7c42198e8b701e8f474e3e59b2825a11a1f9f780a880595dd13ad24a076a1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634900256, "uuid": "6e808cf3-96b2-4b35-a272-afe17887a56f", "value": "T14F946A0436A95B12E5BAABF01631590053BB7DAE247DE60D1EDE34CE1F77F408A60B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634900256, "uuid": "234f152d-dc53-4fb8-bb0d-0ad419247cb1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634900256, "uuid": "f1c536ea-670a-48d6-af9e-72b488c8d450", "value": "6144:0GxhLTAIxrvAbMe+iNX/KR7xbpQ9DJCe+VxxfFW7LdbP8RlgedyeihypTJ1:drtk+iNX/m7x69MeExhsdbugoynK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634900256, "uuid": "a319be89-c94a-4f9e-b5ce-86243685e128", "value": 436224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634900256, "uuid": "18de46a5-07e1-4a71-afb5-de237d3786a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634900256, "uuid": "efffd2cd-ace1-41d2-af80-7e7e8bcea666", "value": "4a01bb13ad043b84697166d7705b1028", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a11c276-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1634928006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928006, "uuid": "4e8586f1-a429-48b7-8eee-77287e1806fb", "comment": "Malware payload (NanoCore)", "value": "12897cc89f6a46e25f9d5445e9299003", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928006, "uuid": "7d2f30c3-3256-4e5f-8233-ac96fe107cb5", "comment": "Malware payload (NanoCore)", "value": "f7943cf69c4834c48a432c2a76caa9eecc80fa9fffdf5868277556c6d3fefd64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928006, "uuid": "fd6c12f3-8851-4a73-a051-802aa9b1c4f6", "comment": "Malware payload (NanoCore)", "value": "6b3d478c2895cccbf8bfd6135338e517bb20707c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928006, "uuid": "6f3e995e-28dd-4676-be5e-fecaf92db9df", "comment": "Malware payload (NanoCore)", "value": "68960066f44bb6eb61c3041038be119d14b79c5bcb5ce4f9fdadf4b80cb7db6038ec41cd69364d1d27bfd2c321514f96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928006, "uuid": "ef4a6b7d-8b27-4ccc-becc-e9877fbf5cdc", "value": "T18235120037EC4F76F4FA9BF5593169201B7635262872EB0C4EE134CE1E727918A92B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928006, "uuid": "b9138cb6-302a-4255-bec1-262b96410308", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928006, "uuid": "bc13e763-e635-446b-afef-8e481952b21a", "value": "24576:jWFOB6AlAlKal/zPsKuLubbXwUv8hzZhg3+TE/+PnyuXzhU:zB6Y1O3yAwUkhzXgOTaYnyq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928006, "uuid": "a4fade21-56f5-4318-b918-85559119e045", "value": 1090560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928006, "uuid": "d50d5d4b-9547-49f0-91e5-6fe8450f7861", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928006, "uuid": "691bb365-419b-40f9-83af-93232ba326e8", "value": "12897cc89f6a46e25f9d5445e9299003.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11383acc-3368-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928260, "uuid": "f8529942-fa01-42cc-8bdd-d7e58a3003c0", "comment": "Malware payload (RedLineStealer)", "value": "7b43d2b53d921c0f5274a4d9fc478073", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928260, "uuid": "70177180-5a60-46c0-8e8a-973013ba8ea2", "comment": "Malware payload (RedLineStealer)", "value": "f8eaf4927a573dd810d0d51d0af5b72dfe12045dd7e84535ff9b636ec8f6dfb1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928260, "uuid": "3b6d4829-fa24-4f33-bd1c-24d3edea4a46", "comment": "Malware payload (RedLineStealer)", "value": "36a06369878b8cce78f3ed7142a7b733584f0f34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928260, "uuid": "75bfac8f-8704-4863-8b76-d307ea2f5ec6", "comment": "Malware payload (RedLineStealer)", "value": "389f3304ce372076000ec386b59e5f1fb9617f984e9a55dec955f76caf0bcc1463d21337782c896364529c900cf12ba4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928260, "uuid": "a6af4d81-780b-4106-b40e-49d7cf3f62bb", "value": "T1BFA4AE00AA61C039F1F352F45ABA9368A52E7EE16B2490CF53D51AEE57356E0FC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928260, "uuid": "2acdcfd0-5f2d-4ffb-b759-0824265ad9b3", "value": "9cccee30870eeeef9fd80f169e4bd55f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928260, "uuid": "8db06fbe-c406-4a8a-8d58-a771a8d4bfb6", "value": "12288:Op44B9zBU7i3CvYsKcz/XD2zDxL6gFLxj3:OP99U0CvYxmuDJ6gd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928260, "uuid": "04228cfe-ebe2-48c2-b588-2d8b501c1395", "value": 463360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928260, "uuid": "8b9a31f4-26f9-46fb-be18-8afbb7a38a51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928260, "uuid": "7f484db6-caec-4342-b3c1-75e577ecd26d", "value": "7b43d2b53d921c0f5274a4d9fc478073.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7f11a73-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928110, "uuid": "de60cb2c-e6e0-4dcd-a4fe-0cf27d715562", "comment": "Malware payload (RedLineStealer)", "value": "5dbd8aa86a7a7f9fb08d46199adfbb16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928110, "uuid": "3003ee47-395b-4222-9e2f-7206596eec88", "comment": "Malware payload (RedLineStealer)", "value": "f9770d111ea06ea7a7c4b10461d7b88a1971b0e3f07573b3d656ef752db9abb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928110, "uuid": "80e7c7b5-2811-4bfe-a1b1-8e990492ce88", "comment": "Malware payload (RedLineStealer)", "value": "79aea5a1228db2443dd58dc870829f70fb1a8f76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928110, "uuid": "d9728e97-244c-40f1-abe8-c21a34ec20eb", "comment": "Malware payload (RedLineStealer)", "value": "eab4d17dbe47b1edaee8d4b77b0badbfddc311c7cc750772badc4b50e5be652dd06ee8adb71539e9f90c62c2ceb38bba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928110, "uuid": "e6473335-081b-4528-9960-be38d6b6c948", "value": "T1A1E4F110AAA0C036F1F316F459B99368A53E7FA1AB3551CF52D426EE47782E1EC31327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928110, "uuid": "29c25211-ec93-492b-b4b4-cd8b1ec185cc", "value": "0aa8675e96bbc2351e2af940f447c93e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928110, "uuid": "5e71b4bf-464d-4f84-9d2d-5410fdbce968", "value": "12288:zgAhg8E3QvuqxYjBrfxgsH3EmHp0llqM3qjm1Jg+p4KFANsjUA6XIGlW1ApLzU:8AS6WqxYvjN6llHngs4CAegtXIvF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928110, "uuid": "be61bfb9-f238-4c0b-b3c5-17d6f5a6b135", "value": 669184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928110, "uuid": "ec6f7b7d-f23b-42ba-8f8f-34e023527d3c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928110, "uuid": "9c9353f8-691e-45be-98b1-efcd95df9225", "value": "5dbd8aa86a7a7f9fb08d46199adfbb16.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe839991-3320-11ec-843c-42010a9c0014", "comment": "Malware payload (TeamBot)", "timestamp": 1634897734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897734, "uuid": "fc2a626c-1b0d-4b68-b38a-4623ae09ba9e", "comment": "Malware payload (TeamBot)", "value": "7a1362a40d3936ba380649092031a2ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897734, "uuid": "4e5e4162-fb3a-4a6e-8b55-b9aff1da9f5e", "comment": "Malware payload (TeamBot)", "value": "fbb99570b341367a86c2c23b56862bfb3d3ea91c06e7c15750f7d36bf82f494b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897734, "uuid": "e2a9500e-a7ec-4f16-b6a2-9be888414a45", "comment": "Malware payload (TeamBot)", "value": "7c6afa09f1d0cce0401d256d19123d0b1edef331", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634897734, "uuid": "d8749856-81a4-4546-afe3-5abc2233d1d2", "comment": "Malware payload (TeamBot)", "value": "a5368d6e29f1b45b433a2116adfd184f6e40e5bedbd84813dff586d0be7038266dcbb813991a9acfd3269a0e54b0e386", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897734, "uuid": "ac81274a-26b2-42ad-96f7-7e95a59ab2c5", "value": "T114549E10AAA0C035F5F316F859BA93ACA92E7EA15B3554CF52D426EE47386E0FC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897734, "uuid": "25555d61-ce9b-4fb7-850d-7cbd45083b6d", "value": "0aa8675e96bbc2351e2af940f447c93e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897734, "uuid": "8c2c85af-7429-4ea1-95e8-3c748fe4d582", "value": "6144:inr+igK84SPdiuJIlyGDq9gXvJbkF3GoeMIl0CkhJ4OeIMR:6r+igK87vdOaSvBgx41khJ4O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634897734, "uuid": "7c19047d-5061-4911-ac52-df5ce79a05fb", "value": 290816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634897734, "uuid": "e525851c-61a2-4766-adea-dec91c4bb3c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634897734, "uuid": "a336c9ba-d698-430f-b9a5-2b15742e321c", "value": "7a1362a40d3936ba380649092031a2ba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f4a8ade-3325-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634899534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634899534, "uuid": "a8782ee2-48b5-446e-9db8-257262bf4823", "comment": "Malware payload (Loki)", "value": "c53168d1494977e6433cc671f6f9aceb", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634899534, "uuid": "c3313f04-d589-48cb-b5c2-685416bde559", "comment": "Malware payload (Loki)", "value": "fbc1d4213384d14e23d204c883c9d6fbf98427210c970852692978d24304da39", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634899534, "uuid": "8cd7a9b3-5ce0-4308-b485-887d09cc352a", "comment": "Malware payload (Loki)", "value": "fce4da52da626fcbb2fd2f9c896c260cfa64f011", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634899534, "uuid": "6d614ad9-5793-4c88-a7f8-3269f6b55333", "comment": "Malware payload (Loki)", "value": "9d900eba9d128eaa87e1f006a7fc5e3c0efc1d1c074e51b0c0289368e982b2f93b28deefe31e32c0b7fef7c935b84fd5", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634899534, "uuid": "e6422716-f64a-421d-b23d-a36f5464eacc", "value": "T165B2257EF5870E48DE56D6A9160A7B65064DF11D32C840E23BBCDB387A5C85B8B23D38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634899534, "uuid": "4cbe3080-ff35-40f1-a137-c5c9904c3b7c", "value": "384:K3pYxzsE5uSpHHtvutwhMJ9rcqFoIzrsHZEpjpEUYwe8Gxr3W7V:9US521J9rcqSer6ZEpjzYtBj4V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634899534, "uuid": "79d66d7a-1fe9-48c5-9199-470c5a83b876", "value": 25486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634899534, "uuid": "9514e30e-61f3-4249-8a35-65b7ebf63ee1", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634899534, "uuid": "2ea59652-21cc-454d-b15a-4b02daf28e9f", "value": "c53168d1494977e6433cc671f6f9aceb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96a2cf6f-330c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634888970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888970, "uuid": "399905d3-9535-48a4-bc19-fc348313ede3", "comment": "Malware payload", "value": "c8f76def15e78d841fd8708c9ef4182e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888970, "uuid": "2e4a5fea-2e91-45ef-ad5e-548a188bb32f", "comment": "Malware payload", "value": "fbe20eef80caf229ba6ddb37c7bd90cd2c9fdf2cee193c318e9fab35333b8d0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888970, "uuid": "37140583-0a96-4fb6-8f92-7c319a1f1c26", "comment": "Malware payload", "value": "add5c99232530270d3d074dc84c7369eef42077e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888970, "uuid": "8ef917d9-e5e2-4734-934b-a713801af73d", "comment": "Malware payload", "value": "b3d6a08e9f95844fb60dfc72789c9c2868da1190cd3f3eac7732590add7088e5ee868dff3839ba9b3399426d21c690cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888970, "uuid": "40b1d176-6799-4b1f-a5b4-b1068d9a822a", "value": "T1BF953A16B8D306BAC57AF130855293A17A317C7587323BD71E80BA6A1AB8FD42F7D314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888970, "uuid": "d6f9539c-d8e8-4bae-b07e-830dc619d467", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888970, "uuid": "1abc72b1-3720-4170-a7fe-f9509bd462c6", "value": "24576:D3jG6gFJHbsgqXwpleaswsHSzGeAUbSKcgL0eFNE1F:DcFJQgqXwjnsfHpebSObNE1F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634888970, "uuid": "e1a0c2fd-2ca7-4b1d-95d0-132cae7f91ae", "value": 1959056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634888970, "uuid": "5be57ba1-b5c3-45ac-95c4-59dd4eaff25c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888970, "uuid": "d9b8ccba-6530-420e-b2e0-95dc2beef822", "value": "fbe20eef80caf229ba6ddb37c7bd90cd2c9fdf2cee193c318e9fab35333b8d0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f26d9fe-3312-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634891507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634891507, "uuid": "f83a995b-5301-4991-8ed3-ffe689ed19f2", "comment": "Malware payload (Loki)", "value": "f2b0b0c3a1df878a36acb0736b8e2ccf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634891507, "uuid": "a3851f33-1910-484e-b4cb-aa44bf6ea486", "comment": "Malware payload (Loki)", "value": "fbf42fc8b79fc13e42f52d0b8c3a390290229ca1a4f59e84ac0c971ea69dfed3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634891507, "uuid": "325f038d-fd48-446a-b326-7cb5b4c48926", "comment": "Malware payload (Loki)", "value": "fd0627cf9a06fac3a9bbd34d736718e0fe0db2e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634891507, "uuid": "451144ba-bde7-4ab6-b753-003d0c15ed14", "comment": "Malware payload (Loki)", "value": "f4045df8a12186c4a64ad9f4b97e495ba8378f5fa106b6db479c6d5ed14f28d2ec5bcff372bdd340b674a0ba0666a438", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634891507, "uuid": "dc8f0d0a-c0ec-45df-8d7b-2c22267bcd11", "value": "T192946A0436E95B11E5BA6BF01672584097BB7DAE243DE60D1DEE34CA0F77F448A60B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634891507, "uuid": "1522d763-b0f4-4e5d-a016-e1c2b7efe3d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634891507, "uuid": "13c82420-de55-48fd-b7b4-da7311f44705", "value": "6144:CGxhLlI+BvRijL3IfOTfBUoCE0e0eDHHMTzKcnna:LaSw0fONUVE04DOKc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634891507, "uuid": "ccf17b24-95e8-46b2-8cf1-dd79fdf6a79b", "value": 437760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634891507, "uuid": "2c8095c1-e122-4890-a57e-b27569ef18d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634891507, "uuid": "75ccaa91-3a40-46f3-8c92-d7ad2210ca1c", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cad1cb9d-3367-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634928141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928141, "uuid": "9e1cbe5f-949d-4f56-a897-e372778a96a1", "comment": "Malware payload (RedLineStealer)", "value": "45655ffa2cc4dcf5475750b8e58abb16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928141, "uuid": "394c2a4d-d8fa-454a-b2f0-fa057c0b8c2d", "comment": "Malware payload (RedLineStealer)", "value": "fc041d4d2b6f0d58846b69024edfb01fa7ca8908a4d2cf228f8f8538501b690c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928141, "uuid": "a0fd356b-6660-45ae-8881-213bda6a0617", "comment": "Malware payload (RedLineStealer)", "value": "ceba55251d7e9ea5b5f650f80cc89e3bbf9c0f03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634928141, "uuid": "6e57f8bc-f96d-4ce7-b8b3-f110f57ffa4d", "comment": "Malware payload (RedLineStealer)", "value": "9cd9e0c065afa8bb914f4667a62529fface0ab96fd53338b055e3fb1e2e9723a44a8c7c4cc34fd1a5bd86406e92046b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928141, "uuid": "59ec4f0e-8245-4350-abe8-505220e88733", "value": "T12BF4E100B6A0C035F5B722F449BA9368A52E7EE16B6454CF52E41BED4735AE1FC3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928141, "uuid": "c36b4434-7288-4350-b87e-aee946b016bf", "value": "85b11e7df91b461ff7ceddce26982802", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928141, "uuid": "05f26aa4-8e83-4c5a-b86b-5cd39c068486", "value": "12288:da5Fgr9KVsVh7ONXyzOflZjE381yY2wu0HAwvxmtzCsSe3KlT9Rv5VL9j1vU:dd91hyVZjN8QDCp0TTv5VRu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634928141, "uuid": "a94d4bc4-1071-4f93-a014-4899d786ba54", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634928141, "uuid": "1d123fca-9d27-48b6-bc52-beb0e678d7b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634928141, "uuid": "b2423cfd-3c2a-40b9-bb42-c3372545b050", "value": "45655ffa2cc4dcf5475750b8e58abb16.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9974c82e-3355-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634920328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634920328, "uuid": "960dc327-4e8f-4925-93ed-b167fe496345", "comment": "Malware payload", "value": "7b300ad981bd98b367d5800d3b84e3c4", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634920328, "uuid": "8205b70b-7ba5-4fde-a4b5-07a47f504d20", "comment": "Malware payload", "value": "fc5c1044523a10a3f2b91b543e36e0ce067dd80eb8e1cea82722f575f1fa5546", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634920328, "uuid": "8615f9af-da3e-48c7-b6ad-62ad140f0807", "comment": "Malware payload", "value": "d185b28d1feacbe32302994d94d10cc11d3e5dc9", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634920328, "uuid": "bb2801ae-fbc1-4969-a16a-96b9f2da6cbb", "comment": "Malware payload", "value": "1563ccb34475eb10fdb2641d5db4b5e5cecc0eac56df91e240ec37eee03ba1fed2878353e9fbab49a86025c74e38a652", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634920328, "uuid": "7dc4575b-c5fc-417a-870c-ac39985f8bec", "value": "T1B874B0F875147DE6666F476BDA96ECEC13A627238ACBA4CD8064B7C30563371FE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634920328, "uuid": "1e5f8094-a9b4-4a16-b23f-95a4dacafeda", "value": "6144:TnbimU3T+vpZ3Ju66quC+RFcWt+b11zfV5khUXQ5h36BTnyImpWQ:Tn+T+v3JuLFKh1zt5MX58fzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634920328, "uuid": "143e1bdb-137f-463e-bdde-feb359ddb9f6", "value": 348654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634920328, "uuid": "a8a88949-ba79-412c-9081-d9267a19cac7", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634920328, "uuid": "996b378f-69b6-4de4-9516-5be249886575", "value": "payment.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7846c18-337f-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634938417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634938417, "uuid": "41039991-4379-4859-94f6-055cf17dbfe0", "comment": "Malware payload", "value": "36a1f9ebb9147ae271bfc11b3594a282", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634938417, "uuid": "09b25c33-1e39-444c-9a08-dbab5160a14d", "comment": "Malware payload", "value": "fc8c983c70303955fbbf53be566a1e573a231e2d38aaeaee4ed30a064a1bf172", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634938417, "uuid": "04ac082c-fdab-4a8b-9656-c55d8960ab07", "comment": "Malware payload", "value": "b74c63549416dd5756c2bc75cfc0743ddfe925fa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634938417, "uuid": "f2636242-540f-495e-b38b-7382de2b8bf9", "comment": "Malware payload", "value": "e2ffb34a9e708d2edf6d86f50b9107f51dd3cf3c168508a88f5f7ed5135f287a811d051c0bc28a0d2831d0773b1bd97a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634938417, "uuid": "dd75419b-7c97-46a8-bc50-f0d2fd1bb1e9", "value": "T1FEC3F17897D88637DCFB6F3298A5D702A730A702BC53CB2F85C881960D9325259F179A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634938417, "uuid": "83475831-c6a5-43d8-a70c-6faeb9d89f21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634938417, "uuid": "6dc13f06-21b1-4150-8841-24d82fadb3f3", "value": "1536:66zs2Tw0lZ0p71gwumR5e6kE4+0PvsFvmOw38ABVGKPP9ey+V9DkYdWLnudb7UfN:pYaagwumRE6Q14vmOw38a9Mm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634938417, "uuid": "834ced59-66fd-4e78-83a9-85f4c673ea37", "value": 121200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634938417, "uuid": "2f42b79b-29cd-4e8c-8a27-7c575ec716a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634938417, "uuid": "32674c93-78a1-49b0-8b90-096e51fe2f87", "value": "36a1f9ebb9147ae271bfc11b3594a282", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9292ea6a-3301-11ec-843c-42010a9c0014", "comment": "Malware payload (BazaLoader)", "timestamp": 1634884238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634884238, "uuid": "d7b9dfca-0da3-4b08-bfec-6dc4cb4cb5f8", "comment": "Malware payload (BazaLoader)", "value": "89c7feab515bbfec864010c118692b4c", "object_relation": "md5", "Tag": [ { "name": "64bit", "colour": "#91D6E8", "exportable": true, "hide_tag": false }, { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634884238, "uuid": "bfb7c92c-5fe3-4744-a804-a594e2c07203", "comment": "Malware payload (BazaLoader)", "value": "fd2f1c48403857b80a466cb30f43a3b49e02cd480ee9cf05f6038d4816e2563b", "object_relation": "sha256", "Tag": [ { "name": "64bit", "colour": "#91D6E8", "exportable": true, "hide_tag": false }, { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634884238, "uuid": "bb1924a8-b031-4822-aa78-cf84a1724c7c", "comment": "Malware payload (BazaLoader)", "value": "870e42c0b598c056d846e6d012da536cbdd37680", "object_relation": "sha1", "Tag": [ { "name": "64bit", "colour": "#91D6E8", "exportable": true, "hide_tag": false }, { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634884238, "uuid": "32a47f87-5735-4854-b7a8-e4f589092f2b", "comment": "Malware payload (BazaLoader)", "value": "cf8a5f8e7ca5e6f9a11ff89c655164a3cd15d54d39d03038aaf5ea228aa0b467dc08e01476934bf064192a8cc85989ff", "object_relation": "sha3-384", "Tag": [ { "name": "64bit", "colour": "#91D6E8", "exportable": true, "hide_tag": false }, { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634884238, "uuid": "dd277a00-bae4-474a-8080-64c7dc3c9f94", "value": "T105745BBE848506A8DFEF0BFC4C752EEDB5AC62833A10641CA53A75D21F2377DE44452A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634884238, "uuid": "10976161-800b-43d5-ba14-e0f6c7fbb79c", "value": "8fc81352ac718681e376edb5b78a04b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634884238, "uuid": "2244e76b-1bf3-4ee1-8719-c27416057c04", "value": "6144:E9UhcITop4D8ZLhy/9OB6bkRY1Y4DbA0TKO2p/kiT3KQ0pJCpe:E9VcFOobk6YooOc3K3Cpe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634884238, "uuid": "08a8a638-2214-4b63-abde-7923c3bcb217", "value": 337417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634884238, "uuid": "aed43cf7-3dd4-43b8-9e5c-c1910f2da2cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634884238, "uuid": "9210a2ea-edcb-4046-bde6-398ccd16f2bd", "value": "sgRkrN.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97b67a29-330c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634888971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888971, "uuid": "35cb2ca4-2b79-4776-b9ae-f7fd6544ad08", "comment": "Malware payload", "value": "c3a47b7f4abc8b54ac9864d16ee93132", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888971, "uuid": "c9fa7400-f6f7-4c7b-a7f6-e45c31868e25", "comment": "Malware payload", "value": "fd34a4448804a7805889f781c059be0320c9cfc62ee15350efdae10b6dda669a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888971, "uuid": "7f8d414c-814d-4f18-b847-54bbb4ad2964", "comment": "Malware payload", "value": "fe5e0696ec8fe7892e50d47659283d8620587060", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634888971, "uuid": "e6fe8094-d961-4444-93fa-6ed8e2355594", "comment": "Malware payload", "value": "c258b48dab20623d3cb5cb3ca7b63833ede816d207fde0b5642e4f20c49674fde4273cb0a1cf7044a476a97e5f355ef3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888971, "uuid": "dd45fc9c-304b-43ad-b371-d92e0e3abfd6", "value": "T152853B47BC9150F9C0BAC231CA66D2917631B899073323DB2F60A6B51F72BD85FB9394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888971, "uuid": "28be48db-e92f-48b9-b74f-1b43da7b004a", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888971, "uuid": "8fe79dbb-9dcf-4e82-ac4a-39a485ae9bdc", "value": "49152:m5MGKHrb/T7vO90dL3BmAFd4A64nsfJdnkphyHMg+/HOrb1v:m5e8kphxHY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634888971, "uuid": "27cb2b29-db3d-46c4-ae73-039b901b73b2", "value": 1756384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634888971, "uuid": "e4419f8c-d6af-423e-847b-2cee3cab0e86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634888971, "uuid": "0820ccdc-95fd-4034-a3e5-30f53e7ee1eb", "value": "fd34a4448804a7805889f781c059be0320c9cfc62ee15350efdae10b6dda669a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a1e4c19-3338-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634907712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634907712, "uuid": "4ca91d05-9da0-4175-b55e-e4eff03be339", "comment": "Malware payload (Loki)", "value": "cf88707c2d358eede496b20ecc98a458", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634907712, "uuid": "e33d338b-7ade-445e-b4b3-aa005d386903", "comment": "Malware payload (Loki)", "value": "fdbbc4592fc124696cd71011554e1403c78a0f3a8c6d3451115ca16994bd6453", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634907712, "uuid": "163fe2c9-c71b-49a7-91c0-f79fceb75527", "comment": "Malware payload (Loki)", "value": "2cee25a5528d4334ac372f05f67534145c7e9296", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634907712, "uuid": "4109f8a8-51df-4f10-813d-7ed1e6e2e62e", "comment": "Malware payload (Loki)", "value": "b380e4ed767a4d7c3a0a848e152f4975891ad25ea240ce4639a20377d6bc02781cf72ddb053a80d50195a20fa9c79859", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634907712, "uuid": "9264a189-ab97-4b07-83ce-418a63adde89", "value": "T1B3227D3CC688A916E112187DD01A42F6F76D102AF613B87F214673CD4FA17D387CA6AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634907712, "uuid": "56573d14-cb2e-49d7-9579-19dd4170550e", "value": "192:ScIMmtPWQjG/b+rcafbO+25SEzBC4vNqH9Rcmf5sr:SPXlGT+O+EhlqH15w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634907712, "uuid": "7f27c882-513b-4a9a-828e-d69fcaf5aca6", "value": 10335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634907712, "uuid": "98320908-5e00-43a2-9d26-0311b4bdb348", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634907712, "uuid": "c984851e-5714-4bf5-bc0e-0a369045edbc", "value": "RFQ_INAC_005REQ21.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e6a60ac-3322-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634898217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634898217, "uuid": "80981f9b-4a96-4a00-a854-673889ffcb45", "comment": "Malware payload (AgentTesla)", "value": "1d98b20b0aaff4529830badd847d6f74", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634898217, "uuid": "c6947002-43c9-470a-8df0-1d253a359fa3", "comment": "Malware payload (AgentTesla)", "value": "ff5a9952f9262a760b7e87fa0b9e1d4880b8f7dbc348b4697c340be813882b16", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634898217, "uuid": "efcf047c-ccf1-4285-94d7-8eb5c55da786", "comment": "Malware payload (AgentTesla)", "value": "2fc732c85a9696c926fc3c002e918b34292cacf3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634898217, "uuid": "82f07e58-927f-49de-abcb-189ae06f7990", "comment": "Malware payload (AgentTesla)", "value": "61572a9dd735023be283611bb8a36549e20eeeef6dd502cac8712118e2ea8e34675caa31c956ecb6b9957313f19989f9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634898217, "uuid": "81b58cba-bb6e-4eb7-8015-41f328c3ad86", "value": "T1F6F3480277824113C26A25F842FF9B5823B2D387217BB5592944C17D2DDFECEFA486E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634898217, "uuid": "85977302-91f9-41ec-a43e-9ce5f8a84943", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634898217, "uuid": "d6049de7-dbb4-43a2-b100-b9410e63ecba", "value": "3072:mo1rXZctajMS0h0CTXYmvFMQ4b1Lf7D6wz4oJnnsq2xc150:HrJwS0hYmuQ4pfsoJnnsjxC0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634898217, "uuid": "27aed923-94cb-43f8-9c42-eac365e1396b", "value": 167176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634898217, "uuid": "e2726f24-bc4d-4d65-b0bd-60f842028863", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634898217, "uuid": "f996884a-ca5b-495b-bdf7-9348de6b961a", "value": "Payment Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }