{ "Event": { "published": true, "date": "2021-06-01", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-06-01", "timestamp": 1622592181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "ad03b05e-c08c-4e77-b25a-47ca6a3db904", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05d97d02-c2f1-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622562600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622562600, "uuid": "39b142dd-d3c0-4cd8-b107-111e52d05441", "comment": "Malware payload (AgentTesla)", "value": "b9edb124084bf03c5f23ce9561b95e6c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622562600, "uuid": "c53d2ccd-8642-46b7-aa40-1b4980598fe2", "comment": "Malware payload (AgentTesla)", "value": "001eee16b6b3c7180d2a4277edd84898b6f5406d47b4fa45d013c8c95aa6e7b1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622562600, "uuid": "f89d0d4f-ed20-463f-ad17-8bde63b6a37e", "comment": "Malware payload (AgentTesla)", "value": "7889df2cd0ac983faf149a5e3869754640a6bd2c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622562600, "uuid": "7cb7e4b0-0cd6-4fbd-9ffe-c81a10d249c1", "comment": "Malware payload (AgentTesla)", "value": "494f808532224c2a7182214213c90350460400869cab52fd84eabb671da97e95fc9dc15e06916b2984048f7ee6787457", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622562600, "uuid": "3100c75a-c0e4-44da-98cc-47f7e731b59e", "value": "8515DF2132ADBB39E4B847F84130618017F1BD6A3756D70E6E8172DE1973BB08B91A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622562600, "uuid": "f966b023-db0e-4952-a315-7233971de686", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622562600, "uuid": "df0b3c38-3961-4e4f-82aa-4ebbf3c7c9d9", "value": "12288:rov7Wcuf0Iv3DZ047gyEp5YJUIvbZfqFOPNlXcHQwOb:rE7WcalZW55YJUGbSIsH4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622562600, "uuid": "a2675f8e-2a46-43ee-8187-8666ab5c2626", "value": 940544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622562600, "uuid": "cad43d98-f511-4308-9125-d29245d1d0fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622562600, "uuid": "a7046d2c-4d23-4727-9a9c-86f85aee7dcb", "value": "RE Order Overview.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9066490d-c307-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1622572281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622572281, "uuid": "16c36692-4f65-4161-b053-908938727917", "comment": "Malware payload (Quakbot)", "value": "44db6c24a9450d59686a58b53e25388c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622572281, "uuid": "dcac0dc6-5121-4b65-8bf0-873f55fac8af", "comment": "Malware payload (Quakbot)", "value": "005000bdd51108ad3fd9377efa8d5d01cda64a20efbb93f0b77434169a550044", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622572281, "uuid": "52d6e16d-5e49-4999-8e59-80008cd6ab72", "comment": "Malware payload (Quakbot)", "value": "ae830f033c9e0fcca24e8794ec015b5b2caa62f3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622572281, "uuid": "e0700a3e-bba8-47ed-aedf-214af04b9bf1", "comment": "Malware payload (Quakbot)", "value": "5d6f8a61326e60cd96730dca456c3887d3865594d3825088f3702c84840d7a9b11b861086bd754232eec578f55d188f8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622572281, "uuid": "036b9ebc-bbf6-4111-a502-a0ab8bb0317c", "value": "9E74127FE68559F4C335893ED284A1A0C265F1D040A7B22D07DD3528E35329FBA9E2DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622572281, "uuid": "7730056a-b2f7-4765-8c87-510b440d5656", "value": "6144:DRMlgE+mJ9ABc/nv5k8IKAhBfsOwmLgzLc1pTcsGEdDIPmhsB0vRakfzeQZNe:DRMmEv2Bc/nvm8IKABfsYOmauFy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622572281, "uuid": "0e33bdfb-3301-494f-b9ff-add892ee65b5", "value": 343689, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622572281, "uuid": "6a239e7f-157f-413c-b4d9-f888e370a9bf", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622572281, "uuid": "89502445-8e62-43a4-86ba-4b80c22e8604", "value": "Overdue_Debt_1124459128_06012021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "319fe354-c2ea-11eb-875b-42010a9c0053", "comment": "Malware payload (TrickBot)", "timestamp": 1622559667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622559667, "uuid": "4b31596a-fe9e-436a-a334-ad3ee6dd5cab", "comment": "Malware payload (TrickBot)", "value": "6aa7925f6d03c57b8b7ff2a05f6f06bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622559667, "uuid": "ca0aff47-b2a6-48da-b690-5ef7504bdd63", "comment": "Malware payload (TrickBot)", "value": "01f2c84a70591092d759626abcda56cd89a3f76b51627685df2611e861657a3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622559667, "uuid": "ceffac07-3d33-4449-8356-7ff02a9acc4c", "comment": "Malware payload (TrickBot)", "value": "679fb05317480d4565963a3ce506c8d7b568fc8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622559667, "uuid": "7ceed0c6-4430-4627-a3a2-415cb5772896", "comment": "Malware payload (TrickBot)", "value": "fbfb6e80c03db3de8e5f6d0e6b17bb6fd07bede59caa78e08688cb99ae7c9b472cd799ff7fe588c8a2c55068d7d44b0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622559667, "uuid": "ac3eca97-41f8-491d-ba0f-588cba1ae681", "value": "DAC52F32A360905EC2531AF7E45CCAA9B5A4F0B5551F6DE85FC2E8CFF6342F51EA8810", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622559667, "uuid": "6569132a-ae60-4153-869d-ed536bcac24a", "value": "555560b7871e0ba802f2f6fbf05d9bfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622559667, "uuid": "4ab51230-36e7-43bf-b0e9-f51384bf0842", "value": "49152:m0dZXWp9v+FfUpMz8n+ZuZUB4+0zX9aYUhg+6nXmv632EEZnoZzf0G:xdkKRMRzX9anumy31E+Zz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622559667, "uuid": "aec2f6a9-7436-48ee-9dfb-c2c019281ce2", "value": 2671616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622559667, "uuid": "9a179f13-6fc1-42dc-853a-7bad1d34a1eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622559667, "uuid": "ebe28744-18c1-4344-ada3-1c42b24f124c", "value": "01f2c84a70591092d759626abcda56cd89a3f76b51627685df2611e861657a3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eb76b28-c2b0-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622534751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622534751, "uuid": "de53e5d8-295e-467b-8ae5-d211f1cd9eef", "comment": "Malware payload (AgentTesla)", "value": "154d76c8e25f6677c320b9a8b871c7db", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622534751, "uuid": "baaba666-1221-4ef1-94d4-0e489fec3aa2", "comment": "Malware payload (AgentTesla)", "value": "04538fa6efd1de9c1eb97acc72b3ce8f5625ab5a9e41c7eb7c9d753ccbb7881e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622534751, "uuid": "679576c3-78cc-4a2d-90bc-f90481b1e70a", "comment": "Malware payload (AgentTesla)", "value": "250e0564bc343760d24d8c56c73349f261e6e5a2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622534751, "uuid": "ba1d87fc-f13a-45d0-b44a-ba4be33d18fb", "comment": "Malware payload (AgentTesla)", "value": "71a3ca96f372270fc66154ac98c40c4e758648586c669ed6b3ffed22aed58dfa3805c3c13147353adc83e3c6f6e83387", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622534751, "uuid": "74ef9d24-6ca4-4fce-ac93-42ffca1fd563", "value": "B8157CF4F0589AB2C18DD732CBA1DDAAEB6116FD52034D1D29B9EA8C1B4378F8F48445", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622534751, "uuid": "75a5f2ea-ade7-4d07-b33b-2f8f65aba612", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622534751, "uuid": "5b752029-0977-44c3-a312-b38e75b6515b", "value": "12288:dg8kAJVrhvT3fVGfRQnpvi765MUwCnrfPHSBYuoqmGn+b5K+PHgPEi+EsV5DmPiY:dg8JVrM765x1rf2tv+dPHri+Es/h53", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622534751, "uuid": "9ebb08fd-1b06-47f3-8779-4fb11a1fcef8", "value": 903680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622534751, "uuid": "9578d822-e511-4321-bf79-d21ce817511c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622534751, "uuid": "25c80a16-9c4a-49fd-ab7d-8c6c1cd880ec", "value": "Drawings-ESS316.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a4e5730-c2ce-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622547575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547575, "uuid": "99671baa-b7b6-45b1-836f-ced3ffad1a70", "comment": "Malware payload (Formbook)", "value": "9287afea22d334d75e2780cbee5da87c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547575, "uuid": "4a80df90-cef6-4ba7-be08-d410c6a4b161", "comment": "Malware payload (Formbook)", "value": "0490222a7f96d4d1a414521e4c01a46e3b5cb894061c2f5a3c704b25e01efc58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547575, "uuid": "e78a864f-49d5-4c50-90cc-a4203ac87367", "comment": "Malware payload (Formbook)", "value": "94c763b9a61592a4718873c5f7cbf86135215e34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547575, "uuid": "fb24a0db-252b-441d-85d9-d4cbd55c79b6", "comment": "Malware payload (Formbook)", "value": "be294ef00313f0d17459a6b93a0eba3ec1600e1de41e2b7aa2756bdb18205e0a0d5c19620768c732ab1c5a2d6ad37e3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547575, "uuid": "1d56bf67-ca2f-4693-aeaf-2bef96828cfb", "value": "1605E122319DAFE5D33E83B881E0D47303F1A4A7FB22D63D6F9090D949A1790DB615B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547575, "uuid": "bfb0f37c-e8b8-4a0f-87aa-46fa206ca3d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547575, "uuid": "c134233d-b84c-4503-becf-8549677a897e", "value": "12288:UXtpky6N0yqK5Nl0+meY68oaFA2WuxQ9H4pXAdR8P/BRTKkjOne9rLo1EUiDO32:2tNyqMNl3YoQBxQ9Y9AdRkR2Te5tI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622547575, "uuid": "668bf7b7-1aec-4778-8334-26d0f440dcf8", "value": 855552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622547575, "uuid": "4f6f27d5-66c7-49a0-aed2-43d53a76beaf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547575, "uuid": "b10ec6a7-db85-4472-9972-2a0cbadf7369", "value": "SecuriteInfo.com.Trojan.PackedNET.789.20245.5473", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd59acf0-c2a2-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622529005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529005, "uuid": "2337b640-e756-4f25-bc38-c8017bd75bdf", "comment": "Malware payload (AgentTesla)", "value": "c1ed5c469dd9549dd0c1234463fddc8c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529005, "uuid": "736b6203-2ad3-4a17-90af-6d013e9849e8", "comment": "Malware payload (AgentTesla)", "value": "04adbb54b8390e8f57aedd3d7de29795403173145b7923c3baf183593559cd62", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529005, "uuid": "38c1edfd-63fb-43f9-93c3-4ca714feb57b", "comment": "Malware payload (AgentTesla)", "value": "51acb5b7e1188c942c1f0b34412c46f1f43f3d6f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529005, "uuid": "7e9c0fa2-de98-4c86-96c6-ceb9a0351c41", "comment": "Malware payload (AgentTesla)", "value": "c5ec632e902f26de7053f0cf3cbbc1d66457bf013a38dd94667688ae65da8273d8182caa12f939c0ebe6ef4ee104057d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529005, "uuid": "6845813c-e7ef-426f-b4b3-a9b2f93cb0b1", "value": "B515E131225E9BE4E67DCBF840A4987303F1B987EB11CB3D9EA910991491F4486D27BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529005, "uuid": "921a102f-d6de-4eba-8898-5d4f4dfbc9c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529005, "uuid": "b9afec2c-90d5-4491-8ac8-a1a61a3071da", "value": "12288:oSkll/Cg6Qoib6NCIqQwc+gvuIDsKKqIaPi7/corb0VuPTGCx/LghqvNqTNyR:S5RLfgWzYYF2uPy0pVqRy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529005, "uuid": "e0f005d7-2969-4848-9fda-40c1818752e5", "value": 877568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529005, "uuid": "dbdda68a-67f5-4072-bc62-ac8e70d9281b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529005, "uuid": "05e6bbf2-8de3-4097-a637-8821f45e0154", "value": "img-00454637.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06318b71-c335-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622591806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591806, "uuid": "192bf1ef-4bd2-4eb3-8df4-9996654640ef", "comment": "Malware payload", "value": "736d58bf1d28bf930534dd4e05c4aa9c", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591806, "uuid": "aa037740-4d10-45cf-ad44-a72a96a8bd9b", "comment": "Malware payload", "value": "0585ed374f47d823f8fcbb4054ad06980b1fe89f3fa3484558e7d30f7b6e9597", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591806, "uuid": "282b38de-fe91-4956-8688-9290e16bccae", "comment": "Malware payload", "value": "182a7a2a0f84d11d832bc7b847677f086c2db757", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591806, "uuid": "1d8269c9-6a6a-48a7-af63-5a6d04f1ee36", "comment": "Malware payload", "value": "60716eba814f0eed322eef32d6336eba68136227be411b183050acae73a8a9becdd356854945cd6afb57dd9cbff80cd6", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591806, "uuid": "5c46d48e-5af1-4422-a968-b6a75c5563cc", "value": "EF2121012BC52B54D3738F7204B6F311C632B911DD67DB5D488891CD2CF0618E83AE23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591806, "uuid": "62cf73d1-065a-49ca-95d2-a56a4dc07692", "value": "24:8az2Jm8lTyA6e6+/Cl3Of1jxz04I0W4Rg8gOs76/qqgufm5:86IFltr4lQ9zrImR+OJ/qbufe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622591806, "uuid": "bed2adb9-0204-410f-b997-40554be04cd1", "value": 1396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622591806, "uuid": "e3183558-a3d9-44b4-b72d-eb214ce18f88", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591806, "uuid": "aee32396-1bca-4a36-858e-d2111bcf18b9", "value": "0585ed374f47d823f8fcbb4054ad06980b1fe89f3fa3484558e7d30f7b6e9597.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56b6288d-c2db-11eb-875b-42010a9c0053", "comment": "Malware payload (WSHRAT)", "timestamp": 1622553287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553287, "uuid": "02480451-db1e-40c9-8ff3-a63779fdc3d3", "comment": "Malware payload (WSHRAT)", "value": "9303d47b0cdc56bad7e57515498ed24b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553287, "uuid": "3655c4e7-0cf1-4fc5-bbcd-e527ca655287", "comment": "Malware payload (WSHRAT)", "value": "0696366d915088e8d56571eec4d0e418ebcb41fcc582b888502ae49176dc866c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553287, "uuid": "be4e1c96-c9ea-449a-af79-ed180ad3ea02", "comment": "Malware payload (WSHRAT)", "value": "a848f1251ff0b122d584ed4fefab38e18b390d6e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553287, "uuid": "c3cba273-3de9-4d5f-bef2-0d8683891c8c", "comment": "Malware payload (WSHRAT)", "value": "331f34b786a2ad7814b031f22e118fd01c184f26f456c4e44a76d24e4be0a808b917055dbb5cf2cfa28168f37cc518ca", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553287, "uuid": "55f8832e-fdba-4759-b172-a59f4a5fee36", "value": "1E343C3971AE83F6D06192A13E406F47096FC395D2E1335566FBF4A5A3293C4F2062AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553287, "uuid": "dc270d24-f0a9-44e0-8018-d78e3bbf9d41", "value": "6144:GQOLzwdtcnZpXe/qLqQRq7S6zduSPSj15p/qt:GxzwdtcnZpXe/qLqQRq7S6zduSPSj15u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622553287, "uuid": "7b746581-adb2-4a51-b14a-c3f1b3c55f07", "value": 246142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622553287, "uuid": "23e49985-bb46-4953-a384-3e45996cfb22", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553287, "uuid": "f491a435-5420-4a54-97e2-ffce9da0de9c", "value": "NewOrder.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f2fbd7b-c334-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622591419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591419, "uuid": "65cb0966-246c-46ea-af6f-8c891f30ed25", "comment": "Malware payload", "value": "59b583645978f9ad1d091310afc3c204", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591419, "uuid": "b37d0ffb-1b93-4e4e-a06f-673d34170156", "comment": "Malware payload", "value": "076b5eab4b6a2ba87632218213908d9c2a7684629ecc3f2d30ad3cf23024aa33", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591419, "uuid": "dc028324-4515-455e-b6c4-957f29104a6f", "comment": "Malware payload", "value": "d464bc03fe20c788404abfb1e6ae46e01b440f0c", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591419, "uuid": "2ceb243d-9c19-48bb-949d-3d4e0d56f7a8", "comment": "Malware payload", "value": "68118ac2948f642212cf4a69759e54f9385669e960b50bc78e1dc5e083e603b58415598aada5f23014b533f18a4fbae6", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591419, "uuid": "678983f5-4ea8-4310-985c-c7405ac26f29", "value": "41852301E5EEB45B8FA5467C2B1A644F2D8730BFD029DAA2185E473EF1C4F9B145E0B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591419, "uuid": "f73ca2f0-8b07-41f2-b7a6-00f468ecb391", "value": "24576:GJ6bSYhOnNDdbUB4B9YiI7CvJoNOHy3I9hOTA7iW:W6bb0DoUYqYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622591419, "uuid": "a61d371c-75ab-4a2a-8af3-87fd8262eeeb", "value": 1750794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622591419, "uuid": "050e9ad9-61c7-4903-a7c2-10e9a4152e2e", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591419, "uuid": "0e4e581e-dcab-4746-beb7-459c9a78348e", "value": "076b5eab4b6a2ba87632218213908d9c2a7684629ecc3f2d30ad3cf23024aa33.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbca74d9-c2a2-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622529029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529029, "uuid": "f1dd2210-2f63-42e9-aee3-4f2b420acf4d", "comment": "Malware payload (Formbook)", "value": "d1d8b45be97f99e3f649957003034495", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529029, "uuid": "d1576195-8792-4517-800f-c6a3d0ee13b2", "comment": "Malware payload (Formbook)", "value": "0875979d43fc978bb9d4979c2b38690f86e11075b529d32ec98efa659558477b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529029, "uuid": "716d4310-f035-473a-8f28-707db3ff008c", "comment": "Malware payload (Formbook)", "value": "d21784fbfc59903a5dad86fd461a4e31931bb8b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529029, "uuid": "c2b8ea10-6280-44d1-95cc-633bec24f1b8", "comment": "Malware payload (Formbook)", "value": "d56ab8237876ac3a3b152cd9f1391742faa3d50759514b56ae54364291ce6c5fec8739be44451d5f452592ee16cf8e87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529029, "uuid": "b51e2781-4611-4700-964b-0d1230ccdfde", "value": "E224127B7AC0D4ABD10651B527ABE27CC27A4F06051CA95B2B353FEA3F71281E907643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529029, "uuid": "22edbaf4-d0ae-4aa6-9620-790a38ab4ddf", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529029, "uuid": "2f326eab-a69e-4ca8-adab-25cbc711c9c8", "value": "6144:gQqW+vWV6X6P4Gc1TMk+H9icuufS3M1e1Up:vIWV4Tr1adduufSFUp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529029, "uuid": "91a98c05-6cfe-4870-ac82-9cecdc8489ac", "value": 223004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529029, "uuid": "a5786304-54cb-439b-8739-473a44e3d25f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529029, "uuid": "c9df28b8-5d59-4a42-9d99-a937fd04228e", "value": "Items and Specification Needed for RFQ546092227865431209PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f387b986-c2ce-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622547966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547966, "uuid": "25c695b5-ef13-4eaa-b608-0514b9f4db83", "comment": "Malware payload", "value": "3543c83d2af13da097ca67c6f32bf3e2", "object_relation": "md5", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547966, "uuid": "59efb66d-df83-40dc-84ac-c1116abb9920", "comment": "Malware payload", "value": "08e1c68ed3fcaa544d3fe03a46cb6b964cacd0dfe09b10dd221babf8c84c2429", "object_relation": "sha256", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547966, "uuid": "e4994051-e549-4473-9757-5217f19118d0", "comment": "Malware payload", "value": "59af344e5634f410a84cb525db3d14038cce4cd3", "object_relation": "sha1", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547966, "uuid": "f8180f11-00ad-4169-bc51-ab7216c8c750", "comment": "Malware payload", "value": "e9c85938fdb89c8a5329e2301e9e1d34246bac015fd4b22a5ff7b18c76c85a0df2ff38903cceb3acb526fccaa75e4d12", "object_relation": "sha3-384", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547966, "uuid": "7693d075-9e13-4806-8fc7-632bfec0fd45", "value": "62F3F9CDB692B076837364B5442F110BB13A79ABF84888A8F188D8F57D748691277F7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547966, "uuid": "8b3e9cf3-4301-471f-8f48-5ca6f1c64065", "value": "1536:kMDGM6qMJcMHZCvnc3CWG9MdeW4dHUJAyekX5zwsfb7BGRsAim8TcVEljmComlE5:kMDGM6qMJcMITUJnhx7Bf1wkTCL4Ji", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622547966, "uuid": "3a9cd70c-660e-46cd-85be-03f9c3c0089d", "value": 158072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622547966, "uuid": "8ffca029-2c57-44ea-880d-2b12c027edc9", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547966, "uuid": "5ac1168d-6c92-4e8a-bdd9-b688179d56c4", "value": "08e1c68ed3fcaa544d3fe03a46cb6b964cacd0dfe09b10dd221babf8c84c2429", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f99d190c-c2a2-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1622529079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529079, "uuid": "b5b5c984-6deb-4f06-a15d-564e7087aa59", "comment": "Malware payload (SnakeKeylogger)", "value": "c3a67244e2b9b43be822960b5e03710b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529079, "uuid": "d9afeb84-e36a-479d-a8a2-2c179fa41cd7", "comment": "Malware payload (SnakeKeylogger)", "value": "08f5c6d5d35837ff5025df253c4bdc84bd1f37a463db6ae622fc9eb8d9ca2f46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529079, "uuid": "af388c5d-5ff4-4ad7-ae9b-c1af990216e4", "comment": "Malware payload (SnakeKeylogger)", "value": "6268e5f4084539a15feac3f686292ae7fa07fdf2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529079, "uuid": "c8e8ea67-8f0f-4469-8b0f-750952d475ec", "comment": "Malware payload (SnakeKeylogger)", "value": "c9ee61a890346d93ff52be9ecf53e8c15d787b467a2567f51b6052762994ef31e726f9993ffa8cafdbd86a2de7e440e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529079, "uuid": "ced2260e-6104-48f8-b9e9-337486f3ad99", "value": "87256BFCF598A8B1C1CEC771C6959CAAEB6105FF5243491C0AB9DE8C3A7378A8B4C445", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529079, "uuid": "96bf5e1b-cfc5-402f-b560-4526cea6b7ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529079, "uuid": "05b7644d-8d09-49d5-8fc8-5c16aca97139", "value": "12288:ae5tQ0WrhvTpHpU4ghXONTYbKHhg8sj2zGXPu0Mh4OtwVIhUXvI9WyRPV7:ae5tWrXuTOU+hTMbOtwVlXSWy/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529079, "uuid": "a4eaff83-984e-422c-854c-1995c0e7b343", "value": 976384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529079, "uuid": "3853d966-7e24-4e04-a4fe-b65aef030c82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529079, "uuid": "cfe24ab1-5214-4cee-aef0-1c2aebb89732", "value": "d2CmcgePLtGepBS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72854c41-c302-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622570084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622570084, "uuid": "8ff2311e-663d-44a5-aff8-da9a38fd129a", "comment": "Malware payload (AgentTesla)", "value": "e43c2cd7654ea98d091066336f49341e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622570084, "uuid": "e8a0cdf8-23f0-4557-9a24-f5767b84c928", "comment": "Malware payload (AgentTesla)", "value": "09e134b0c8490f0b7dcdb46da01235383cd74bcb34f3f03cb43e17c1fb751945", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622570084, "uuid": "16b7c467-6dc0-404f-8361-bd2633c27c1e", "comment": "Malware payload (AgentTesla)", "value": "2d2c595e0bcbeb796c9cffac49b2eede08d7b47d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622570084, "uuid": "4cc171e0-7b77-4edb-9804-367700ae656d", "comment": "Malware payload (AgentTesla)", "value": "9f0dc5d9167ead902a703c43a398f268593784c54e0d7a8ea1c7a5b38e2d02672da5d964b9797afbef9c5e2e768600be", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622570084, "uuid": "b68c3639-ef9e-4b41-9187-71722461e656", "value": "F5057DF4F59898B2D24EC732D795ACAEE76206FE1203495C0AA9DACC1F4378E9F4C445", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622570084, "uuid": "3a44e73f-7976-46da-91c5-343ec5b98c84", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622570084, "uuid": "b2f5ba84-ffd5-45cd-bd75-59ca82fe83b9", "value": "12288:JqnYkR0rhvTb1Kphbw2dkOG83RwOP0WCth3ktj5zYAVQlU8SIU:JqnarTwbHa3OP0Jhcz5v/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622570084, "uuid": "43d2d575-44ed-4156-862d-40fea1bbb417", "value": 869888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622570084, "uuid": "20a3e3de-0f4d-4360-9546-d0c6c73dbe39", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622570084, "uuid": "dd3eec76-25f7-45ab-8a2d-f690cbef86bc", "value": "New Order List.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8b13c8a-c2d5-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622550901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622550901, "uuid": "473fd516-3603-4776-85e4-35dd3dd84f51", "comment": "Malware payload (AgentTesla)", "value": "51dbb8d549a3f5e08645d8f597067191", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622550901, "uuid": "296ba4f0-41a3-4aad-9e27-0784a5a71921", "comment": "Malware payload (AgentTesla)", "value": "09f4064dd3b5bd284fc8b32cb82efba6a81105df429ed2f3952defc51b292054", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622550901, "uuid": "0736b66f-0b16-4a95-9d7a-812ee2e15e3b", "comment": "Malware payload (AgentTesla)", "value": "f93e724eca4f7511ed5732a7c91e923239d2b648", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622550901, "uuid": "fd66f97e-c744-4577-8737-1c72831e8598", "comment": "Malware payload (AgentTesla)", "value": "e798e0c2c218e2643f30b581126363372961ea77767262227c4c7ed4e8f5e8cbcdb9c8ebe3aa95b11a9e3550f7087bfc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622550901, "uuid": "a51b0f4f-da75-4adb-9f85-6f3eaff8c9b7", "value": "7A154A2439FA501AB1B3FFA98BE474D6DA6FBB733B06945D10A003864723A42DDC153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622550901, "uuid": "b0279849-9772-46c4-90d8-320d6039e5ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622550901, "uuid": "cf1c09fd-be63-43d9-b1b9-41b3a2f8bd1a", "value": "12288:eo01v63ZZQp2O6vdwDxuJGrnseRmN3OnFscYIudI/cNecGAOM0xqmRSgPsn+KZz5:n46ljDCP80xihJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622550901, "uuid": "467ef9f1-bb0d-4b39-82d9-84bba4c47358", "value": 894976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622550901, "uuid": "351872e4-71a6-43e6-ac2c-0d1daf9815d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622550901, "uuid": "1c51b44f-370d-480c-96d2-9d1ae071e361", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d05c17e3-c2da-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622553061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553061, "uuid": "9a678c09-2310-486b-8876-d85a8eaf9a9a", "comment": "Malware payload", "value": "4f9bf95254ac818ee13e8c4915a23aa0", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553061, "uuid": "3fe23752-13c1-4a6b-a6f7-e57441e75759", "comment": "Malware payload", "value": "0a73a7cad42160b50b6ce1a88d9fadbc2761e6009b1672e884abab11d32eb94a", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553061, "uuid": "2fee8339-5057-4487-8fb7-d012e872cf81", "comment": "Malware payload", "value": "ef179f649207242a908fbb60c22dd991fe75351b", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553061, "uuid": "24924625-cb16-443f-99a2-e3fb150dfc84", "comment": "Malware payload", "value": "21cee0d4e2deed469b1f418d77c4ec16e04d959064d8a0e9dc06c16d52e243f0ee7ab5b1d952da35d9a7198f748746cd", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553061, "uuid": "cb51258a-5faf-43e3-a859-4d50ed7c7ee8", "value": "187568F0AD01D4C1F57E5B6AF2FD3A48A1343217EBC94A4A00E7E5651EF6A11B90ECC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553061, "uuid": "bea14a99-d647-457b-b66e-2c66677b53e8", "value": "12288:0sdENjr4B5CITO/WROLgcba/8maJXM8WAb6C7v5UPs:zdWnK596WRaS8mmc6bH7BUU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622553061, "uuid": "97f1f7e3-71d8-45b3-b828-a1334f45baa1", "value": 1605789, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622553061, "uuid": "e94ca985-d941-4d0a-8b21-b9dabb1912e9", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553061, "uuid": "760651db-e36b-4cf4-915d-45254a4c6829", "value": "4f9bf95254ac818ee13e8c4915a23aa0.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e5520e8-c333-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622591122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591122, "uuid": "606bd5ac-09e4-4a7c-af78-6f931621f858", "comment": "Malware payload", "value": "e9594890e33b653eb6a8b4c87f6b32a8", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "BoomBox", "colour": "#3AA072", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591122, "uuid": "bafc43f9-5bbc-4097-90c7-7dc83f17430f", "comment": "Malware payload", "value": "0acb884f2f4cfa75b726cb8290b20328c8ddbcd49f95a1d761b7d131b95bafec", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "BoomBox", "colour": "#3AA072", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591122, "uuid": "8255e9e4-1874-4407-a8b7-336ec9b077a0", "comment": "Malware payload", "value": "5fb5074d1036245ab7fb936a83556a2d5862328c", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "BoomBox", "colour": "#3AA072", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591122, "uuid": "2b0d8eba-ebef-42a8-9d32-94870309e7ed", "comment": "Malware payload", "value": "7996a1b49c8db746c4edd9d26df01f78bb7945c7acc6a79338f248b9601176117e5d46e9fd3aac55e8be8fb2df2382ea", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "BoomBox", "colour": "#3AA072", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591122, "uuid": "ac4f0656-9ac7-4a91-8551-8e05152cdb35", "value": "AA523C05BBEC4725E1FF4BB998F296180638FB164922DF6D2CC4550FAC337448A62B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591122, "uuid": "93c23b52-7557-499d-b098-f88621a0f346", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591122, "uuid": "9034236b-1aae-4856-bb31-a59aedf7d065", "value": "192:MBYCN8pSCROuN3Zqajxm3Cdia6difDLeqCtkMBpFEtKJ7Cp+34f:RZMW83CdiaoweqQkMBG+o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622591122, "uuid": "ce080576-e001-44e1-9c53-dfeb28b51c7e", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622591122, "uuid": "ded08bb0-c695-49a5-9abb-ecd1ff77e2d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591122, "uuid": "4e0432dd-cd90-40d8-8a90-c5cc4bdf4646", "value": "0acb884f2f4cfa75b726cb8290b20328c8ddbcd49f95a1d761b7d131b95bafec.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "951f75e2-c2d2-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622549526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622549526, "uuid": "c2ad868a-70ba-4d0b-a8b0-5a554c2462ff", "comment": "Malware payload (RedLineStealer)", "value": "a5e4c9084b0f9840c41da314377970c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622549526, "uuid": "002f8bef-3611-4ed9-8327-e4ff5ef06ccf", "comment": "Malware payload (RedLineStealer)", "value": "0acd7696d5dc482aa3b4110fd60c6b9f2df88545f6cf9986714a984673965249", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622549526, "uuid": "ddaf3c73-622e-4458-b2f8-ed81e52eb194", "comment": "Malware payload (RedLineStealer)", "value": "ff54ec32fdc8d53b281e4ecf6fb38df83eb44372", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622549526, "uuid": "20195719-4bb3-40bb-a134-196a2aead319", "comment": "Malware payload (RedLineStealer)", "value": "b676c37e292cf30050a2f1d0425893bbbf833f2bc41996ed139568fdcf2317d9b1288a1541f5533da0eda9833de9aa5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622549526, "uuid": "eacbccff-2478-4e73-ab03-6b6dba32eeb2", "value": "C7849E10F690D035F1F332B45AB792BDA62EBDA1EB6450CF62C46AE956346E0EC31707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622549526, "uuid": "37ae7131-8a68-4ece-9a6e-d4c637a17e56", "value": "84a7eb4192b6bf7f0b88f528d598a47f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622549526, "uuid": "42b34014-2702-42ea-90d8-150f5444d412", "value": "6144:s4OL82g8RUPrtYZn9i4SKlP8K+hvNOWbrpjaFFlA8ebCWTSuvA:s4OwgUDuZn9OKiKINmFlA8exZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622549526, "uuid": "d7961fcb-6fa0-48f0-9327-4991075f13c1", "value": 397824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622549526, "uuid": "1d535497-c24a-4ea6-9a5b-a54cee1b058d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622549526, "uuid": "65c787b6-1f2d-4fab-b906-87b36a1bd663", "value": "a5e4c9084b0f9840c41da314377970c4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec54feda-c2bd-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1622540653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622540653, "uuid": "a82b894c-a88f-4725-acaa-ea4e860da16a", "comment": "Malware payload (NanoCore)", "value": "8d980bcf7984f90954e920f15709dc00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622540653, "uuid": "acf26d7d-eed9-4f59-9c78-929f21930490", "comment": "Malware payload (NanoCore)", "value": "0be86bf8628ff23ecb9940250857734126f7191dfa40cff34107a346748482e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622540653, "uuid": "3751d19d-b1f8-4695-9b1c-cb8ea2c87520", "comment": "Malware payload (NanoCore)", "value": "438e65e16410bdd8cc242324e3c761724b528ba5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622540653, "uuid": "e9e6f6a7-8004-43b9-9ccd-436f3c22a92a", "comment": "Malware payload (NanoCore)", "value": "c9c00d6eb99d19dba0a5acf876c150d443a439b1bbb6308b96a113fcfe431666eba075235effbab36cdcbdeecad6a573", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622540653, "uuid": "b3025e7b-17b7-4f50-8195-bd32e94f52a4", "value": "20154AAC325075EFC867CC36C9A82C64EA6074BB570BD207A01716ED9A1DA9BDF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622540653, "uuid": "563f4438-bcc8-47ce-802c-596334836cc6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622540653, "uuid": "ba1e0451-fb6e-4c75-be4e-48ee969f1d79", "value": "12288:ypoBdfcHjhwNQ8nXs8mhbc1/X487L/nhiPub1lGyJHNTI9Bax4xwd7n7QghrjEIb:YoBdfcHqXdH1/X53nhlrT4ax4EMS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622540653, "uuid": "5c3b9109-8d03-4855-bdd3-1703eee35438", "value": 901120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622540653, "uuid": "644c3a7e-f0b6-459b-a471-772d8ae69bf3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622540653, "uuid": "f5acc731-12c2-494b-9b27-7ac4c2dc3830", "value": "Asif Professional CV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1e3cb90-c2a2-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1622529012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529012, "uuid": "baa6d867-2053-493c-a001-c7c8a436fc08", "comment": "Malware payload (SnakeKeylogger)", "value": "92f17f68744a336e76045ea9b72e8e54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529012, "uuid": "127620ee-9482-4257-97a3-42256c724713", "comment": "Malware payload (SnakeKeylogger)", "value": "0d8c817d2d6d9def564058b156fcf2b24896aeeeed1970f7fc67866415079de6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529012, "uuid": "0dbe960b-24a4-4b7b-9c9f-642335399c43", "comment": "Malware payload (SnakeKeylogger)", "value": "9934cc38452e5f2d325dd5e598142a4479f09733", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529012, "uuid": "72e0040a-01ad-4de0-8307-7639d66539d3", "comment": "Malware payload (SnakeKeylogger)", "value": "734afa091ade8305dd25dbbbc83cc512456911a79878a0338eda11fb30f4242cc0a741da8081b70b9e4772778e3f0559", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529012, "uuid": "ca5c3057-c8bb-42ea-af35-47bf857d74ee", "value": "5924F146B70AD152C5D68EFAEEC2F5F200B59F502D978C5B54083F8F72733899B42A16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529012, "uuid": "eb7773cb-b5fe-447e-96f7-ccbc933505d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529012, "uuid": "2bd4dad6-433c-4577-80df-3fbba0995471", "value": "3072:02anzmsf7780tmjcZYjg53cgGAUk24UHr9g/dseKp3KP76mk5cZNo2yeSGW/pW/L:izTiIYEsg924UH4oKPfZUEL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529012, "uuid": "7b6689f4-7e9c-44de-b27e-8d498a2bad70", "value": 216208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529012, "uuid": "1c1b6ece-1bdd-4d15-bde5-4ca7342ef0b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529012, "uuid": "479e9075-fd60-4186-a348-7bb7c2e02cf7", "value": "92f17f68744a336e76045ea9b72e8e54.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "369fd20c-c2a0-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622527893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622527893, "uuid": "25247356-6eff-46ba-85b9-0e4c76e4d3b7", "comment": "Malware payload (RedLineStealer)", "value": "ab6b048b830303695154f9ec9b169c20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622527893, "uuid": "36d41150-275c-4a37-9e55-ce1ed0de5bd8", "comment": "Malware payload (RedLineStealer)", "value": "0eb930799c4e9edafc01531441539a136e4510177ba8c934711c7743f1238f72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622527893, "uuid": "8d3a1b02-bd47-4909-b35f-22589483ed0d", "comment": "Malware payload (RedLineStealer)", "value": "5f6189d093e7003b20764184b4080965e9e115cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622527893, "uuid": "23099f1b-1b3b-4a84-852b-6a60931c1d99", "comment": "Malware payload (RedLineStealer)", "value": "5df6f08fb6c1e618037957bb5ae082902472d8bf9153553dcf21e59bfad8f77a55abc8243c941a377f54b2e893c4168d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622527893, "uuid": "ed630d09-4877-47fa-ab81-3d50e0cdbebb", "value": "C1849E00E6A0D035F5F336F44ABB92BDA52DBDA1E76450CF52D4AAEA57356E0AC30307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622527893, "uuid": "c1e7253f-1235-4015-b3f3-90addcc9e9f0", "value": "2aa777536af73fd51efa6e88134a6411", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622527893, "uuid": "aa589861-7c79-486a-a672-f2e6a0e1180d", "value": "6144:NHzOCAStdBLK+CERxbivjVYrmlIx4++cJJPlV9KJlv078Jw:NHzOHStdBOvER9ivCqIxmuXcvjJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622527893, "uuid": "12f9b743-819d-4a37-a8f3-42c4ac5642ec", "value": 400896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622527893, "uuid": "54fa513e-47ac-4cad-9829-1a84d8aa5835", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622527893, "uuid": "07008108-d400-427b-85a7-5f545cbc0d95", "value": "ab6b048b830303695154f9ec9b169c20.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc788c17-c2a2-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622529003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529003, "uuid": "8a9115f4-c902-41f1-bd58-3da318fd0a58", "comment": "Malware payload", "value": "3241493e38ba11393845d427a83d9a56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529003, "uuid": "a04ab3ce-88bf-46dd-972d-d449a3d15263", "comment": "Malware payload", "value": "0fb7c0f2f50e8e8cfdefb5e916fc13158f525c0ac0d8cf7ce0e3a477128f9e9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529003, "uuid": "1b890375-29f6-44ed-b239-9cc1c3f01665", "comment": "Malware payload", "value": "6e3a1efdc08183104354688ca4130484a4cfc807", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529003, "uuid": "e7c3bbcb-82ea-478d-a9c4-be89da714d3b", "comment": "Malware payload", "value": "e10c3f9504d1b8dcf540efa71e09f4113f2ae5eaa916213545e7dca788227c16eebcdb4565b52c9885f6a52650433882", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529003, "uuid": "f5892a01-2a41-469c-8e04-a6da6bd680e8", "value": "A0C4B765DAEACCFEC072143C6030A65108A6EFC65703E7D8A46DBD39DC34743B69993A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529003, "uuid": "e40b23cc-aa05-4b96-8b5f-05ac4aef0d37", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529003, "uuid": "c8b1c286-3572-4a62-9a54-4f87ff2c9632", "value": "6144:foP1SMKzgHm6B9ghYNVyAfx1hOHi5ikii9iiigiiixiiiixiiiiaiiiiidiiiii2:8p/HmM2WNXJf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529003, "uuid": "3ea89a70-8fba-4b95-85b9-1c6d215791dc", "value": 562688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529003, "uuid": "0b09eafd-063d-4610-9fa3-7b4cc32df641", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529003, "uuid": "d142a51c-3ab0-4df4-92f9-19141fdf4152", "value": "ConsoleApp3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0252653c-c2cf-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622547991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547991, "uuid": "c68e8d67-7aa1-461d-82d5-e2df6ed492c5", "comment": "Malware payload", "value": "0f803ce700a4fcd02ea7abeb43c4cd53", "object_relation": "md5", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547991, "uuid": "a9cbd49f-be89-4d84-8d49-2bf815cd9a56", "comment": "Malware payload", "value": "0fe5a7d7d6a2c077b4b641f4d2077f2fa476a2317283323801bed7a7a6770906", "object_relation": "sha256", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547991, "uuid": "92eeac08-4a1d-4599-96c9-7a82b3b4bb33", "comment": "Malware payload", "value": "67365c8e4bd1fc1e5c6ac10b46b13aca918ab8b3", "object_relation": "sha1", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547991, "uuid": "a9ed0924-f52b-4de3-9d11-64df43ee1a49", "comment": "Malware payload", "value": "9b1849ad9c3266cb35115c3b2b7311fd84498186bf74932470e81cc73bbd50b5a48cd9a3e500818c27e38d4bcc208ab3", "object_relation": "sha3-384", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547991, "uuid": "add78ee3-fc3d-40f1-8a52-2bca4f0f91e0", "value": "95217441B4048CFABE42ED4765CA3C3695B6003F5C3E5324132884BA4877E3DA5C74D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547991, "uuid": "c3a6e779-9480-4c4a-abba-1ddd7dabef60", "value": "24:mdfz1RoYFZl8V7OOMm8V7LOsTjMtXiOiP659XqTG7ro5lKuPxNYh+YAq+NYfwQcB:mB1KYFZl8TMm80s3qyOiP6LkGXZuPxNN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622547991, "uuid": "782be0f5-dabd-4b05-9d59-a5cda38046bf", "value": 1188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622547991, "uuid": "32a29ffb-76e0-424c-b8e4-e102ac3d72f0", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547991, "uuid": "14b1dffc-e90d-444c-9ba5-99ee8604ded7", "value": "0fe5a7d7d6a2c077b4b641f4d2077f2fa476a2317283323801bed7a7a6770906", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b3554a8-c314-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622577641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622577641, "uuid": "8c97a844-7b0e-424d-a7e5-db57ae8a584d", "comment": "Malware payload", "value": "a6a75fa456d47f41586a77e7d4880841", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622577641, "uuid": "afe21e30-880e-41fd-8b03-1c8ea6bf29cf", "comment": "Malware payload", "value": "10893a950a2ce7a51e5a7c75f7b5a0dc69dd32fe8d6d25f5a1d1c2936bea17ca", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622577641, "uuid": "b10dfcb7-bc7e-447d-8269-6283aa974f87", "comment": "Malware payload", "value": "fbcedbd83c7053d1d760643cabe03ede15df2539", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622577641, "uuid": "ad578524-6ef6-462e-88a2-744b8b135c45", "comment": "Malware payload", "value": "b83e1c9c376bef86f94b9d6c979e182cbb95bbf8ea74750d2d943b891ae264415fc010bceb16f9ef94003ddca3d2f3ca", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622577641, "uuid": "170dc9b5-7a87-41d5-af7f-0f3b0673f4c6", "value": "0C933A17B71D0B93C49B59F12CFB3FF18B69A5E023A2A181711DAFD05772AB02412FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622577641, "uuid": "03dffd6d-bf79-4e84-b132-2e07d1da85ac", "value": "1536:MVSysAW8yTHYzN2ccPB38JaRKfq8xMEmVUVqp/+5fb/e:MMJAJe4tcPB31sBaEmVUVqpG5fb/e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622577641, "uuid": "7391097f-4689-4c01-8f04-35d5a3b76d6b", "value": 90337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622577641, "uuid": "99ec79d2-e7ed-4891-8057-2f148c95dfca", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622577641, "uuid": "5be9bde9-6f56-42be-96ac-dc44d19a2185", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9d14635-c2a7-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1622531227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622531227, "uuid": "c6c6e06e-008e-4826-b523-4fb94453a971", "comment": "Malware payload (GuLoader)", "value": "89661f2576e74a1fd0b6c851987498a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622531227, "uuid": "9371b338-37f1-4b51-b811-baeedfaa5d2d", "comment": "Malware payload (GuLoader)", "value": "10b42560903d6d2fe79b9450f56dae0d2a19960cda5d53b8b70b7f7a075bb2ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622531227, "uuid": "b85de5b0-ce58-4445-b0f4-cc5d92e6f288", "comment": "Malware payload (GuLoader)", "value": "f06de0148eb1152b39b42675cc96de7a45c53b07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622531227, "uuid": "edbe90fe-bc18-4bfa-a5e3-162269cd24a0", "comment": "Malware payload (GuLoader)", "value": "eafb78f7525fff274fe63c9ee4c50059461130c588a531369bf43daa7531480afb942d340a977dc40baa7cd75c916f4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622531227, "uuid": "e4fdc7b4-cd49-480f-abc2-eb6e6860d53b", "value": "E1A38332F210B369F54A83B02618AB5F15346F73444BED06F781AF1AE9747D370E8A96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622531227, "uuid": "faadf819-5689-4009-8645-1c6a9474e5fc", "value": "42cd9a917403a1f7a071034a21284723", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622531227, "uuid": "eab7d65e-8ed5-4ad9-be22-d5e5a2d308c2", "value": "768:NKSFLXvf5iNnd4slA+rrwNVCbPQ6ENdj9wIyRQBr2nY7YdomOSgmfbkBWfzvhCJT:rL/f5iwsTwNVCTsNmnY7YdISg/ap0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622531227, "uuid": "e640f9b8-28d7-4484-9b74-2e978f1369d9", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622531227, "uuid": "2080f077-95eb-4376-9281-169b205637c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622531227, "uuid": "a7fec0b2-ad87-4bb0-9472-017dea8f3b1e", "value": "89661f2576e74a1fd0b6c851987498a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a969c8ee-c2aa-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1622532380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622532380, "uuid": "bb166b62-d5f6-42d7-8d6e-0fb168c297f8", "comment": "Malware payload (RaccoonStealer)", "value": "ca365c8eeff08380abff016ba3ce6886", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622532380, "uuid": "681692bf-dcde-4700-8777-cd80b214767d", "comment": "Malware payload (RaccoonStealer)", "value": "127e3090f7a0985c64b81ce3d942d7d5c864a00777b00822e4b03080fb049488", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622532380, "uuid": "b6d62328-4f92-45a5-a394-7e91beda5e9c", "comment": "Malware payload (RaccoonStealer)", "value": "496f2161de557d881ec8d5ec680e2533b18b9946", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622532380, "uuid": "fd1ce1a2-af30-463f-93ab-175c785fca09", "comment": "Malware payload (RaccoonStealer)", "value": "641839f709b8cfbc0daf44d3255da66f5ad243965c1248608fe7055837ca1c2b0edfc451cc522dd04b593ae2f605ec44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622532380, "uuid": "9819aeba-cb36-4223-84bf-f71e1617837f", "value": "EB95BE8921B58936D3A4977086D2845B4F03F9237023FB5E3F99E724366217A2B513EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622532380, "uuid": "68739e92-79a1-44d7-a86a-b711968a2d5d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622532380, "uuid": "30ed97d4-fba0-4960-bcf0-94c54b85a428", "value": "24576:uD72Tb85nVHU2W/gM4udgg8vcL+qwpIW3QFkNcAdJQQwIiXkV8el1Ty:2y/s5U28gMBdV8vciDOyQG/9wIiXkfm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622532380, "uuid": "63e32760-c9bf-4960-8679-9dfa1827b65a", "value": 2060512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622532380, "uuid": "09c56970-a0a6-4bf1-81f3-9b7baf1bfbf0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622532380, "uuid": "f270bc5c-7a53-4ff1-9f9b-66532c929c70", "value": "CA365C8EEFF08380ABFF016BA3CE6886.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ef8d1b7-c298-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1622524578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622524578, "uuid": "d9c97831-96a4-49b3-acac-ed4b47f23cfd", "comment": "Malware payload (CryptBot)", "value": "58fe2c2a4e7bdf9a1ea96b7e9242fcf1", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622524578, "uuid": "71c20220-2858-441d-bf71-78eaab1d3017", "comment": "Malware payload (CryptBot)", "value": "1298b62fc3c9668e95a2d8af5f3c227afa87083c3e614d48d01d01509316c3ec", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622524578, "uuid": "faa9c769-106b-4ed8-849d-8c0fc3ccb995", "comment": "Malware payload (CryptBot)", "value": "660d25a37871b8e05ded2e0ed2c3b0173d2948bb", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622524578, "uuid": "dece5820-d5a7-4cfa-9b7f-b2fee6262903", "comment": "Malware payload (CryptBot)", "value": "71f905310d7e5a611404dfa0b1dbedaa9d6d5476cf2f7fc107c8ad0ac1b090988193d265e1db3c2d580257bbe5d735f4", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622524578, "uuid": "04d4b0d7-0590-4842-a571-2f8462db0c60", "value": "C805F100B790C034F1F616F9C9B69A68592D7D51AB6849CB1FC527EE1AB96E0BC30F07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622524578, "uuid": "6fe4d320-7cd3-4c57-80cb-e48a7dec932e", "value": "43e89f03c67c1058eacd36c423bbf2f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622524578, "uuid": "1bde1477-8e82-4c62-8b97-c98b20f793e2", "value": "24576:NAd1fMlyHXTBn5pI+/rTGtwcq1JlOf1q:NZIn5pR/rfcq1Jwf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622524578, "uuid": "a6fb9cd4-d697-4b88-823e-db1eee78797a", "value": 821248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622524578, "uuid": "258d27fd-7d55-4232-b7cb-e29bd4c60a99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622524578, "uuid": "8fa8b725-2da7-453f-b3fd-0ad3c9287681", "value": "1298b62fc3c9668e95a2d8af5f3c227afa87083c3e614.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f7509d3-c2d2-11eb-875b-42010a9c0053", "comment": "Malware payload (AZORult)", "timestamp": 1622549543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622549543, "uuid": "ce4cf70b-2ec7-4280-a075-1ccf5e696177", "comment": "Malware payload (AZORult)", "value": "20ef2306d38158c129aa5e01e2107bdc", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622549543, "uuid": "fedf41aa-c7da-4ce0-921a-67aeec5ab203", "comment": "Malware payload (AZORult)", "value": "12aad0b7f750d5fd81cf6e33c3024f81ad82c0a179d15e0c1cae207e5df1a02f", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622549543, "uuid": "0aad0b22-73d6-426a-b987-29eaf0e10459", "comment": "Malware payload (AZORult)", "value": "71588e0a6f1d40f09f45f3abf468f99d5f3ca0fe", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622549543, "uuid": "dacb1354-0ec4-4dcd-85aa-f4a2d49839c9", "comment": "Malware payload (AZORult)", "value": "e00665cd0ecb7dcd8c74a49903fad85f08a7138a225e96d5ec4c38ccb8673f6cfe136368f48cd760b47d225159642f6d", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622549543, "uuid": "879dc7ee-68b9-47a8-9b8b-c6530d425b87", "value": "76E51A61A4BF26EC776C4BE058A9E0EC0557E8F5C8BC79900712145A0F96B44DBBCB3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622549543, "uuid": "dc2eddde-c67e-4fa4-afee-5e11df3a871f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622549543, "uuid": "139b6afe-c2c8-4cce-8f93-de7af475ee53", "value": "3072:/oLgkpf9L3RncoCbzDmv5rRhj7SCpM9a3GL0FGuMxtuWgJr8ISShu693vENl8ljc:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622549543, "uuid": "94044629-d66a-4bcc-a190-cc101b865b55", "value": 3173376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622549543, "uuid": "f71ffe7e-5094-45ae-aed4-1768919fd530", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622549543, "uuid": "d48e8444-f442-4636-b4df-c6426fb43ac5", "value": "inv062021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5982fd0-c2a2-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1622529018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529018, "uuid": "141aadab-41a2-4beb-bc75-eb9a6ac3606f", "comment": "Malware payload (ArkeiStealer)", "value": "bf2b51371b97a9f07eb561d56898d17a", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529018, "uuid": "67827a6c-79a3-4b1c-b419-63b93d6d28ba", "comment": "Malware payload (ArkeiStealer)", "value": "130789a4c8ec23403e33a0ef0de7f9a67cd6749063e5b8f99f1d0e936f41891f", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529018, "uuid": "86968906-036b-4195-8d7c-1cc1f67d24c5", "comment": "Malware payload (ArkeiStealer)", "value": "23213acdf87702bd44fe8e343914d356e820abb8", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529018, "uuid": "37ee3ca3-696c-4f21-ba01-793905aefaf5", "comment": "Malware payload (ArkeiStealer)", "value": "2b8943b8fba58345533cbec7fd72734c64c813ff7389ce84c120341f06505b68f50dcffdd2589c23d0c395b8e1ac4928", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529018, "uuid": "08155954-36d2-4a3f-a6de-29e925642c22", "value": "BE05F100A790E030F5F336F559BB817DA92E7D92EB6850CF12D4AAEE66346D0AC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529018, "uuid": "bf58fe34-e142-422c-aeec-aac8ed8f770a", "value": "ddfa50a7d17fa7288028195442f05ca4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529018, "uuid": "26a19384-758e-4e0d-9de9-dc1acf13617a", "value": "24576:FbYB6i3bdL2EnNn/GTtO3elgFli7o1uNM/l:Fa9uTtO3e4i7oQW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529018, "uuid": "a60196e7-e9cc-4293-bbc3-759ba6ba8ee0", "value": 864768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529018, "uuid": "16acdeb9-af2f-4f15-b36f-dff5f14bc887", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529018, "uuid": "1f46edf1-1c27-4612-8da9-e73d947ca73a", "value": "bf2b51371b97a9f07eb561d56898d17a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "550299a0-c335-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622591939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591939, "uuid": "f04927db-6341-48e4-a9cf-f6ff6c685e8f", "comment": "Malware payload", "value": "a707f6bd9c96423619366b02073f0923", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "NativeZone", "colour": "#3FF26C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591939, "uuid": "1dec3094-acb1-4efb-a3ed-547207ae3677", "comment": "Malware payload", "value": "136f4083b67bc8dc999eb15bb83042aeb01791fc0b20b5683af6b4ddcf0bbc7d", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "NativeZone", "colour": "#3FF26C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591939, "uuid": "d4f55b57-34c0-4668-8308-97d7d56655a7", "comment": "Malware payload", "value": "91f9ee61662317e13fd8a73506dd7cd780c417dc", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "NativeZone", "colour": "#3FF26C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591939, "uuid": "f2f56c31-dd14-40fa-af26-9020f259fe06", "comment": "Malware payload", "value": "5461f46f13a39cb8de67d1055dd8060daaa9072b0385f313f2b6a819e2b5b49a0c9a7c42544345ce8964e86bc8537886", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "NativeZone", "colour": "#3FF26C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591939, "uuid": "3e652fe9-4c93-45ee-8992-1e008db06e29", "value": "5B938D4071C1C072E9FE1D3C0570E6A19B3E7930DE90ADAB678416399E706D1DE38E7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591939, "uuid": "b022c603-b353-4a7b-b0bb-71012dc30507", "value": "f200d189ba41ff20937aa94ea2778111", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591939, "uuid": "bd85abfa-bc4b-42e3-9118-cd82db568d26", "value": "1536:RlBIOoEPFaLzvPUwoKDK47mRs7MULXynNyoA4hSxuvFmsWzcdLCwqB:VIOoEwvvPUlKDK0mRsrLXy8sSxu7LCb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622591939, "uuid": "55abd7b8-0e0a-4d57-8975-b00025f09cbb", "value": 95248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622591939, "uuid": "18e2c93f-9c82-4773-ba5b-44f740e98e51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591939, "uuid": "7bc98485-12a7-4193-8cb7-dd7269bd0e10", "value": "136f4083b67bc8dc999eb15bb83042aeb01791fc0b20b5683af6b4ddcf0bbc7d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30238ef4-c2d4-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1622550216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622550216, "uuid": "70fde113-94e8-43cd-b3fb-b7634baf1112", "comment": "Malware payload (Loki)", "value": "8ac9e272b1df5061daa9455ff0230c36", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622550216, "uuid": "7d526ee2-bed0-4785-83da-1bb6f64cb223", "comment": "Malware payload (Loki)", "value": "13bda2fab9d78868f30a0bb704eaa1db2e0dacfe11bd3dcd348290bfc67fe40c", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622550216, "uuid": "6efef531-faae-484e-a06b-a6ed5d6b7dc9", "comment": "Malware payload (Loki)", "value": "f4e3b490779151aa5477a5a1d0a9f296c8f6c68b", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622550216, "uuid": "303f81c4-dd51-4c36-b274-beb641dffb1b", "comment": "Malware payload (Loki)", "value": "fe0ece4e957361526f4273aabac50cecd74b23a021a7afc5ffe5089ec58a32a47633c8c3c3354d021c2da014043787e0", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622550216, "uuid": "014bd33c-6d41-4e2f-8cef-9f5c2ca4ba55", "value": "B154A645165BC2D5F19A4588386CF722087A747B7BC88A361237430AEBDED4A1DCFB8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622550216, "uuid": "7725670e-628e-4e9c-a55d-f479b2850c8c", "value": "6144:9laTYe1Utx7ccUWqPcQtU78uNUysckPuILJGAm8Eu0tga+MLB:9laTYeqtx7cc3Okgu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622550216, "uuid": "347bbef9-ff13-4dd5-b9cd-0fedb826b589", "value": 300877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622550216, "uuid": "0f93dc60-af1d-48e5-b58b-0e0e7787e969", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622550216, "uuid": "38c4c8e4-d53f-4b8b-a4b8-74eb9bf64277", "value": "1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d33757a3-c2c5-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622544047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622544047, "uuid": "cd5d5426-e1f3-4113-a2de-7afeca81a8c8", "comment": "Malware payload (Formbook)", "value": "da54b52dce53e334acd0fa07477eb0a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622544047, "uuid": "dfcae7bf-98db-4f05-ba34-dd67151dcb9b", "comment": "Malware payload (Formbook)", "value": "146f5b2544e98818cbe9813068d6f08037df0e29a3b83d4d2fce3e1bfc444f2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622544047, "uuid": "fd241a83-cfa6-4892-a93c-6d0470ea79fa", "comment": "Malware payload (Formbook)", "value": "306672db60b888aa6930cbe7b9ad8ef73dedd5a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622544047, "uuid": "fc1de82c-bded-4d53-a567-d997d41ce33b", "comment": "Malware payload (Formbook)", "value": "3d637eeab03ea45e0f2b38d723da1dac631cc813fb6eed791f1aa9515e6f2614ecb2d33cb485fede0ed665f3b81fc86a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622544047, "uuid": "4ff56220-467b-4bb9-8bdf-4b2a445782d0", "value": "1B4528F9F241D4D0F50E9672CE90BEF856126DBECA060D1B025ABE89357779B4B3E042", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622544047, "uuid": "e7b1368c-2ef0-4ba9-92cf-bebbca268067", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622544047, "uuid": "19407ed5-e6b5-41ec-a1e7-3de0d72652c2", "value": "12288:+WiA02rhvTIVeyYQBiAAw+zBxO0A3lWf0BeY0fKyeXokM0VAYC1:+WiWr2V5/i/zBSlW8J0SH99VAYS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622544047, "uuid": "402f1e51-70ab-4d7d-8d6d-2aaf92f50dc4", "value": 1223680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622544047, "uuid": "2b7c4a2b-537a-4f70-beca-dbf82f4fcf71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622544047, "uuid": "fb83c479-6460-4b38-805c-09ec17fc215f", "value": "SecuriteInfo.com.Trojan.PackedNET.791.3629.15758", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b9989c3-c2a2-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1622528814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622528814, "uuid": "9e0af502-71b4-47f8-8e64-541eca895716", "comment": "Malware payload (NanoCore)", "value": "27063cb28a2ae38c36f6534bf83f1b05", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622528814, "uuid": "29887b66-cbfb-4533-8f76-941d7c65a765", "comment": "Malware payload (NanoCore)", "value": "167ab795206ab85259affeff91f06bf6c4ac2b617a35bc00fdfd0cb9294dca3f", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622528814, "uuid": "154cc136-6615-4559-ad25-a5da18a4c3aa", "comment": "Malware payload (NanoCore)", "value": "0b837c582682704741d565eb8e68d8dc29ace8f0", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622528814, "uuid": "3a7a4ec7-03f3-40e4-8ef2-7755666ecfd6", "comment": "Malware payload (NanoCore)", "value": "f3a15d3f2f07aeef0f6ab7640d1e043dfce07bbd4800157fef9b614189e6a521fedbc7a11650c3593a4f20af11c7515f", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622528814, "uuid": "4f0c396a-a2e7-45fe-adc5-308c176e8b6a", "value": "995533947DC14967C6B383B5030BE9296BB6DC01DA08D2DB37AC7B2FB531538939612E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622528814, "uuid": "bd4a2c1b-73c1-460e-92cd-546d4e0eb6e3", "value": "24576:n2KpqxqL+8OKcQ8i9IbQoI+uLgvsikgZ8fL9DXr/6TtLho9hUWVbCFZ1j2QG:DeqL+8cQp9IbQSuLgvsikI8pzLIoMWMw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622528814, "uuid": "b05dc04d-c8fc-40c7-a75c-6b3917965438", "value": 1318392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622528814, "uuid": "ed6cd5dc-cc93-48ed-beb6-d0e2e6deb760", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622528814, "uuid": "6fbc7c02-acc5-4c37-9e7a-10101b070837", "value": "AN_8383883773636.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea7076f7-c2ce-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622547951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547951, "uuid": "c05ed6fc-bf1b-4fed-9fc9-88a06e64e27b", "comment": "Malware payload", "value": "0e34c566710f901073ab063d53c526f0", "object_relation": "md5", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547951, "uuid": "17ec53bc-dcea-49ca-94d9-fcd752b8f608", "comment": "Malware payload", "value": "198ffca0fe83ba91e5f9c3d81172c5dac1fb297be01beaed7ab978e402ae3775", "object_relation": "sha256", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547951, "uuid": "fe7c1967-91e8-4abc-840b-2992e363e2d0", "comment": "Malware payload", "value": "5d3da16c9496b63c06add59e1c0ad802187fec3e", "object_relation": "sha1", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547951, "uuid": "1cda4e9e-d87b-4f44-a85b-ad84abfc2a2c", "comment": "Malware payload", "value": "48174a6cfda728ba9630870aa933b64c4ef89e8ea1995226492a9ec40f114b751b90cbce4479fd8882d2749f1c1d691e", "object_relation": "sha3-384", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547951, "uuid": "46d974f0-eb72-4fe3-8e7d-00f18adac98a", "value": "FB02A6CE60BB64BADF72755EE01DFF28A2991E13E40778B1D94445042F06F8ED168F68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547951, "uuid": "b5729a62-82eb-4647-a0fb-6950d8ce18d6", "value": "192:PapuuQMKVztDjMn6rMJox+MeRgP5PvPULPaPUjPPOhOAZEyIbBRq2EbLJ8Ghqcpy:YuuQMKrjM6rMJox+M8gP5PvPULPaPUjx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622547951, "uuid": "1ba725f2-d3f8-438a-897e-54957c88e729", "value": 8270, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622547951, "uuid": "1c38699c-f2c2-480b-850d-fc5c7c11c1d5", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547951, "uuid": "65b4e325-ff70-429a-bf10-0aa118fa6dfa", "value": "198ffca0fe83ba91e5f9c3d81172c5dac1fb297be01beaed7ab978e402ae3775", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5201789d-c313-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1622577331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622577331, "uuid": "8315afa5-6de1-419b-a713-9d4782defc3c", "comment": "Malware payload (BitRAT)", "value": "226ba2426c05250b6cc81014631d9559", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622577331, "uuid": "5a5964a7-131b-42b7-935c-011a551c974d", "comment": "Malware payload (BitRAT)", "value": "1aa49d396f379747b78ad52b75228a66a330caa67eae2fd86c0cf4b9bbf078a1", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622577331, "uuid": "3b70204d-4946-488a-ac01-87d8817306b9", "comment": "Malware payload (BitRAT)", "value": "27620f0b8412b40d74ea0af98970f9f64d6ef60d", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622577331, "uuid": "97a8b1c8-d0b3-4286-8ef2-7059a839a6a4", "comment": "Malware payload (BitRAT)", "value": "4bb94b7c9cee6afd0b96ec04d8d266dfdc15192f1d2b33df9b8bfc8e1b3656571733fd7965be73e996b85694a3d68260", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622577331, "uuid": "ba36d84a-a31f-4457-968a-8693a31d8b31", "value": "3C8512C44D120EA7DE774AB86742DFD5EB2B4186A3D38D1FE70B0F58290A38CAE245C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622577331, "uuid": "a08809ee-41d9-4d7e-acdf-671dd0b8a39a", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622577331, "uuid": "2279324a-c1cf-46d3-ac3e-ed45acb363aa", "value": "24576:G0bldrWsWS8Sc18Er7V9lgJuxiAKBzBYk1IVIf0Nw39JCsIhpaWrGR1CzVE0NTb/:PpUVjGJusAECNwntIhcWa/ClbbDi+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622577331, "uuid": "6daf6943-2609-4bd6-86ef-ee747ed3a7df", "value": 1755856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622577331, "uuid": "df60f373-1bc4-42b1-b383-83b4f173a760", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622577331, "uuid": "514c0609-721c-4ac7-85d3-6142d407661d", "value": "invoice11201.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9537dd9-c32c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622588349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622588349, "uuid": "5f11f365-e78e-4365-8281-0b3994d935d4", "comment": "Malware payload", "value": "da46d047266e1a6a884f38d9868f8afb", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622588349, "uuid": "8b7a1f0f-5d8e-4901-9e9d-84a3f437fab8", "comment": "Malware payload", "value": "1aaa6368a8e5f74c470a8b932e0f6377a752ef52f64b38afa5a30564a52cc5ab", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622588349, "uuid": "48cbff24-bd71-45e7-8569-3e053174aaa6", "comment": "Malware payload", "value": "a64dd9d2c6c6bde0aef84c6d8c3b95a6f1351cf0", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622588349, "uuid": "3a51b6a6-ed2f-4618-b093-7027169056aa", "comment": "Malware payload", "value": "4891caf50889572fb6c5c8b657e4353c4aa0ade6a9f739665fd4f398adbe0a6e637132b59ea3e5c7b906d75a0ec1eda2", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622588349, "uuid": "7fe87838-7d81-4acb-9045-a48447c9bbc1", "value": "D6E219B6EC472D315635A6673C820637EAF150836100A4B0BECE47CD5F7E56901EBAEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622588349, "uuid": "25bca6ed-6666-43d6-a971-28a74b16df5b", "value": "768:Inx+p+p0I0uEx13tsteXe6JbQNRL3/VJ/mh8jNMKFLWmheXPjfKrx8:InkpkIVHstRaPurx8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622588349, "uuid": "9a71e9c8-21eb-49c9-9183-4af7696e59ab", "value": 32239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622588349, "uuid": "18a3040b-8afa-4b63-ac8c-26f1d54b561f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622588349, "uuid": "effb8f31-ea63-4498-be46-bc6b7e16c0ca", "value": "datacustomer6J2124455.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aa5709f-c2da-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622552944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622552944, "uuid": "a7da8d05-1534-4162-9801-c2adbb304c9f", "comment": "Malware payload (AgentTesla)", "value": "df907d20a0d042c138973ae0d26ac44f", "object_relation": "md5", "Tag": [ { "name": "Agent Tesla", "colour": "#1DFEAD", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622552944, "uuid": "77a52f04-d642-4177-8aa4-7198fa587f9f", "comment": "Malware payload (AgentTesla)", "value": "1b0e31ee2445c96bb67fecf748e061b3378cbe913a47240bddacdd8115ff29bf", "object_relation": "sha256", "Tag": [ { "name": "Agent Tesla", "colour": "#1DFEAD", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622552944, "uuid": "2b645767-fd13-41fd-a4f0-7d6ceabcb75a", "comment": "Malware payload (AgentTesla)", "value": "76cc48b9365917fcbd745f8cf99eeff86bbe2b66", "object_relation": "sha1", "Tag": [ { "name": "Agent Tesla", "colour": "#1DFEAD", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622552944, "uuid": "5cae74cb-2dc2-45b2-911f-f490322dbbdf", "comment": "Malware payload (AgentTesla)", "value": "b3f32ac6ce6f05dd0b9b7a87052a97b5ed66ed0570c32058e9564ecc244d3624a38e7407fcba281b8906322e76206869", "object_relation": "sha3-384", "Tag": [ { "name": "Agent Tesla", "colour": "#1DFEAD", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622552944, "uuid": "509db09e-3bef-44dd-a1d7-f7d285d08f70", "value": "1FB45AE29F8445E5D09A833B8037E6676223555E9E2A490F2E90FF5F3EA33024617F47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622552944, "uuid": "9a4bd851-5640-4c79-ac1a-637ae7cf04da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622552944, "uuid": "fb0b8a47-07bc-4603-999c-7561e5b5a773", "value": "12288:2R255JtGNComVeyDGblNt6P5yp+Q6dAA:D5yHmgZNkA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622552944, "uuid": "94ca1964-4461-4155-84b2-21ce54acb9d3", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622552944, "uuid": "132ded59-be2c-445c-b137-e89dc119c2e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622552944, "uuid": "b2a30a3a-4f45-4eb5-b076-5d482cfa084e", "value": "APT-AE04805Q0024311METP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64869c75-c275-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622509501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622509501, "uuid": "60f4f312-8102-4d14-9b63-10237fc5997d", "comment": "Malware payload (AgentTesla)", "value": "d3ad204cd7500b797fee163cd10bf75b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622509501, "uuid": "d70bc93b-ff24-4a91-ab28-5770164a4b8a", "comment": "Malware payload (AgentTesla)", "value": "1b22cede73b15157e4e5555e8729d6203f563e73943033e26e1082f27576a7b2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622509501, "uuid": "65e61257-5108-4718-adf2-debc65d1d92e", "comment": "Malware payload (AgentTesla)", "value": "6b45ec03eb527190bbe203628ade97bb140afa52", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622509501, "uuid": "20f51798-9860-4151-a383-03f81af73853", "comment": "Malware payload (AgentTesla)", "value": "a3ccfa385992299036e87e739d521395f397828cfd7e0a47bab31e02a2c698b8820af1f92a0e112dc0563e029b7eece9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622509501, "uuid": "caf1b621-c5fb-4b7b-b262-6c605681951d", "value": "3A45AE223652CE81D3D94276CCEFD52807FCAE83BA52DF2B7A96339C51327668C054D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622509501, "uuid": "a3cd3cce-7cbf-42e4-a798-917fa75768e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622509501, "uuid": "1f3498fd-3583-44ea-a715-ce378258199f", "value": "12288:CI/Dc2TKppDr3VRx41FaO8aNomCmnwxC2u6Akgxqd23l7kH3ahOiwQXNwhwmauCG:dwTDRRx4DHkSl7q3OXr/uCLvLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622509501, "uuid": "5dde5b32-5424-4e57-86da-b6e78e923293", "value": 1183744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622509501, "uuid": "0e9784f7-884c-47ca-9dd6-092ad3951c95", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622509501, "uuid": "b8c7693c-f832-4650-be6d-2c48bbf59e92", "value": "SecuriteInfo.com.Trojan.PackedNET.785.508.32674", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41b54bd9-c2d4-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622550245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622550245, "uuid": "aad68054-1852-4afd-816f-e63a34a56975", "comment": "Malware payload (AgentTesla)", "value": "878e01fa2d12ab1b8a55d1891e8ea56e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622550245, "uuid": "8f4be098-7af4-4ae9-bb2b-3c5d115346cb", "comment": "Malware payload (AgentTesla)", "value": "1e1d402ec8737ae45f73057aaa148454e19bb6807b7b4881db9349ef32c61fe2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622550245, "uuid": "b615e274-7fb6-427a-af67-5ebb5c8bed23", "comment": "Malware payload (AgentTesla)", "value": "a2b3d3ad329e17d93ce76d378e44e1941310f865", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622550245, "uuid": "566f1fad-d5fe-4e0d-8d1a-08434d4c58dd", "comment": "Malware payload (AgentTesla)", "value": "87588085623cef35efe4de2341c7363280cb59d065329ba7b5feed2e557c218fb6d8e81dccc71523cded86854d7cdb25", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622550245, "uuid": "197b85e1-d938-40fc-8f0d-7dc1eea88516", "value": "D025BF223192DA94D1DA9237CDEFC12847FCA983BB62DF367D9A339C40437668C095D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622550245, "uuid": "2b770edc-488c-4da3-96ce-5f4fe33f9c07", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622550245, "uuid": "2bdd237e-653b-4d50-85e8-a3a6eb573d08", "value": "24576:hclpoDotpT6Ii5+WSrufmh8ihEc8zv5L3ZoIR:cpoDWTW52I680Av5LJo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622550245, "uuid": "f3218092-868d-4d39-8cc7-f1a302874602", "value": 1021952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622550245, "uuid": "75cb09a0-e90e-4878-bd12-c6901eb82236", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622550245, "uuid": "709cdceb-7e26-4095-83bc-81a57c631f72", "value": "Payment Copy Proforma Invoice LTPRO4021, 113521L_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2a9b4a6-c333-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622591317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591317, "uuid": "47f87de3-7acf-4ef9-8c01-3b14def262cc", "comment": "Malware payload", "value": "51a21f21c988b0851295230dd1303998", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591317, "uuid": "ca15dd38-7e70-4bab-aca0-11edeb6819ea", "comment": "Malware payload", "value": "1eb4ce329e339e35fe82b2a2046a202562a11968a9080b20ea77d8a1211763ee", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591317, "uuid": "7cbf2a44-97e9-4e65-bc9b-e3d87f489a57", "comment": "Malware payload", "value": "ccdba29c0463a88dd66bf0546ff01770391e3442", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591317, "uuid": "bbabb830-b123-431c-808b-6c090b441436", "comment": "Malware payload", "value": "9d939068513122b0917ae4f858118953812198d56bdaf0cc9aa7441499c7a28eddc44db3690b8e5d4b039a079f1ffbbf", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591317, "uuid": "0d517f82-6cb2-4489-bcfa-288f9a44bc83", "value": "A475E1329A11BEC9072D2D018C4F1FD70D2C5AA38AAC9376DE89126791DDA61CF3D97C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591317, "uuid": "97db2588-0c22-4af8-9f1a-f222f181c699", "value": "12288:0ROXV/IoWjsinN8orndcBPwnms5I1kD4Lrwzz:YOXV/I+iN8oRcLB1k8gf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622591317, "uuid": "2ca38529-b394-41da-837f-5731b34f0d15", "value": 1663258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622591317, "uuid": "20d79085-04cd-4011-a011-22c36714f46f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591317, "uuid": "8f4f65bc-e047-41d2-9d37-27cbf118666a", "value": "1eb4ce329e339e35fe82b2a2046a202562a11968a9080b20ea77d8a1211763ee.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ce2b217-c2db-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622553297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553297, "uuid": "37ecd7c1-4180-473f-b7e8-65e1a148dea3", "comment": "Malware payload (Formbook)", "value": "3b122a4b0f526aac310e1324a2e17dbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553297, "uuid": "29ecf02f-92fe-4ee2-b4d3-b3860d7a7ef6", "comment": "Malware payload (Formbook)", "value": "1efa3be7bb4a5338ac6f3c92855275b09d0fd047c8434a7eb5ed7ee40e1703a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553297, "uuid": "1c30c714-67aa-44d7-b13d-194407e00b79", "comment": "Malware payload (Formbook)", "value": "7328c5bb96d9af480515b8c358d99a2539e773e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553297, "uuid": "c6ba3e30-3167-4ba2-a0cb-dbbc2208cc64", "comment": "Malware payload (Formbook)", "value": "8e3d22945b39cdf561437179ad69fe3e310dffbc6eecd57d9400b441a026635344631fcd9489e72a3092fd8fc2082f5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553297, "uuid": "9a4ad5e5-2fbb-4f3e-a5de-658806f33390", "value": "0225E1321659DBD7E3AE46F481A4E97A06F06EE37F50CB3E2D50709C31B2B548A13276", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553297, "uuid": "a8f7d9eb-2d94-49f4-80ef-9bbdced19831", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553297, "uuid": "50596bf7-e18c-4376-abcb-04973a9adf04", "value": "24576:do7sbbSDvR8+McejsmbrF+kyzr1sRfBhTxvLe:ewSDvHBiV8sRZNxvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622553297, "uuid": "43f510d6-8725-4f4f-ac4b-0ea5f7c40b61", "value": 1018880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622553297, "uuid": "66786b4e-2bda-4e2e-95d5-790ff8a1ddce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553297, "uuid": "830b6e2f-7b9e-469d-aaf7-65ee335de129", "value": "KAZOX MATERIALS SDN BHD Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "704041ed-c2ab-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622532714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622532714, "uuid": "5d9416e6-3f0b-4f8f-96e8-d61e5ac225c4", "comment": "Malware payload (RedLineStealer)", "value": "411630891581826f8b4069a2a2adc0be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622532714, "uuid": "775a0d39-89dd-4234-9cbb-30b2bde578b4", "comment": "Malware payload (RedLineStealer)", "value": "1f090615b025ca978616652c41369f2331100c7650dabd92ee0fa650f29de47d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622532714, "uuid": "9355694d-620d-4b53-be31-c6846bab8d73", "comment": "Malware payload (RedLineStealer)", "value": "526020cc36d9cbb58b7f66e8c53c37b45540b3fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622532714, "uuid": "fd054b05-6a6e-47e6-ad44-4df37a58dfd9", "comment": "Malware payload (RedLineStealer)", "value": "4506ce998c383abd61d5c2e2af4ddc060650fb52d0f4ae0957ec024a2d54823599c163649cbd16247e0201da7db202ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622532714, "uuid": "95b52f2e-da9b-4e03-a5f7-d3ec58c57fb1", "value": "7D849F10F690C035F5F336F44AB781BDA62ABDA1EB2450CF62D46AEA56346E0ED31707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622532714, "uuid": "3ba75661-3a46-49f7-b6aa-b49526d7f362", "value": "2f20facc3edc1d8ba24ede1f07abf090", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622532714, "uuid": "e23b2054-8750-4193-b7a8-2739fbead190", "value": "12288:R+n0ojdeZqHxyiZhhM0qNYA1rYN4Dq6Y:R+xeZqHlMPYA1r2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622532714, "uuid": "49fbd5cc-b386-407f-8a51-cae5cca08d8c", "value": 397824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622532714, "uuid": "a0b57d48-203f-4f9a-8b37-c11d44f26509", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622532714, "uuid": "acf8613e-619f-4c85-acf7-f987ad440cb8", "value": "411630891581826f8b4069a2a2adc0be.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b53611e0-c29d-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1622526817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622526817, "uuid": "95f062a9-657a-4288-b777-b12b2097e717", "comment": "Malware payload (AsyncRAT)", "value": "3f9bf6e39956b3da6bacf9e1052d65f8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622526817, "uuid": "fcd8d595-ea0a-42db-96a7-3e65ac371a17", "comment": "Malware payload (AsyncRAT)", "value": "1f8f0432a3824227efc866e2638d5ff16b524c3ba9d08d7e98ad888293e464ef", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622526817, "uuid": "3d27a2ef-27f3-45ec-84c7-9d1ce8e81deb", "comment": "Malware payload (AsyncRAT)", "value": "d66a1cfda2f61818a3df7b255e13d588d3d8a7a9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622526817, "uuid": "955c4fd9-84f8-48c1-a42b-70856d7d65c1", "comment": "Malware payload (AsyncRAT)", "value": "b7f5ec0b652562b7da238376867132278786c89ea3c5778b811d503905a5d9724240ac47672f00568301b9c4a1195e3e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622526817, "uuid": "76d58342-667f-465d-aede-d3e3370ae5c9", "value": "11A48DE1669A931DC740CAB876C2A0ACCF933E1C541869F4FD773689393BA2404ED79D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622526817, "uuid": "9094791f-6976-4a1c-9c9c-312851f41c80", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622526817, "uuid": "61866eb9-dd06-40f4-b404-3cc19f897169", "value": "12288:LjynsvfCsPvU/qTV8qqIdgT5AGncbPIq9:pPvU+V8qTo3cd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622526817, "uuid": "9e75f96f-0820-4653-a721-70c11b955669", "value": 465408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622526817, "uuid": "969182e4-24e8-43e2-bdc2-aa355df4c5ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622526817, "uuid": "b027546a-3623-4897-ae00-1570ed4bba58", "value": "ONS-2_exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9313173e-c299-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622525041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622525041, "uuid": "6bd94787-3b64-4b2c-be37-a32f53f4a39e", "comment": "Malware payload (Formbook)", "value": "1c5967145825db08e9ddc91f6a181663", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622525041, "uuid": "baedaa9b-ece9-40bc-983e-ff3dfc2a0505", "comment": "Malware payload (Formbook)", "value": "1f9aa7a160c01d85dfb94eeddadbb0c159cbedb7ef0f8f47b72e377ee68f4fca", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622525041, "uuid": "51401809-c7af-43d8-b7b6-bc268e80345f", "comment": "Malware payload (Formbook)", "value": "b2f47affd0742b3d7c8a712c23c5cca85f946424", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622525041, "uuid": "75003c61-18f9-489d-abe8-b47fd7ee8180", "comment": "Malware payload (Formbook)", "value": "521152a9e4936fcce5b54f986de892bddc05bc0745ae9ece6a4b527bfa967be253b47d22ca0bc0456f130f297d70ff37", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622525041, "uuid": "3bb98577-6576-4e3c-9725-218bd8003c0d", "value": "11F433F424995A898CDBBF9FA431D413A1FA84ECCF1DEE80419372B534EB20A96F1751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622525041, "uuid": "07d4a281-e047-4683-943e-9ceaa4ebccbf", "value": "12288:X4p3qcsAOv4KjLVNdduxbpBGwL41xWjZY00YcW913LHIJmOTnsbrwzrxR:XE6jdFibGw01xWj600bchLgTnkmf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622525041, "uuid": "aaac4a3b-6a7d-413f-ad3a-c1e5df63141e", "value": 726024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622525041, "uuid": "12d4145e-f240-4242-b878-ab15956d0c79", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622525041, "uuid": "bcf0ada3-7fb0-478d-823a-d61b20f3e609", "value": "PI.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c0bb4d6-c2af-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1622534291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622534291, "uuid": "eb22a2b5-890c-4bc7-8e17-79dc41f84d1e", "comment": "Malware payload (ArkeiStealer)", "value": "f7376dac615205e5231094c907788a37", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622534291, "uuid": "8cbeb5df-4090-46d2-82cf-05df30b9c497", "comment": "Malware payload (ArkeiStealer)", "value": "2030e38e1dc310fda1151eb6578b61af73c9e95810b0786e32b07fb99259fd64", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622534291, "uuid": "250357ba-48e7-431e-904d-4a0a4deaec36", "comment": "Malware payload (ArkeiStealer)", "value": "77dcd7f5c6b998f21b4e92a7a00a12454c565be6", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622534291, "uuid": "6de4db67-75e6-486a-be6e-5add58194cf1", "comment": "Malware payload (ArkeiStealer)", "value": "0e273e4df0822595a3a219007b7b63e56f3783be59c846fc8898964b4397da2eecfeeda670f743e821738ed8ebc314d0", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622534291, "uuid": "022aac64-5d0d-4514-93c2-744f7c5f1181", "value": "FDE4E010B691C035F5F632B499BB927DA92EBDE0EB6850CB53C566EE5A345E0AC30703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622534291, "uuid": "b3c52d73-d68b-4245-badd-9ab70b39f887", "value": "f9bd684309ec108423c625f7e337de4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622534291, "uuid": "94c0708b-a990-4fe6-8e20-aee1ff15fc10", "value": "12288:cF2KSiFHBmhr39uzK44r1A9+KP/Q8L7joI6N4zuiGLExrZSQEQ2k5RtXu:cPVB8FP1mTVjbve2TEFkRt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622534291, "uuid": "43a9f597-cf4f-43ad-aad9-3f50886508ca", "value": 666624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622534291, "uuid": "211676eb-a271-4c4b-9b08-ffbf4c51f67c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622534291, "uuid": "424b9ddc-b2f6-403a-b4a1-5ee1000457c1", "value": "f7376dac615205e5231094c907788a37.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f13b860d-c2ce-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622547963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547963, "uuid": "127f03b5-e4fe-4868-938f-b19df4010ecb", "comment": "Malware payload", "value": "bf496f32c7cdcd984ebd25ff8ccc5c3f", "object_relation": "md5", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547963, "uuid": "d3af87d2-e389-4721-800d-78c43449f731", "comment": "Malware payload", "value": "208b1907d0597dc847426b0a2399fd00fb3096fb731dfa461bf59acf4408bb99", "object_relation": "sha256", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547963, "uuid": "b0b2e102-dfd4-4e74-9e9c-d9a96011ee2e", "comment": "Malware payload", "value": "5df44430f7c8ea6492eff37966f280e29325be09", "object_relation": "sha1", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547963, "uuid": "100448cb-2b84-405a-9a11-4e7314e139a1", "comment": "Malware payload", "value": "32f5674fc56c173065692fe0f7afc65ba254ba30578587eb427efdae84454c41131d9448613607d0c08f7e837ea841aa", "object_relation": "sha3-384", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547963, "uuid": "dd4e6fd0-d428-4879-821b-6706f945269e", "value": "90F3F9CDB692B076837364B5442F110BB13A79ABF84888A8F088D8F57D758691277F7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547963, "uuid": "2145ec36-fe35-460a-bde6-bcbd253db0d9", "value": "1536:lMDGM6qMJcMoZCvnc3CWG9MdeW4dHUJAyekX5zwsfb7BGRsAim8TcVEljmComlEw:lMDGM6qMJcMtTUJnhx7Bf1wkTCLUJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622547963, "uuid": "a0acd40b-e36a-4ede-b7c9-24ddbbc9f3f0", "value": 159111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622547963, "uuid": "2bf077fd-9a39-4e02-afca-55387cfd35e7", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547963, "uuid": "55ad7f64-bef7-4930-9a11-5115b18c2636", "value": "208b1907d0597dc847426b0a2399fd00fb3096fb731dfa461bf59acf4408bb99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a80e757c-c280-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1622514339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622514339, "uuid": "75ce8417-f8ec-4d9a-911a-6f0cceb1a63a", "comment": "Malware payload (RaccoonStealer)", "value": "58b8dc36e66a23b3ce97cf7818d0eb06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622514339, "uuid": "eac627a4-9d0b-4f58-a721-0113c2f8ca1f", "comment": "Malware payload (RaccoonStealer)", "value": "209fba0ad040546a0732332b958ca53a53f87b9253ae365f0248939213718012", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622514339, "uuid": "bc19a99d-5f10-4f19-a11b-75341dbedbec", "comment": "Malware payload (RaccoonStealer)", "value": "5d3ec25cd4cc4885f85753d773e7da05cef3b46d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622514339, "uuid": "e9391003-76da-402e-a34d-d6cc786a6d2c", "comment": "Malware payload (RaccoonStealer)", "value": "a86b1898ec130746cbc2c07f51953f2d891a5dfeb90c9bfa49b39e8184fb2287b7d1c0ac60119c3980cef5dc823d7974", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622514339, "uuid": "574b9304-f49a-4b77-ab37-69b866d18fb3", "value": "50C4CF007650C038F5F636F489BBA26DA56ABEA1E73490CF22C467EA56346F0BD31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622514339, "uuid": "e73fd45e-ef46-4f09-8400-e404a680d7cc", "value": "04270520ff7500328fbe7b31f4e73eb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622514339, "uuid": "f147ee24-cea5-4361-a8e1-08f3169b957a", "value": "12288:8955ARf43rVo5D2rz5zL3nxghcoptad5KBadLa/ysErQuDI/rR:8T5b3rVpzF9g9tqUa4ys2QoI/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622514339, "uuid": "31e09a82-dc8c-4d95-8b34-ae10d9d5682e", "value": 595968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622514339, "uuid": "46adc1e0-c166-4d12-83fc-53e5b9c71d4d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622514339, "uuid": "e81a9869-f6a1-4760-9040-0e262caf7e90", "value": "58b8dc36e66a23b3ce97cf7818d0eb06.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f604d62-c2aa-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622532363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622532363, "uuid": "e2a0e827-3ace-4b26-acbd-3a26a6ab6e36", "comment": "Malware payload", "value": "1c6912234118d5328ee59b25e7b4bf63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622532363, "uuid": "8136954a-a9e6-4295-b09a-a124ccd9c3a6", "comment": "Malware payload", "value": "22f4a7e07a09255756ad7f3ab954972b7133f00870e122b11b411d457ce71d22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622532363, "uuid": "d9990426-8ea4-4b9a-8c49-9a2c6d533f46", "comment": "Malware payload", "value": "ce558134d8cc39e905d6052d290275a74cd7ce1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622532363, "uuid": "6938d055-9671-40c7-9052-8b5aa7a973d2", "comment": "Malware payload", "value": "96aee1dc245e88ecf83305e3a7bcd6e39941f6b3bede7205c33b35693714f6bc7564279d6bfa3c3ff50ed21e487d6829", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622532363, "uuid": "882a95a8-8989-457b-913d-2f6a6a2602d5", "value": "4B747E00A6A0D035E6BB35B449BB927C95297DA0DB2450CB23C47AEE56F46E0BD307DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622532363, "uuid": "357b5799-2965-45fb-bab6-ddfc514a5051", "value": "99012338f1bbaabe225761bf7cb06050", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622532363, "uuid": "0b6ffa5d-bd70-4414-831b-04b56250866d", "value": "6144:EL3py5EdCb0Jw0NlX1ayqjbf9Ohkept511b7GN7iI:EL3py5EQ0GMzayqn+Bxyl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622532363, "uuid": "a1691f10-4424-4e9f-affa-f7f7587b2d83", "value": 346624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622532363, "uuid": "8bbc98d5-5694-4c45-9728-d51c6da72adf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622532363, "uuid": "fdc812c0-03b9-493e-98c0-1a3fbec1c329", "value": "1c6912234118d5328ee59b25e7b4bf63.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67a033d6-c335-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622591970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591970, "uuid": "9d529ad3-4ea3-4513-84ff-332dac00467c", "comment": "Malware payload", "value": "9147f37c1186ec93b7fca964fb9cfa2b", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "encoded payload", "colour": "#0021A0", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591970, "uuid": "62eada80-b855-40bb-9b07-3f9b60075402", "comment": "Malware payload", "value": "23e20d630a8fd12600c2811d8f179f0e408dcb3e82600456db74cbf93a66e70f", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "encoded payload", "colour": "#0021A0", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591970, "uuid": "e29ce1f2-e92b-47bc-b176-3fe5c76cd078", "comment": "Malware payload", "value": "8d32ee818a3a02a58db3747a22df767cfc49ef23", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "encoded payload", "colour": "#0021A0", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591970, "uuid": "d18580ae-b49a-4b04-a507-0b3c7f0a89ed", "comment": "Malware payload", "value": "f40114c5ff3f55a8f8553f767526b3392884a0c39cb56161429f0610b5bd34ffcf9b3f9fa10436abb17837fcd96f5fb5", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "encoded payload", "colour": "#0021A0", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591970, "uuid": "ae3c577f-fd1c-414b-b298-94d88c0d9752", "value": "AAA3127E53F162D6B07BFAA8552A99A1C5B0EF7E933B497303CE2043538C6F050AD658", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591970, "uuid": "30a123c9-dd11-4562-acd2-760fe6b1620f", "value": "3072:GHB4qu9bwpbmrgRv75uBkq8WQYvr03vFataEV697lj:GHVu9EpCrSv4QYvEvF+rV6xZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622591970, "uuid": "90485a71-cdf0-4146-96ec-301383f9b080", "value": 104993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622591970, "uuid": "01357ca7-7ace-48b3-8e7d-e770a9bd4d48", "value": "application/pdf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591970, "uuid": "68b5d915-d100-41f6-a20d-1384027c17ff", "value": "23e20d630a8fd12600c2811d8f179f0e408dcb3e82600456db74cbf93a66e70f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eea60df3-c334-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622591767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591767, "uuid": "9065b5a1-66ef-4c40-be91-96efcee60577", "comment": "Malware payload", "value": "038579bdb1de9e0ab541df532afeb50d", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591767, "uuid": "1bd26e0c-b4d6-451d-976a-a1b89d1d4e41", "comment": "Malware payload", "value": "24caf54e7c3fe308444093f7ac64d6d520c8f44ea4251e09e24931bdb72f5548", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591767, "uuid": "f7dd5ccd-c5bd-47ab-9d3b-c2a5431ec43c", "comment": "Malware payload", "value": "846620d647314390d641e6400733ceddc5b21ce3", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591767, "uuid": "efb858d1-0102-4a19-8752-db8869ddb183", "comment": "Malware payload", "value": "55e9ac50983ed2b70dab90d222f815d294dce877655920c437467ee38953f13ae2b1999b05a782c38462382884c77193", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591767, "uuid": "cea117d7-c1fc-4958-84db-400a2b18da3d", "value": "8131EF1817C54219E2728B76EC3AE301D279F86A9D11CF6D00C45494686A201F938F3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591767, "uuid": "2e66e4aa-ca26-4732-9ee0-b715ba93831a", "value": "24:8WwW3V/beelTyAVeAh+/CllJ+Y/fk4o0ajmOm8abNISmU:8WwSReelt8A7llrroxmOm8aBLJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622591767, "uuid": "833171d6-f502-4c2a-9b40-fb9bbacccb55", "value": 1850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622591767, "uuid": "6db2e321-3fa9-4abe-ad7e-df3d3839e469", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591767, "uuid": "e4b3c17d-f809-49f9-8265-c3e68622aca1", "value": "24caf54e7c3fe308444093f7ac64d6d520c8f44ea4251e09e24931bdb72f5548.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b1a905c-c2a3-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622529189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529189, "uuid": "bbe459a9-6601-4ef7-9a20-3d1d3a744191", "comment": "Malware payload (Formbook)", "value": "21d9b19ac9451f5ceaea7f6ed5593587", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529189, "uuid": "c241f4ec-7a40-474d-90d4-dd7091a2d217", "comment": "Malware payload (Formbook)", "value": "25ccba7b1faefe85e035fb10cf4bc3c72096640699e19ec1c024c7332c213b58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529189, "uuid": "f9c209eb-76b0-4bed-b92b-54416b3f1b70", "comment": "Malware payload (Formbook)", "value": "5f011f05aecc2d5cf70f374b2bba39256c2c7f29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529189, "uuid": "c4143cc7-e1f9-4eba-a3ed-70326f0d4016", "comment": "Malware payload (Formbook)", "value": "0466cd0969114cf5a7d5520243d84ae931d26bb6b9dfb7e45cd04b60118dc770447255911e24c4e5a0122501674be773", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529189, "uuid": "fd97db6a-55e3-4a23-87b0-cd6408565f82", "value": "3424121D36C5E4BBCEA645711EB7C22AC77797041642121FEB341F2B2C221D3E72AAD2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529189, "uuid": "78134b6c-da7d-4a2c-be8c-fc6fc50c55b6", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529189, "uuid": "f8c83589-2784-4d5f-9da6-9e8bf7502a87", "value": "6144:8Qq+jrf+k4sOFvewuqMyLA9emwY8qjaup:TP+k3DqMIQemw81p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529189, "uuid": "c8ebd9e2-9484-4f67-ab5e-cfc233a0d3e7", "value": 218117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529189, "uuid": "a65b766d-912e-4fdb-ac52-433a560a1ff8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529189, "uuid": "892f7bcd-e927-4324-bea6-5e8c0e25a107", "value": "SKMBT_C22421033008180 png.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0110becd-c2a3-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622529091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529091, "uuid": "db076487-6b75-4bd6-b904-64060c2daa90", "comment": "Malware payload (Formbook)", "value": "672b0a8aefcb6f317ce9e00447a7b870", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529091, "uuid": "c0a7b64a-2cbf-464c-b533-44dd2c7f3c72", "comment": "Malware payload (Formbook)", "value": "27779a2144bbdf6e45d625b507098a3655a43c47a372297e5803ec23505c53a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529091, "uuid": "719cbe71-6be3-458c-9642-a14a6fdd2ff0", "comment": "Malware payload (Formbook)", "value": "66a4572e85dd4d94dc9b037a2e5938dfad58e3d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529091, "uuid": "20c479ec-c8e6-4de0-b1da-536f1f56b537", "comment": "Malware payload (Formbook)", "value": "95d2be261d2c99ec5ccb62de0057da56721b278b3764773758d088d6ce947d7b2c75a76775a89f5b5552a79627d728f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529091, "uuid": "3ed713c1-904d-4feb-95bb-841b71b2392c", "value": "98B4F143AA08C5F9E12521F35CE0D7F6269FB86D867CCB83B3E9470DA47B281D615392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529091, "uuid": "26503f09-b2c5-4d1a-8949-058b96560f6c", "value": "6349db18596ebf564d02723a6dfdc378", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529091, "uuid": "33fcc6be-8f8d-4ea7-97a1-4bdca4924e54", "value": "6144:lfT1D+xdgEjdLIqeE79q+3qLUtiNyuIQ4mlfYHeaSuNcVD8payTq6pSKvXpR//I:lb8jnd2E79q+37iwPmlJui6pay2eSWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529091, "uuid": "114e6628-52a9-4fba-b295-e7f8d5c6ddc7", "value": 517120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529091, "uuid": "0f5b49d9-deea-4980-a4ef-deef8666fd4f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529091, "uuid": "3b1ebedc-f607-4c86-9465-eac3d330eab6", "value": "PO_FALL 2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2740cde0-c334-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622591432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591432, "uuid": "50d2ad06-b286-4363-811e-e5bc913fa3c6", "comment": "Malware payload", "value": "32e0940e1715392280d4bdb514d9cf11", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591432, "uuid": "98603046-742f-4a2e-8e11-cccc4ba3cfc9", "comment": "Malware payload", "value": "279d5ef8f80aba530aaac8afd049fa171704fc703d9cfe337b56639732e8ce11", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591432, "uuid": "9beccc55-96ed-4f98-b862-c1d4fc3760e7", "comment": "Malware payload", "value": "9cf1847cf6d5b4d858e89f3dee87e398ead25136", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591432, "uuid": "002b0c19-808b-48ee-a55e-904ed70946cb", "comment": "Malware payload", "value": "6bc61ca6601e5bc8965cbf765d3d771c47a274fbb8c4d545afd522d60b7ba2daf5a8fa9a8cc2e67777226ef44bf9d814", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591432, "uuid": "832ec386-f63b-4637-bb87-c6f911a9acb8", "value": "FD852302E5EEB45B8FE5463C6B16644F2D8730BED069DAA2185E433EF1C4F9F145E0A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591432, "uuid": "3d95fe83-c35c-4b5d-8c93-e3fe19affde3", "value": "24576:/J6bSYhOnNDdbUB4B9YiI7CvJoNOHy3I9hOTA7iK:h6bb0DoUYqYK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622591432, "uuid": "4a9937a8-48e9-4278-9d71-f0dc6664d792", "value": 1751101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622591432, "uuid": "7ed67e7d-033b-43cd-92b9-2de35ae37837", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591432, "uuid": "14e07bd7-fab0-4f30-923c-645b4bebca5f", "value": "279d5ef8f80aba530aaac8afd049fa171704fc703d9cfe337b56639732e8ce11.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a09f11d2-c333-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622591207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591207, "uuid": "94d1d973-0505-43ab-8423-f12d149e6ac5", "comment": "Malware payload", "value": "df328fd5308f027a347b997542b1b32c", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591207, "uuid": "262282e9-b7a5-4706-9e6f-8718cc38b10b", "comment": "Malware payload", "value": "292e5b0a12fea4ff3fc02e1f98b7a370f88152ce71fe62670dd2f5edfaab2ff8", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591207, "uuid": "bed933f6-9e6e-44ab-87b3-981714768dff", "comment": "Malware payload", "value": "dd17765749d92d98eba5dfb869d027acf8e45731", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591207, "uuid": "58bd16ee-bc1e-47a5-bc3a-1f80a72430fa", "comment": "Malware payload", "value": "8ed32febf7966840e2ae10f221a5217a33a98774d80bc56e58f1bed966a2eebd26c2567738118659f45fb664a12740f0", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591207, "uuid": "35e318f0-48b0-4fdb-bb49-82c088ed50be", "value": "7474D04725B900AFD1A1C234E8536A76D372F6441E7CDB9F03E0594A1FAB790DE2AB31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591207, "uuid": "ed12576a-0e31-46b8-a1d7-f895749bda28", "value": "f09dc86f464ce6172bb999c112f3b234", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591207, "uuid": "32c0fc36-dc14-486f-85de-3d669a77dab5", "value": "6144:A/jnP8/L1bir8VS09NyoyXO+MwGW+Vmv9tzE6JdnxhhcEo1NSiCqFH:A7nKhbiEf9NyoyNHimv9ZEGdnxTY1NSq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622591207, "uuid": "ece9437f-6039-4149-8e15-0d1873cfabce", "value": 358912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622591207, "uuid": "a898a709-85e9-477a-85cb-315a0bd4c1ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591207, "uuid": "c386e3de-6f61-4a2d-8f05-02165451a1fd", "value": "292e5b0a12fea4ff3fc02e1f98b7a370f88152ce71fe62670dd2f5edfaab2ff8.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51be1bfb-c2b7-11eb-875b-42010a9c0053", "comment": "Malware payload (Cerberus)", "timestamp": 1622537817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622537817, "uuid": "70093c62-ac9e-4727-89f6-c5a99b2f8410", "comment": "Malware payload (Cerberus)", "value": "478b9437dc7ecf349982f1290e7d065b", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622537817, "uuid": "f5c8615c-59ed-46af-a019-e6d3276d86f2", "comment": "Malware payload (Cerberus)", "value": "29e99eee9d17e2bdb604ac3cc0f20d6dc4be8d98f071870f7c8913b3c44ed0bc", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622537817, "uuid": "816cdb3c-c42d-4971-bc9b-2a119b3906c0", "comment": "Malware payload (Cerberus)", "value": "54ea1a4d02b2b003171de539ec64980d018c939a", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622537817, "uuid": "3c2896a7-e4a1-423b-917d-4b270d120b8b", "comment": "Malware payload (Cerberus)", "value": "9a5e0bbf1bab536ae6aff9365505a55111fee0f2c52733bccfc8dcdc8c8a1045bbc25e906d57e5e24b488ef13a081349", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622537817, "uuid": "a92d4b1c-9023-4ad9-b8ce-bf6800e2b325", "value": "2D441253438D4596FA3F26F743F247B09B7103A712E1B6A62107C656BC82BA80F94E97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622537817, "uuid": "cf193d88-6ffb-4bde-8064-40fd496270f8", "value": "6144:lw9HksGXkgo9wBf/WMU+xY1dpc71dpc5ou1Z4:lwGjTog/PUdR0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622537817, "uuid": "c2e99efb-eb66-4d5b-b86e-98b25677c478", "value": 267474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622537817, "uuid": "4461930e-89a0-4e65-ba12-5e0ce144d18e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622537817, "uuid": "4bee4748-12b6-447a-93b7-3bb0e387cf71", "value": "WhatsApp.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16ec90d0-c299-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622524833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622524833, "uuid": "f870b590-ba8a-4e3d-a544-a28ba0cf3e3f", "comment": "Malware payload (AgentTesla)", "value": "52b4434deeada58924127eab8023a864", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622524833, "uuid": "c49b6ec4-d1fa-4bf9-ae9a-42b41cbc8269", "comment": "Malware payload (AgentTesla)", "value": "2a2e2d6d7e0027f5ad4fd7581397002dc5588579e4c42ba78fb662532089ccb2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622524833, "uuid": "40e7f250-a942-4701-a8e9-df5aa675b64d", "comment": "Malware payload (AgentTesla)", "value": "afcf9af33d527541b4fd9df62e98b5c9acf123b8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622524833, "uuid": "605bafa6-dc25-47a4-ab22-313b127a7e3e", "comment": "Malware payload (AgentTesla)", "value": "f0abfab13a34d84e1494b4e9f4876fe4f5cab831aef70909e09225d4aa7d880889ad52228c4ac25fb778b0058e7494ca", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622524833, "uuid": "fc319b99-8bdd-47ca-b9a7-7b8e12953efd", "value": "4AF4D03B624ACBD7D25DC4F8C588DD6743F681E7BE42EBB82E4130A4BD9374466810AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622524833, "uuid": "7cc3acf9-f1a2-4965-b258-bddab88e4a2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622524833, "uuid": "5d220346-f17c-4c43-9ea6-002b30a67850", "value": "12288:6TEb6Ngq7yfgLDfGB4DJ7r01AXijE26E2wqPj6E9Y8kJ8NIiQxR0m2R3YklQ/TW6:9mhDN7+o2grI78eLxR0mqllQ/i64SHv1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622524833, "uuid": "46d864f8-aff2-4335-8345-aedcee2fb26e", "value": 782848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622524833, "uuid": "df37eae6-72d7-480c-91ce-8fd8bc9b383d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622524833, "uuid": "12023ba0-c3e5-4eb3-9881-a2faaba47fd0", "value": "1092991(JB#082).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "984dfeef-c333-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622591193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591193, "uuid": "b483e747-f72f-4e12-ac34-7dfee2ddf6e9", "comment": "Malware payload", "value": "77605aa6bd6fb890b9b823bd7a3cc78b", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591193, "uuid": "bf2bacda-0bfa-4475-84ff-60fc3d2867df", "comment": "Malware payload", "value": "2a352380d61e89c89f03f4008044241a38751284995d000c73acf9cad38b989e", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591193, "uuid": "b3af1537-083a-497e-af77-40e0d6aa12dc", "comment": "Malware payload", "value": "6114655cf8ddfd115156a1c450ba01e31887fabb", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591193, "uuid": "ddf0378f-5ea2-4bd1-b1cf-3b0e93c47975", "comment": "Malware payload", "value": "cbc4a6c77b6c73132ffd06a53a89691c947fa782e5f9d7542202862d59d720ffbf33b3f52825f5aff3d428865ff3d6f7", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591193, "uuid": "b0d10aa6-f966-43fb-b4ed-72548db1ee74", "value": "6764D04076A3F0E8E6FD813405EA85614B2DB93DDAA478E7EE4451CD2F646C00DFEAD2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591193, "uuid": "64ccc5ca-f4d0-44d2-bad3-25c4f5fb647c", "value": "4c87e913f89b91a225d7e97a247d74fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591193, "uuid": "01fa36cf-7d76-42a1-948a-d6881d29718a", "value": "6144:8S+SUvY2lH9F9hUVHbutYsATDaqeKOQe0d9:8S+XvY2ysAnaqepz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622591193, "uuid": "5895a63a-f4fb-4586-a095-f81392486d99", "value": 306688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622591193, "uuid": "405e1c6d-8c2e-4e1d-8cb4-e3c80a22ab5f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591193, "uuid": "1f8fb1aa-6bcf-4938-99a2-b09daafb89ff", "value": "2a352380d61e89c89f03f4008044241a38751284995d000c73acf9cad38b989e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21734f4a-c2a3-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622529146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529146, "uuid": "c768c553-7769-45ed-934e-a39eba45e2fb", "comment": "Malware payload (AgentTesla)", "value": "96b95028335997852a9b769393421ccd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529146, "uuid": "20e2ced5-582d-4df7-a7d0-c10b8a228f15", "comment": "Malware payload (AgentTesla)", "value": "2bec24e1932c6f4256c34c09016780cf423e28f9dbb6c37c18cae5887149c226", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529146, "uuid": "55d36627-bba6-46c7-8f5a-25eed2333952", "comment": "Malware payload (AgentTesla)", "value": "c454f3567c55a6975e5bd37a44dbb376d2517199", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529146, "uuid": "609bc4d3-8753-44d3-a6e3-0e02b9be0077", "comment": "Malware payload (AgentTesla)", "value": "6d2aa39774491fc02c596680f053b258b2a7720661311852dc681c8bf636a00cae2c76c6819a69f7efd9568afd1b513c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529146, "uuid": "b8400219-4b6d-462d-a669-f7230de48dd0", "value": "D8255CE6BDD4D8A8E1C9C73D82F8586ABF53C5EA010B0ED905D7B79C068374AFB58442", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529146, "uuid": "e81ce103-acc8-4af7-84a1-02a6a2d4f5ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529146, "uuid": "97bcc3ac-b5ca-4676-8aca-f71e0649302f", "value": "24576:+ftrh1jrRT9ElnL9fGCXsabli7pz8T2ci1:6tT99qnLfXS7iTRM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529146, "uuid": "05216be1-5c77-471a-aad4-996507433c2f", "value": 1013248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529146, "uuid": "85792449-4780-4745-8753-a362ce8e1421", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529146, "uuid": "74ec1868-a57e-42bc-8f50-1c3385226ba2", "value": "payment_ Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d42c615-c2ad-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1622533568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622533568, "uuid": "9aa131f7-0380-4c90-b894-a687934da2ae", "comment": "Malware payload (RaccoonStealer)", "value": "480d202bd37a16d5bcc03d410e2384e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622533568, "uuid": "4ff9a214-92b6-476a-9b61-1e5b3f02fe0a", "comment": "Malware payload (RaccoonStealer)", "value": "2cdf554c536e1d38490814b0b7961657cd2b2ea11989e25b3208a5b4776702e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622533568, "uuid": "fcd2303d-c3ed-44dd-afe7-b4cfd59c55ee", "comment": "Malware payload (RaccoonStealer)", "value": "85f8b1c22e943ddf78a7ed347ddc894581a50dd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622533568, "uuid": "1948e2ef-891c-48ac-8cdb-1c19e4876985", "comment": "Malware payload (RaccoonStealer)", "value": "362b7b910adae5f4210e70d01a8728bc9b4737cfa779eec6559ad49bd57571edb8993df1f45a563e9701679e02a7bccd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622533568, "uuid": "e9b1ce38-0f6b-4a73-ad28-1fa9225f883b", "value": "B6C4D010A690C038F5F636F88ABF926C656ABEB1DB2450CF13D566EA56306F0BD30717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622533568, "uuid": "fe2faaf0-feb6-45b1-be4e-72f2ab3e7b97", "value": "99012338f1bbaabe225761bf7cb06050", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622533568, "uuid": "7d1d1a80-8e82-4cea-8943-eb64a8dcaf2c", "value": "12288:2V5HjFZj1xJ5P2S9gtUs+a9yAjmk1DAX4TmGw7d35CbY:2V5Hj1xbXxYyrkjTmGwpJC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622533568, "uuid": "1bc9948e-aea9-4e0e-b92d-e18dead6cd03", "value": 596480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622533568, "uuid": "0e617ec4-f27d-4c12-939f-75de216fa22c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622533568, "uuid": "3737bfa2-ab54-4476-9ff0-c367e93402c8", "value": "480d202bd37a16d5bcc03d410e2384e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e67542c7-c2c3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622543220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622543220, "uuid": "83e5f9c8-f429-4d13-8044-e4fbcd33c1d3", "comment": "Malware payload", "value": "3fd109ebb186743c12ac2922863d07dd", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "equation editor", "colour": "#D21332", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622543220, "uuid": "545a26a8-9ac7-443d-94ac-caad9da41662", "comment": "Malware payload", "value": "2dc1471c7a73eadd6afda4cf3aa7e424351af455207404584486d2d1747b8aed", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "equation editor", "colour": "#D21332", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622543220, "uuid": "39f81aa3-57e4-46da-a0d4-d61fea8df680", "comment": "Malware payload", "value": "5d8a0cee756d18eabd4430fab3d64f8a96bf2ee9", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "equation editor", "colour": "#D21332", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622543220, "uuid": "4b9dcd52-b956-40c7-ba13-14024b47a1f4", "comment": "Malware payload", "value": "5b30bb5b518e39a519a66633c2453e10f48bf6c6b997826a1cfbd0a30609c0228188b5422838d619f02377b3e25118ce", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "equation editor", "colour": "#D21332", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622543220, "uuid": "11fc45d3-b197-4549-a301-0673f4544d3f", "value": "069557F0AD01D4C1F57E5B6AF2FD3A48A1343217EBC94A4A00E7E5552EF6A11B90ECC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622543220, "uuid": "923bed0c-63e0-4ce5-8089-c45279b77acc", "value": "12288:OhKoqy7R66XkVmRDzd/wLCcW9w19AhSjKcpBWZYtW5/vnk2gX/1:OhKoq883mV2tW21ESe6BWWk/G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622543220, "uuid": "69b83e36-87d0-44cd-9d55-a638a5444f39", "value": 2010712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622543220, "uuid": "966fde47-562e-418c-99f5-8710a6d05c37", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622543220, "uuid": "4f62985c-4fb0-45e8-90fb-1f2a5605b90d", "value": "New order 201534.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9f26c7f-c2a3-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622529375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529375, "uuid": "e159f7f6-7939-43b1-8fe6-a95f043cd002", "comment": "Malware payload (AgentTesla)", "value": "e08b777e4056702f743f6426591ab0ff", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529375, "uuid": "efcf2d7d-fc0a-4d91-8e76-ba17896878c9", "comment": "Malware payload (AgentTesla)", "value": "2df39e2f69745aac9cda8985b6d07deca0957a43db332e61fa080bd62b30bcb4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529375, "uuid": "10400ad6-908e-4770-bbce-73c10d1847d9", "comment": "Malware payload (AgentTesla)", "value": "1afdd66b1b32da2377da609f982439b06c1f9611", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529375, "uuid": "ee117362-7a9e-419f-ac7d-5bc4832c5f10", "comment": "Malware payload (AgentTesla)", "value": "31039001f576f791d16a0ff9ea203ddd9f0c09ab23355a3208b22f04a052d74bb7548c118707d194f17830104fa9d17a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529375, "uuid": "e136bfc1-da4a-4cf8-8294-7381c71b3dc4", "value": "33F4D0E1B1204B9CF97E4BF52021089107B32DBEB5B5D30C6CF572DA2AB77A24225D5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529375, "uuid": "e44c980f-98bb-4734-9571-5e513a162c05", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529375, "uuid": "b1b5f4c9-7585-45d5-a276-4b66c34b6f83", "value": "12288:ZZvVWbu3AJp0luA2rfMEbh5ket39sGyNWKKW0:ZxVWbuwD0lpEV5ketxmWj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529375, "uuid": "90ed3792-1b06-46e4-957a-8823c88827fd", "value": 765952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529375, "uuid": "97a371c8-8f52-46d7-a052-828a266a8386", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529375, "uuid": "c1247e93-0531-4f0f-8f47-a3c375472fcf", "value": "PO_021_816150833358.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1b90068-c2a7-11eb-875b-42010a9c0053", "comment": "Malware payload (Stop)", "timestamp": 1622531133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622531133, "uuid": "ea1e2365-4e58-414a-9508-c98a82489257", "comment": "Malware payload (Stop)", "value": "04870936dd1a1731acf8ac30e2150992", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622531133, "uuid": "74b96164-96ed-4f9b-b4a4-5eabfe11a9fa", "comment": "Malware payload (Stop)", "value": "2e2a0ce800846a1c642b25f05db4266ff783a486fea187c2df20af4814ae166a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622531133, "uuid": "635757d2-28c5-48d2-8da6-708cb064bbed", "comment": "Malware payload (Stop)", "value": "39b9f09db4eeb84d155b4f6de985e413ea34109b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622531133, "uuid": "c222ae20-d179-405f-b069-f236ed2cb6e9", "comment": "Malware payload (Stop)", "value": "17766ed2a6f492925bec6861e9f5448aaf844f1df5ca4bdeba9c09e41d40aaf3b62932149c538cd619f18e4371800750", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622531133, "uuid": "cacdffe3-0723-43c2-9845-8e17470b9411", "value": "5905F100B691E034F6F736F58AB7926D952E7DA3D72451CF22C4AAEE66345E0AC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622531133, "uuid": "8e3e5bf2-e662-499f-ae66-fab7c204750d", "value": "beb713a5b9cd61f251bf70772291e813", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622531133, "uuid": "b2d40f45-4a64-4d0e-a4a4-20f7480be634", "value": "12288:6QocQITBQ1CfsjK8QuNorMFJe8SshdVo/8HkDBZuqvY8WH5OvRmLzKamo6eTsXt3:6HEBQMfsbKrEhbaduwOYvc/jTWTMj5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622531133, "uuid": "48c80cec-a507-4c18-aa73-ca7c7a8c3bcb", "value": 874496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622531133, "uuid": "33a8edc5-f183-4e42-8808-2669498e3830", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622531133, "uuid": "f3e86055-fae0-4ecb-8385-1eb36ea78b09", "value": "04870936dd1a1731acf8ac30e2150992.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ca0d0b0-c2a3-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622529191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529191, "uuid": "2bdb5e9e-c641-44c3-aea7-4767dd48826f", "comment": "Malware payload (AgentTesla)", "value": "ba01e758509497aa831e5c98100a1cca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529191, "uuid": "dc529fc6-b671-4c00-b0c5-aceee96124bc", "comment": "Malware payload (AgentTesla)", "value": "2ea1019302fcd419a8125ae5d4f3ede42d5cc6b43e8ec335a573af91a99c2604", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529191, "uuid": "fa25144c-4c74-4171-9b7e-eb2afe4537dd", "comment": "Malware payload (AgentTesla)", "value": "da84c7c521e594a103c61bb019f4c8b4b57e11c9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529191, "uuid": "44fac8d3-b78b-4b0d-b55f-0cf23afdd327", "comment": "Malware payload (AgentTesla)", "value": "14bcdae72287621c739eef88db96c8a7b7f4d6355a8b3783ddb2d8e1383697c2419665477778c16eaa5d825af2d2a0b4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529191, "uuid": "b7ec9bfa-8d91-4a95-866c-26f3e0f49ce3", "value": "8E05E136129D6BE0E6BDC7B840A4987303F5B9C3DB12CB3D6EAC54991495B8085D23BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529191, "uuid": "1181398f-eef4-4bcb-8718-29017cef6ed8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529191, "uuid": "0f54f8ad-f2c6-4962-b890-8f7ac9a27e33", "value": "24576:NtVlqnPwU8qKEzlKazkO2WxaLw+CHckZ1/:rVlav8TGz4W0MrHpB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529191, "uuid": "78dda073-6a35-4308-b738-d156aa6dd597", "value": 864256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529191, "uuid": "5e583830-72a8-4317-bb45-c9abf70f6f6e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529191, "uuid": "1d600f3a-2ed0-4067-b6e4-8a57ba38352a", "value": "Urgent leader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c551e152-c292-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1622522119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622522119, "uuid": "69107f38-0fb2-4228-a0b1-6c458f198503", "comment": "Malware payload (Gozi)", "value": "006e66d40ebf85681027d6aa6a6cc6e9", "object_relation": "md5", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622522119, "uuid": "a4d76c38-1600-440a-bced-3f299352f4f2", "comment": "Malware payload (Gozi)", "value": "2ec1119c2b57a60df967d7eacd0cfd7b0da685e2149fc9696a1663f692a13ccc", "object_relation": "sha256", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622522119, "uuid": "bdfbaceb-b5fc-4145-83e5-73ddae4016e6", "comment": "Malware payload (Gozi)", "value": "1b30ce124c5a99d856d1d0e5cd691c52652d5d55", "object_relation": "sha1", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622522119, "uuid": "552b6491-6ad1-4787-939f-d3fb398962b9", "comment": "Malware payload (Gozi)", "value": "3bd236c4f9fe1e24e80ce09f06cb90fae6d3561820412410fc4f2f87c16482b92d7cba02bd02dd2df4ff1cc161a59067", "object_relation": "sha3-384", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622522119, "uuid": "f5056ddd-1883-4cb6-aa6e-94d7fbd3204b", "value": "8AA3E5C66B62DD79DB80D2318CDA81862361EC414A6E47873544F37A3EFAE70FE126C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622522119, "uuid": "94b3e8ed-467c-4db2-b04c-526469720553", "value": "3072:xhlYkEIuPm3fNRZmbaoFhZhR0cixIHm03thkbZkfFLjWrxr9CW:TlYkEIuPm3fNRZmbaoFhZhR0cixIHm0u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622522119, "uuid": "ea4ff1f6-5257-4ef5-9df9-5afd36017246", "value": 104448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622522119, "uuid": "f3a3280d-7aa2-424c-aeb2-8bc91d195904", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622522119, "uuid": "d89e0817-8392-4e01-817e-893a1f5f3dc1", "value": "Fattura n_01667982.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d84f9a7-c2b7-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1622537836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622537836, "uuid": "338c8f07-bdc7-4daa-8500-9b0bd3eacc30", "comment": "Malware payload (Loki)", "value": "2e038aee140d32efa0a94c12b0085906", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622537836, "uuid": "a934b63b-d219-4295-8598-fae7c288c94e", "comment": "Malware payload (Loki)", "value": "321e7fea6ceb5255c592162c7781c524b7569c3f1244274a247f5f0c97702c49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622537836, "uuid": "20a4aa9c-83c3-4726-aa60-b4d456d4633d", "comment": "Malware payload (Loki)", "value": "b85204961f4e5e84399b042f311feb8d7a2a7679", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622537836, "uuid": "40917511-d170-465b-9c39-250450b40766", "comment": "Malware payload (Loki)", "value": "cfcc23e65a9a53470d9a4db327b8f9268a92d8c3e481f2d3116728805d1a4ace19d5422ce6d52817cc22125e780a2706", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622537836, "uuid": "f9927271-d8d5-43cf-8128-613d93a6ff42", "value": "C4E49D23F6814637C02E09795D475BA8A939BF307E0498A73AF97D8C4F7A65138391E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622537836, "uuid": "cf93bc17-ca66-4eef-96ae-44e1ae7151ab", "value": "449021d3d5fea66598eeba9c93aa4705", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622537836, "uuid": "de5b342f-265e-434d-a8e2-4db66de0dfb2", "value": "12288:3kIquSFoM9SJLcThopnxJ/5JKcut4n2O4XP2OzeRtSQwNyAV:0tBvSJLcT2xJ/53cI2OEP2Ozaiy+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622537836, "uuid": "cdf5fec2-25dd-4620-b88a-17b96935d5c1", "value": 716960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622537836, "uuid": "57449cb3-1087-45ed-98c6-afacb3a75cc5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622537836, "uuid": "0569b4ea-87a8-4f18-a648-9b24bdd8d33e", "value": "Eurswift.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a725eae8-c333-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622591217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591217, "uuid": "dcebd54a-a277-478a-a8c3-25d53ce7b267", "comment": "Malware payload", "value": "736ddbe16e777f145461c3d1444994c0", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591217, "uuid": "101c3e0d-e651-4be8-9048-8efdcc9a65c0", "comment": "Malware payload", "value": "336bd53861dfdcb433486bc852127c77ccc3234de79582b39639d2aacf5fd2aa", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591217, "uuid": "3f6af3f4-32d7-4e81-817d-cef136cc4a23", "comment": "Malware payload", "value": "6f1ddffe2128455269ca493116e34f8d03931c6e", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591217, "uuid": "1f99bbcc-b75b-4675-934c-eb47407a454c", "comment": "Malware payload", "value": "ff5f00c46f873094142c5029a972055c723fdad04fdac687284be78aed1b045fcb941e8abfb377026c41ecfe3853b137", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591217, "uuid": "99faaca8-e0a7-45cf-bb5c-ec4b28935fc4", "value": "E164D04076A3F0E8E6FD813405EA85614B2DB93DDAA478E7EE4451CD2F646C00DFEAD2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591217, "uuid": "c684a250-c182-4490-808a-7e2ac80531c3", "value": "4c87e913f89b91a225d7e97a247d74fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591217, "uuid": "6f0cb8bf-7e77-4ebe-a842-dd926b1783f3", "value": "6144:eS+SUvY2lH9F9hUVHbutYsATDaqeKOQe0d9:eS+XvY2ysAnaqepz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622591217, "uuid": "943e50d0-173c-416e-a826-a10277bc4c75", "value": 306688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622591217, "uuid": "ba22c61c-1008-40d0-9db4-91c5d0698268", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591217, "uuid": "46839c59-91b6-4dd4-9ba8-3f8ad2302916", "value": "336bd53861dfdcb433486bc852127c77ccc3234de79582b39639d2aacf5fd2aa.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d804a9ee-c2da-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622553074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553074, "uuid": "2068cc2b-7835-439a-8ea2-dc751746263f", "comment": "Malware payload (Formbook)", "value": "92767e8ca316676942db9d959edc3338", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553074, "uuid": "71456c04-05f2-44c4-9172-4d1eb892a531", "comment": "Malware payload (Formbook)", "value": "33ab3e8b6b9e120f172452af47ef4478cac25fac68982451ea0d5a773bae5488", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553074, "uuid": "6249fcb1-a51b-491c-b69e-1ad45c16773e", "comment": "Malware payload (Formbook)", "value": "690b1d251b5e262704dd21125f6c12b00ce3094b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553074, "uuid": "a8074759-b30b-40d0-814a-31c4c3cd1c6f", "comment": "Malware payload (Formbook)", "value": "764fd2bfd24a6beed64f59cb3f10a50762d8997d45805a53897cd7f47f9e05beaa7182af042109dc846b4465bc31a320", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553074, "uuid": "8ffc8816-863e-4ac3-8c42-15c0e15076ea", "value": "CB5523734EF83B97E7BBA4723991992420AD0C117B29D8267389771D98F1E32C75226C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553074, "uuid": "a0bcf28c-22b5-4978-b979-3900c56bd57a", "value": "24576:kvue21jvqdoec6iHqEDKWyhLPFWMqO1g6I2D0LpG+fvDDMGgXq8aCzKqPY:KD26EGWszFWY1gc4lG+fvD1jv4Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622553074, "uuid": "7772595b-2afb-4919-9efd-48fdc38679a1", "value": 1351864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622553074, "uuid": "a824f906-311e-410f-a5b9-ef6a0ceb70da", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553074, "uuid": "733f34d8-c07e-49e0-b56f-04c743813fd0", "value": "CONTRACT 312000H123 SSR ADVICE 31-05-2021 (1).xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f57437c2-c2ce-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622547970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547970, "uuid": "b2948a1f-bc39-40a3-93ab-d7f3f7122f43", "comment": "Malware payload", "value": "9327c746a750b29fea413735bf4f8c3e", "object_relation": "md5", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547970, "uuid": "d497d4f6-cee9-4b91-9442-cd484deddfde", "comment": "Malware payload", "value": "34a8c631f49a2017959f8ccc7e62d31ae2c24d7b2841369f272bbdcb0b705214", "object_relation": "sha256", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547970, "uuid": "b2bc2a88-2459-4b52-a50d-57793e89f312", "comment": "Malware payload", "value": "068bb7b786a0db3fafc31bd4cb465c263dedb340", "object_relation": "sha1", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547970, "uuid": "908724d0-7dfd-4503-9eed-06340c771596", "comment": "Malware payload", "value": "25d7815144f7bb19c2366b3b97489fdea60ecdadca1af746e6dc647969807579b0f144fec44abc816d07f3a2295d0483", "object_relation": "sha3-384", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547970, "uuid": "edd48628-5d00-43ff-895d-54333b6eaebd", "value": "9981DBDC2533A4B9DA722553E00DBB7D82752EABF40E74F09A8481011F66F8DD268F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547970, "uuid": "560ef410-79ca-4ec2-bed0-e848ca8fe43b", "value": "96:napDDSsgCMSzcPPdztqBuGMDPJ96qMJ4m1SDF3Me1:napDDBM/VztDGMn6qMJox3Me1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622547970, "uuid": "67ed67f5-545f-4385-a414-a9e3d3c7dac6", "value": 3837, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622547970, "uuid": "73bdf1bf-56e3-4c34-97c7-07c33b0d0b28", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547970, "uuid": "34ab774a-8046-4d89-8c4f-ef31217c4430", "value": "34a8c631f49a2017959f8ccc7e62d31ae2c24d7b2841369f272bbdcb0b705214", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7afb392-c2a5-11eb-875b-42010a9c0053", "comment": "Malware payload (njrat)", "timestamp": 1622530310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622530310, "uuid": "4403d02c-3073-4cb2-983b-ae035733c105", "comment": "Malware payload (njrat)", "value": "f5b93d86bf0102d5ff41af395e71e6fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622530310, "uuid": "edaf9b8b-86bd-4c94-98ad-464caf6f98ee", "comment": "Malware payload (njrat)", "value": "34ae4ccb5f97185c95f697a8aaaf1d9d221ed8d58db66a6701296355833c4186", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622530310, "uuid": "5450658a-332e-41ff-8da1-2add75b1140b", "comment": "Malware payload (njrat)", "value": "f04b4f9e8b76d0e6095158c98e90c4a0c54857a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622530310, "uuid": "00b05681-c6fb-48ce-9659-1259cd27f219", "comment": "Malware payload (njrat)", "value": "1095a3683ad62057b32cd6f45c64321e5b2e817535a6ea4d229af2ee0fe03f1b0739fd96105a3a3966d2af4156b9e968", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622530310, "uuid": "de9b7b8f-17c1-4800-b152-d40478eee443", "value": "DA13D74CB694E174D5FF8BF1A4A2B2890F71A017A806930F99F154D94FB3EC0A611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622530310, "uuid": "9700f175-c4bc-4ad4-b4ab-8cbac011cb69", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622530310, "uuid": "e52999b6-4ae6-4d7f-987c-3032143d9b35", "value": "384:CZycdSd2foUyXXhZ9VO8EDAZ7lR6z4Iij+ZsNO3vlppKkksh/TzF7p2nn9TdbeTf:wfdSoghXRZnOfABAuXQf/Yn9C+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622530310, "uuid": "b76c21fb-871e-4c3e-9bce-f796b012ce6c", "value": 43520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622530310, "uuid": "c4a38467-2bb6-4bdd-af77-8b03bbefdbe8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622530310, "uuid": "e763394c-3941-4228-b246-18903331230c", "value": "F5B93D86BF0102D5FF41AF395E71E6FB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef642069-c2dc-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622553972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553972, "uuid": "7a8943d6-051b-435f-8f5c-a589c1f8aebe", "comment": "Malware payload", "value": "9fe47224348826078d662e161f2d38f7", "object_relation": "md5", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553972, "uuid": "59845cff-042a-47ce-bbcd-6f1bf1c93b0f", "comment": "Malware payload", "value": "34f1c88f96be05aa777fa3348631784be4a679334179bb4ce02ad9adcb201644", "object_relation": "sha256", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553972, "uuid": "d69fd55c-bbfc-4463-86de-79b326ae270c", "comment": "Malware payload", "value": "7f40018c9a4f292e873e724c950af6b17fc888d0", "object_relation": "sha1", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553972, "uuid": "625c5be7-43ec-49b2-948d-14242e0bccbe", "comment": "Malware payload", "value": "a6fdfa607a89b465464a55bfce51c4c993bbb6c2fa54fcacea7208a4ce97cce6dddea9ee2088de4d2c574547b1b7be32", "object_relation": "sha3-384", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553972, "uuid": "1c6be42c-6927-45f1-8891-fff25829353a", "value": "D502AE6277093364EB30C73E2535A8F4701D21299587850A72946EDDA5E24C3CBCBBCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553972, "uuid": "aef5a575-80d9-4185-a3c8-83dbc546a3aa", "value": "192:ZMAXRmgpUBJYZIGB3eZSmSa23KEymy/+NjTfjR16BvLu:1bpxxBKfSdymBJfRIa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622553972, "uuid": "f9223110-f945-4aaf-abf3-54eb1d139ce5", "value": 8880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622553972, "uuid": "29e5f0be-6043-4c39-a765-e08051ddc95e", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553972, "uuid": "e0b1e0d4-6633-468d-84a4-65e516b14a45", "value": "RFQ No3756368.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "319c22c5-c2a5-11eb-875b-42010a9c0053", "comment": "Malware payload (FluBot)", "timestamp": 1622530032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622530032, "uuid": "bff21de4-9288-47f2-b715-53a73cd45188", "comment": "Malware payload (FluBot)", "value": "0f1ed21fff27291645ee8350bc813228", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622530032, "uuid": "3e3d9dee-cdc5-463e-81a7-d3f7ca79e22a", "comment": "Malware payload (FluBot)", "value": "352e9dabede5a893b1a7af33bd23fb57e84b7606ee0ccdff1fb08657dd52db0e", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622530032, "uuid": "9f808de9-15b7-47f7-aa1b-410f9caaf499", "comment": "Malware payload (FluBot)", "value": "ba73b04ef692e1ce947aaacf4dd82955261c275c", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622530032, "uuid": "89871cf6-95fa-4f8d-8d17-7d99841ecfc3", "comment": "Malware payload (FluBot)", "value": "7c4e3f5da5527097db7377fab1b7a680a22eb5dcad2b7bb423d37562fbb692e3d28b376c862513776a58335320258959", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622530032, "uuid": "d3977ac9-b78b-486f-94ec-31ced3ebc9bd", "value": "7F162287AEDEE81AC083E136C3799597D408106E4A14FB3B2B75849C0DB7D81AB17EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622530032, "uuid": "5fb25edd-d1a6-4149-b70a-4be1321d4beb", "value": "98304:otknISHh3FZNqsf4VF6cO6iXBBrzXUpBJ1FSzHptw0oo/MTy:wknhlj7SzO6iDrzXUbJ1FSzk0oo/MTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622530032, "uuid": "4dd8e312-0b88-497a-9e5c-3b26a8d554c7", "value": 4235044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622530032, "uuid": "b315af61-94bb-40c8-959c-57b098009c6a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622530032, "uuid": "c1473c3c-d374-4171-95bd-5fe303e8b656", "value": "DHL398.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bb8e4e4-c2e0-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622555309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622555309, "uuid": "44098234-a0bc-4e68-9f9c-8e40e12ecaf7", "comment": "Malware payload (AgentTesla)", "value": "a1f1605f890c027e64a26a30bb54f473", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622555309, "uuid": "a4bd4017-af6b-4f77-9f5a-afe67b4f4c47", "comment": "Malware payload (AgentTesla)", "value": "3735fab98d444297223e389c2a473118164784eabe00196a1476a05487f134ef", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622555309, "uuid": "d7b0655c-0d0c-4c10-adda-8599747518b9", "comment": "Malware payload (AgentTesla)", "value": "3586e04a65ad1dafb640b5a86c9ffe5f45e33772", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622555309, "uuid": "861bf700-a553-4dab-bec6-ec9b52223308", "comment": "Malware payload (AgentTesla)", "value": "57928c595a6725ba79cdec999807d565c24e5488f851b1c110b5e88136a68a4b134e82f7953ee9226429fd8398f7779a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622555309, "uuid": "6fc50f7a-f62a-4a16-9a22-031da934652d", "value": "A7C401B131BC9B18F47D8BF45130A04013B2BABF3566E71C0ED272DD1A22B9187A5E67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622555309, "uuid": "8b98b93e-5437-4529-a7b8-d200b7d282b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622555309, "uuid": "f57ba0a5-1094-455f-8f19-e3d8a3c0247c", "value": "12288:78vfW68vwbTdf/poNj6U+8VtRHLMPCEq98ZEN8:7ofWdKdf/ulc8VtRevq9V8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622555309, "uuid": "33043a5f-2ba5-4ddd-9f75-95e5c65ad2ee", "value": 556032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622555309, "uuid": "95872426-d543-4d8b-89f7-5357ba434d42", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622555309, "uuid": "4a258764-0232-4f09-a5ef-358e305df1d5", "value": "202143 31 5 2021 PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b2544f7-c2e0-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622555522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622555522, "uuid": "661e11e9-e34a-4ecb-a987-5c8fc7ab7358", "comment": "Malware payload (RedLineStealer)", "value": "48ca1047314e091e8b2c6afc557c9f13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622555522, "uuid": "ccb0b7de-946b-4877-83f5-a0da9362ce94", "comment": "Malware payload (RedLineStealer)", "value": "37a8c9dbb2bd8c64a1fe0e1d72e812db8e54411e2a97598ead5555fd0b1127c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622555522, "uuid": "af054710-f9f1-4a23-a1bd-e1c67619b22d", "comment": "Malware payload (RedLineStealer)", "value": "914f443f50489c1a25b0a8e41378534061b913be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622555522, "uuid": "a0e33907-1a05-467a-a8fe-9f041715034a", "comment": "Malware payload (RedLineStealer)", "value": "739cd6760c8afcb44e94ee8820fd7f9f4d076ed274907e86ccacb74f8be7a9b0efa5eaa134d8a2bb7e0e9e20651942ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622555522, "uuid": "6883dfc6-9d03-4781-9674-0202334d1c96", "value": "C6849F10F650D035F5F336F44A7B82BDA629BEA1EB6450CF62D46AEA56346E0EC31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622555522, "uuid": "20570115-1219-43ba-8d21-af9fa2344bfe", "value": "63c85c090ca4b46213d1d3501aebeb61", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622555522, "uuid": "684002be-2d6c-4b38-ad0f-79326789c419", "value": "6144:0u/LQW27u9bNhxNZgYZXzrRfbAY9LjDA453IDpYSjXwhuXSKCgh0szy+:0u/c+FvxNZ3Xzr1bVpDhDSjAhuCGvy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622555522, "uuid": "4faf8ba3-1c73-4e6a-a7f8-c01f4ec0dd4b", "value": 397824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622555522, "uuid": "89efc483-cf6a-4c41-a07e-45935b525f1a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622555522, "uuid": "175e0750-2634-4b7e-9182-7785813e16f7", "value": "48ca1047314e091e8b2c6afc557c9f13.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62f8dfc9-c299-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622524961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622524961, "uuid": "e57a16c4-afe4-4fd8-943a-27a68a23659e", "comment": "Malware payload (Formbook)", "value": "8eb4ee839c5733c86b0fa32b2460f03f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622524961, "uuid": "4c191e4d-9f27-41ba-a30c-d0f3c4cd3ace", "comment": "Malware payload (Formbook)", "value": "380d7d1bb1a62dd980d700d3f7d0dcb30ba83b21d93939eb86e64802f0e6f641", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622524961, "uuid": "6d1aabba-d32d-45ec-bba4-85e7e9fe9d31", "comment": "Malware payload (Formbook)", "value": "15627900495b60feb31acdb82f5e0d6be264624d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622524961, "uuid": "79c38e5a-df87-46f4-8a91-62a0f955f462", "comment": "Malware payload (Formbook)", "value": "f097102d5530452fdf101395b6dc4690e2c7c27f5478390e8e43f04d21b34c4974a5e4504c63ae57447507f552642edf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622524961, "uuid": "34c4709b-d760-4f24-b288-066882ca544d", "value": "1605D126125AABE4E27DC7B840A4D87303F5B9D3DF12CB3DADAC50991095B8486D237F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622524961, "uuid": "8c4b4c47-6e42-4daf-be9b-b690d08ecd87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622524961, "uuid": "0b09591f-fc5f-4723-b42f-5d3b76de457b", "value": "24576:7Edj0wnos5Q5gRU7xlsePotEqv2ElQz6j8t/UR9Y0mg:7EdAT5J1lsrP+8f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622524961, "uuid": "9b2a10f3-c1db-42bd-9286-783237abf8b6", "value": 862720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622524961, "uuid": "6d8aa40d-4f37-499f-9955-ff21cee02bc1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622524961, "uuid": "a7468765-ea37-412c-85ef-f5670a63b421", "value": "Swift copy_9808.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f86610d2-c2a4-11eb-875b-42010a9c0053", "comment": "Malware payload (Stop)", "timestamp": 1622529936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529936, "uuid": "ac4b0ccb-af3d-4faa-b024-615034bfc0f1", "comment": "Malware payload (Stop)", "value": "3f12c5402938c20096a6b05b955380b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529936, "uuid": "542d2940-6350-4f9e-9cf0-6bd6e18b87f6", "comment": "Malware payload (Stop)", "value": "387b599ab1e1f3dc00f924f7ab4463b5730d00d7591c78137eb9d404d565b302", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529936, "uuid": "3dd8d84c-c749-42f2-a5f7-410a57183323", "comment": "Malware payload (Stop)", "value": "e54e42e5fc04e37af8df0a367da355a67785a531", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529936, "uuid": "fa98a6ba-c654-46ad-b554-feeece95f6c2", "comment": "Malware payload (Stop)", "value": "01c0468e4a3938c5a649e02d2f2eb08c91025f0447ed6062c3ccadaaf31cb83494d31115218397de296067b8daf0c7ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529936, "uuid": "a16b8921-5fc4-419d-8571-a1c4a4c191f4", "value": "F605F1007B90D034F1B335B55A77826DA62E7DA1EB2451CF63C4AAEE2A356E0EC71347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529936, "uuid": "c31777a5-33aa-4f33-b927-2eb4df1bcc56", "value": "2f20facc3edc1d8ba24ede1f07abf090", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529936, "uuid": "c1d95823-c772-48f5-a933-a4c7c0a45e71", "value": "12288:QLvGvVPVrGzjQp5LBwGq8jNKBqeyfVEqRHUVP+5QBzNsi1KASxcgut:QLSRVrGzSdcBpqVEAmzai1KpWR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529936, "uuid": "004946b6-b8f2-40e7-a281-d750d34cbbfc", "value": 861696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529936, "uuid": "bd572210-d630-42b0-852a-6fbae2e4ab38", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529936, "uuid": "532ed13b-b1de-4137-8f0c-18f536ff12ad", "value": "3f12c5402938c20096a6b05b955380b1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0014db56-c2a3-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622529090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529090, "uuid": "39670f6a-27ad-4d70-ac38-976107a773d2", "comment": "Malware payload (AgentTesla)", "value": "d64307f249329d91340647eccd0f7dbf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529090, "uuid": "ac4eaba6-4709-4421-a29f-44b2b7c39024", "comment": "Malware payload (AgentTesla)", "value": "38b8e69e6478da910a8f0d1322a8c17bf16b7ca2f8be612f58c1e09fcf266431", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529090, "uuid": "b2b7d53d-f7ad-47ca-b8bb-864172bfb9e1", "comment": "Malware payload (AgentTesla)", "value": "3641cac943f083f9dd23914fba6d700af6c5fed9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529090, "uuid": "37032bd2-afb1-4ba0-908c-be728b4268ad", "comment": "Malware payload (AgentTesla)", "value": "9e362dd8215c45ddeabd6c801ef56ae256e7f3e9808354b59b19c85314e1d98da90ecb1894ac036b2dec52150c53eb41", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529090, "uuid": "f0b429cb-8447-4f98-a465-5d1534188059", "value": "664528F9F241D4D0F50ED672CE90BEF856126DBECA06091B01A97EC93577B9B4B3A042", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529090, "uuid": "a97128e0-15c5-43d8-8989-f2477a3b3c87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529090, "uuid": "2dbd9eac-c096-4416-b2cb-7e9c8a6e7c3b", "value": "12288:EUa9jvTmYWKVVV1eMRHkVP89kYycmz5pTFkL7EcKltSL5EOvP9kalv5kP1:YUn+V3Gt8XyuLIcKltcSyWov6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529090, "uuid": "285dc5c3-54b9-439a-bd25-e8eeb5a47104", "value": 1266176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529090, "uuid": "7329c8c7-12f8-43b6-8b14-53a02d21071e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529090, "uuid": "dd74b635-33b9-4cc3-88a0-c2b89fb39e06", "value": "PAYMENT INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "055accab-c2ae-11eb-875b-42010a9c0053", "comment": "Malware payload (Stop)", "timestamp": 1622533823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622533823, "uuid": "0c44fbb2-a245-4533-be1a-b115b3e0dbe9", "comment": "Malware payload (Stop)", "value": "c059704e95d127cf722e9170f8376f3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622533823, "uuid": "f40fb62a-3ed0-4635-96dd-05156b7e64f0", "comment": "Malware payload (Stop)", "value": "3957d209e4cfae390f47dae135b3edfad6b5914d177e898635cee40d330781a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622533823, "uuid": "23efb470-40a2-474d-bf1f-efc8c7444b64", "comment": "Malware payload (Stop)", "value": "c99f718bd9412c29da57eac91b3c4159c7518244", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622533823, "uuid": "9ab2e472-10ce-4058-bebe-6212d354c719", "comment": "Malware payload (Stop)", "value": "e8314928b329ff26d7ec30f351113a30fb677711e4913bb9c7396b5c7871fb2adf2d1c56f238f020887691cb622d2101", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622533823, "uuid": "61e09296-fe7a-4e35-a466-1075af281b07", "value": "AB05F100B791D034F5F236F58A7782AD5A297EE2DB2451CF12C5BAEE5A346E0AC31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622533823, "uuid": "6d5f81b7-83c5-4bed-8710-3353564998e8", "value": "2f20facc3edc1d8ba24ede1f07abf090", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622533823, "uuid": "e0d7e225-94c5-478b-8f8a-d9a6d305d544", "value": "24576:Z0cRVr/z4BkVG8hWcPbusQ3p810B6dWPopRF:Z3/gBoGEWcDnGb6IPopj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622533823, "uuid": "2a52bfd6-748e-471a-a767-f3e2684dc07b", "value": 862208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622533823, "uuid": "35de10e6-7ae1-4f27-ba20-0fc4e7347456", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622533823, "uuid": "6d4404dd-021d-4652-ae19-58c294e5a6c2", "value": "c059704e95d127cf722e9170f8376f3a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7f49690-c29f-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622527653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622527653, "uuid": "3b385deb-9ccf-4b4d-bae8-6a8008f8d417", "comment": "Malware payload (AgentTesla)", "value": "0cd49295e80faf170c9e409086877aab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622527653, "uuid": "2118fa1d-c942-4ae7-b191-130c9b3e4d0d", "comment": "Malware payload (AgentTesla)", "value": "3aae6daed910bbe29974e3c7182a68712681a16f78e1718476a00245039a3108", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622527653, "uuid": "768405d1-a6ab-4999-acc1-0c3858dd9d3b", "comment": "Malware payload (AgentTesla)", "value": "007cc9b559a17e742b9946913fe2a3ae2220af81", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622527653, "uuid": "da3ba812-f0a6-4bb0-80e8-b233fd484640", "comment": "Malware payload (AgentTesla)", "value": "9e8384b0ab1c85ea2055598b95cb9224f28e5b281260f0860c44bd60d2043e234f88d3dd54244b0a5f685d4967571d65", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622527653, "uuid": "165273cf-7374-4d41-bf4c-0e244fb6e95b", "value": "02B3AEA2B6F5E802DD0A073648E38BE7A2677C519FD7874BB285F30E4B75EC04906257", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622527653, "uuid": "918e4170-fdfa-4b9b-aea7-d6b7c73179c7", "value": "3072:uk3hOdsylKlgryzc4bNhZFGzE+cL2knAWeCqQYWe/6m8bU1Y0k6y:uk3hOdsylKlgryzc4bNhZF+E+W2knA8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622527653, "uuid": "19507f5b-10f8-4077-9f19-5ab5cc65786a", "value": 107520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622527653, "uuid": "e0d5e959-fb3c-4e11-8b5d-5bfbba2680c6", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622527653, "uuid": "24482f9c-2cf0-4c3d-a669-32da4aabdd8b", "value": "IMG_065017223.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d64190e8-c2da-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622553071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553071, "uuid": "d57a0ef4-fa47-4719-8bce-158caebcbad2", "comment": "Malware payload", "value": "3b7450adbb5d0ebece1425045c213e03", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553071, "uuid": "41e83fc2-149c-4e5c-b402-d326bba51047", "comment": "Malware payload", "value": "3b02018be8e526e74028f065ecdb95ea375f51b06cedef844fb1e633c40a7fd7", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553071, "uuid": "c55f86d4-95ed-4a5e-a5e8-7ccfddad48b9", "comment": "Malware payload", "value": "d98231251061f987ea051695d3673c4bb6b67d46", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553071, "uuid": "091941d2-c240-473b-9e1f-f0e0dade2efe", "comment": "Malware payload", "value": "f1e4ff6857ddbe7a5255412eecbd59d6d9039a01a1b16ded4e50e7fb604a0b54af3b236f1caf1e2ca5ab9db917533736", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553071, "uuid": "2cf07647-258c-4493-bd8c-8dbda62279f9", "value": "748557F0AD01D4C1F57E5B6AF2FD3A48A1343217EBC94A4A00E7E5551EF6A11B90ECCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553071, "uuid": "e64cbb48-900f-4671-8aef-68258e805320", "value": "12288:Soa8sDCVZOLbSkVn8/xU/KD0163ByZR/uuychjuivKA:Soa8MCVZKbSkVnCxU/i0+yPqvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622553071, "uuid": "29b04692-bff1-4129-bd86-1f8cac2a2c70", "value": 1852808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622553071, "uuid": "c786a188-835d-4696-a841-9ff95d188ac3", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553071, "uuid": "a90035e7-0068-4ad3-abd2-c63847394815", "value": "New order 201534.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b73c9da-c2a3-11eb-875b-42010a9c0053", "comment": "Malware payload (Matiex)", "timestamp": 1622529162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529162, "uuid": "94331c12-1d4e-4848-9278-36b6f2ebc24b", "comment": "Malware payload (Matiex)", "value": "c982d394b35091d3e8ca9192feb154d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529162, "uuid": "4ea1efa9-5635-44b7-b606-b58ebda1492e", "comment": "Malware payload (Matiex)", "value": "3b26d0eed9d4227e81df890c7c0f19c53c8a88bcba470d89b5865ea1709c3ad2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529162, "uuid": "f3fae6e4-9f77-4064-85b3-7f86be5fc797", "comment": "Malware payload (Matiex)", "value": "a7e6444c0f4bd3b52ea073b4f2a8119eb88d9d13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529162, "uuid": "2ec88e53-2658-4d16-816e-726e98f1391e", "comment": "Malware payload (Matiex)", "value": "e76a99cdb335c4e89c335c0da41c68c792eeeca4e1a8491d36c95baa1d2b04f21ddd31fbfb254c1253feb7ca50cb618c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529162, "uuid": "1c14aa2a-637a-443a-912d-594c5f9682c3", "value": "B0157CF4F19898F2C14ED772C795ACAAE76202FE5253491C09B9EB8C1B4378E8F4D845", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529162, "uuid": "4f77a1b5-f50a-458a-a1d0-bcbc9cb89294", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529162, "uuid": "a937d352-13f6-41aa-b0f1-6b4146f75ec2", "value": "12288:CtVw8GrhvTnJmVCSu/VQHEu6OboZAdNVGneBu42taOmqq/:CtVGrtJS8/V8EdObJGn+2t8q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529162, "uuid": "825b5b1e-482f-4657-987f-1650379114fe", "value": 887296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529162, "uuid": "a2a9e035-b77b-4ae9-8824-2ebc232f0e4b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529162, "uuid": "6c8220dd-897f-4ccd-90f6-135e598187ea", "value": "Specification__Order_612021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d14a981-c335-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622591925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591925, "uuid": "8cca7b84-c006-451f-bbf4-dc97dc9d477d", "comment": "Malware payload", "value": "66534e53d8751a24a767221fed01268d", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "NativeZone", "colour": "#3FF26C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591925, "uuid": "56514964-59db-4ff6-aa23-423623cc1d30", "comment": "Malware payload", "value": "3b94cc71c325f9068105b9e7d5c9667b1de2bde85b7abc5b29ff649fd54715c4", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "NativeZone", "colour": "#3FF26C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591925, "uuid": "5a05d001-8c52-4af9-9846-d1011e99b604", "comment": "Malware payload", "value": "fc781887fd0579044bbf783e6c408eb0eea43485", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "NativeZone", "colour": "#3FF26C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591925, "uuid": "a2661986-b0ef-4016-94f6-d031936edee9", "comment": "Malware payload", "value": "7a0c2978cd0bf2323554c907023fe42128b12d8bbceac3a48eab83ef61044814154b9896c0b58828feabe316f76e3a8f", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "NativeZone", "colour": "#3FF26C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591925, "uuid": "5bbb0de4-2201-4964-9f05-5057d0352a7b", "value": "6E54E1607EA37035D9DC4DF115B8F0721A3CA9518AD289AF3FE62D2D0F316A05B2791E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591925, "uuid": "c945cf00-3672-4e00-811c-adf22197936b", "value": "a3e5fd5218aa8ab2d136d8141d5f022b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591925, "uuid": "720434d8-3000-46a4-8399-3cd8e2ed44aa", "value": "6144:qLH2gY7rrs52ACS+ToF3dxmTZysKwlVAl519k7nm9OQ4nFI:qj9U9ovI1V819k7nNFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622591925, "uuid": "395915a5-aa2e-484c-8035-d7bb04a08e2a", "value": 288768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622591925, "uuid": "acee9ecb-9d62-4e1c-a49a-708a1d2d4449", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591925, "uuid": "209741e2-1748-446a-81d9-2239dbf9c378", "value": "3b94cc71c325f9068105b9e7d5c9667b1de2bde85b7abc5b29ff649fd54715c4.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc9eca94-c2a2-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622529030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529030, "uuid": "3b47d99b-dc49-4af0-b6d8-6a8e8ed65350", "comment": "Malware payload (Formbook)", "value": "1c908ffcc8fb66b63ed6c6799ceeae2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529030, "uuid": "8cc119b1-8fa3-40e9-960c-c8bad5a36c45", "comment": "Malware payload (Formbook)", "value": "3cec9bd714745b020366af9537184c619794ef4dee36c99093f53b243c97dcc1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529030, "uuid": "0553d614-42dd-49e2-a7fc-d5adff077f03", "comment": "Malware payload (Formbook)", "value": "a955b5ca78087fc1b68c8a391a4dd015bd829f9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529030, "uuid": "c52b61a3-e697-44a5-92fb-d54b2f4ec4aa", "comment": "Malware payload (Formbook)", "value": "7f0d592f3f8e5646e13edf868a80f6b969a2cf16e2d7b427847955b97b668e01876e18d78949b9fce50f4da94c152aa9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529030, "uuid": "bccb2dd1-77b3-4651-aeb2-53fd2cdd94f7", "value": "6B94E172BAC06D2BC536D7B4457AC13056BBEE084641D80BB7E8BF2FAB36752E814354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529030, "uuid": "b6c6bd76-66f1-4ef1-b940-c19eec2dddea", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529030, "uuid": "05715b2b-40e6-4b41-87c6-7f4c2db0dd92", "value": "12288:E5mFvcyYQhfvWZDA7bMP4KVwjPldd/N91p:lFH+ZM3MQKVwLhVJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529030, "uuid": "32cc46c8-e269-4729-9e6f-3881f9986573", "value": 427600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529030, "uuid": "059e875c-2df4-4c52-a457-e7fa7d3e1026", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529030, "uuid": "6945db7a-02f3-41a7-b44d-4482ab465ea6", "value": "DOC1073.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfd880a6-c2aa-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1622532418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622532418, "uuid": "cd90974f-206f-419a-b43b-cac8f9a2e17a", "comment": "Malware payload (BitRAT)", "value": "c57aa6170ddd18a3d5662f27ab5a37ee", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622532418, "uuid": "857ae21a-3ecc-4aca-8eb2-ba6e91452f4b", "comment": "Malware payload (BitRAT)", "value": "3da1df40a9b987cd1fa8d9d4ddab806178ae4157ecb01f22c849220be33416f1", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622532418, "uuid": "95b84c7e-f12c-4a09-b6db-134c51fe4eab", "comment": "Malware payload (BitRAT)", "value": "aab95ef357b23dd31351e76def1a0fb75cb52cd5", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622532418, "uuid": "6b9ab2a1-b0a0-4ff3-a912-fe636af3d392", "comment": "Malware payload (BitRAT)", "value": "731eaf6ee93d92baca63272f660d54a599c095fdc76f7b674f30253b125a85bef8e34826e9ce3bd58044046f203165c5", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622532418, "uuid": "3d125406-170b-40a1-ad75-c5dc49399c2c", "value": "AA9239827FD857B3DF6C47F518A2468043B5511A6562EBBE6CD490CA2E12F9807C2E3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622532418, "uuid": "9283eef3-4c1d-408d-a0b6-5e6eb5b09d27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622532418, "uuid": "b5318ac9-d28c-4765-af13-c3cf13d437b0", "value": "384:3Mno/0No9YUhAiqhPeo/gyXgCHPZFFUuokwlwA70o2dxRLEO9PfZ3X:IozhAiIXVvVdkO5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622532418, "uuid": "a377f847-b56a-4fd2-8f85-1ee1e130f108", "value": 20480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622532418, "uuid": "07d0cb2b-f8e0-4a41-8902-10fb027e74b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622532418, "uuid": "ee6a3baf-986e-41a7-9fbd-22cccc4624c9", "value": "C57AA6170DDD18A3D5662F27AB5A37EE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c8c665b-c2db-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622553243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553243, "uuid": "7eb88d18-eabe-4419-9e6c-761ffc03af0f", "comment": "Malware payload (AgentTesla)", "value": "0471ad5575abe49aa77bba71482c918d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553243, "uuid": "33a0f58c-727c-494a-b55a-c34e027efeb9", "comment": "Malware payload (AgentTesla)", "value": "3daf49b81d1c57e27736ae2a02507ba5db772fc23e27fc452d6f8527f2afe7b1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553243, "uuid": "1b21594a-d4ac-46d2-bf55-ee1bf4fe3d5a", "comment": "Malware payload (AgentTesla)", "value": "16141d869f79d9057893f545baf9d02b3772ae8d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553243, "uuid": "c1add240-06a0-4746-a32d-4dc0e7d8043d", "comment": "Malware payload (AgentTesla)", "value": "b40ab44a55fe4f052b6a652ab31211d5431fdf085b55621d976ad1a9aa5d69dc196761f43d8578a8cd59dddf7adc084f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553243, "uuid": "211bcf88-765b-4304-bf25-0643489811d2", "value": "A7158DF4F59898B2D14EC772C791ACAEEB6201FE5203496C0AB9DACC1B4379E8F4D445", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553243, "uuid": "f39ee1ad-eb4e-43ba-850c-ceabae0aff29", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553243, "uuid": "95e0443d-c84f-46ba-854e-b996887324a9", "value": "12288:I2JoMbtrhvThTz5z0ffKT/Dguf0vtnkKlYQ0PPu9ID0YwrsQWg:I2JDtr7H5Affc/D7MV1x0XwYxRg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622553243, "uuid": "71e160bb-af3e-469f-8240-f5805451bb33", "value": 905216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622553243, "uuid": "9352a167-b298-46f8-a1da-d55604919a6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553243, "uuid": "4f9ac241-8f34-4878-b01a-0462a0f3a1ae", "value": "PO-079SN70-NO#10-Order xls.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa14f69f-c2d0-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1622548702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622548702, "uuid": "2f62352b-edfd-4a65-b5bf-572c02b435a9", "comment": "Malware payload (Quakbot)", "value": "e0b2476284b229f8d902b66fcf202aed", "object_relation": "md5", "Tag": [ { "name": "ANKADA GROUP d.o.o.", "colour": "#C29E4E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622548702, "uuid": "0a7560ad-d862-4ff9-830b-a7c319eac099", "comment": "Malware payload (Quakbot)", "value": "3dd13a7ac7e2249f933efe211a4eb64dce0c13811da83e7c41f11c28d3aeac03", "object_relation": "sha256", "Tag": [ { "name": "ANKADA GROUP d.o.o.", "colour": "#C29E4E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622548702, "uuid": "08c7cbc3-865c-441c-b01d-4adc4b84252c", "comment": "Malware payload (Quakbot)", "value": "ac6ebde71af45afb5c78b98ab888a6017f7329bb", "object_relation": "sha1", "Tag": [ { "name": "ANKADA GROUP d.o.o.", "colour": "#C29E4E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622548702, "uuid": "03bfbedf-6b8e-4249-b1bb-260ab80efd08", "comment": "Malware payload (Quakbot)", "value": "f341af3735cee603cd42aef6b7ebe1b16ea7f3e3eeff85df8301713e4b3a7288cd857d6644c50943bed1a2beccacae57", "object_relation": "sha3-384", "Tag": [ { "name": "ANKADA GROUP d.o.o.", "colour": "#C29E4E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622548702, "uuid": "23f2b741-53f6-4a97-b96c-7676afc51925", "value": "5E45AEA435C6F132E07520308F95D9FC1728BD11AB5A0ADB37E02F9F6D6DAD26631722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622548702, "uuid": "d1d08335-aab5-4056-8d66-ecbf8c5c8094", "value": "0ed466b2251d50e532029d12ce278b8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622548702, "uuid": "11644939-d0a4-4cd9-8c2d-f323a59cd008", "value": "24576:f+pepiaKOv8yfFBexidQtpIGte8CBwLCAJCLLM:2aqsFRdgteDBwsM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622548702, "uuid": "41c0e9ec-84de-41db-85bd-c461e1eb7384", "value": 1247176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622548702, "uuid": "ef0a8283-f909-412a-a400-be7e07f7ae0f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622548702, "uuid": "385a7e31-521c-45da-a3bf-5f40b365c9e9", "value": "3dd13a7ac7e2249f933efe211a4eb64dce0c13811da83e7c41f11c28d3aeac03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45fdc9e3-c2db-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622553259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553259, "uuid": "3e15b884-d620-4060-a511-80edb7a03568", "comment": "Malware payload", "value": "63ec5677f843b7ed3ee6c1da27fbee27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553259, "uuid": "12fcb6db-5ecc-4ad7-bc63-37b30c7cb5df", "comment": "Malware payload", "value": "3e75632899bd44ec5be0f6ad8ddd6b04f949a30527b6448c84a6b0f30f0a4087", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553259, "uuid": "eba80006-4d80-4a26-b46b-bf8b74d5f230", "comment": "Malware payload", "value": "bb7c321fed58b301959fa94f5831fa2628775592", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553259, "uuid": "4ae13f97-1c91-44cd-b5ab-0084bb1d9704", "comment": "Malware payload", "value": "923e6ecb383676369523a86b8173faf0d12da0bdf5bb4c64714fd53ea97cfa43d923579523fd1193c5af258d5d447a8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553259, "uuid": "547439d0-6b4d-4064-9bd1-8dc1de6c0b47", "value": "50D4E053770EA66AC4970ABEA887E544063E7E108CD7C7B67589331E06F77568E30F42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553259, "uuid": "76b05d99-957a-421c-8796-77deef99d61d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553259, "uuid": "1f5aa219-8103-4c4c-bfa9-474bfe8b4575", "value": "6144:fsnwCTXbMP6M5eAbIxVDEbfXBExoOSwKk6h0vw:mw8rMiM5xbqIfR8P9w0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622553259, "uuid": "4d4f7f10-2711-43d1-b850-030f3deff50c", "value": 600064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622553259, "uuid": "c796a1b0-1224-4362-a285-307bc5ae3e98", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553259, "uuid": "9a659eb8-f889-437a-bf7a-acf6fb69027a", "value": "IMG-619370-720182_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "307c353f-c2a5-11eb-875b-42010a9c0053", "comment": "Malware payload (FluBot)", "timestamp": 1622530030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622530030, "uuid": "18a7bb18-a163-4206-bc75-a2ae40b4275d", "comment": "Malware payload (FluBot)", "value": "155953e69a4512cd222fd13863228a1f", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622530030, "uuid": "e7c3fff8-a544-4837-8c1b-83a7fd441ec1", "comment": "Malware payload (FluBot)", "value": "3f92de4c765321d0d022a607266351cea4de1929a5eceae07b3d76b5d606716c", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622530030, "uuid": "67b55a31-1b9c-4ed6-986d-1784ca934095", "comment": "Malware payload (FluBot)", "value": "2c1d549a0691b45ba219508742af51105fb5a2ee", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622530030, "uuid": "4aabf8d7-be97-4e10-8f9e-56db62454ac1", "comment": "Malware payload (FluBot)", "value": "fb70d834b5dce89996e8f5e04d380170277403e36d6959e3ad6229d4366da1157ae6eada029351e00f6a732bfcb19237", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622530030, "uuid": "4b3e1ab1-d3d8-4890-b06e-bac1930628d1", "value": "8F162216BE9DE81EC203E13D89B19DA7D848106E9614FA1F1B75848C0DB7D82EB16FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622530030, "uuid": "57d51141-8729-4d11-8698-4b1f31e8b4ef", "value": "98304:lSknISHh3FZNqsf44T4QC6iH0BrzXUpBJ1FSnhjThemFjMT:Qknhlj7LfC6ikrzXUbJ1FSn3emFjMT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622530030, "uuid": "267bb30d-a92a-4cb4-a55f-2eacd6e55490", "value": 4235044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622530030, "uuid": "3ea390ad-d9b2-4918-9376-6f8a754ae181", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622530030, "uuid": "40106a83-1eb7-4e23-b22e-07da20600313", "value": "DHL29.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bc9b662-c2a3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622529136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529136, "uuid": "a6165a5f-5c68-48b5-8177-dad75716d388", "comment": "Malware payload", "value": "0603c8b039cad2a695efb7a3b102b3d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529136, "uuid": "00c2a0d6-f48c-42cf-b906-519d7121ff33", "comment": "Malware payload", "value": "4068367bc59ad89c43c9024b63d4057942626c13d4cb4233ba14218a5f1d2ee8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529136, "uuid": "984c9c52-8d91-45bb-9ea5-b18d8ec6602a", "comment": "Malware payload", "value": "e493828998953e39a5103cde4f6bb80fa1330322", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529136, "uuid": "50fa37cd-770c-440e-83d8-b95a413b2922", "comment": "Malware payload", "value": "fdcc894ae0bd9d5190c1c5d6f3b19de46b58352e458ca2df147b6103a4b43e73278f70ffdcde5dd32981906c19459559", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529136, "uuid": "2ae5d662-d4c9-4edd-a918-9a8810bbd5fc", "value": "0106482439EA501AB173EFAA8BE478DADA6FBF733B066459109133460733981DDC153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529136, "uuid": "0ef4b877-1e45-4a15-9e82-8e2bb996c8b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529136, "uuid": "5db6844e-ad6a-4c95-a81d-e0ac1c849a94", "value": "24576:U8Jw4dBEDfCmKnzwcsIYgdxzOsZ5o7NZn0IoPNdrdsNgAKMZRJ26zDSa8I2XktGN:p/Uf7KnzjsIvx3NdxBe1zWvp0dYi5w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529136, "uuid": "d199ddc1-389a-41aa-9b67-7ac65a4e5502", "value": 3932672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529136, "uuid": "e9dd907f-b746-4a3d-ad71-fc911314ca3f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529136, "uuid": "5427acdc-80aa-4872-b9a6-8b800fef534a", "value": "0900080009000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d29409a7-c2e6-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622558219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622558219, "uuid": "c6ccd63a-e747-49b7-9c82-4bbb89d82427", "comment": "Malware payload (AgentTesla)", "value": "2c26d7685f95521e2e40e149003a95f1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622558219, "uuid": "b0a656d6-dce5-4e49-afdf-5d38894a3efe", "comment": "Malware payload (AgentTesla)", "value": "40cbaf59854994db0eddc7f6e367229d13b5be583f325552b1a7ee7bd35504e2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622558219, "uuid": "dd229c14-d3b6-4baa-974d-9ed560563fd0", "comment": "Malware payload (AgentTesla)", "value": "0e60dc452d19044636c722c4952e2119d10b4885", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622558219, "uuid": "2fb613bd-a1a1-4c69-8cfc-b893b334d81b", "comment": "Malware payload (AgentTesla)", "value": "bc63c93c96f2d49014835d3d7fb67d904b0e97d0c90859b06da12688f0c5dd6561fbcacff01bce836f6c2776e1424e2d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622558219, "uuid": "980e8a89-1076-4a65-a0de-54c46ce31869", "value": "9AE4CF3623E05968E57E877590340950A7F2B902E722DF5EF8CE06990F637C79B0F626", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622558219, "uuid": "92ef5730-421b-421b-a1f4-30260b76aa35", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622558219, "uuid": "6d9e9cc4-c331-4d14-9604-30be1d608930", "value": "12288:y0eeXklXH6PQuxm16KALWyTk4nQMecqARKUMe:ydeX/PQuxi6bk4Q0q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622558219, "uuid": "d39a6908-a68b-4356-815f-28cc34e027a4", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622558219, "uuid": "b4d5497d-7130-46a3-97d8-d1539a28bd8a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622558219, "uuid": "91badcd2-f02e-4b1d-90a3-4beb80533df5", "value": "BNC41171TRF32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fea07c45-c2cc-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622547126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547126, "uuid": "dc553196-fbd0-46fd-be97-0696bde0ff3c", "comment": "Malware payload (RedLineStealer)", "value": "baa2e0fcec088e5c10610441401897ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547126, "uuid": "0ef67a10-678c-44cd-a5bb-7ba7d371cb14", "comment": "Malware payload (RedLineStealer)", "value": "4214be5d965b37b39719e498f254a788bc458c9e943e1d99e7a5b781892d237e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547126, "uuid": "b924afaa-e724-41be-b09f-40fa6e13f122", "comment": "Malware payload (RedLineStealer)", "value": "3d46906b636fce97bdc3dd68be86372f7b073942", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547126, "uuid": "91c65ca6-be7f-4f03-8838-8eebc814b028", "comment": "Malware payload (RedLineStealer)", "value": "ae619f5ce43de3a3e54fd8de634a764f2daff6b66ab4ea349b3a53de9c5652984efa748933832c15eb7c8aaee56e97d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547126, "uuid": "54c6a26d-e148-44b4-9191-336562f2dc08", "value": "61849E10B790D035F1F336B44A7792BCA629BDE1EB6450CF62D4AAEA16356E0EC31707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547126, "uuid": "26d3b28e-21fc-44d0-b471-c03c489cbc3a", "value": "84a7eb4192b6bf7f0b88f528d598a47f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547126, "uuid": "b4846ba5-316c-48df-a06e-bc1958a8e8a8", "value": "6144:6dOL82g8RUPrtYpn9i4SKlP8KO1J1zelb+dxqExZgwzinNDLTACWTvpbV:6dOwgUDupn9OKiKEGlbqxqEzgQinZAx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622547126, "uuid": "752c7107-b68c-4a69-985b-268910d6ea74", "value": 397824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622547126, "uuid": "7e04a5b8-a797-4d5f-a7c3-6606d3e21f55", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547126, "uuid": "a60f7fe6-b785-4dbb-8952-5d8d5e183ceb", "value": "baa2e0fcec088e5c10610441401897ef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8cec588-c2a5-11eb-875b-42010a9c0053", "comment": "Malware payload (njrat)", "timestamp": 1622530312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622530312, "uuid": "7bc0fff4-26d3-45da-99af-c24a1124589d", "comment": "Malware payload (njrat)", "value": "a2f3f98031dc0ed2007355b6b12f0968", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622530312, "uuid": "e15d7671-cdd2-4c5e-a013-eb5cc11902b0", "comment": "Malware payload (njrat)", "value": "44daeb817d6f9ba005d5b12f6ded8a5a2c969a65e3d709afcb1978b5b9dd78fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622530312, "uuid": "1e897be2-d23b-429e-a7d4-57fd308b7a41", "comment": "Malware payload (njrat)", "value": "bd5d457420a4e17ad6c9e3425df4f2add6c240b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622530312, "uuid": "882dd934-35af-4cc7-8b2f-e28c88b7a1a0", "comment": "Malware payload (njrat)", "value": "acdb7261ff429b73bb6629bdb53a60004bec11e3c38b59603e09115842b534c454676d689e0f98aa6b81c9c81f7d8493", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622530312, "uuid": "076e42f7-9e43-4a5a-aafa-c275193cb8de", "value": "B8033B4D7FE18168C5FD057B06B2D41207BAE04B6E23D91ECEF164AA37636C18B50AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622530312, "uuid": "44951640-72be-4692-ae7d-07ecd9bb8403", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622530312, "uuid": "de59adb0-ae69-4ce4-b2e9-ad51d218cfae", "value": "768:uv+DemUbCv/cPLADsHf0XVrM+rMRa8Nun1t:u2D6bW0jssHcXO+gRJNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622530312, "uuid": "f951de67-89dd-4387-9b8a-04010566f705", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622530312, "uuid": "273500d5-1a0f-4e99-bcbc-35ca349a4793", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622530312, "uuid": "cf19acb1-ee14-4eb5-8f20-55585bc21c60", "value": "a2f3f98031dc0ed2007355b6b12f0968.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7ecd7ab-c2ba-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1622539330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622539330, "uuid": "2738d22a-dc4f-49ea-97e6-6d168cba5c81", "comment": "Malware payload (NanoCore)", "value": "7fd41119cd2f2bd6fe13aa60eafd534d", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622539330, "uuid": "b36ad2b3-2583-4aa8-9c6e-58507d1271c8", "comment": "Malware payload (NanoCore)", "value": "46470e5d1165ebd652727c2eb110e7955691a0d374d24929d481aaf9848f442b", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622539330, "uuid": "6af5b93b-aa64-47b9-b9ab-91d72941f79f", "comment": "Malware payload (NanoCore)", "value": "f0122d5ca22aefc96a58055a69705bfa2de0fdae", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622539330, "uuid": "19de791e-0074-4a60-82c0-1d9f55a600b4", "comment": "Malware payload (NanoCore)", "value": "64dcb6842ebedf39c34c4a9924e48df27025a8348088d510aa377c6186af1186104dd52ae9fab4ed6eb170790a1a9782", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622539330, "uuid": "9ab1512b-ec8b-4f94-9187-e07d4b24b501", "value": "675523529ED1D70FD96E12391777C0172DBCCDAA7A4CA063F7A0330E72B1A324BA6459", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622539330, "uuid": "e109733d-4135-4581-ad0a-755363aea906", "value": "24576:7OJR8RqMmplBokkU0mVGnfJZIxJ2R9m9fIov80dGGNGb4NLB1ZGIER9:A4qMmDBDj0mVYfJZAYR9m9Ii1G6GbAZO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622539330, "uuid": "9525a68b-1ec1-4b6c-bd17-6fda9f942866", "value": 1282712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622539330, "uuid": "56991d5a-5d67-4987-b72a-b65a87ed966c", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622539330, "uuid": "aeec7efb-8e7e-4211-8633-da2a47720251", "value": "LOT_20210526.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29fab50e-c2e2-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622556218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622556218, "uuid": "c0e04209-f94b-472a-8525-a878ba7b966c", "comment": "Malware payload (Formbook)", "value": "533ab9f02052221f3c77112156fbb2c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622556218, "uuid": "236e8fb3-c10b-4266-a307-bf506ada1c7f", "comment": "Malware payload (Formbook)", "value": "46a43e78123a8400e4eecc145ab51509a3cd7baae19f450d5150bb762d0bc34e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622556218, "uuid": "f8d9a183-1ca8-4765-8430-b619b9aa7eff", "comment": "Malware payload (Formbook)", "value": "d8093eef688851203f143fe1b87086c0250b6ab5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622556218, "uuid": "c522daae-8d3b-4de8-aefa-4309dd54d035", "comment": "Malware payload (Formbook)", "value": "e1882cacb9ff2d76784affd451a73209c1cd3957752ca544cffc3a5d5541ea8aded4c5bcadccf2fbdc7c5a3c51589fd3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622556218, "uuid": "0e369311-2572-47f1-b1c9-62163b1c6924", "value": "3D34135A32D4D8ABF2134272A547CB67D23AE7442A006A5FEB561F7A36305C0EE47292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622556218, "uuid": "74f97e0c-f85a-4412-8418-0ce46c398033", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622556218, "uuid": "fed58180-c65d-4773-ae87-66566678fe08", "value": "6144:8Qq+WFkLkeCN5FEQsHmNoBJXlmhivfoRPFeaE2pOp:TWFAkTXsHPihivQRdo2pOp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622556218, "uuid": "637ffd6a-02b7-47d5-abf1-7359c8ef3625", "value": 239666, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622556218, "uuid": "ee63b244-732b-4370-8091-e2e3041250b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622556218, "uuid": "e6c8e233-ecab-4ce7-a4fa-9d7ab81594db", "value": "transferred.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eee4229d-c29d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622526913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622526913, "uuid": "67df098a-f7c6-4a57-865c-a19b2be9d388", "comment": "Malware payload", "value": "41cb54585c5188446052b8af876825db", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622526913, "uuid": "a7edc708-c100-479b-bb02-994a96fd975c", "comment": "Malware payload", "value": "474b17e5fdf5312c53ea7c31b6b5a7aebe51b6a6031f166c600527ec54e194ae", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622526913, "uuid": "da2e9ffa-e741-4972-a80e-ee03077050f4", "comment": "Malware payload", "value": "3f4747f38265aa7ebae7440e78e73e10742bc727", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622526913, "uuid": "4c0b8533-a3ee-4c8d-bf91-82d919fbb187", "comment": "Malware payload", "value": "766c06148ea4db0ae90e1a69dc299681578b4179058980482760717b946865a52495e9ad6ea97fc30df7e61caec383f1", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622526913, "uuid": "88abada3-9860-4bd1-a772-8647d0fc627d", "value": "AB225C29C921F43ED02106FDD11546F1E61D2063E661BA6E2940E6DC0FE16D247EFAFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622526913, "uuid": "785657fc-a43b-4f49-9834-025e6f511b8e", "value": "96:kHcIMm57P6Jb73IdmGJa6T/n/jNT7aTZ4W1+IwlLEl9V7JaqMxnIOU+txiR:ScIMmtPs5G/bhaTOT4R7JarU+3iR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622526913, "uuid": "111c494d-b278-4f8e-b6de-fd769535727a", "value": 10342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622526913, "uuid": "35e6a6f1-fdb7-4a76-b030-6aaa413374d6", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622526913, "uuid": "638246ae-c23e-4e74-bc59-8c9920d8fa3d", "value": "PO-EME3448.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bbfff5d-c2ef-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1622561805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622561805, "uuid": "c5a1a31e-1945-4591-a484-2886e9fb7da4", "comment": "Malware payload (Quakbot)", "value": "0c9a69ab1955a93bf88d84efcb72f5a8", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622561805, "uuid": "9ac3c088-374b-477e-8aaa-a92613efb471", "comment": "Malware payload (Quakbot)", "value": "4a1b8d185d07ef19d3dd25327fe94b1dea0fcedfa91ddd36fcf842095d4222b8", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622561805, "uuid": "7238078c-28d0-40b8-93cf-66c438f59b4f", "comment": "Malware payload (Quakbot)", "value": "9636e7991056dc8808b7ad74f9a3d1bc43bd4dce", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622561805, "uuid": "da15ac4e-1c06-4196-ad66-6efb3c1f0830", "comment": "Malware payload (Quakbot)", "value": "ebe163b1f59926384c6ef1018e763b6c2d54c18e405b817a5921073cc00301d62343344a61b9dc119d7f7057bd677258", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622561805, "uuid": "5c310039-27cc-4cac-a199-7b877e16815e", "value": "4474127FE28569F4C3398C3ED684A1A0C255F0D040A7B21D47DD3529A35329FBA5E2EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622561805, "uuid": "e15058dd-f11e-47c4-9f3f-d7897deec28f", "value": "6144:6RMlgE+mJ9ABc/nv5k8IKAhBfsOwmLgzLc1pTcsGEdDIPmhsB0vRakfzeQZNl:6RMmEv2Bc/nvm8IKABfsYOmauF5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622561805, "uuid": "8f322b33-6432-44cb-b14c-51e669ad3f94", "value": 345798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622561805, "uuid": "3ead92fa-cea2-4038-99e2-7c89d6bca08d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622561805, "uuid": "2a62b8e6-5d1d-43ca-8e85-50c0e04e9dcb", "value": "754107292075906012021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "060a4ae0-c2ce-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622547568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547568, "uuid": "88627903-92e5-40f8-bf22-febd6a00eaaf", "comment": "Malware payload", "value": "79f5193013aedbd1d7141ad5e4a1b633", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547568, "uuid": "ae1e1ecc-59db-4963-906a-f3d0fa6e75e3", "comment": "Malware payload", "value": "4b0d3810907fb50ccc30c5661b8a2c8d0d59841e599c76220dec29628a12e553", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547568, "uuid": "06b4926a-5664-4369-b45e-8f0c79c2ce30", "comment": "Malware payload", "value": "fae71f4b17ea8436f78e50f8622e93051b7bfdee", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547568, "uuid": "5d5a2df1-e1d0-4def-a717-2d4007ecc507", "comment": "Malware payload", "value": "7090271766b4d9efab7c110f3735cbceeb0451be5e8d3bb07a1b177d8464d8cbda254fd8b4f907ea6207a2504bfc0c6e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547568, "uuid": "6ce26653-1ac2-4dcd-a27d-750c896fd10a", "value": "11133A51730787A9CC5A4BB2946BEA5205F2BFA519BBD90E308CB325DD333C71B23646", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547568, "uuid": "5f7ceb2c-4c73-4c9a-b9e7-dfa63125cf75", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547568, "uuid": "f1984fc2-b18c-4a0f-9da9-f7ce28ddf292", "value": "768:S24H6z1g/b+8DMMIg3XhL2fkIHnLyeCKzFsLSJqZhqyFee:S2DmyoIHnLyeCKzFgSBe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622547568, "uuid": "5981bf63-16bc-4465-91a2-e7afe9d7ccc8", "value": 44888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622547568, "uuid": "fc192363-3f8f-4454-96e8-3beb2d253a37", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547568, "uuid": "bef9e479-4eef-4003-8d8a-4255344082b7", "value": "SecuriteInfo.com.Malware.AI.4179784947.3208.15387", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4385975a-c292-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1622521901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622521901, "uuid": "7d4a26ce-6657-403c-8a5b-d9ff62b673c4", "comment": "Malware payload (Loki)", "value": "64b0e9f88ead12df4fa8307831deb287", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622521901, "uuid": "45777183-30c2-4b1a-a5d5-cd28f18ebf42", "comment": "Malware payload (Loki)", "value": "4b6197829f765c730b138d6d7c21a9b1109e91ca94489023cb47f9dc6b5613f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622521901, "uuid": "599a04ad-f0a7-4610-8468-14c984a53b8c", "comment": "Malware payload (Loki)", "value": "111734a8b7920059410ebb50ffa422d3d455534b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622521901, "uuid": "a297f776-f733-419c-a5be-0bdc27e2f83b", "comment": "Malware payload (Loki)", "value": "d35c765276463a0178578a6aace3085da26e0ade537ca2aa1a8ffb0141e00f16eb6e9a7a10ba353f1ae6b19dddd76ced", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622521901, "uuid": "8bb287e0-ce0b-4205-ac56-370e725ae2b3", "value": "1725ADBE32817ACEC92BCD72C9549C21F671B0B6430BE3275067159C9A8D6ABDF141F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622521901, "uuid": "d677eaf1-cd5a-4528-a1e2-74e3d916ad42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622521901, "uuid": "7d26cd5f-766d-4511-813d-bd6aa4fe33c3", "value": "24576:l7vdgOY/jkxPYWKjpXG4h+eOz0x8TDGhLN:dQ+3e/h+rzOc+p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622521901, "uuid": "21993dd2-1bc0-45d9-bd7c-40c97e373186", "value": 1007104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622521901, "uuid": "a89caeed-fa13-4192-a9e0-430667fb46d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622521901, "uuid": "0c7c8b69-2945-45ca-83b1-5f1c61651341", "value": "QUOTATION-FORM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9c3163d-c2ce-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622547977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547977, "uuid": "be4fa918-d111-4be6-aa2a-152a851c9af3", "comment": "Malware payload", "value": "f55796cbf95a7479cb038ec68d3db120", "object_relation": "md5", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547977, "uuid": "bc6a0eae-d2d3-41ca-b524-1b6320255f0e", "comment": "Malware payload", "value": "4bf4a05ac303f3516bc8663636b8c2fa32878a7aeeecd5c4b9097813f9e762d5", "object_relation": "sha256", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547977, "uuid": "e8b69154-6d9e-45a5-91d1-7e0479b1e9ec", "comment": "Malware payload", "value": "3e6a46ee42970e9114ba50c895cd0f46d1768601", "object_relation": "sha1", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547977, "uuid": "fbdfbe2e-de46-4bd3-b939-4e1286136717", "comment": "Malware payload", "value": "c8ecce952269144fc2a8deec0669038030c985742e58da753fe5a575057a1ac00480ed692c3f68531a576ed075fd42f2", "object_relation": "sha3-384", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547977, "uuid": "5b625dcd-a2f9-48e6-8811-5b75dfc986ab", "value": "A081DBDC2533A4B9DA722553E00DBB7D82752EA7F40E74F09A8481012F66F8DD268F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547977, "uuid": "ea5dd9ce-ca41-44e9-b7a1-ce3a68dd49e1", "value": "96:napeexsgCMSzcGPdztqBuBMDPJ96zMJ4m1SDFMMe1:napeeAM2VztDBMn6zMJoxMMe1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622547977, "uuid": "5eb9b0c7-c6ba-47fb-ad5d-5a7ae8ae29eb", "value": 3837, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622547977, "uuid": "37ba2a61-2dfb-4ccf-bac2-5275bb27eb7e", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547977, "uuid": "69c3423a-8f17-4d71-b677-69419daf31b5", "value": "4bf4a05ac303f3516bc8663636b8c2fa32878a7aeeecd5c4b9097813f9e762d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44b0c029-c2f3-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622563565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622563565, "uuid": "d59fad48-dcc5-44c8-a016-76031fb4a5fd", "comment": "Malware payload (RedLineStealer)", "value": "6bd38328d617533cf6d194120a0146a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622563565, "uuid": "7e39ad63-d126-4559-8b2d-03841ed75840", "comment": "Malware payload (RedLineStealer)", "value": "4deb8887fb1ac1b6cc881ad17c732f934a5673d0f15184acfe5678af8eb2b285", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622563565, "uuid": "070e2743-4e07-405d-8894-40c743c54ab4", "comment": "Malware payload (RedLineStealer)", "value": "a224399efe3c4fb33601556738e3ef7479d75a25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622563565, "uuid": "99758f3b-5faa-48a1-b6b5-50fae5255f17", "comment": "Malware payload (RedLineStealer)", "value": "b1e5e0bbbbd88cbd959c07d81fd9f8a881bbbb43a8c9ba2d6c8439af510365c6c1ab4f71d682cf2e555b50bc99c4d782", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622563565, "uuid": "b84d7b20-478b-4eda-9c1f-9e3a3c917a65", "value": "82849E10EA90D034F5F336F44A7B82BC962ABDE1EB6450CF62C56AEA56345E0ED31707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622563565, "uuid": "31b6ed80-0b33-44d1-85d9-15ac336a43eb", "value": "f675fc7e3dff863c99ba9efdb72cc4b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622563565, "uuid": "83953e09-4608-4b28-960f-4c6c524a7b4a", "value": "12288:EmmcHJSLhZznfvEw4xrCqaxYW4RHGQ2gJF:EmrSLhZorCSW6HGXoF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622563565, "uuid": "d6f41650-fb8b-4a09-a5bc-1d83411b5134", "value": 397824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622563565, "uuid": "576f439f-d5a0-40e4-b24b-56b1fcd57df5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622563565, "uuid": "f1275847-82af-4c2c-a7ca-05c218a90dab", "value": "6bd38328d617533cf6d194120a0146a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e30c3c6-c2db-11eb-875b-42010a9c0053", "comment": "Malware payload (Adwind)", "timestamp": 1622553353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553353, "uuid": "59eca982-1def-428c-b79f-50ddd64fa9c8", "comment": "Malware payload (Adwind)", "value": "9ec814ea3f8519990b790ca22666a6ad", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553353, "uuid": "5925a659-ae04-449b-83e8-49bd2ca13e72", "comment": "Malware payload (Adwind)", "value": "4f056a30ef5442b0806499eac9d9b2f7317759696baadf845e9c6729facc4ef8", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553353, "uuid": "68acb5ae-dffd-42ac-b660-ef6535c4600a", "comment": "Malware payload (Adwind)", "value": "765734ad68d43ddcb9c7d2f9421bc4dfca91eb18", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553353, "uuid": "8c66e532-55dd-4440-a021-5cac7fe7d97e", "comment": "Malware payload (Adwind)", "value": "33f139ae37e5cb7ea88d79fc497d915e872ea80755d928059c0b79c115d4f9efdfc974064adb8824362d0ed596d54dae", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553353, "uuid": "a5f7ef80-deb9-4cff-91ea-dda407d52bb7", "value": "066423ADB894E224C40B7A96941E7713C56C0988C6B406E4308A1516EE7E9C3DFF6FCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553353, "uuid": "9a7eed08-2910-40ab-9ca8-22e969815bc1", "value": "6144:/scPJWewXzGG2HYPsWof7Xrs6Xxok0tSAC6QZQ8wQpzBq20klOASV7MBJ9n3:/scPwXzGG24PAPXx9eaBBq20klOPV4B/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622553353, "uuid": "863de777-b680-4c30-93c9-d7ab64d7a275", "value": 319125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622553353, "uuid": "87cc21c7-b3c9-4c5d-afc6-1b698667e209", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553353, "uuid": "de3900f7-6ced-4549-9b09-a8e1fa601c65", "value": "1KZLIBWSubnuq5OPpq3T8g1cj8G5faaZe.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10337d28-c27b-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622511937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622511937, "uuid": "3678cde2-57bd-4b81-8751-e9a5c64a6387", "comment": "Malware payload (Formbook)", "value": "3fbfc82d120ab09cc7ffa16cb70ac4e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622511937, "uuid": "8852c0d3-ac41-4aa2-878a-d40c82fd193d", "comment": "Malware payload (Formbook)", "value": "4f9d8536fa4475655dd14db7d472399f2b7214ddb16d3483f9a2a673e4fc1543", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622511937, "uuid": "0377910a-6017-4069-8a55-004574d6b291", "comment": "Malware payload (Formbook)", "value": "695b8743c0a62a837d31d2e6e6dd1e574a76de03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622511937, "uuid": "d6eb7832-9976-41e5-8e6a-451b9436fe0f", "comment": "Malware payload (Formbook)", "value": "efe0b4a0e26432f7dc1da757d07cc40f4142ed6d94dc5be42f9c2093462da9228bf01e5572be10116ca1b931f6f9beae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622511937, "uuid": "f43a98fd-4c1d-4a1a-9da0-a8fb59ed7932", "value": "C334122A22C561FFDC1A71B284B7F93AD377971104282337AFB85FAE8D245C2C593985", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622511937, "uuid": "f4d6f0ef-1693-4648-9a9a-f6dc48d043a6", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622511937, "uuid": "802fe772-84d3-45a4-9b8e-32e9e8beeed5", "value": "6144:8Qq+heTn4+ufeHyGM3enCcfzVpvRJjl7NSY7Tx0qp:TheTnRdHyGM3X67ZbNSY7Kqp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622511937, "uuid": "a8c3c3ad-b56c-4b77-9280-82fb7f0644c7", "value": 235568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622511937, "uuid": "9d757755-70d6-49d5-80fa-0c8f658320eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622511937, "uuid": "028ae493-f0e2-4467-af21-7b8b22c996e4", "value": "SecuriteInfo.com.Trojan.Packed2.43157.10012.17335", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ef07c4a-c2db-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622553274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553274, "uuid": "88f5b015-f449-41f4-be7b-79572f8484aa", "comment": "Malware payload (Formbook)", "value": "2a1f22459cc8c6b01fa07cf591be45a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553274, "uuid": "e0768247-3a50-4307-8ff4-a8d3791d84b3", "comment": "Malware payload (Formbook)", "value": "5067910c2b8052defd03e10ac71b3a63d5aea4dd8430a0e0af4b5bb39ad7b335", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553274, "uuid": "cdc16f11-ea77-42ef-bee9-cd5f4e7400ca", "comment": "Malware payload (Formbook)", "value": "cf598e36d524210f96a81495962e670e398ea957", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553274, "uuid": "bb117c5b-a7fd-4a93-95f3-359f9af54372", "comment": "Malware payload (Formbook)", "value": "3ce0fb39b04cfd568e3486964d5b586ee6af95f85fe24c6d9881acd7ea9dbc1bbabbbbbff6720cb06203312604457d00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553274, "uuid": "2125776a-b604-41a3-98c2-7de6d0894034", "value": "BC34220EB2C844A3F58265701EB3CB2BE777C371126156AF4BB82F6D2E256434611BDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553274, "uuid": "2e26f3ff-275e-4986-a64f-291141564c66", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553274, "uuid": "a776a677-95c7-48d4-a28a-f6f7a234a586", "value": "6144:8Qq++VRNVU2eXA/wFOxnTospDSd43WIZ7lS6uND6Onp:T2RNVmXhIn0sEuWItw36Onp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622553274, "uuid": "8fdc44db-831e-4a2d-afc8-f66080ec8abd", "value": 239903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622553274, "uuid": "6827ec2d-879a-4c29-bdb0-39ffd4456eaa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553274, "uuid": "35377989-a441-4c6b-a4ec-2f7d80d58b00", "value": "CONTAINER DEPOSIT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41553364-c2c9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622545520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622545520, "uuid": "bc9ac340-0372-44f0-94f5-606577292d4e", "comment": "Malware payload", "value": "2f880565f1102456611433310d49ce6b", "object_relation": "md5", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx86", "colour": "#7C59EF", "exportable": true, "hide_tag": false }, { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622545520, "uuid": "1e4e6b6a-5007-4363-b815-bc2d8fb710f6", "comment": "Malware payload", "value": "50e825a3a61e6f5fab0740c7ced94ac994d954b95df998fb06f6c11833863006", "object_relation": "sha256", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx86", "colour": "#7C59EF", "exportable": true, "hide_tag": false }, { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622545520, "uuid": "be25a8e4-5eb6-4a63-bc9e-7fba60badc1b", "comment": "Malware payload", "value": "501d99597ad95e5d557f74c8f889b44ca457d389", "object_relation": "sha1", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx86", "colour": "#7C59EF", "exportable": true, "hide_tag": false }, { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622545520, "uuid": "5cbe2743-07c8-4a86-bf33-83ef3e27e1de", "comment": "Malware payload", "value": "faa8520babfcfee81487bf42578d25f174c260d8107831ced8ba468f333f2d8cc3d80f674b627df618f78df90c242bfa", "object_relation": "sha3-384", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx86", "colour": "#7C59EF", "exportable": true, "hide_tag": false }, { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622545520, "uuid": "91aa657f-6a73-4200-9946-fa6ec29fdd18", "value": "CDC1F226CE31BCD8836D364097151C8B21E42916C7B75B38DB061CBA3E61BD6EF2968C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622545520, "uuid": "7be6dcad-6cca-484d-bdc0-f6f14aa981bf", "value": "96:Gnn2jh1hLmTzQKaVUJLas91OhLAX2SAgeI5qQj4sVsYrqCOExQ2FKYQLaIFt7vEw:+n2jh1hqTniLs257I4T2qCOEx7IF6hdC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622545520, "uuid": "e8081eca-9808-41a6-b423-36d0438b1d3d", "value": 6095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622545520, "uuid": "6117fb13-fa5d-4ad5-9a08-116ffc21c4c4", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622545520, "uuid": "6adbbbde-d490-41b4-8b67-d1caff63c226", "value": "khTRdqZJ.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6d88ab1-c2a5-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622530255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622530255, "uuid": "c24ababb-8b83-45a0-b75f-b795f3af251c", "comment": "Malware payload (RedLineStealer)", "value": "a99440929912b197e425966e1b7b3e67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622530255, "uuid": "4e6acb41-e1d7-4393-be7e-d37cd584cad7", "comment": "Malware payload (RedLineStealer)", "value": "5125cdd8826eb7547feff07034b2deaeaf2262eba03c6fc1c468be7b80e3b431", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622530255, "uuid": "c6c34706-1097-4fc4-8d18-801ae9de7cf1", "comment": "Malware payload (RedLineStealer)", "value": "582b088422a26329ba56a1468bf0f878433b5487", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622530255, "uuid": "353cbae4-8bc7-4713-831c-5e1c49f9e4d5", "comment": "Malware payload (RedLineStealer)", "value": "e9cfd399e54907efb148bb60722ca8781b3b06ed71f485ea385e97705926bb43b740254b00468ebeecb00135e00a0e63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622530255, "uuid": "38088996-0419-4057-95ce-8c7fc1ce5935", "value": "03E3CF0AEA9B6551C75D0673C0A3601C4176DA0BF563F7BF95C82EF21F62ED8C286863", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622530255, "uuid": "dbb6c948-fb56-4094-b894-8bcbcba39f8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622530255, "uuid": "cf0a5f12-8aba-4cec-985d-112261759143", "value": "3072:pl0cGGl8nQhD+pDpzNkXY/1sJ7u/lhDY7eAreGoo76tHHqn:pl0+2QMnjGlOkPrH374+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622530255, "uuid": "158f0882-c4b6-4b4e-aa41-9e4528209b5c", "value": 146856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622530255, "uuid": "6f3cef2b-11a8-4a1f-b00c-48d3b95315ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622530255, "uuid": "39bf9bce-9e3a-4287-b6d9-608dc2defe86", "value": "a99440929912b197e425966e1b7b3e67.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dabf3e7d-c2a2-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622529027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529027, "uuid": "0ca4dd13-9efe-4c37-bca3-eeb200342954", "comment": "Malware payload (Formbook)", "value": "1df2c05ff9a03515d1c0b140f1d7496f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529027, "uuid": "0a6c59bc-c9e7-43c5-bbeb-591ea265ead6", "comment": "Malware payload (Formbook)", "value": "533402c16a639ab11af6e3765d4c190f81c24f5fef39e65342a6201eaf971e1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529027, "uuid": "34f67350-0b67-432f-9421-4db4313cb2e9", "comment": "Malware payload (Formbook)", "value": "8dc1c775e4d365cb30e8fa8301d5e162d227fd8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529027, "uuid": "a5d71678-383f-48c2-b034-f1da775162d0", "comment": "Malware payload (Formbook)", "value": "a354a3f9ab754c176625de90121dd7b3897d6f74a76511d81caf9198a084f4adee0455c83065425717e01965ab74ad8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529027, "uuid": "db2d3bef-f52f-47b8-ab9a-2f837e6909d3", "value": "3A157CF4F59898B1C14DCB32C7919CAAD7620DFE1213892C0AB9FACC1B6379E9F49445", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529027, "uuid": "b09247f2-00a4-4eee-8bef-b00bcfa986ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529027, "uuid": "b25d3440-04e7-4405-b92f-297af7e66791", "value": "12288:/5W4sLrrhvTYxn0Bss2Bu7aMXX/yu+fXdXnJV0YPuR+XLl+:/5WvrZBsa5yX9JV0YC+7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529027, "uuid": "f4d33956-9394-49b1-830b-f9d14bb8899c", "value": 952832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529027, "uuid": "710e35a3-824d-4550-8948-75de5a8e7ac7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529027, "uuid": "0e5c4632-56db-4663-96f1-a37867aa3a77", "value": "PI2021kPAkP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89a888c9-c303-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622570552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622570552, "uuid": "69108669-f7de-4f43-8566-acd18b24a894", "comment": "Malware payload (AgentTesla)", "value": "34fa00ffa9f244bc25fa88066248fc87", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622570552, "uuid": "14ef7120-efbd-4f9a-9436-a8c742398961", "comment": "Malware payload (AgentTesla)", "value": "534487a00113114ba9592a798ef52f0e5bb2b1e5fd27ba7431789b5c506482fb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622570552, "uuid": "86c37005-471b-41ed-a0bf-f4239a9abc9b", "comment": "Malware payload (AgentTesla)", "value": "e0aad19a7a226eef654af19f770f5aceae1026c2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622570552, "uuid": "11027e15-06c1-4837-bdc5-7033ea2bf3ab", "comment": "Malware payload (AgentTesla)", "value": "86ad18d50f15384bec368c39d2fa79ca33adf2630f61642c34744061a0182d338298458dfaee3dc85afd96b89e1729eb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622570552, "uuid": "e9696593-abd5-4350-9f36-01b8c0555ebf", "value": "6372803AF2A0C234C46FC6399652BD0C0625B6C7C8D69EE963BC5C124C52FDF6E526E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622570552, "uuid": "a45b76a9-bfca-4254-8c5b-913e72950f04", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622570552, "uuid": "f5b4c9e7-1dc0-49c3-a6e7-22ea02d5b496", "value": "192:iQKdQI3JBe0PsofhIW1Pna6riact2x/8LNEPq8TGu:BYJdPsofrna6riFt2xMEPNG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622570552, "uuid": "4a8f090a-a9fb-4d2a-916b-7f90102a3332", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622570552, "uuid": "5040a2a7-b486-4906-8089-cc80addaf9f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622570552, "uuid": "5c124ed8-aef6-4ed5-bf23-ac76026147ee", "value": "2525_133347.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "307e99c5-c334-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622591448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591448, "uuid": "4fe2d54c-82c3-4c47-a8b7-97732696159a", "comment": "Malware payload", "value": "2ea5aea76bfa9dfac5ffdf93b0515555", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591448, "uuid": "b0a41d06-ae7b-423e-8b23-4c7d4a3be21a", "comment": "Malware payload", "value": "541d3868c3f75bbc3f6747e653e9907d12e5d4eacf74e311d37d5b7d0574a94b", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591448, "uuid": "a5f46964-ea22-43a6-8abc-83664772732d", "comment": "Malware payload", "value": "d6ce559645b043216eb0dee2983f707ff271d818", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591448, "uuid": "759d7496-3b0b-470a-97d1-9fc0216e8b3e", "comment": "Malware payload", "value": "8bccdf6a7a071a9df35ceb4bfcf6d755eb4bb80d99923ab1d5926c04cb0cd40f1514165a9d6d4dda147a0213a12b83e0", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591448, "uuid": "bfe4a92a-733e-4c2b-8a28-a292d5b54ea6", "value": "1A852301E5EEB45B8FA5467C2B1A644F2D8730BFD029DAA2185E473EF1C4F9B145E0B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591448, "uuid": "82d5414a-d3ca-405f-8686-33e674a4c954", "value": "24576:GJ6bSYhOnNDdbUB4B9YiI7CvJoNOHy3I9hOTA7io:W6bb0DoUYqYo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622591448, "uuid": "bf2691f5-3374-4c45-a59e-21c994e06719", "value": 1750795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622591448, "uuid": "147ca875-a9f0-40f3-9524-97ed0a05413e", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591448, "uuid": "847dd59a-0b26-493b-8420-d1bd17d7241b", "value": "541d3868c3f75bbc3f6747e653e9907d12e5d4eacf74e311d37d5b7d0574a94b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd7409f5-c2a2-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622529032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529032, "uuid": "e60ad4a0-5ae9-478d-b270-8178207cdaea", "comment": "Malware payload (AgentTesla)", "value": "0c3b698b7baf2fdff493fba44adf31f5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529032, "uuid": "212afe21-0e50-4f47-be7a-456ddab4ebb6", "comment": "Malware payload (AgentTesla)", "value": "55f61fd3e6b64a22398404f8dd18df1b0f8f9d456c10985bc9ffde0baa71796c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529032, "uuid": "5eeb26d9-30b2-4016-968d-3844881949cd", "comment": "Malware payload (AgentTesla)", "value": "5e8d06edb633110dce08fd54a33497412666a211", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529032, "uuid": "4f64e375-12b4-45fa-9117-b2cf664ef05a", "comment": "Malware payload (AgentTesla)", "value": "a76498cb17e7ab604982526f8a253f9e0e7b5d4d4aa3035e94fea5f7ac78c5381ebc4695647544221c6dbbb427e9fbc7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529032, "uuid": "de52c7b2-ddc0-474e-bfb0-6ddd249e4836", "value": "D015E13612999BE4E67DC7F840A4DCB303F1B993EB05CB3D6EA851980591B4486D23BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529032, "uuid": "079074ff-9570-4d32-a26b-0a813388f883", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529032, "uuid": "ca632955-5857-450d-a854-4f9e39323208", "value": "24576:kpq5MAuKAPjyR6/aYEIjry8Q8d8cz6PSO+:kpq1A+cc2rL1+G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529032, "uuid": "4b8a9a51-0a92-4829-8169-041d4562de11", "value": 891392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529032, "uuid": "88cc84ad-8faf-40c8-b048-2556bc77d5df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529032, "uuid": "83f4fbc1-829d-4b6b-8d63-5b4dc33cc549", "value": "Original TT remittance Application order 76533 SHEET.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "755330ee-c2e5-11eb-875b-42010a9c0053", "comment": "Malware payload (WSHRAT)", "timestamp": 1622557633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622557633, "uuid": "370c05f6-f47b-456c-9029-be2084cfdb20", "comment": "Malware payload (WSHRAT)", "value": "f6971cb72125dcc83648bc76ac1448b8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622557633, "uuid": "6e9a4f7f-2fa7-49d3-bafd-f4585328c00b", "comment": "Malware payload (WSHRAT)", "value": "560386c6a67d6e2c217b7256bea1c9857a440b96cae388a72bfcc50b34ed6cd2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622557633, "uuid": "9b8ca415-be51-4138-a03f-499704614ab9", "comment": "Malware payload (WSHRAT)", "value": "8aca767fe15d838bce57a440c88bf3ae5e6013bf", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622557633, "uuid": "05ea158c-652d-4c3e-aed1-ec1ff8d38823", "comment": "Malware payload (WSHRAT)", "value": "f2431a724ace70aa1d965e231131b56e0a8dabe5907889b2c7a93471f3e29971496135c5154b0f132977e6235687a2c3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622557633, "uuid": "b942e722-ea51-4c93-93e8-5ffa4fbed303", "value": "2614AF813B81F84E0747ABB5731FB5D9D06A0D9B74C9888FE144BC50F869A26FEE1532", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622557633, "uuid": "30e90f22-21f1-4529-8456-3299adb44899", "value": "3072:meGK/6bbIpklgVDSxGfmuZjbURClZw3u7zQ0bam9858hygevEzX:meGKiAklgF2GuuZkRCu1Mc58hygqe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622557633, "uuid": "ce047fe1-d172-4fe7-a630-306ac2912590", "value": 208572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622557633, "uuid": "249eb30c-4c96-4eea-a953-4ca54cfeb06f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622557633, "uuid": "784c2a62-b05f-4180-9d20-4f262db97a42", "value": "Ebay-invoice-27814.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c2d682a-c2a6-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1622530613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622530613, "uuid": "d2a22ff1-f373-4043-be93-f5c8059d7467", "comment": "Malware payload (BitRAT)", "value": "93f4fbe8fed5d2ec67a64f6b25cd58f2", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622530613, "uuid": "bb0881fe-2237-4612-8c0a-366e6bc3084f", "comment": "Malware payload (BitRAT)", "value": "5764c6a1fc596df5e693f53736692d4f395ba92cb0b9a30db1b2b00d790155c0", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622530613, "uuid": "812a43bf-d270-4bea-a346-6443c7c8f434", "comment": "Malware payload (BitRAT)", "value": "77ff46aebca96c9a063a352d1be33cfd61d9ae3e", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622530613, "uuid": "c93e6ece-28d9-4f10-8a8d-d96086432c66", "comment": "Malware payload (BitRAT)", "value": "0a777a3f05a43333797d7ee83f182da2bf644d917de23bfda37a9dd9d5745a608e685c05b12e29fd766107747b3e18b6", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622530613, "uuid": "40e5b4dc-0795-4ba3-b66a-0bc893606fe8", "value": "9B8512C89D250EB7CEA756B86743CFE1EB678143B7D78D1F974B0B58261A34CA9280C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622530613, "uuid": "56440982-1b72-4335-a7b9-6caefcddfa40", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622530613, "uuid": "dd3c6dd6-f759-45a5-ad05-18a8176db670", "value": "24576:G0bldTU8I1zBR2XBr1m85qVH7z+dXDxvXwLw1lbYosEF5CUL5rUkx1ohX4cFzIir:Ps8ZrA8YF7A1vwMPMoXF5CUL5NAk5p7c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622530613, "uuid": "e6e42fc9-ec18-4f4f-bc18-b764e0fcf8eb", "value": 1761873, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622530613, "uuid": "4cd4900a-c0aa-4836-8ccb-a4516bdbe9f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622530613, "uuid": "0893352b-6e96-454e-9d9e-9c6fb66fd49c", "value": "invoice#11021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa0f90d3-c29e-11eb-875b-42010a9c0053", "comment": "Malware payload (Stop)", "timestamp": 1622527227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622527227, "uuid": "e4566879-82d7-4338-8660-74a4c8dcae2b", "comment": "Malware payload (Stop)", "value": "539b57bf9669e0728bc60991b0b98e37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622527227, "uuid": "54b30fc3-e00c-4da5-9432-e9d0e2b4d17f", "comment": "Malware payload (Stop)", "value": "57f27ebdb4121e12383aca306d73aaa1c70bbb83e01be0a54dfa314ea8463357", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622527227, "uuid": "e4f58f46-cd6e-4300-aead-e6e8af5fff79", "comment": "Malware payload (Stop)", "value": "ec53dbde2cfa5d1f7e45d3c91bef78ab261838f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622527227, "uuid": "30726164-09fb-40e1-96b3-8d5b973cd359", "comment": "Malware payload (Stop)", "value": "902abb4a4fa400dd0988966c6c93084fc9af2eff7c2d033728d7117dfb437f96f4224a27271fd5e8345d292c8ad4de7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622527227, "uuid": "e1427509-02e9-4881-817f-189bdd7f00ed", "value": "8C050200BA90E034F2F735B5567B916DA5297EF1DB2850CF22D5AAEA27346E0DC3134B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622527227, "uuid": "f857d7d7-8ca1-432c-b859-678de8d1efa8", "value": "2f20facc3edc1d8ba24ede1f07abf090", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622527227, "uuid": "62ad00fb-8999-4e7d-9fd3-dbcaecafb60f", "value": "24576:Y1XlLvD/qgFHR4ZbbDgD+6mzr9/1I3YI4VYDqGtZ:YnnB2ZjgjmF1ov4mvtZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622527227, "uuid": "fae95b73-098a-46c6-8ef5-b9eee4a92f7a", "value": 862208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622527227, "uuid": "02b2733f-2a45-44ae-bcba-ce4fcbdf344d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622527227, "uuid": "182c9663-1e46-4d2e-94d4-842308f5bf2b", "value": "539b57bf9669e0728bc60991b0b98e37.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05d44e1a-c334-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622591376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591376, "uuid": "477d32e8-d6e2-41bc-89b3-fb9199592dbd", "comment": "Malware payload", "value": "135f37fcfff6a78f181ca94b34ae461e", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591376, "uuid": "d1e1ef90-6669-489f-9dce-26532bcad5fa", "comment": "Malware payload", "value": "58bcbb31f0e93602d2a4c1b2e2c932e5398307e6c89ed661b2e9869c7c2afc62", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591376, "uuid": "df077d12-3e01-4f65-ac8c-0dd026635bf9", "comment": "Malware payload", "value": "0e45f0513cae6c0fcf7adae4265e3f1167ed7649", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591376, "uuid": "7c16d22f-831d-4751-a1af-f805d0e8b023", "comment": "Malware payload", "value": "3013c92bb0002f5ef4b718b18457b0675f1632aabf3a0abbf42b127f04d269dc123b95c8a99237a87e2012761c0d0ec0", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591376, "uuid": "4c847e21-6f38-4edb-aedf-c409ffd9a8b4", "value": "7B75F10DD9335074DE95C77CBF894766688EBABFD5BAD123E428C56BB4C0268B81C0B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591376, "uuid": "83b86a5d-6a9a-4341-aae9-aea876202b64", "value": "12288:HKAV/eHtTJK3STyAcPQ9qWoUyHYa9j2sK+EU:IBcXYcjpEU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622591376, "uuid": "98828f23-e41f-4b70-9b5c-b0c6aae154ab", "value": 1664206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622591376, "uuid": "26bfbe4d-3d93-44ad-b565-1f1c07cf1b69", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591376, "uuid": "4ecd5a9b-cff8-4d23-9c1c-58b3300d2d02", "value": "58bcbb31f0e93602d2a4c1b2e2c932e5398307e6c89ed661b2e9869c7c2afc62.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50f6b66d-c2e9-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622559290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622559290, "uuid": "81fd88ac-532a-46f0-9c49-3b9d37eaa7a4", "comment": "Malware payload (AgentTesla)", "value": "3eed3f251a1e66aa194346306bc86687", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622559290, "uuid": "aec92dbf-5dfc-4dc4-8ed9-9575e3b6abc9", "comment": "Malware payload (AgentTesla)", "value": "5a0e57325ae9e685f56854dc93c77d8d814b0d3b6b76f6106301a0b997083e35", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622559290, "uuid": "1b54825e-67f5-4ba4-82e3-f200573040d2", "comment": "Malware payload (AgentTesla)", "value": "aa3fef0b85a4c68e1ab46e906feb7123308afa65", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622559290, "uuid": "b435a3c2-9c8c-4216-9f5a-ece8946d52fb", "comment": "Malware payload (AgentTesla)", "value": "86868656c50653dca42f192aabfa7d83a8e65c40a1ff0275a2165d1b0105655e69a0b65d8823e771028ac8b508671af6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622559290, "uuid": "a2c9d204-cc8c-4d9c-82ec-39d78d0b9c05", "value": "7235D0523685DEC9E16F5BF544AEC83002F4BC9FC615CA2C3B86AD2A58E374610573AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622559290, "uuid": "d6d9eca8-a19a-4979-91c1-a50619757431", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622559290, "uuid": "977c45bf-50c3-4187-982a-b122eb3e98f1", "value": "24576:7bWlPJJ/A3q3xfU9KGjXXcHVjxxupVz1mAVacsbd8:GlPJJ53xfU9KYHmjxxupVYmEK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622559290, "uuid": "25f798d7-8e19-4c46-97ce-e825f4c5537a", "value": 1072640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622559290, "uuid": "e5405789-a6aa-48c0-bc96-327b8b071b4e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622559290, "uuid": "afa0c7c6-ff5c-4676-981f-247244698e62", "value": "ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c6f581d-c2db-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1622553323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553323, "uuid": "faf2c1eb-f0be-4f11-a82f-321afb0c5b2f", "comment": "Malware payload (GuLoader)", "value": "34a051fdef0df94baa149fdc84622f1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553323, "uuid": "77daf6fb-5405-4f6c-bbb0-d7b1f19afa94", "comment": "Malware payload (GuLoader)", "value": "5b638cf8104db2f27a5e66e77376a493e18403f4be26bd9f005a1551b173761b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553323, "uuid": "f8fe20dc-0b23-48d2-b294-e5f2482b2c36", "comment": "Malware payload (GuLoader)", "value": "c652373bafd603a11bab2e974403ff83b19750ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553323, "uuid": "bbd769bb-c76d-4c9a-91c8-1d007cf0015a", "comment": "Malware payload (GuLoader)", "value": "157a8fd961b388955e5c3bb946154ae22c95057968276af4ef88c4a7cb3fd0f75a779c4e04a4ecd347aac6815203d041", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553323, "uuid": "eeddca3a-cf7f-4ce2-b39f-1f8a15517742", "value": "1FC3D6A5B69CEA56D21BB0B0862843A80152BC30FB154933B3C1FE7CE273FD5456D79A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553323, "uuid": "0c1da7e8-5926-4bc3-ac41-2116220a71dd", "value": "8ee013a5dde91a1baedc7b29791f6212", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553323, "uuid": "c9c3005c-db69-487f-ae6b-cfc6a672d6c2", "value": "1536:DdmiGtmE+EdUYUaPHcpRmdU8U2rLrN+DzazuhveQUTa9BWPErU0/LBvJ:DdqtmEDdUxaP/I2rLU3NrUTa9BFQ0TP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622553323, "uuid": "38dd5b50-f77d-4eef-9d32-3933916a4ef3", "value": 122880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622553323, "uuid": "8a1260b1-d23a-4200-b729-7c1ea8948149", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553323, "uuid": "4cce4658-86aa-4a73-b234-bd2f8bbe815e", "value": "Attached Template.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68931967-c28a-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1622518528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622518528, "uuid": "c67d1652-48b5-4fc7-8eae-415489150b08", "comment": "Malware payload (ArkeiStealer)", "value": "bb67a245f1b9a49c4bf41dadfc8ace6e", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622518528, "uuid": "7ec3dbe4-505e-4d97-aeed-6faa5a4fc474", "comment": "Malware payload (ArkeiStealer)", "value": "5b73fe2b2388fcd2b0f2c71f8499221e5ccd1bcfc4e31d2140d5eca1c3a45414", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622518528, "uuid": "8ff19df8-46b9-4e7e-addb-1cbf038fd51b", "comment": "Malware payload (ArkeiStealer)", "value": "d16a2b6cc2dcf990b5c022ff75780e512c5893fb", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622518528, "uuid": "7fcb4f07-3b1d-474b-ae26-c3862c935c62", "comment": "Malware payload (ArkeiStealer)", "value": "581907ffe2fb5045073d0633556a184e9f5a4b77aeea81bbd2932784c51fd836a28c05808794f3279d668989041f57e8", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622518528, "uuid": "165da1c6-94b0-4a95-a12b-1f4869fb9405", "value": "CAF533E4A4E0C369DB64CC3C249DB7AA14E9525012783F5E3BE5B3C5AF128A5190AF1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622518528, "uuid": "e9b17b76-c63b-44fa-a3af-0684d01eb8e2", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622518528, "uuid": "c88671ca-872a-4f74-8419-5aa056de70aa", "value": "98304:JkHGDH+SH8Wzo/c8Eo6kva9WXKgdYZvl9Lymcz4zmwHn2hg:Jk0HTcWzo08Eo6snZyZvltXcz4i+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622518528, "uuid": "264f4489-7358-40ba-a0c8-36faa248fed7", "value": 3588111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622518528, "uuid": "e9a9a51e-e9bd-418a-bdd1-dd417b12c343", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622518528, "uuid": "eabee005-5063-4635-a1eb-672606bd110c", "value": "BB67A245F1B9A49C4BF41DADFC8ACE6E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf302e8f-c2b5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622537168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622537168, "uuid": "2501b26d-448d-490c-b2a2-57ca175c96ba", "comment": "Malware payload", "value": "71ba42309dc8ddb031cf0863755b1049", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622537168, "uuid": "cb729f2d-1079-4390-85e7-696157515e37", "comment": "Malware payload", "value": "5c7477a9e188ca29be9a1fe3b6cb4e40140d079cc3d9a3cdd6dccf284db00d76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622537168, "uuid": "910a84da-fb78-406e-9f21-5c432f762414", "comment": "Malware payload", "value": "609160c16d1a643c1d11100dc93cf129540678a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622537168, "uuid": "2022ea86-fb7e-4062-8beb-ac59e2b5f1b4", "comment": "Malware payload", "value": "08988eb0ce4e0acef32af1a42a096a08334feaee4e6f28cc70d19e5fd13c59a828d589054f783c4eac5c29e0f5d1c5f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622537168, "uuid": "e610d84f-96f3-4017-84d8-4f8e315b296f", "value": "29735B07B5C19872E872193248A4D9A0D96FF9211E60DE7B3395067E4F302D19E36EBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622537168, "uuid": "459bfebb-9a46-4828-bb19-76775083ac40", "value": "fd357b6b621ece14d65cd7cfeb9b428a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622537168, "uuid": "e110e43a-bdc0-479d-8747-796341963a32", "value": "1536:sKyxMPUCRiALX/mrwUUcOBNPLFU70q2F0jJVfZ/1MsWwtcd6zecaesueR:sKlUCQW/mr5IPLFU70q2aLfd1386zec+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622537168, "uuid": "09355c0e-d5ef-4bbc-b219-60963bd289e3", "value": 79872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622537168, "uuid": "226b16dd-cc20-463e-8987-48e5c57e2c1b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622537168, "uuid": "c048c976-d299-4d87-8f5e-1ebbfacf46de", "value": "OneDrive.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59a1e711-c314-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1622577773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622577773, "uuid": "65396c4a-af93-4610-99ab-32bdab5a2a40", "comment": "Malware payload (Mirai)", "value": "a3f09e65f4c7a1f89eb2831dc0450022", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622577773, "uuid": "c6f26743-d333-42e7-97c9-7f5566a6a61f", "comment": "Malware payload (Mirai)", "value": "5c74818b4576f19613473f37a97bc4326b886c5845c807b8c4c2ab408bc3da6f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622577773, "uuid": "bffe5a07-1bef-44ef-add6-c60a327833ad", "comment": "Malware payload (Mirai)", "value": "08a085872fb660a033fca13a348393b64d660a72", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622577773, "uuid": "d6b68a63-37f4-45e9-adc8-50c123cef53c", "comment": "Malware payload (Mirai)", "value": "9e14b01fc869ec90088710f05667256c7c0ee73973a6d6bcff204ef4ac352bbd714181fc0dd5cc42fde7e50d18a76792", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622577773, "uuid": "9a682466-8a8b-46f6-a0e2-4ec0097d0419", "value": "4564F1CAEE11AD7AF9D507B97A6B070973F2CBD8D3C3B100E224C61439AD6468B645C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622577773, "uuid": "fff6558d-747f-4796-acb5-4563adc3cfee", "value": "6144:7O/QJHZweEL/NOjCHm7FZZnc8sKqqfPqOJ:78QpZsKCaizKqoPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622577773, "uuid": "26aa5708-8063-4afa-8243-161d675e280b", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622577773, "uuid": "fc3330c6-b145-4b65-ab45-db126b766e87", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622577773, "uuid": "9e628092-ce61-44e1-9f28-f2c3bf1a1a9d", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b9186f8-c2d5-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622550825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622550825, "uuid": "49ba80da-305d-4513-9d86-9c1d97648879", "comment": "Malware payload (AgentTesla)", "value": "494ad543e6bff0ca9be67799d4ea86dd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622550825, "uuid": "d45d9d75-3161-4125-b31b-8d0361ef235f", "comment": "Malware payload (AgentTesla)", "value": "5c9cc4bd942e70569472d74c4ccfbc4d53bb64ac407bdbf234f5c06de0e967cf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622550825, "uuid": "b591edc4-6c20-4b2e-821d-5b872b70a456", "comment": "Malware payload (AgentTesla)", "value": "c8c69072cc1bbc780f7d0316704e0a3933a8487a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622550825, "uuid": "0c89e294-c06d-4206-9683-78c581a7d3a3", "comment": "Malware payload (AgentTesla)", "value": "4fdf68335a8ae5e2afb056ffe27041a38823b59be328b4ed770520e081d93d375d41806bf9d51aed981e87d61e73c477", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622550825, "uuid": "35f0f077-0409-45dd-861a-bd6367e5601e", "value": "AEE4E0787114339FC817CC76C96D3C6CAA616C36535B8243E85F33B96AFE596CE090A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622550825, "uuid": "78d963ee-3e1f-4e0b-a71f-d593eae59cf4", "value": "12288:CSMSJQiDXXkLI331KKArEKkauLoQ/VAQ51TxYrs5XGbj4u:3MViXUM31KXrvkauLv/VAQDxH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622550825, "uuid": "5aa01cdb-46a9-4d08-b136-2cc1638c2301", "value": 707584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622550825, "uuid": "fea53912-54db-4d95-a1a9-2944addf3ae6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622550825, "uuid": "a4e9d61e-a4ca-473c-a8ec-d1190ca45f83", "value": "Shipping Receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5edecc9-c2e4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622557339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622557339, "uuid": "687f67b4-2cd4-420b-a939-f988c41cfd73", "comment": "Malware payload", "value": "ec901f509871709b2038cfa53a72f577", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622557339, "uuid": "eb29bded-5356-4217-8ee3-4569676b1d40", "comment": "Malware payload", "value": "5f97ddc523fa47fd8b4f137a52407d5ead5b60fa9d4315e5070698488a202ef5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622557339, "uuid": "72b59851-ee2f-4b35-854d-7216fc48534a", "comment": "Malware payload", "value": "d8984e029248bb55549848dd6927a0a54a0d1f24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622557339, "uuid": "941484fe-30fb-411c-b1d3-b488a1f86591", "comment": "Malware payload", "value": "f36abb2385537345560877d88ad225d7f07ebb7a41f9158bc9114233dc6014f9323d46fc04ac4557c3894dfa4ef19ab2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622557339, "uuid": "164e34a1-8098-41b5-ab80-91345777c5dd", "value": "4A24F162B2533118CDA60ABF6CC6E5750AE7BB437423AE1B1004F2295D76FDE0BF1646", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622557339, "uuid": "b0cc52a3-cd88-4657-bb5a-3e064ef99f32", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622557339, "uuid": "27e788a6-cec6-44d0-87a8-cf52a4b87e17", "value": "3072:IXDqeOowQdseK3xKVvV1T6BffbJ6FRtFEF2W449nA5rfL9bn2ye0:uqmwSQKFOfV6FRtWF841yJb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622557339, "uuid": "1f2e90ac-5060-410f-8dc5-5cdc9210665f", "value": 209920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622557339, "uuid": "9aae99ca-7276-4599-97a4-7d0782498637", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622557339, "uuid": "399a0e28-3a9c-4d27-8f15-fe9c74f75791", "value": "ec901f509871709b2038cfa53a72f577.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f35d1aa-c334-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622591607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591607, "uuid": "edf9aad4-d18c-4031-9a8c-2d37da26c7e3", "comment": "Malware payload", "value": "a879889bc011f0fb9a17681ea85113ce", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591607, "uuid": "0a732d09-477e-425d-aa57-2a9e58364b73", "comment": "Malware payload", "value": "60e20576b08a24cdaeaabc4849011885fb7517713226e2663031d9533d2187bc", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591607, "uuid": "971c4cfb-3505-410e-9fd8-d9075681902f", "comment": "Malware payload", "value": "f48026a143a8b4e347298b4a99b38cda20fb19d1", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591607, "uuid": "876f9929-96c5-4dae-8dc2-d1ec1b7b6db1", "comment": "Malware payload", "value": "c6dabd4f9b93957ed99649a6598bf26b5ca29ca06daae59a0388bf20087023a4cb0e4c4e9085d556f0c0d00fc0ac7af1", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591607, "uuid": "562cc661-60da-4287-b93f-c28cb4de8bc5", "value": "5145F159EFD85529D0BE0A3620B25330B634B7574322DF2A3D9DA30E8FA1281C955F3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591607, "uuid": "72fd2bf5-1a98-4891-b624-4d907bf8ff83", "value": "3072:9yC9XmD6yfPg56SDpUc8BP0hmUqLyVKpA18oz:IQKSp78K0DLyVYpoz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622591607, "uuid": "7fe82ae4-f0eb-4bf5-93f9-e8c1ae7769aa", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622591607, "uuid": "280e935d-3932-443e-a872-9e69a1cb6258", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591607, "uuid": "89ef8f8c-7c32-4596-ba82-5751f8195a8e", "value": "60e20576b08a24cdaeaabc4849011885fb7517713226e2663031d9533d2187bc.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6325317-c284-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1622516161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622516161, "uuid": "dc54d715-96d8-4713-bde6-41f9f835fd22", "comment": "Malware payload (NanoCore)", "value": "c20ace73c54b4b1f9ce3d4eb5e3ea77a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622516161, "uuid": "01adfb29-926b-47d4-b4cc-ed0de9572c3e", "comment": "Malware payload (NanoCore)", "value": "61803de50535a38519fcfacaba6438717e7ac6e97a10348bf5c7d3a2ddc02e1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622516161, "uuid": "0da60872-e4fe-4a6a-8447-a029d6e15126", "comment": "Malware payload (NanoCore)", "value": "ba4fab84e58f174d25e712440bd196a050f2bdb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622516161, "uuid": "dde0c7bf-e2e9-4bef-9c15-160e25eec119", "comment": "Malware payload (NanoCore)", "value": "5a138e33a44885235d984b9a3e13759b3fefaa9aa6e60ae98c50e2f0c288c4996353687bb060392061cd537ea79edd02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622516161, "uuid": "94245c7b-6a40-4c11-8494-e58952bf34de", "value": "8F35234429A7AC15CBFE97739C69F6A802396947A15CC42F88D9D1E7BB0FE0B43015E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622516161, "uuid": "9b891896-335b-4a1d-8d4f-6d3dc081314b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622516161, "uuid": "c20a727b-9361-4ec8-adbb-c73266eb7d5e", "value": "24576:ivb7fzX8c51T/m1cj4dJXQvNUttfHxhpbBdRs/LMvLp7:mfzsczbmrPRBGUt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622516161, "uuid": "a9346c30-3f04-4876-ab8d-6f24f8defc37", "value": 1160192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622516161, "uuid": "7c5b5d8f-2333-4074-81f8-a6f998157f1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622516161, "uuid": "95581b74-79da-4f7b-8539-7b575b8afb1f", "value": "C20ACE73C54B4B1F9CE3D4EB5E3EA77A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbcbd8dc-c2ce-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622547980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547980, "uuid": "14ebc81b-7d45-459d-b93d-e14047eda6aa", "comment": "Malware payload", "value": "57a0759e2d526e48adf18c0f852422e1", "object_relation": "md5", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547980, "uuid": "60400df8-5764-4308-8252-0623049420ac", "comment": "Malware payload", "value": "62c9757664447d903e7b899f6e7cb85171e44a3eaad7dfa99ca710ba695e06c5", "object_relation": "sha256", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547980, "uuid": "be9dd04a-21d2-4dfa-82c9-2f8e69b2c52e", "comment": "Malware payload", "value": "e6d046406615716d7e63b7f697fdc8ee5dec1648", "object_relation": "sha1", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547980, "uuid": "e0ce5303-9863-492b-8746-4216a5516b40", "comment": "Malware payload", "value": "6ac314f544a1186f4c7f5c3654b518a31c4fbc7c408103082da6c91787722d7d24ae8ea039df484724d2c3a85b74f4a6", "object_relation": "sha3-384", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547980, "uuid": "82c4d8f7-9a37-4d3f-b482-40de8a812d37", "value": "3481DCDC2533A4B9DA722553E00D7B7D82752EABF80E74F09A8481011F66F8DD268F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547980, "uuid": "73425ed7-0a49-4548-b3ab-2043679d247d", "value": "96:napffGsgCMSzclhPdztqBuSZMDPJ96DKMJ4m1SDFwmMe1:napff9MVhVztDSZMn6DKMJoxwmMe1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622547980, "uuid": "23a8db7b-5bf6-4f4f-bc63-09c7a858d0ce", "value": 3837, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622547980, "uuid": "3f7f11f1-8d07-4d29-a86f-e8ba595b1524", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547980, "uuid": "98a73fc0-55de-4aec-ad8d-ab845d67c5f8", "value": "62c9757664447d903e7b899f6e7cb85171e44a3eaad7dfa99ca710ba695e06c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df8144ca-c282-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622515291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622515291, "uuid": "cd4c985f-0a62-4f4c-a698-47913f6c912d", "comment": "Malware payload (RedLineStealer)", "value": "c75b5513e9d3d42e81f294e7c4d3213d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622515291, "uuid": "f9ba1fc9-33b8-4502-8b38-19fd5ad252eb", "comment": "Malware payload (RedLineStealer)", "value": "638530dbbf77baacf60576aa4731dad819d965985c3f3c7b03a29aa938f07564", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622515291, "uuid": "4f822988-28b7-4fbf-b338-4324a39bff24", "comment": "Malware payload (RedLineStealer)", "value": "8c3197b5f390ba21f4e1ea2a61f743945334f8ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622515291, "uuid": "df5aee39-15b4-4c73-a622-e3d46c26c76e", "comment": "Malware payload (RedLineStealer)", "value": "1b3a9741c5274cd6a5d6fc89f6d9f3f4bc3222c84c305b4b0586633535229b7eeca157966b52f0b8c76c120888daf219", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622515291, "uuid": "8c9ae6b9-c483-4867-a23b-b5a3ed77af63", "value": "7574126C07A8C25CEAFE2638407441149336F257A232C74E8F49A4BD9E97B15CAC7F76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622515291, "uuid": "a45f6d85-a781-4ab7-b00e-ac8d41fe769b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622515291, "uuid": "60c09480-2753-444e-acc8-6ed156e1f07c", "value": "6144:CnLAskLMSwKeue3ZEzc7r9qyxKPCKT7pM10brfBkqJ9XiVZJ:CnLhEBFq9qUKPjdbrfSq8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622515291, "uuid": "f5586360-16d4-4414-8c26-ddb1f415136d", "value": 337408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622515291, "uuid": "46f26bc5-db02-42d6-a991-6daf4b089f4c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622515291, "uuid": "7b4e4eb4-4151-4209-b916-4bb2367d88d1", "value": "C75B5513E9D3D42E81F294E7C4D3213D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "548845b2-c2cb-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622546411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622546411, "uuid": "4bd4292f-8559-449b-aba4-39e9b7ab1e9d", "comment": "Malware payload (AgentTesla)", "value": "4cef3df8963e77207a2e04887a140761", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622546411, "uuid": "2af4e8a6-2a04-4ba2-998f-d4b45d054b2d", "comment": "Malware payload (AgentTesla)", "value": "63b6f4de7ae3b635415d9963830613c9b6654a6d1e429580494105a72404867e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622546411, "uuid": "189e686d-2869-4ba8-9610-67804d6b612d", "comment": "Malware payload (AgentTesla)", "value": "20291056c33713ad10b05c0d290d272bfb0e524f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622546411, "uuid": "cf326d11-5a47-4c0e-9cc9-a999e687bc4c", "comment": "Malware payload (AgentTesla)", "value": "1b6fb4d845824a4453795e348722013681ff50749759864ceba79deabe68e2ff5b15b8ba5d566e8857813097ed5b99b7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622546411, "uuid": "96945735-9b9e-4654-9228-c06025a1ba6c", "value": "53A41378F0B71AE4F14BC9C429A8FDA50A3235F3E8CA1931137C62449FADB946E5944F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622546411, "uuid": "cd0752e4-d28d-4f44-8e56-7c073c580dbe", "value": "6144:b5Rdbyp2l+kLunuZ06v/8CxTQEg9YNom+atq0K3C9w3i8:9ywl+kLun4L8CxTQEcYNom+aGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622546411, "uuid": "77b05b7f-4461-4d25-bfab-8ea8608fb2bd", "value": 482148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622546411, "uuid": "529e6978-a71b-4ea2-8a14-cd73f364f4d8", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622546411, "uuid": "3127a692-f363-438d-acd2-d952dd622834", "value": "10.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a44ab83f-c2b3-11eb-875b-42010a9c0053", "comment": "Malware payload (Adware.FileTour)", "timestamp": 1622536237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622536237, "uuid": "59426380-c05b-4004-84bd-bf243bdc2d8c", "comment": "Malware payload (Adware.FileTour)", "value": "ac001161492c123ed08aff6389716c8f", "object_relation": "md5", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622536237, "uuid": "07c7c1ef-ac90-4706-9fd0-5c307919cc25", "comment": "Malware payload (Adware.FileTour)", "value": "652788bae486f6ef0ecadb2a951cd25da57d4f399ba77011745bae565cb7e762", "object_relation": "sha256", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622536237, "uuid": "70527fab-8a89-402a-9d23-00a3bb4a9475", "comment": "Malware payload (Adware.FileTour)", "value": "26fca9da16ebcfad666c22f6cfc5adda1a3a3d1c", "object_relation": "sha1", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622536237, "uuid": "5d4da4e0-49b4-46ab-938b-7d0f0b28cd5d", "comment": "Malware payload (Adware.FileTour)", "value": "d29f084f9a7af8a8b5b3f6347c12c22ea19c78fe3e2f8b2644e590d59ce028d5bc4a9d68d0cdadfdf71c8ff08564dbdb", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622536237, "uuid": "9e5d8522-1bfc-4d73-9825-c901a09cdab3", "value": "0B0633417BE8C0F4E6524435BE48DBF3A4FEC38C173361D3AB10C5AA2F7C6A5A51A694", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622536237, "uuid": "2bcce229-d273-43c6-bfb2-d12ab2036f01", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622536237, "uuid": "92403f6d-ecf4-4f05-85d7-053fc2e4749e", "value": "98304:xgCvLUBsgAfrEdTPOoeCfFS0JUKbhtetWZ1XGReVlF:xdLUCgAotPONCfE0Jb19Z1XHVT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622536237, "uuid": "6b4f2333-4a64-4115-bc70-bbc363c365a8", "value": 3939251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622536237, "uuid": "01482f5a-096a-4252-94a1-307c6546bf7a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622536237, "uuid": "a456e443-9ebe-47fe-b23c-0c60032556c7", "value": "ac001161492c123ed08aff6389716c8f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d33de22-c335-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622591979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591979, "uuid": "0bdcc33a-4cef-4d1a-83c9-42d6adf5cf6b", "comment": "Malware payload", "value": "c59d65430e090f31c85ebead45d197ab", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "encoded payload", "colour": "#0021A0", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591979, "uuid": "f6207ea0-579e-45eb-9537-04c3548af182", "comment": "Malware payload", "value": "656384c4e5f9fe435d51edf910e7ba28b5c6d183587cf3e8f75fb2d798a01eeb", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "encoded payload", "colour": "#0021A0", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591979, "uuid": "c65dec0e-1c2e-4be0-a277-0c6a0d086c18", "comment": "Malware payload", "value": "88f009eb0d6802470b883b606700508ea5db49ae", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "encoded payload", "colour": "#0021A0", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591979, "uuid": "f67f37cf-a100-4cbf-9b56-cfdaa0a5c176", "comment": "Malware payload", "value": "d881f2a6455ff58e81b412f33b2ab16095e12baad7a5da8204a32047813d3eb621db88ab4e2af1417a154290f3c6cac4", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "encoded payload", "colour": "#0021A0", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591979, "uuid": "ee65b4eb-47bc-4080-85f1-9d33d8632395", "value": "CB9312E3FD75D11A9E4B4D5D032470E7BAF63EAB1A61DD76A28CE820E1643C1E72D006", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591979, "uuid": "266c5615-2f89-4979-ab60-532fb23dc675", "value": "1536:8LdhgRLd0rklfzIuSk3gl9o0f+g57fYTEl457nh0xmVdHKsvX+PPPplF5ddDYWzN:8id0rk5IdY8f+gFSrHloBlF5jYWv2Oz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622591979, "uuid": "081d3f7f-a3b2-4e4d-949a-0cf1d5f7fe98", "value": 95265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622591979, "uuid": "84eaa46f-935a-4814-9569-0a55cb726c7c", "value": "application/pdf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591979, "uuid": "3c2ac353-4e7d-439a-aaf2-519b0418fc15", "value": "656384c4e5f9fe435d51edf910e7ba28b5c6d183587cf3e8f75fb2d798a01eeb.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cca47984-c29e-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622527285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622527285, "uuid": "9788d94f-e7a4-4db5-a3e8-df0e4d789e8e", "comment": "Malware payload (RedLineStealer)", "value": "07940014d57eace5c143e704a79d1f50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622527285, "uuid": "16262335-f2e8-4747-b523-a91b4dc6f703", "comment": "Malware payload (RedLineStealer)", "value": "65f74567c2faff6c1005d715a0525fac1844809a853006e3298a0834b804e188", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622527285, "uuid": "6cad08a9-8210-4719-a98b-a5819a7439b3", "comment": "Malware payload (RedLineStealer)", "value": "5fac005fe7487612b8d41762de8eca09a1a9bf7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622527285, "uuid": "0c29ce94-621c-43b8-8a11-696fe6f6a111", "comment": "Malware payload (RedLineStealer)", "value": "5f54c7b27432b424d8915618c1888dd61258078485733646abaa527285833e863912518377052d58ee73479054a1243f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622527285, "uuid": "feac583f-b3ce-4f89-ab5a-e6eef3a98b6e", "value": "31849E10F690D034F5F332F88ABB92BD952D7DA1EB2850CF52D46AEA56346E0AC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622527285, "uuid": "7c53068b-1950-49ec-bca9-550fd5856934", "value": "ddfa50a7d17fa7288028195442f05ca4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622527285, "uuid": "34157c25-69d5-4d59-a94c-d6386a6c5482", "value": "6144:ZxnTWrlBbUDEB1CV66GYpBh+831orxRCOaBjOK0Wl3J0n1urVE:ZxnTWrlBAEB1CVkYn3eUOk3NrV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622527285, "uuid": "227a6770-9d11-4fc4-9b05-85e9c29f3af0", "value": 401920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622527285, "uuid": "1ac05ad8-dea7-4c34-b2d5-b9ebcee6c1bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622527285, "uuid": "585352ef-328c-4a12-848b-d1060f160ca8", "value": "07940014d57eace5c143e704a79d1f50.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c326c41b-c2e4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622557334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622557334, "uuid": "ca6b364d-4c89-4410-a6a9-f41eda21335e", "comment": "Malware payload", "value": "8e92a33277fce903f46b4551b9871f8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622557334, "uuid": "5e4f761b-3902-4e0b-9cee-ed1197b443da", "comment": "Malware payload", "value": "66000a28db4d08daefa210364ed798c2ddab00ebd5e9fd5793ac7558537d9425", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622557334, "uuid": "1ff5a0aa-914b-4401-9e09-6a6967ca6947", "comment": "Malware payload", "value": "245df5266c736ea88ce31f72626e7fa0f75d0fbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622557334, "uuid": "c4161917-c4a4-405a-8198-d6d31d9ba7ca", "comment": "Malware payload", "value": "8f20bf56b1ebadc3cfcd4e9ab74eaa6bec08ad6ba52354e91455d20125bf894cc34f533f6298b4e7ba311679c4a9466f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622557334, "uuid": "240eaaa1-4855-45f5-a589-cc4500e590c5", "value": "1424F112B3427665CEB90E7EACC6D4700377BB136827ED5A200CF2599533F885BE466B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622557334, "uuid": "9982f0ca-4ac0-4785-9975-13d7e01a19fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622557334, "uuid": "13c33cc4-bf21-4340-bf17-975f3503cdbc", "value": "3072:kni9sBoyDx01K1t8cxdqhurJ0g04pQdseKpxKi78Xtv22yeU:GPBnD+w1t8K0+xSWKiIXR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622557334, "uuid": "8bcb6b5b-5637-4fb0-b2bd-64acd45cddc9", "value": 224768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622557334, "uuid": "37d5a7d6-fc8b-4f14-9a99-ad409d2c3933", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622557334, "uuid": "44150d9b-679d-475d-8a5f-dc62609c8a6f", "value": "8e92a33277fce903f46b4551b9871f8d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3bc3368-c2da-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622553094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553094, "uuid": "ef5ab0e3-347c-4133-bc47-2077bffaa0f6", "comment": "Malware payload (Formbook)", "value": "cdc018a44e40c90de305f5a0f68db451", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553094, "uuid": "7b4c22e5-feaf-4baf-84ae-708956d86999", "comment": "Malware payload (Formbook)", "value": "664aa81f10f6251026abcb4120f5df0cc5c8d5045942ec045d310a5f1e4969c1", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553094, "uuid": "da471488-f2a9-45b4-9db7-f7ca4d708b75", "comment": "Malware payload (Formbook)", "value": "2bb35ad3fc14eced7bdd47f55b46e765005f81f5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553094, "uuid": "ba3cdceb-8931-41b5-8758-a14bf8e9fcd2", "comment": "Malware payload (Formbook)", "value": "28b08f2ae5af71f44a71f0fc465013f531d644669ba88866c2003ce1a57a07034a5a5b3d1a20e0284afd3d5ab2616d93", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553094, "uuid": "66de6621-b292-4765-a608-8eed181b061b", "value": "E44523B1BAD06BABD86F17FD04AFC0315BBC2C5BF20396695BA67121157A331426E12C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553094, "uuid": "9e33cf00-04de-4dd1-b636-9f790f8baa7c", "value": "24576:DpbVLKfYsUKsha97T3jr7lzugyiqqX8B+2JfP9+lMl5Oy0bFCaQTXRg:DjywGJqVB+qNf5Oy0r6Rg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622553094, "uuid": "7a4c2a0d-dceb-4b7c-b92e-f05b92dce5dd", "value": 1264424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622553094, "uuid": "c03c03f7-f512-452e-9b39-9337ea0a18b1", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553094, "uuid": "117821e2-8867-426f-938d-8e326c7325e0", "value": "BA-CONTRACT 312000123 SSR ADVICE 31-05-2021.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a20de62b-c2da-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622552984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622552984, "uuid": "d75a7806-8c04-454d-be2d-2e38cb29c242", "comment": "Malware payload (Formbook)", "value": "7037dbde5fb5142dd574e03f971292c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622552984, "uuid": "d9c217c4-de34-4c64-9025-35b0a42b03d5", "comment": "Malware payload (Formbook)", "value": "672795699cca5d2353cd8a39ea7d1c0f2a779b3c943a7c3630884b2141a82214", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622552984, "uuid": "7e512523-6868-43de-8acf-42bda59b9ac1", "comment": "Malware payload (Formbook)", "value": "ff96d596a86a7f18d3ff8e5c530b8d9562871acc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622552984, "uuid": "f4eb15f9-2106-49e6-bbbb-8628126abd52", "comment": "Malware payload (Formbook)", "value": "6d1f2aa4a0120cc439deb9ca7612867f6ec9aefbdb42f0c66e9d5df1dde5d781632efc9783133633c5de7a363d80dd82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622552984, "uuid": "02f1e280-1c1c-4aea-bf07-5f123fa020cd", "value": "97156C22B6B0CD33C1B9297B5F0776E85C2CBE302D54B8663AE97D48EE3664178251D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622552984, "uuid": "ef457c09-24fb-4bfd-9444-c03a1bdd9e8a", "value": "449021d3d5fea66598eeba9c93aa4705", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622552984, "uuid": "daf4b075-965c-496f-8c32-bef6ad8f736d", "value": "12288:jkIquSFoM9SJLcThopnxJ/5JKcut4n2O4XP2OzeRtSP2Ny6c:AtBvSJLcT2xJ/53cI2OEP2OzaZyB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622552984, "uuid": "badb4228-e194-4633-9094-becb7183f438", "value": 883360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622552984, "uuid": "d2089319-c367-499e-83d4-f89efb29ec07", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622552984, "uuid": "e78905e5-1d91-472d-b95c-93183ea23201", "value": "003 SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ba9d6a5-c2c9-11eb-875b-42010a9c0053", "comment": "Malware payload (Stop)", "timestamp": 1622545537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622545537, "uuid": "068de929-9341-4648-926b-3d3bcf8b887f", "comment": "Malware payload (Stop)", "value": "db2ae9060a09c595cf2c7390fdf837b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622545537, "uuid": "3b9f38ff-0a7e-4b31-ba62-d09ceeed9cb5", "comment": "Malware payload (Stop)", "value": "676fe1f868300fadc29cfd816f9ade2e105622a2cd9fc9e38b66a0c7359f3d8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622545537, "uuid": "6c442db1-bc31-451f-a612-bb0873a73fd6", "comment": "Malware payload (Stop)", "value": "4d7004f87206b7238d53829f2cde9e986da7a8a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622545537, "uuid": "0a6d46ff-5d29-495c-8ae8-ba4ad195d119", "comment": "Malware payload (Stop)", "value": "5ef8cd2804ec92f52fb7aeed21355ddc6ddae8b6ffb3915a8b321f02224f1b34b954e5de7a25e46966a5b0332c4a4830", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622545537, "uuid": "7f450465-1fb4-41db-8e8e-f5b7b7365fcc", "value": "C905F200B690D034F1F772B59AB7826D692D7EE2EB3450CF12D5AAEE26345E0AC31747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622545537, "uuid": "3c92d416-ab4c-412d-b218-540fa3623e23", "value": "84a7eb4192b6bf7f0b88f528d598a47f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622545537, "uuid": "806de767-365f-4f00-9c91-1c9cba7233a9", "value": "24576:iTBt3/apw8Ox5v1kATJI8C5z68Nk2lq6AWieR:iPkavZN2BAWFR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622545537, "uuid": "ddc4bcb8-5240-4038-adc4-8ddb192cd179", "value": 862208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622545537, "uuid": "65890615-f647-4926-a46d-650e6efdd7bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622545537, "uuid": "8f171a1a-ad1a-4402-929d-c4dbb262c033", "value": "db2ae9060a09c595cf2c7390fdf837b3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9239369-c2e6-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1622558150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622558150, "uuid": "ddaf2f98-b7a7-4119-8f42-faaa8fbf4117", "comment": "Malware payload (IcedID)", "value": "8a17c1e3019c4ffaad39f98aaf2c3108", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622558150, "uuid": "c01fbb5e-016a-4fe4-af9b-dfedc43801d2", "comment": "Malware payload (IcedID)", "value": "677dbb3d766eb72cbaf57720f8d7895e2569c209e9b11f820811d8df19c63e7a", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622558150, "uuid": "89d2792e-0cba-40bc-9b11-3ee246ca4e05", "comment": "Malware payload (IcedID)", "value": "e71ecdf6a889dd04e88475d32fa4e1e93ce8cf21", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622558150, "uuid": "0ec82cdb-dfda-4ff4-9514-a1309f6436af", "comment": "Malware payload (IcedID)", "value": "d280da104432309e7815abd02e513b62e6bf7219d099275707c6efcc2cf6b9b825eda58f613fc5f4308b9cb802614ab6", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622558150, "uuid": "af4425b1-d0cb-4def-9a63-d7132b7e92bb", "value": "D163F188E9563D85D333C47FF96824FAE18A265960C0B80C2E61E24D0BA778717FF61D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622558150, "uuid": "231df456-664f-4ac0-9452-749599b9ea08", "value": "1536:QsiLKwfKO/epnbl8D+uHyYKmpniWWGH0AeWsx7h:QsSf2pRI+zYKmpniWW20Zxl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622558150, "uuid": "a169dfb1-61d8-4670-a7b8-ca4a2b501694", "value": 67446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622558150, "uuid": "233e1729-817f-4d07-9f66-489477197738", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622558150, "uuid": "dc2df978-ed0e-4c2e-9375-98f8e6e227e2", "value": "677dbb3d766eb72cbaf57720f8d7895e2569c209e9b11f820811d8df19c63e7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f19de4ae-c2ef-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622562137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622562137, "uuid": "6bd7c74a-b7d1-46e2-9c1f-b3370a7e9024", "comment": "Malware payload (AgentTesla)", "value": "b72e0e1344e5107ad9ccbdb27164114f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622562137, "uuid": "7f58dfe9-9b38-486a-a39e-af32588fc0ce", "comment": "Malware payload (AgentTesla)", "value": "678b3bcdba43bb32445d3088d4dd3ce9209a23381841830ab4c1ea8cb609edd3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622562137, "uuid": "8b90364a-0bb1-4126-a285-889cc6af3e1a", "comment": "Malware payload (AgentTesla)", "value": "c17042a608b459534f5cee1fe5a40bad4a0e109f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622562137, "uuid": "35fca8c9-b200-4b3c-bb09-71c00a3ad561", "comment": "Malware payload (AgentTesla)", "value": "0db62913e49280c873a03ab4a535e41676c9fd64887d1f20d68fe2d940dcf6f97d434ffe81b3edb5ff78370ff2f78d0c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622562137, "uuid": "b9dfe8f9-ec62-44ac-b173-2606db19fab7", "value": "6644123A77C454FBE6E34A31016B5B71F7B7A31A2B22582B07112F790F624A76A13347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622562137, "uuid": "c1d18bf6-b19b-42a4-9570-c5d32b42836d", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622562137, "uuid": "a7c42549-d646-4b14-893d-a1654643ba84", "value": "6144:8Qq++pTWfvTHwd1r8eU9/zvFfX/b47gLPga1X6nhp:T+pqnTHk9g9/c7MWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622562137, "uuid": "ec0bae9e-d8f1-468c-9083-544bc8628bcc", "value": 274827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622562137, "uuid": "907f4f71-1c29-4466-97b3-6acd0aa50b1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622562137, "uuid": "dcabe945-deee-4cd4-8297-c16023a5118a", "value": "INQUIRY_SAMPLES773887_PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d680fb47-c2a2-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1622529020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529020, "uuid": "43cc1ab2-7379-4f77-981b-d565dc85fed3", "comment": "Malware payload (BitRAT)", "value": "028ee366a7f4b43a29d60872ada36f8e", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529020, "uuid": "2ef962da-f616-4404-9728-99b57783b5fa", "comment": "Malware payload (BitRAT)", "value": "67a56ec7a3dbb37af95b762014d093cb5e47cd5579af4611a82ac0e847bea910", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529020, "uuid": "1890ed88-d9ff-4ce6-ae2c-f685de197d62", "comment": "Malware payload (BitRAT)", "value": "18853be2f3fbce2570e30a2eaf6f5453eb0cf5fb", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529020, "uuid": "fd04f7e7-1cbd-4617-86ea-01f8b38a73b0", "comment": "Malware payload (BitRAT)", "value": "c45e3ade344c9221c81bac3ce6028e5197d7f634f2e90874cfdf82802465da54c9421f842005945d8d12a9a851aa2136", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529020, "uuid": "2054ce10-c89a-4ca9-9001-a51fba8f6d37", "value": "7CC5D0F4FD99B86AC10ED731B25098FDD7631DFA028A4BA906A7FECD5B037494B48481", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529020, "uuid": "1c30983e-08e1-4a5f-ac9d-e2046866c23c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529020, "uuid": "30ead7dc-1f1f-4902-b1ae-44fa3c069069", "value": "49152:UqtFH4nmcNoDwAfDKuz3ZRpGyntAWp+3+qGDc7ZRT5JLft9wmcnfGtLc:7FHsrGDw5kJW2tARPJLftIutLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529020, "uuid": "9647efe4-e800-4589-9e6f-2a3d4f0be336", "value": 2526720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529020, "uuid": "3b5a3936-a0a3-419e-8ddd-a38adb9cc5c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529020, "uuid": "6bcb69d0-546a-4ee6-9167-186607103eb8", "value": "PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54bc2140-c333-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622591079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591079, "uuid": "8add3630-4d21-4718-b3a3-4bf9f5aabd23", "comment": "Malware payload", "value": "a0e5786223e98d702cffe00ee9cba3c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591079, "uuid": "8efab593-be2e-4634-a766-d0ccbe3b260e", "comment": "Malware payload", "value": "68eef7e7aa13163999786ef3108e659ba98a40b794a771f05fba8e7eaafb5c12", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591079, "uuid": "349ade61-cfd9-4e83-ab3a-5cc2ed186910", "comment": "Malware payload", "value": "6f17796f38bdf8e6b0fae0d2306d0617ffe1824b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591079, "uuid": "e0edd7ee-5d60-4cd2-8f96-b40103425866", "comment": "Malware payload", "value": "47f80124af121670ea764c5e575c625bb69a12faad3691432e1f58a3e7ca6a4ef6175319d7eb7587770dd71e17cbfb50", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591079, "uuid": "0dac3d1e-8b55-405a-a121-691e159ef8cc", "value": "11210B0D7380231AE1307AB395BEA33BDBEB418915201704C7F7224A745B47F54F9908", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591079, "uuid": "f1481c46-3b43-48bc-9507-f03ad2b33908", "value": "24:39BLWnNZc1eYHm5IGcqnhHEv6Bb5GPNlj+mpR9cGKW2ZaWb3abEZ5Cn:tx4kwYHm0qnhHNBdBmpRnKgkKAS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622591079, "uuid": "24ccf728-0a67-47c5-820b-748bf0bcd0b5", "value": 1440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622591079, "uuid": "e85f6337-9828-4547-9f31-16593bb1a674", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591079, "uuid": "0620308a-34d7-4996-837a-3cb1df50e658", "value": "SecuriteInfo.com.Backdoor.Linux.dzna.20997.18215", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a5ee266-c2a3-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1622529322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529322, "uuid": "ea68bc11-33db-4d06-97a3-861636a5e4fd", "comment": "Malware payload (AsyncRAT)", "value": "d7e998af7dd53c6c088305ccb80c4eb4", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529322, "uuid": "cb0bfe1a-f4c7-4e31-8b21-9a614b3d2994", "comment": "Malware payload (AsyncRAT)", "value": "699d7e2b7fd1875b5e84ed92556aae0b2b482ded55f48d32c8c11e1fa8db6c0b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529322, "uuid": "152b0bde-d36c-46ab-99f8-60fac6aa9af3", "comment": "Malware payload (AsyncRAT)", "value": "fff319200350392f8c20ffa57bbb2e7697bf490b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529322, "uuid": "bbd1402f-5436-4f98-8fc2-9d33b414c202", "comment": "Malware payload (AsyncRAT)", "value": "fe6a9b525dd85b54c8451459ad07e750cc4c1f8acc975408581741efc51229078556c39d4b4e674c8a511a32fac7cdfb", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529322, "uuid": "db7ecf74-7df6-4bed-b469-33bc22cc94b8", "value": "8BF097AA280CD175172FA1CD07A5A00CC20A816F2251EB12AA94DD1C30A3EA4AFAE853", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529322, "uuid": "91c75067-120e-4f98-ac51-a750e922f262", "value": "12:7EPaJSA1pEI+lI7wn2H/vMxCIpeEXQVz62H/vs8AdjQRcYSn0:7EPaQAAIBx/kUKgVz64/+H0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529322, "uuid": "a47546cf-2a62-4d01-b7f4-17612f949a18", "value": 490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529322, "uuid": "a79d21ff-51f4-4b67-84ab-d9843c66139c", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529322, "uuid": "b834b868-0623-4009-a4cb-09584335ca13", "value": "eBay-invoice-2195921.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d58dd4de-c2a5-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622530307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622530307, "uuid": "9b213f08-16e1-45c9-a93c-0ba548558a8a", "comment": "Malware payload (RedLineStealer)", "value": "63fbb16c35f1890c9b0d0ea7e01076db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622530307, "uuid": "5f985b84-bd19-4431-9120-7348c6713158", "comment": "Malware payload (RedLineStealer)", "value": "69c0a77de39fbf7cc3dfcdd29ba803f0aec498175091594c12a3341e05e32914", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622530307, "uuid": "adeb3d85-d63a-4df8-964c-ad0b78b64683", "comment": "Malware payload (RedLineStealer)", "value": "aae526ad616c2a3f14a019a389ef4f8ea13e8e57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622530307, "uuid": "2d244999-e0ab-4521-99f4-a4ba48c9ad7f", "comment": "Malware payload (RedLineStealer)", "value": "e77983859f34b817580cb13ae7b600d98e4979adf1b4d1985dfeab56b40d354dff0c732e8c9728f43cbbe08723d50449", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622530307, "uuid": "eaa5d84a-8454-497b-bccc-b527eac5e0e7", "value": "A7849E00F690D034F5F236F84EBB92BD952DBDA1EB6450CF62D46AEA56346E0AC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622530307, "uuid": "37d3280f-d9a3-4815-90a5-bb93cbc2fa2f", "value": "ddfa50a7d17fa7288028195442f05ca4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622530307, "uuid": "76d6fe87-16cc-4697-ace0-2d8000a69cd9", "value": "6144:oxzOIAWrfBLETEdlbinvz2GQMPFZQUbxImZhnxkSZGKJldtw:oxzOFWrfBwEd5inbZQMN1amZhnxkS3d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622530307, "uuid": "c416ac2b-d3ca-4279-8149-cb5b1567e0cb", "value": 400896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622530307, "uuid": "194c5ff6-dbf6-4706-8191-e99d0f1e74da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622530307, "uuid": "10453823-f786-42d6-b69c-4947d9e1c2d9", "value": "63fbb16c35f1890c9b0d0ea7e01076db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd67cb40-c334-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622591792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591792, "uuid": "4f3c7917-e8af-4c42-933a-dad595871a07", "comment": "Malware payload", "value": "ed24b708a0abb91d2d984c646527823f", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591792, "uuid": "a285a285-4b38-4c92-aa09-fa1d33dbdff6", "comment": "Malware payload", "value": "69f0d85119123f3c2e4c052a83671732aced07312a05a3abf4ab0360c70f65de", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591792, "uuid": "c3f7f1e8-31d4-4bb7-bf8d-af3a88d17fbd", "comment": "Malware payload", "value": "6e45cc934336d7709647c1c61d9f215f15fef396", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591792, "uuid": "13cb6873-d753-4508-8600-b1aa6d29659e", "comment": "Malware payload", "value": "37d1ad8e189d7f251eb3d3ff5fa625c906711c8ec017ace2035415eb99631b8d02d57b7e4e91040b3da64f3f5001c4fa", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591792, "uuid": "f6ded62e-4e81-4b95-98f8-907133d34cc4", "value": "2331C01807C55B50D2B28E336C3AF3168672FC06DD77CB690E8891C82C65328FA39E36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591792, "uuid": "3c6240a7-514b-4feb-ac8d-2a430c90764e", "value": "24:8uLbt6F78lTyA6e8+/ClVSY3+/27T4I02m5:8+UgltrulVh3jMIre", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622591792, "uuid": "31e87002-bd07-4d0a-8a69-1b6068b7e205", "value": 1697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622591792, "uuid": "a62859fe-c558-4c4f-854c-d777a1188de3", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591792, "uuid": "6fae9e9a-16ad-47d6-8d5e-af4b28c1bd38", "value": "69f0d85119123f3c2e4c052a83671732aced07312a05a3abf4ab0360c70f65de.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e3ace29-c2a5-11eb-875b-42010a9c0053", "comment": "Malware payload (FluBot)", "timestamp": 1622530026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622530026, "uuid": "4134a088-bbd5-48f0-8b37-97dbab1aacfc", "comment": "Malware payload (FluBot)", "value": "1edd97885a8a7e88694be9971ac317e5", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "V4.4", "colour": "#959210", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622530026, "uuid": "4f4c4dd6-9b1a-47ea-b98c-0caa721d37f0", "comment": "Malware payload (FluBot)", "value": "6a03efa4ffa38032edfb5b604672e8c9e01a324f8857b5848e8160593dfb325e", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "V4.4", "colour": "#959210", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622530026, "uuid": "b3bf2546-cdc1-451a-9b3b-8d6488c23306", "comment": "Malware payload (FluBot)", "value": "64c4b39176709a7fa9be936b925b17fb53544da9", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "V4.4", "colour": "#959210", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622530026, "uuid": "f20e8b73-5549-4457-8417-ec799819b386", "comment": "Malware payload (FluBot)", "value": "f3fe515c923d4e4b52196b1e646636a760b7cd2a1216ae0ae098df4b19486008c361010a51671397e59bf9e571e0ecf3", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "V4.4", "colour": "#959210", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622530026, "uuid": "532a9e08-6f4d-48fc-94e5-cf67c4dadfd9", "value": "38162326FEADE81AC00BE136C971D557D408207E6614F61B1B75888C4EBBD81EB0BEDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622530026, "uuid": "4310fb30-7c56-4088-8857-53be7b70b346", "value": "98304:s5knISHh3FZNqsf44bTUIYiFZBrzXUpBJ1FS3VfTvOGn/Ms:oknhlj7bUIYi5rzXUbJ1FS3VOGn/Ms", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622530026, "uuid": "28e7b0b7-78a8-43b9-9ec1-4bff310f35c3", "value": 4235044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622530026, "uuid": "e399d16b-96be-4ea8-a984-0b745106d1ac", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622530026, "uuid": "e16e6f5b-3065-4371-b000-758f2c93bdea", "value": "DHL706.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3de7767e-c2db-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622553245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553245, "uuid": "35968663-64b2-4b07-9c03-167088e64d71", "comment": "Malware payload (AgentTesla)", "value": "2fb9d33ba637d20dd063413bd737ff4c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553245, "uuid": "e66175bd-ac07-45bd-b37f-246d2c7041a5", "comment": "Malware payload (AgentTesla)", "value": "6a24ab81488efe130ff37ee21f06443dd8c23c156ca94a714907798fd1fae44b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553245, "uuid": "ca59e777-9b76-4c90-8c71-2993182910d0", "comment": "Malware payload (AgentTesla)", "value": "e136a2774fb2428cb4b86ab0d0d913956c8465b9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553245, "uuid": "de8ff8b3-5178-4164-9eaf-595e05d66acb", "comment": "Malware payload (AgentTesla)", "value": "3b083e70524a0087e444e182a0333f07f2ea6f062db424856356feec701fb891dab0b221e707920a0bff777fbe786fef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553245, "uuid": "bdf487da-a57f-4463-8a7d-2a0c1a9cecf9", "value": "86158DF4F598A9B2D14ECB72C7919CAEEB6112FE1243491C0AA9DACC1F0379E8F5C445", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553245, "uuid": "1d7f2fa3-88fa-45fb-ba60-583a4c50a60b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553245, "uuid": "e8fd60cf-88f9-4975-ba53-7b7f0f918fd3", "value": "12288:M2JoMkurhvT0TluFZOLKdjprlrkeSSWfzo9G9tD0tOZJln7duzS:M2JVrS0mLwjBrSSio9G9x0tOZhd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622553245, "uuid": "1ec64892-bec2-434f-949f-ab2783e849d0", "value": 923648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622553245, "uuid": "34ce4e11-4a61-4e6e-9724-44deee86c111", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553245, "uuid": "47ccd0d1-d6e2-442f-b669-4088d1affeea", "value": "PO-VN8829297187.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42e77abe-c2db-11eb-875b-42010a9c0053", "comment": "Malware payload (WSHRAT)", "timestamp": 1622553254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553254, "uuid": "46cce75f-0cab-4a56-ad95-a3e6034cb6cf", "comment": "Malware payload (WSHRAT)", "value": "513e79b433bc1ff7be51bae91d4ad7aa", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553254, "uuid": "c513c254-3ae6-4f20-8613-7a72ba691597", "comment": "Malware payload (WSHRAT)", "value": "6b833497346dc87d546fa9b07cdded60d6db017c91ce4f0d537f9cf9ba21f3d4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553254, "uuid": "ec31ab1b-7c47-4830-ba1a-3080b167fde2", "comment": "Malware payload (WSHRAT)", "value": "b357e275cab637e3beabff982156ec1bccf6d166", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553254, "uuid": "e739f66b-a524-4500-b004-953d196cb2c5", "comment": "Malware payload (WSHRAT)", "value": "35a8f39d97a69118df0226912f16bbf4ca464d525c866e82c864f873e0b940cb07df1737ab32abca898a7d1c0134aa85", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553254, "uuid": "68d8103f-8bf3-4b72-a89d-2a2a12661362", "value": "E4C4D729716EA6F5C071D2E32F408A86041BC2D4D1F16AC5A9EDFC69933C3C9F2961DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553254, "uuid": "2c126d06-41ba-46e4-8b6a-d50ebe709eff", "value": "12288:MxzwdtcnZpXe/qLqQRq7S6zduSPSj15p/qT5flbyX9iJ9AIWCHt6w3Mf5h8tJH++:7dtcnZpXe/qLqQRq7S6zduSPSj15p/qh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622553254, "uuid": "f167c05b-4065-43d3-8977-7a4ce38c52f1", "value": 564040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622553254, "uuid": "c21f8b4d-78e8-4fa0-aef1-9fd15b37f2ae", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553254, "uuid": "7b1f0507-f5ce-4d9f-9784-b9db470384e7", "value": "ORDER.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3694fe7a-c2e2-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1622556239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622556239, "uuid": "fa796722-7c31-427b-a77a-c673c8cda569", "comment": "Malware payload (Mirai)", "value": "ef7a25db3fdf6b149f84147d56b96992", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622556239, "uuid": "0ce0cc61-10d3-4919-8672-3a101565b2eb", "comment": "Malware payload (Mirai)", "value": "6c432ec8f76b7625a7ca3bbc7235784cea53f269c1ab865e558be3589f7cdfbf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622556239, "uuid": "45c627e9-34fb-4f61-9311-7991d2e3d563", "comment": "Malware payload (Mirai)", "value": "01710678078210e3e1b08239f78ed1e7358bfc9f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622556239, "uuid": "5d897642-f587-48bd-b810-c6e626fd2d45", "comment": "Malware payload (Mirai)", "value": "03909509f4759a7ceafb821fc22f83a880aac95f13aa394e75e28cc874be04c4931b6cbd749a38ad9002d79f00b31fc8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622556239, "uuid": "9d465556-4fe4-44cc-95fb-1a8002ec987e", "value": "1864E1CAED01AE75F9D547B9BA1F074973B68BE8D3C3B110E224C61439EE6468B391C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622556239, "uuid": "7c57b7c9-63a9-4a5e-9818-8dae58c71b8b", "value": "6144:7O/QJHZweEL/NOjCHm7FZZncMoNsKqqfPqOJ:78QpZsKCaiMHKqoPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622556239, "uuid": "49b1572c-0d79-4ccb-8676-2081ad7beab0", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622556239, "uuid": "d3131392-10f0-4513-878d-016f36eddf74", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622556239, "uuid": "96133afc-db47-4d6c-967a-bc19848185ce", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd843987-c301-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1622569780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622569780, "uuid": "3a90a32c-d5b8-4b6c-90e8-afb74ddfbf5e", "comment": "Malware payload (SnakeKeylogger)", "value": "26044ede9d0cb61b6e7dc8a335d4bff5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622569780, "uuid": "ebd3b5af-aa37-4121-abff-4da4474f879e", "comment": "Malware payload (SnakeKeylogger)", "value": "6d90749ebf53964457ca724dc03586d828b8f43302e987664c23f68580ccbd25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622569780, "uuid": "6420633d-e968-490c-91d7-d15452bd8bc0", "comment": "Malware payload (SnakeKeylogger)", "value": "f42e7a114f4233a9eb94c4865d484ea704fd30c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622569780, "uuid": "78441dd1-3fcd-42d4-939f-2cf0a36c1148", "comment": "Malware payload (SnakeKeylogger)", "value": "bd377d6af7092bef91a78d2fa8ec428d033d864e5db64ca0b72133356fa17fe0e7fd802f7f88f614a809bf31f0c8ce77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622569780, "uuid": "2a1d4585-36e8-4602-8c3c-15f5296f5362", "value": "A0157BF4F0989AB2C18DD731CA90DDADEB6216FE92034D1D26B4EA8C1B4378F9F59444", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622569780, "uuid": "2a23d051-f4b7-4b7f-8d77-0dc89a083908", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622569780, "uuid": "dc661d88-e33c-472e-944b-0abb9507faa4", "value": "24576:tiKhlE/irqgqUiNqAp6shxeCbYuhJFlrikJHbZDSu:Sp4CbpRlGkRdDV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622569780, "uuid": "67bace1e-5fec-4304-815f-ba7644f15778", "value": 875008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622569780, "uuid": "7f1d466e-9c89-4034-84e2-a774f8918af1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622569780, "uuid": "efd2a464-ad4c-43ec-83ab-35273ead8fac", "value": "PO#131222.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed8d110a-c333-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622591336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591336, "uuid": "609d11e3-308d-4efb-be4c-7dda6e2a6fe3", "comment": "Malware payload", "value": "df8028d0769429701c3d380d7705ed59", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591336, "uuid": "31fc1ce1-bfdd-484a-a748-d46f3c3e090f", "comment": "Malware payload", "value": "6dc08be554674d05a630d6f3a5fd851d804ed5360b8d954b5d1096ca25e41e52", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591336, "uuid": "e85b7d03-181b-4cd5-bcc4-76b5c9aaad95", "comment": "Malware payload", "value": "9c1e7fa746e0d14684cbc9dcc7e3f1372c26ed0c", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591336, "uuid": "6dac4216-6d19-4b05-82de-76c86cd25fe7", "comment": "Malware payload", "value": "217e3389af3c2338330903e9495aeea5211186d4f114ec816e104c697e7f80e2928bb080243c259b46ad29c0d8bbf94a", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591336, "uuid": "1cf2b14f-d558-427e-a04a-bebafcc6aa5f", "value": "3875F10DD9335074DE95C77CBF894766688EBABFD5BA9133E428C56BB4C0268B81C0B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591336, "uuid": "8d58d04d-2307-4b60-9d99-332efa651fbd", "value": "12288:HKAV/eHtTJK3STyAcPQ9qWoUyHYa9j2sK+En:IBcXYcjpEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622591336, "uuid": "c3e47590-45d5-4003-8af2-2a8feb4a5c61", "value": 1663524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622591336, "uuid": "9b51a93b-1b11-4289-b220-833c978b4f10", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591336, "uuid": "68a8f671-828e-4595-866f-7ecc2df3395b", "value": "6dc08be554674d05a630d6f3a5fd851d804ed5360b8d954b5d1096ca25e41e52.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6478109-c333-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622591350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591350, "uuid": "633512b8-3708-4397-b5e6-e12594aaae61", "comment": "Malware payload", "value": "5a75adf861a11e0d8557630759cd0aff", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591350, "uuid": "e5c32783-6bea-4a4b-8edc-9d0fd0f69534", "comment": "Malware payload", "value": "6df1d7191f6dd930642cc5c599efb54bfcc964b7a2e77f6007787de472b22a6a", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591350, "uuid": "53eeb66a-7319-4de5-9495-2035ea6be2d0", "comment": "Malware payload", "value": "87f423dec511678bb970cb66a84ceb4f526ff61a", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591350, "uuid": "1884121f-5e43-4c76-8243-3cc0fbb3efa6", "comment": "Malware payload", "value": "24ce34577827a2bb7a36181e18df6f25bc89df348ccfce26e321afdc5473bff88af2955c1f9ee550571f58a82ce07890", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591350, "uuid": "2b78ffe2-17cc-46d1-ad26-13cbc520da3b", "value": "5A85F12DC9335074CE95CB7CBE8D07666C5EBAAFD5B99132D438C56BB8C0258B85C0B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591350, "uuid": "a58d215e-a303-40aa-9679-e4ed5fd11a4b", "value": "12288:kWKAV/eHtTJK3STyAcPQ9qWoUyHYa9j2sK+Em:kLBcXYcjpEm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622591350, "uuid": "5a91670d-b640-4e3c-8229-bf3c5b531b6c", "value": 1715656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622591350, "uuid": "c7f257de-79ea-411f-bd35-2b2867854051", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591350, "uuid": "d67bf4be-fc44-439f-8fa8-b2c43ec821d9", "value": "6df1d7191f6dd930642cc5c599efb54bfcc964b7a2e77f6007787de472b22a6a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "890e7aaa-c2b8-11eb-875b-42010a9c0053", "comment": "Malware payload (Stop)", "timestamp": 1622538339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622538339, "uuid": "ef9c8136-2ccd-490a-9657-f12140ced4a9", "comment": "Malware payload (Stop)", "value": "72a2fb1c6bb26662c7abee07ff05e70e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622538339, "uuid": "e6e1220c-6612-40bf-8ee1-3ea8e9ba9a3e", "comment": "Malware payload (Stop)", "value": "6e4633527799ff0ea7f632c70f6554be0e9c9b769e8631190e21f7b1c27193f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622538339, "uuid": "c417dfbc-6030-42d2-bdb5-c82ec56462e4", "comment": "Malware payload (Stop)", "value": "6432a63008b9e2de9542bcdfc397cbf5adbdbd66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622538339, "uuid": "2d731b49-c1e6-444e-a4b7-e32ed753588c", "comment": "Malware payload (Stop)", "value": "15a94eda68f90db73896da75f51e8df71a7fba89986578b5bd988117709151b005e3b82061d9048dcd73c969da997feb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622538339, "uuid": "e85b83a5-5dcb-426a-9b85-e6985b8ea467", "value": "7A05F100BBA0D034F1F776B95677916CA52E7DA1EB2450CF22D5AAFE16786E0AC30707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622538339, "uuid": "a64f9f41-54c4-4488-af23-b5cc077555df", "value": "2f20facc3edc1d8ba24ede1f07abf090", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622538339, "uuid": "e4f939dc-69ae-4397-8f8a-b80f8e350e00", "value": "24576:ATFRVrfztqC+NJG9TyxSV/t8RFGmchVgkf4oTo1Cnvh:Ax/lqCt9+xSFteQ1f4oToYZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622538339, "uuid": "ec8a3491-d4c1-450a-8a71-92565cb29683", "value": 862208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622538339, "uuid": "d9e1adc1-bb78-4388-86a1-b23cb77cda76", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622538339, "uuid": "f5c1949b-eebd-46cd-a9f8-b3e73636d74c", "value": "72a2fb1c6bb26662c7abee07ff05e70e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea092229-c2d1-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1622549239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622549239, "uuid": "a32695f6-6141-40a8-b0c4-7f2c83430293", "comment": "Malware payload (AsyncRAT)", "value": "15b24030522500ae9fa5f5a7fbdc4012", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622549239, "uuid": "5e899ba5-f9bd-4aad-bc8c-7e2b9c857a95", "comment": "Malware payload (AsyncRAT)", "value": "6e5c2d917d1b94c5cbaadbcc8203692a8c1a5120d06932adacff14a765715d32", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622549239, "uuid": "39bc5757-ead7-40fa-a32f-b2fabd894fa7", "comment": "Malware payload (AsyncRAT)", "value": "b01b8274956c0f2937d9070e1e36afb9643a2a65", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622549239, "uuid": "57aa3e5e-913b-423d-b1ff-ba1596950141", "comment": "Malware payload (AsyncRAT)", "value": "cd309fdab17bab836d4e3bb9e03f6dd514bb2681456934c7bfb3194a621d7d14d3ba5747b278c7ba8b873af9d8aae121", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622549239, "uuid": "b2ba22fb-b138-41df-a54a-64f1c94f9f9b", "value": "8C258DF4F048ACF1C14FDB31CE669CB947265EFD1202891C1957BB8E4A33B9A6B4D849", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622549239, "uuid": "d6949b11-3a5c-4cab-9f89-67fb94fd613b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622549239, "uuid": "bd96f44e-33b7-40dc-8c05-993409a8e219", "value": "12288:ExElvTRZjbwSbf4TzixvEU2YZ5JWdpfKRkp4l3iQr7VnnFrRhfxGa:5B0TuxvECZopWjlb9nFt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622549239, "uuid": "a032f8f0-2a17-44ce-9d18-ca4a3edc89a5", "value": 1053184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622549239, "uuid": "cb9072f7-c0c2-43ec-af27-a8bc326221c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622549239, "uuid": "2d92173f-26e6-4489-a48f-94b60f1b289f", "value": "a45440c4282459458a97d11a299efe45.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "350e4945-c2a2-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622528749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622528749, "uuid": "e01c6860-da69-4a51-bb92-dc5b4ef6a798", "comment": "Malware payload", "value": "061a4e5f46e7a2c6a60be8029884742c", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622528749, "uuid": "3e38f99d-1cb2-4ffd-90e7-86220939331d", "comment": "Malware payload", "value": "6f10e0be14ff8bedc0d02581fd163ca10513c70a8d72759a0e06aa8d8bb999eb", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622528749, "uuid": "2b5ab389-efe9-4946-86b4-f89174ded802", "comment": "Malware payload", "value": "54869a0c0b477c8bf432522d7aebec0a43eff220", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622528749, "uuid": "1c8c72bb-ebf8-4ac1-9b65-3a05bed5c7c8", "comment": "Malware payload", "value": "4905acddb87566843ac29332bf497f63f48fb629ba9ca13cfd3d905019baec85b56d9ff1440261b448a5cbdd56bec78c", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622528749, "uuid": "c5934978-5519-472a-bd03-52e6d503e0bb", "value": "26A557F0AD01D4C1F57E5B6AF2FD3A48A1343217EBC94A4A00E7E5552EF6A11B90ECC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622528749, "uuid": "e142a334-08c5-412a-9624-c7f76e80b67e", "value": "24576:rLUxo2G2Kioa8MCVZKbSkVnCxU/i0+yP3:M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622528749, "uuid": "6036c264-5ab0-4f8d-bc39-603ac0d2ed9c", "value": 2070804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622528749, "uuid": "9af46157-cd76-44e6-9091-065a12d46968", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622528749, "uuid": "a8cd7329-9b63-4ad9-b043-5a73d0a98d7c", "value": "New order 201534.doc__.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daffb558-c2da-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622553079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553079, "uuid": "b2788b1a-1170-4ee7-a12c-dac7799af16b", "comment": "Malware payload (AgentTesla)", "value": "35bf2857cd5f846c8b9d0e02316b37d7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553079, "uuid": "e8af977b-e025-443a-9207-07255f91f937", "comment": "Malware payload (AgentTesla)", "value": "6f7e3b8669f1d48156b3bdcf959a5a23fce48fa9ee8d7be037a1b1564a27599e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553079, "uuid": "bc500b58-53ce-41c2-84eb-667a7101f4fd", "comment": "Malware payload (AgentTesla)", "value": "337232690f3c896c3eda309ca6356f72f6580679", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553079, "uuid": "7c8ed9fe-5246-4995-b83a-4abe3cf62c34", "comment": "Malware payload (AgentTesla)", "value": "b770cc66d7cc062a862abe213ba89f3544deac4c3bea22aeb7aa835bb609b9bffa73b2a52ec1007198a7a38ba41f0ebd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553079, "uuid": "d62130b3-5e90-4123-8401-e4832e154b07", "value": "62152387BED50F6BE1A731723616C9AE8A28FC055368C11BCBC47B603671F9C07A55E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553079, "uuid": "9dbf18b1-c5e0-4dfd-b4cc-d66b33ee3297", "value": "12288:dx8ucrG6cTRE+0Cdzh8/gFcmVjrna8TbSyZCz6AiPWS0cSHu+/stf03qpLBfWgZ:YO7mwOgSmV/TmyZCz650Vu+4VJZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622553079, "uuid": "f6d69e52-bccb-4448-ad5b-ef1d80507615", "value": 958424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622553079, "uuid": "66989f64-ffef-4ce2-87b1-1405f3fb9bc9", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553079, "uuid": "fc5afffa-b324-4026-b9f4-099b4639eec2", "value": "Quotation # 3200025006.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a13d189-c2af-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622534368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622534368, "uuid": "4387b293-53bc-4220-bffc-6b540c60680a", "comment": "Malware payload (AgentTesla)", "value": "3f8e5e8c5eee0dc5a6e0e8a1e4ba1654", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622534368, "uuid": "b6e8722f-0a7e-4868-982b-65c5b1e8e5b3", "comment": "Malware payload (AgentTesla)", "value": "7043ac362acb68500619ebb06c569213dbe77aff3e381cffc99a308a79459c26", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622534368, "uuid": "f2f4898b-6b37-405a-afc8-e6d56fe1f53d", "comment": "Malware payload (AgentTesla)", "value": "921e4af0be756acf249e6a383ebd89fd153acc27", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622534368, "uuid": "82ed3f70-edb1-4b05-b90a-308d2ba33d37", "comment": "Malware payload (AgentTesla)", "value": "aecb12b2d56cb92846102e5c8188b1bf96f16d7e0b07d775cee3e17378f6c9328987509ccc66d4010e8b6d877d5dd927", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622534368, "uuid": "bd89c481-f432-4156-9c96-a17bd8dbadee", "value": "37457DE1B190CCDAE96F45F1EC6AE43021E36D9D9DA4811C1599BB1B36F3342209FE1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622534368, "uuid": "584b3f91-41a7-49ea-bbd6-6594956ee253", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622534368, "uuid": "a422d75a-e870-4bca-bd2f-2b72fe9ce593", "value": "12288:QIjpG6Na8z2xED7GWnRO70umsYbhgunGhp+S2bR4Aad3kR9d63sfFCS6MdzGDywS:bjWRxq7GWgSHhlGhIaduFCtMdzTwIp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622534368, "uuid": "47e63f7a-0547-434d-9f7a-8a3f2267f557", "value": 1183232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622534368, "uuid": "61779b53-3c74-46ad-98a1-e608357fe0e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622534368, "uuid": "bd437815-8d5b-4ffd-b83d-6ef014d781a6", "value": "3f8e5e8c5eee0dc5a6e0e8a1e4ba1654.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06743c43-c2ae-11eb-875b-42010a9c0053", "comment": "Malware payload (Stop)", "timestamp": 1622533825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622533825, "uuid": "bf450803-458b-4bf2-801f-06132d72af2d", "comment": "Malware payload (Stop)", "value": "095887a732fbf7a3b7528cfdab91af9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622533825, "uuid": "f13dbd8f-ac94-40ba-a023-a52b42729aef", "comment": "Malware payload (Stop)", "value": "71421c74b2ec1de53a315ea6321d294fa363683a43d0820d40f2373898a9362b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622533825, "uuid": "d9d075f8-1084-4303-9432-ad99dd1be81b", "comment": "Malware payload (Stop)", "value": "6d0eec546121959a5e0e9da37cb2427482052eca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622533825, "uuid": "eec7818b-6f7e-4404-8969-302cc6ccf614", "comment": "Malware payload (Stop)", "value": "ace2e79c11461f46c05345eabbf75ab740600b8c677d53551d2d75ee0b8e2b98a03f1474651c9904059f51027ce93c34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622533825, "uuid": "63a96695-4084-4f71-a1fb-c8f3cc63046a", "value": "EF05F200BB91D034F1F736B48A7B816DA52ABDB2DB2851CF22D46AFE16345E0AC31757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622533825, "uuid": "d3a7f6ab-82d3-486f-920a-e949465e10c7", "value": "2f20facc3edc1d8ba24ede1f07abf090", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622533825, "uuid": "5f9920d3-9b58-4e66-b3ec-ee204b917fe2", "value": "24576:BE8RVrvzoH87bS27oetSBB8vDMl+kTZbndBJhAOja71U:BH/i+Wwo8SBB8vOTVPJhTuU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622533825, "uuid": "fd457686-7f6f-4cdb-818d-4a6b9a5bbec0", "value": 862208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622533825, "uuid": "d160cb76-1272-407d-a79d-7bb7d0a6bb5e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622533825, "uuid": "0ff3e4bf-0108-45bf-b7f1-c1237c17fe7d", "value": "095887a732fbf7a3b7528cfdab91af9b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deef27a8-c2e2-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1622556522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622556522, "uuid": "1b9f4193-1935-4094-9c81-c07508659701", "comment": "Malware payload (Loki)", "value": "41d7c37ed819228b12143b12e44c6006", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622556522, "uuid": "e970127d-74fd-43d3-a272-15d516a1f9c4", "comment": "Malware payload (Loki)", "value": "7170240500fb45e115c91fc0af42bfe362723fad7159cb14e344fb755aa3eea4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622556522, "uuid": "fbd6263f-c9ff-41b6-b34e-791d0165c24d", "comment": "Malware payload (Loki)", "value": "5859f1c16813a2ad3e95efa1f0ef587202d43d80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622556522, "uuid": "e5900df0-9c59-47ba-b0b0-9410bd680d51", "comment": "Malware payload (Loki)", "value": "ae93b7c3cdfd520977929f484613f02e3bb760834cc0aeec7d4a936438de3488b50e3fd48ff595004181b57cf2edd336", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622556522, "uuid": "14fb44e4-3130-445a-80d4-53772e60df66", "value": "7B74E0DCB6138B1AC84887B68C56FB201BB42FC09E175B2775887B1D6B3B38B9571741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622556522, "uuid": "d0f1b961-f671-4712-96da-63cbe5d2d123", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622556522, "uuid": "c0bd4d6b-49f9-4eb7-ac86-97ee99112403", "value": "6144:r7ufl2NEi6x68kF2/LhiKM/jh5jkFFkBv7m7v:ryN2wx9v/0Zrh5jk6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622556522, "uuid": "83ba6f18-12de-4613-99d7-abc20e753d08", "value": 352256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622556522, "uuid": "714be64f-b199-4007-910c-30df886beef4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622556522, "uuid": "52ecd5b3-f6b7-4b80-83ec-98276024b936", "value": "Delivery Info.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b7e5a98-c2f7-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622565428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622565428, "uuid": "617a3d99-0148-4992-a790-4ce055e355ea", "comment": "Malware payload (Formbook)", "value": "105ffd15c074e777f79563cf0021269d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622565428, "uuid": "1435b0dc-0692-4f7d-a652-1f5c4bf81734", "comment": "Malware payload (Formbook)", "value": "71d0d01b1edf738cf138ff3765fe99cc31e29362495af51b1ab93e3f2bfcc23c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622565428, "uuid": "9b64a129-010a-4362-9e28-b251c9c227c4", "comment": "Malware payload (Formbook)", "value": "b439a30b6d73584b9c5c841445a0beb42def9056", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622565428, "uuid": "b337c6bc-feab-406b-8eea-86b3db5fefba", "comment": "Malware payload (Formbook)", "value": "08d78e6afcf68f5a3f3b613c81516c89096fe97e63dbf5d67d0adef9804ec512af33ffc951d19772d1082a8a81e91063", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622565428, "uuid": "0d655aef-25ba-4062-8581-8302c20f4b0f", "value": "5715F1722296CFC0C23E97F1C0E4E0F313F194EBEE55DD3D6D85588A26B2F8449596A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622565428, "uuid": "44003881-8141-48ee-bb3b-ced0ad7e0c33", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622565428, "uuid": "31909228-cb6c-42b4-865a-c4d88fe1d159", "value": "24576:0jg8mf8dZole7ogFoVeHgveRb0mwt/HxTz/ojt:ug8mf8b7ouoVPWRYvHl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622565428, "uuid": "e2fa75ef-ac55-450a-96b2-6680a60a5a34", "value": 882688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622565428, "uuid": "aa735c22-2e83-41bc-9628-d418fb34e2a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622565428, "uuid": "7b1e76eb-d421-4421-8343-5fa0949425f6", "value": "SecuriteInfo.com.Trojan.PackedNET.791.20423.5154", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17be7699-c334-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622591406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591406, "uuid": "1ce02018-d4bb-4c41-be9f-022e037396b4", "comment": "Malware payload", "value": "8a620ca09cd6f2c62a0b850b2f28a69c", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591406, "uuid": "65dae5cb-75d5-4992-975c-7ea72fc2134c", "comment": "Malware payload", "value": "72ecba53877d5770e3c097fe84620cdb848edb5bd627628885b13a5e242d8831", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591406, "uuid": "a5df27a0-1d42-453a-acbe-95b737845fe2", "comment": "Malware payload", "value": "91f722376257ff37db40f38faec8e925d867f7d7", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591406, "uuid": "4aee64b5-80f6-4861-b8a5-a9c79b0dbb86", "comment": "Malware payload", "value": "13d1ef1697d52add24fd16ef80d6798b3428280315aadda145506624cc0456f90e3316a45ab7cc9d6d17e2b17d17312a", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591406, "uuid": "dd50239d-239d-4606-a506-a93f7c6f4feb", "value": "2975010CD7BAA164CF47253E9FAF931FFE2271AEDA3533412768CA74A5E0C24284D845", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591406, "uuid": "eb0eb0db-d7ad-4762-b499-4123427b1e67", "value": "3072:yUWfHAzfuhQbUNjLYjZp/mTbcXngw9uQwRgWAHoAzUGZ/plv:yMfsLYtnv9/tF7ZXv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622591406, "uuid": "55d28547-fb0c-48a3-ba80-d6833ceef904", "value": 1663423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622591406, "uuid": "34486156-84e4-4a88-99f3-8f9b267c489e", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591406, "uuid": "77bf6c77-c6b2-440c-b2a5-3cfe883687ab", "value": "72ecba53877d5770e3c097fe84620cdb848edb5bd627628885b13a5e242d8831.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41065863-c2a4-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1622529628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529628, "uuid": "91fc81fc-70f5-4b73-9123-cd2d0ba77c07", "comment": "Malware payload (ArkeiStealer)", "value": "19759e739821ab50929a37120e30b0fb", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529628, "uuid": "8423aa3e-cb64-4c26-8c39-1ede6ed129fa", "comment": "Malware payload (ArkeiStealer)", "value": "73756dd47abcedb8cbd652643ff4edb42e43cebf5b576291f604f684e0612280", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529628, "uuid": "f9b7139c-0a81-4885-aa1c-b67577ed32c0", "comment": "Malware payload (ArkeiStealer)", "value": "a8cb9e3cb54ff123f6d016061da943f11d3d0b35", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529628, "uuid": "a9bbea0a-bd0c-45b5-8a75-a8af52e0ffb0", "comment": "Malware payload (ArkeiStealer)", "value": "b04020397423e827ac680cb83d4f76c37dd1c5482b1913abed4aef967db6a24784387192d0e711707a924fe4a275e5ef", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529628, "uuid": "19df5eb6-826b-4e3a-8ee6-c4e3c118998d", "value": "F6E4F130AB91C034F8F316BD99799A6D9C2A7DB35B2410CB12D53BEE56706E2AD30707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529628, "uuid": "187c4d49-6ec6-40b9-80fa-552c91a09150", "value": "c8e47f7be4ebb5701228fea37e8d0168", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529628, "uuid": "cc21e3be-bf0a-4f88-80d1-49d8901ec2fb", "value": "12288:psKuhzjSlteKhgot+8wkGObtNu2m6iNj5R2NiYyyNLS3PNvd:AzjSiKhgoY8wPu01DRUVgf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529628, "uuid": "5cd6386a-0090-42cd-a176-4c3419df798d", "value": 689152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529628, "uuid": "cbf39767-49e1-4a2f-8608-071b14b58e30", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529628, "uuid": "406d16a0-cf16-4926-b82b-3f992cb8914d", "value": "19759E739821AB50929A37120E30B0FB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7de3970c-c2dd-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622554212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622554212, "uuid": "0665d1fd-d9bd-45c0-bc38-39571433ea86", "comment": "Malware payload (AgentTesla)", "value": "9bd2c8af5594794f48f2a074ce8e9d09", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622554212, "uuid": "bbdd9dbc-9953-40dc-a1ce-76419cbe90be", "comment": "Malware payload (AgentTesla)", "value": "73c15eabf6c3daa7e69aef38a2820cf9e86cd9226a360274a6d8be3d7305927d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622554212, "uuid": "9d7ca695-1af1-4e8c-b8cc-8d9ad932abf9", "comment": "Malware payload (AgentTesla)", "value": "3fad574bbda019cfbbf3b4a529cf2596bf336920", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622554212, "uuid": "c108a706-a7f5-4fc7-a1ff-201883de95aa", "comment": "Malware payload (AgentTesla)", "value": "a87e43fbdd9d6dacdabbdea9498ac1d8591a1b57fd010bb6bff4c90e6ddc50a90f638eb1b44e760e7aae8c862d9aa684", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622554212, "uuid": "aa71ecde-cb26-4afa-9d74-b147968b8e90", "value": "5964232C5B20E918F5C3B7E0D14E28625CBF166D8FC184E6D4AD4CE393094B599E3ACE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622554212, "uuid": "419f9b08-e86d-422b-8b32-4ad7c02e11e3", "value": "6144:uaKtt5MyhI3GADXZsIjrK3zrgZbeubMC12b516eMNE+Bvh6/zK:upt5MyhIlXaUbeub712t1XMNE+th6/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622554212, "uuid": "30a2eecb-3038-4b30-bc0d-708d7efb72ae", "value": 336810, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622554212, "uuid": "ff306c87-2aea-40ab-874b-d79aac4554ad", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622554212, "uuid": "4bad3661-baaf-4379-9019-8c04ca6cb5e5", "value": "1092991(JB#082).rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0db97199-c335-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622591819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591819, "uuid": "1ea684e1-7458-4c24-bdbf-c5c59b7a5d21", "comment": "Malware payload", "value": "d98d2caa6e63ca70c245e1d6eda2100b", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591819, "uuid": "c3b8d13f-96e4-4fac-be37-a0b72a86146c", "comment": "Malware payload", "value": "74202eed181e2b83dd0ab6f791a34a13bd94e63e86b82395f9443cb5aeddc891", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591819, "uuid": "f0707b9c-6618-44d0-b267-545a93856a7b", "comment": "Malware payload", "value": "44b1884801c72dc8b218298aa1c537c69f2dfbfa", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591819, "uuid": "1451ae5c-0b27-44f4-9b91-5dd15ae32fd9", "comment": "Malware payload", "value": "491abd4708760ab480ef3ecb3ccdba12e60c7e2abc76ecdcc11281e498bcda25b4fa0c2f63e9ae0fa8febb57e57e88a7", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591819, "uuid": "e88a27a9-6f71-4f6f-b7fe-eee280c44cf9", "value": "C53190542BC52B64D3728EB3283AE3118633FD1ACD77CB5D4DC4D58868B2110B53AE67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591819, "uuid": "0899dc5f-e319-4c7c-a22d-62d606dd26fb", "value": "24:8ubzOTUlTyA6e8+/ClCMKC+/k34I0kNpm5:8YKUltrulyCBoIvTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622591819, "uuid": "29a60b11-2d73-4526-b155-0521a6d14fd9", "value": 1715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622591819, "uuid": "dfd0bcc7-5195-4c76-8c30-d3b357e335ad", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591819, "uuid": "4980121a-c3d9-4cbf-bab8-32d9215d9a5f", "value": "74202eed181e2b83dd0ab6f791a34a13bd94e63e86b82395f9443cb5aeddc891.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a59f15f-c334-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622591626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591626, "uuid": "4bdaf852-8a9f-4b2b-9656-f6b0b76f78c1", "comment": "Malware payload", "value": "5c37d66e0a02ee4ee4e85ae769bb0250", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591626, "uuid": "017a7581-0326-4d26-9d7e-728de9c51227", "comment": "Malware payload", "value": "749bf48a22ca161d86b6e36e71a6817b478a99d935cd721e8bf3dba716224c84", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591626, "uuid": "03332514-b949-4bdd-8e01-b21b7d841b13", "comment": "Malware payload", "value": "de8b0031ac9e0034f8e07d7d48f3b5a9aa308753", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591626, "uuid": "224ca416-6eb2-4904-b51c-03a591d43c3a", "comment": "Malware payload", "value": "db2a7c1efc5c7ff3ed84bf41883ceede67f64ee267c23015ab3431b373b9f66281cef1186d3f0b87f0a2116f30797aa3", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591626, "uuid": "af8e0a13-d8e5-4924-8039-7541bc4e78aa", "value": "44552355EF4EC6A5C0A90FB0F9FCAB09A2B4E1C2A402903F354C49FF5B57D68A84456F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591626, "uuid": "ad3aafe5-bd0b-49e0-9b61-25a82358ef74", "value": "12288:VvM7bJrzDRwlsJKv7bFi41tnXrpLFJY/gWBhFAts6d/0GUdQFtIzyu2LiSnw7yL5:VvM7ElsJKvnFjJLcnms00Gek+u/GkSy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622591626, "uuid": "0fb62d97-e808-4595-814b-c47139ba0b6e", "value": 1310720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622591626, "uuid": "9dbe1a03-af2c-4eb6-99eb-853a222ee8f0", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591626, "uuid": "b4a2e34c-8681-4fd6-bd3a-30a275e56fc1", "value": "749bf48a22ca161d86b6e36e71a6817b478a99d935cd721e8bf3dba716224c84.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bbb239a-c2db-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1622553242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553242, "uuid": "7bfcd12a-37e0-40a6-a8f3-6e72dfe66a17", "comment": "Malware payload (GuLoader)", "value": "273bfcfdc037992a94db1dbb41925f11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553242, "uuid": "785e8743-f5af-4300-8ec3-50dcfc9c5c18", "comment": "Malware payload (GuLoader)", "value": "74a70690b65a38b71be1302f7673ad09f473014d0c6d018c1affb3c3a1e25f85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553242, "uuid": "f8bb2453-b1db-4707-93c9-a0ca2ce4f23f", "comment": "Malware payload (GuLoader)", "value": "7121008ca653ab62aa25140ce84e63e5782d5d2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553242, "uuid": "26fa8af9-22c3-419a-b881-cb72198471e3", "comment": "Malware payload (GuLoader)", "value": "7acfb0b73280d40d76c46d2853841c0696e64f5f2cadb659bf484dbf94fea0c7fda2e8f4787f3140cfd0bfe770b2b4b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553242, "uuid": "e7b3a406-9f73-45f2-bb2f-94dc4fbfa706", "value": "44649267B725A165E00AF470F165E1BEB2187CB2444A0D0BF6C46F6B24709A7FEB4F06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553242, "uuid": "99a425ab-aa19-4ff3-8b32-f95dbaa28cf1", "value": "1b3a9d51a40f5ca9cef0b8379f0622fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553242, "uuid": "7d9a513b-0e3f-4632-928a-149267e3b349", "value": "6144:s7Y1mGclR2f8R9/cEFPosKZGN36DIKRdkCVsS13o3EQxH41I+iIy2ttd0fjtKps0:TYGclYk/cEFPosKZGN36DIKRdkCVsS1r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622553242, "uuid": "4d681a57-dbcb-4e24-87c6-0123c156117e", "value": 315392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622553242, "uuid": "064a5277-7e11-4b25-9756-2e75cc6d390e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553242, "uuid": "3ab915dd-d640-4f42-9c53-dca041a7ee5e", "value": "PO-20213105.109978.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7603a78-c2e1-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1622555999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622555999, "uuid": "d9455933-9ca8-4af2-ac7c-2bf145175165", "comment": "Malware payload (NanoCore)", "value": "4677a6f451382f77c0a1585c0cea03c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622555999, "uuid": "9d961b3b-505b-46c3-911c-56f862888b54", "comment": "Malware payload (NanoCore)", "value": "74b44a4a01084396665ec50ef4a57adb40419f0996bc8723e1cfcd2ce975c06f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622555999, "uuid": "93495fa6-0b63-4a23-aff7-db16ef742f8d", "comment": "Malware payload (NanoCore)", "value": "1f767b55612611696631508e16018e12295c0e81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622555999, "uuid": "af5c81da-8aa7-4d3b-b663-21171b4f7dd5", "comment": "Malware payload (NanoCore)", "value": "262582481ec0b19ba7c0d822ad3f9979c3ff3b4fb5e654a55f21024735f1842951f8cea75e7472e21cd054af282d2d85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622555999, "uuid": "761cf650-befd-496f-bab0-c3762fde4578", "value": "8565CFAD725076DEC41BCEB6CA949C74FA60A4B7930BD353A02315DC9A4DA9BCF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622555999, "uuid": "74da16c7-cb14-4a63-8d7f-a35259f4e836", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622555999, "uuid": "9369cef8-4a18-440c-a2b8-5a273d8db2a4", "value": "24576:drxWfWGhO9bWpxVQybSNPyU5AvuWXDoHTcTQHwiqvkNYL2hUWjjuFqP6o:daO5MrbADHRc8YzzWv0qy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622555999, "uuid": "562f1fd4-f4eb-43b2-b593-c1b28b7471bd", "value": 1532416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622555999, "uuid": "07a65d3c-3a2d-48c4-84a5-677f4303df70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622555999, "uuid": "1ebb955e-a400-4326-9443-62f3d32402cb", "value": "SecuriteInfo.com.Trojan.GenericKD.37013274.28794.30897", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4026247f-c2a3-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622529197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529197, "uuid": "181e6149-bf4f-4ebd-aade-de9a708a2eb8", "comment": "Malware payload (Formbook)", "value": "7da169e6cdf43674ed33633a3c7225d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529197, "uuid": "9fa3069d-ab60-4b49-80c2-8cd1af8100c0", "comment": "Malware payload (Formbook)", "value": "74d3ab7baa7f019cd5ffffca2eff34e7475f718785b09f526703d7dbdd351ce3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529197, "uuid": "d7efd82c-1e4e-4690-8fe2-18fa29c03643", "comment": "Malware payload (Formbook)", "value": "b1889266fd7744f17a2569b994284346a03939ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529197, "uuid": "e7a8eaca-2db7-4dee-8e26-86edff2a178d", "comment": "Malware payload (Formbook)", "value": "ba89c2b1533b99254c5a902b4670e1d28b443cceb81c4575e9bb4e006af235202b33a154522e40d9ea60cb9c67974d1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529197, "uuid": "da02a337-3425-43fb-88a3-3edf2b830c02", "value": "C225CF123259DFCBD19F1AF144ADC87110F4BE9FAB20C62D3B42B52A61D370225577AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529197, "uuid": "70da7fa1-0afa-4058-a448-fcff18f8adc9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529197, "uuid": "2732be79-1d8c-41c7-8d23-7023e7a3c59b", "value": "24576:vo20b1QfGWdn77O7Bmoy/q41Y7XmD2EzPd8:xC1QfGWgBFy//aXmDnPK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529197, "uuid": "01ebec94-a1ce-4130-9954-238f92fcc7ea", "value": 1049600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529197, "uuid": "32808f5a-9839-4fc4-b5b2-0df0688e0f93", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529197, "uuid": "284ea257-dd32-44d3-aa84-431615f696e6", "value": "jebDtHCePK9feGL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00720ae7-c2cf-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622547988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547988, "uuid": "58b9f77d-7569-4f27-ae59-129f27b77abd", "comment": "Malware payload", "value": "cee7ab668b4a542e49f6baa6e361f1f6", "object_relation": "md5", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547988, "uuid": "dde1dfb7-bb25-4491-b29d-0007b4499be0", "comment": "Malware payload", "value": "7586714c776d35fbcdd95618b96ebf3755d2f455073ced995c8dee5b07f55d0d", "object_relation": "sha256", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547988, "uuid": "eb48c08c-8ab3-4e86-a46f-ce881f617e0c", "comment": "Malware payload", "value": "133dec994b360a2d72c1f5051570d96a21103107", "object_relation": "sha1", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547988, "uuid": "cd5ff259-5558-4351-86b2-a8b41aab025c", "comment": "Malware payload", "value": "e816a0ff33ae5daf5fc4b776f237be0ca073ff7f5011a87d2288e4df1ff87cf7d675f5b6a0eefb9699a21ac48fb66ef9", "object_relation": "sha3-384", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547988, "uuid": "98eb2fe8-6c9d-4589-b7bb-9047a3806ce4", "value": "FA81EBEC2133A4B9DA322553E00DBB7D92712EA7F40E74F09A9481011F66F8DD268F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547988, "uuid": "be8ae009-e16f-4bb8-a6f6-7bea738f1ecd", "value": "96:napuuhsgCMSzcaPdztqBujMDPJ96rMJ4m1SDF+Me1:napuuQMKVztDjMn6rMJox+Me1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622547988, "uuid": "69807562-65c3-4879-8564-d26d422ff956", "value": 3830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622547988, "uuid": "48d08030-5bcd-4cea-8078-70b675db32cd", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547988, "uuid": "55791d30-fe42-490e-87aa-709436c5f12b", "value": "7586714c776d35fbcdd95618b96ebf3755d2f455073ced995c8dee5b07f55d0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "115fa8b8-c2e4-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622557036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622557036, "uuid": "ae65057d-5a60-4e59-b076-cd60f89296b7", "comment": "Malware payload (RedLineStealer)", "value": "bd23738e4ca72cf2090aa74f97ec5eeb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622557036, "uuid": "84765a29-716b-4ca0-975a-c7368fe4de87", "comment": "Malware payload (RedLineStealer)", "value": "760e2f819be1acfcf856099e521066e3b802f830b1a7ffa12f5fd8cb48db83f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622557036, "uuid": "e8b54b4c-2e87-4886-b0c8-cd748c9b5748", "comment": "Malware payload (RedLineStealer)", "value": "3539321f71c2f7c59cc80f110bf7c7f26e672f6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622557036, "uuid": "1f09d289-6721-4377-bcf8-ad24fba4302f", "comment": "Malware payload (RedLineStealer)", "value": "a7855df1dde8389875d3935b4f12ac8d950db578f7981dfedda22e61cbad191af4b7f4e807fb285b7f78cef113f8f185", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622557036, "uuid": "55b15a59-3d1a-48d8-9503-3fac0b97df60", "value": "27B2D668A7D99B30FDFB0B34DAF21206E672B5C59501EB2F1984824B95B3B44CE71363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622557036, "uuid": "43858dc9-6d58-431e-a201-9d88176c6b99", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622557036, "uuid": "e6fc6d8d-29da-4979-9304-183073d15e79", "value": "384:h4eW3poDulFtVTfxJdlbltLrdqqD0SiLIPp952Tym0a2udaWzaC9LZYZnXD0Czta:mpiuTvXwqD0zIPpGTjdQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622557036, "uuid": "da1bda0b-959b-4b41-bbc6-f9ba629750a8", "value": 23552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622557036, "uuid": "ec5ca4eb-f793-454e-b9bf-08bd91108ff2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622557036, "uuid": "444f1ad2-5e4c-4932-ba60-00db6d9f901c", "value": "bd23738e4ca72cf2090aa74f97ec5eeb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adac5334-c333-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622591228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591228, "uuid": "f65d164b-e274-4b1e-88c3-6d4736a27ffd", "comment": "Malware payload", "value": "e55d9f6300fa32458b909fded48ec2c9", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591228, "uuid": "6d540506-35f3-4662-8784-ffd0d588c872", "comment": "Malware payload", "value": "776014a63bf3cc7034bd5b6a9c36c75a930b59182fe232535bb7a305e539967b", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591228, "uuid": "6fa5cb9f-e335-4793-8397-16918777b8f6", "comment": "Malware payload", "value": "247a32ebee0595605bab77fc6ff619f66740310b", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591228, "uuid": "705b08cc-d8e6-4860-acc5-894829aab680", "comment": "Malware payload", "value": "3950cac90877a5d26d43e0bb4ddd1d1a938ff3267df5463ea6cf58dc6f37362758f9d550dc87f16cbc2e6eaf06d24d26", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591228, "uuid": "2509a608-d5b8-47d7-8f57-791280a54433", "value": "BE74E09F65A6086EEBD15536C4524905DBF3B4001336AF5E0E5E12DA0EDB3F8CE78A38", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591228, "uuid": "e57af78f-8e66-45e9-80a8-2887ee106741", "value": "f09dc86f464ce6172bb999c112f3b234", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591228, "uuid": "d473e05d-21af-47c5-a10c-5bacc2d2a2e8", "value": "6144:8laMCErK9RL/3IGn9qetACotRyy71zTWOw9cmS82Xlpvqvs3Se6BGDF:VKQRLdqwAgO7XvYfe6Eh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622591228, "uuid": "7244ed74-f65c-4c57-b956-032c5e33c92a", "value": 359936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622591228, "uuid": "05a99440-4c80-48ee-8f6c-d2c7c38a6c53", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591228, "uuid": "12909532-cd1e-41e8-9196-991c6e958c3d", "value": "776014a63bf3cc7034bd5b6a9c36c75a930b59182fe232535bb7a305e539967b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d39bf758-c2a2-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622529015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529015, "uuid": "e2ae28ee-0654-48ae-81ea-e6eb287bab8a", "comment": "Malware payload (AgentTesla)", "value": "5c4d11ea5d91542fedbc848dc30b7c03", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529015, "uuid": "6be6364a-9140-43df-bc44-f6d199d503f4", "comment": "Malware payload (AgentTesla)", "value": "77838fb1cf442aabda52929b8891786638cdbf9018a973580d5995cf20226c55", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529015, "uuid": "c6a423a1-3745-43ee-b67c-3c88a3b12b05", "comment": "Malware payload (AgentTesla)", "value": "f40593b4500536f9c1581bbddbee7720be506a9d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529015, "uuid": "3e9c8b85-c994-4ca5-9f9d-5fe0f964733c", "comment": "Malware payload (AgentTesla)", "value": "e76d2605905f0960259e14501f19fbed5b8060d5ab00dd94492b5fda84d0fca4c855219bf2000cd00da2cf6f66e35f72", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529015, "uuid": "e3be9d48-859d-48d2-bad8-75f947a219bc", "value": "3B05E132129A8BD4E77DC7F990A8E87607F0B8D3EB12CB3DAD9950981590B4085D277F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529015, "uuid": "f6532bc6-28ed-4987-8505-3cea34a01a98", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529015, "uuid": "a5e347d5-f759-49b0-977a-caf9a21291f6", "value": "12288:EJq0Iqk6b6NlCjOSX+uafym3FROaV2jbFVMvvL4rztveEcJOxkwaponnbWa:cJHCCjvJ7m3FROasjhVMHoztGKT+kb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529015, "uuid": "287a07e6-3ed7-4a1b-8d69-ebf0773668d0", "value": 847360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529015, "uuid": "3e8317df-7d61-42fa-abef-bbd86cb12c4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529015, "uuid": "45073152-8df2-44eb-b3b1-33b19a48f134", "value": "New-PO-9360342_Inquiry-Order xls.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad53d7a4-c2d0-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1622548708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622548708, "uuid": "e7fbf194-40fc-4aed-a1fd-4a8b24219841", "comment": "Malware payload (Quakbot)", "value": "3edb77f1ca6d47e075d0fb77d4cab8b8", "object_relation": "md5", "Tag": [ { "name": "ANKADA GROUP d.o.o.", "colour": "#C29E4E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622548708, "uuid": "d6eff8a2-d60a-4179-9971-e51e567b7199", "comment": "Malware payload (Quakbot)", "value": "77abaa92184007a6176bf62098a90cf705254fae15ba25bcf2cd4359ca708428", "object_relation": "sha256", "Tag": [ { "name": "ANKADA GROUP d.o.o.", "colour": "#C29E4E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622548708, "uuid": "0d1fc99b-99f0-4707-bd46-9fa187f3dbaa", "comment": "Malware payload (Quakbot)", "value": "6111565f3cc369d4e917f2519051b56428c10ba4", "object_relation": "sha1", "Tag": [ { "name": "ANKADA GROUP d.o.o.", "colour": "#C29E4E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622548708, "uuid": "03b0e48f-b5d8-4268-89ef-2a8ffede8242", "comment": "Malware payload (Quakbot)", "value": "9fcc04f0f7f1883d519d598eb21bc2fa01639989ff4153b3a8ebe17c944fac7a8ba4b458ba83ddc446082a77c601dda7", "object_relation": "sha3-384", "Tag": [ { "name": "ANKADA GROUP d.o.o.", "colour": "#C29E4E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622548708, "uuid": "afe544bf-e536-48e1-9257-c89cd752fd66", "value": "8515AF37F3A08437D4732AB99C5B62945C39FE106D38E8462FE50E9C5F356913A2B193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622548708, "uuid": "0b915a59-a0b4-4c71-b02a-0b100d57344d", "value": "76fe6bc2f34c0514e8d4456622d2a492", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622548708, "uuid": "23edf32c-c07d-4101-821c-b6fb2af8742b", "value": "24576:uIptuPy6ESrgSmBkaS3sxV5WeHocqi8OREF:btua0I5WeHdS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622548708, "uuid": "f2fe5451-e493-4a7e-8f26-940838881215", "value": 886632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622548708, "uuid": "d9ecd5ef-17ea-4351-9c1a-698fe37d5d6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622548708, "uuid": "6b432e8b-0427-443b-b457-03077e043d36", "value": "77abaa92184007a6176bf62098a90cf705254fae15ba25bcf2cd4359ca708428", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21b20a88-c2b3-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622536018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622536018, "uuid": "6b1bb1bc-1fed-4d58-bafa-4621007f32a8", "comment": "Malware payload (RedLineStealer)", "value": "33ea9bbcbf179ac1c207abc8dbdf9f97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622536018, "uuid": "9aef401a-82e1-4f83-8909-fc27eda898e5", "comment": "Malware payload (RedLineStealer)", "value": "780aeaf7c9c4a6c1dbe53f2861c9ed2eb73790368dda106d1eee057fc8e33824", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622536018, "uuid": "69bfd923-42b2-4fec-91a3-7afa724205c3", "comment": "Malware payload (RedLineStealer)", "value": "9297524866605ce5a07b01f1c8d3181fdd10c0ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622536018, "uuid": "9aba7761-a265-49fa-93b3-6eafaded78a6", "comment": "Malware payload (RedLineStealer)", "value": "cb9e3126bea76433cf3101a3f9d966d76d4066e8dd36049965608972e2c1190fe0ff5e4b664db4af56fba485fa351444", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622536018, "uuid": "334d6def-1516-4230-a5bc-dd6095de28b2", "value": "B3849E10B790D035F1F336B44AB782BDA629BDE1EB2450CF62D46AEA56346E0EC31747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622536018, "uuid": "d33f4577-e8e9-48a1-9e50-6b14a9106052", "value": "2f20facc3edc1d8ba24ede1f07abf090", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622536018, "uuid": "da77ef67-8e47-42c1-8eaa-7b32dc0aa67c", "value": "6144:SzdRbg1ueejPFYP/RqHaB0yAPzZAJP4WTLN6N2panMAXx142RhxPzUd9A:Szn0ojde5qHxyiZj6Gu6RX348h2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622536018, "uuid": "bb2f7625-b589-4936-935f-b215b3e24242", "value": 397824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622536018, "uuid": "ef863a01-a735-4398-9139-38e1a9e4256a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622536018, "uuid": "f3392693-3638-4643-bbbb-7c77d1870ffb", "value": "33ea9bbcbf179ac1c207abc8dbdf9f97.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98ba4ecb-c2a3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622529346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529346, "uuid": "b13adb63-56e6-4989-b478-0d7bace528fd", "comment": "Malware payload", "value": "3da847ab9e370416510af015cb6e304c", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529346, "uuid": "0516ade9-dcfe-4d2f-91f0-5d0a1078c95c", "comment": "Malware payload", "value": "787df34b3b6bf03e92479e3f1a5a78d346e977469e36278c7d428542e2c0a83d", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529346, "uuid": "dfcccd04-2f95-4d4d-8fdf-49b6fa292acc", "comment": "Malware payload", "value": "538a570c6ae2efed34355a6b6250ac768ab6e459", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529346, "uuid": "db7f8a78-9b5c-4333-8afa-0a438bec826a", "comment": "Malware payload", "value": "b56c55a978ecb5b2eb1043bbcdf769d0db1f7247560469ffcb7ab0053acd09536d70c4e7108f5ba3dc10dd275048d513", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529346, "uuid": "a98de95a-42e5-4d20-bd4e-e43f4b7114c9", "value": "F115E6F32CB24372F93892F82719EAD1FD286B628723CD571780EA6F95FC1417A41199", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529346, "uuid": "403ab284-9c7d-4d0f-9d6a-03090d6697d0", "value": "12288:LKKN0lVablIJmw6UcxbClJTk2W4e4TJPz7fmiMBvKoKVIyL2YCb0Lc:LKAhQmw6UsKBkZSTJ9MBMI7PGc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529346, "uuid": "c6312d64-5ae9-4afc-93e1-651043aac339", "value": 943627, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529346, "uuid": "bf7608b1-70a0-42a4-bbb6-b688f996c659", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529346, "uuid": "d1a222ed-937c-4a84-b35c-d2305c6bd97b", "value": "invoice_2058091192_05312021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca04b680-c2cc-11eb-875b-42010a9c0053", "comment": "Malware payload (Stop)", "timestamp": 1622547038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547038, "uuid": "56fb2953-ba37-4ae9-82e6-94f364f843b9", "comment": "Malware payload (Stop)", "value": "4c56095dc5818d4ab935ca0af8270be2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547038, "uuid": "4a983373-db35-4aca-afa3-db4df2fb8d00", "comment": "Malware payload (Stop)", "value": "797b65020bbfa1c58f0d72c7d0ee746fcf28acbaeaad7c5877ff9c53a8bf1cf4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547038, "uuid": "3890404f-fb0e-4725-a45f-82e9534878fd", "comment": "Malware payload (Stop)", "value": "f0d271daa2d2243b44e51af24d65fdfc65255ddc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547038, "uuid": "603b9a2f-a51f-4896-8235-75d99c1bcb8e", "comment": "Malware payload (Stop)", "value": "9cb2dc9cd3b2489754b0e531baf69bbb78208a8aa51f69e84b6c79d02015430b503c9c701935497e7f8f0ca3ed1933c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547038, "uuid": "a8232678-4b6b-4365-8b10-ff9fc63e05a4", "value": "EC050200BBA1D034F5F336B48A77966C552A7EE2EB6451CF22D5AAFD12385E0AC31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547038, "uuid": "b5951735-38d2-464b-84f5-63dace105bc0", "value": "84a7eb4192b6bf7f0b88f528d598a47f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547038, "uuid": "5d57ec93-01bf-481d-8ee1-92671fdacd8f", "value": "24576:57ot3AaCdIDIp3knRAXAU1Axn2EDMYn/:5m2+K0nHICxgY/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622547038, "uuid": "165a4c20-b7a8-4c3a-a1f4-42fc891c130e", "value": 862208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622547038, "uuid": "4f29ce46-8a67-4811-a507-a9d9b29c9266", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547038, "uuid": "6ddcc9d1-593b-4210-823f-be07fdf328b4", "value": "4c56095dc5818d4ab935ca0af8270be2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b1aa487-c2db-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622553294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553294, "uuid": "6f57b419-59eb-4ab3-ab0b-2581aacd4f97", "comment": "Malware payload (AgentTesla)", "value": "ecd6df8dba2c442f1d688f3aeb1656bd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553294, "uuid": "e9ec8def-5c92-4d84-a510-54a897dbe1a7", "comment": "Malware payload (AgentTesla)", "value": "79c3ff4c485bf80c291dfbfe4529e5c5e56727cf6d6d1fa074b4b1ef1a22e8bc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553294, "uuid": "915165b1-8b45-4b15-a833-65e9af1a4f61", "comment": "Malware payload (AgentTesla)", "value": "051f669e8d426cd1d3eb8eb8f0e5eacb4673f04b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553294, "uuid": "102cbcb4-abf8-4ab1-ac54-445ed6c5acc0", "comment": "Malware payload (AgentTesla)", "value": "4d9793bb9abfcfbf7317ad57259aadd8d4a5b07d59155a19768217ca1f58dab3c940335b8938b99dfa5802f86732eee1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553294, "uuid": "f920c132-11de-4a68-8335-de3613db450a", "value": "69055AAD325075DFC867CC76CA682C60EA6074BB570BD207A02716ED9A1DA97CF241F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553294, "uuid": "f116caef-b44b-4a3e-93ec-b7382aa7e0a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553294, "uuid": "00b237fa-553e-4dd2-95ee-250497cde10c", "value": "12288:5kgQ6fxNS3lb9+g9Ywnsk/zA6dbHRQ6nGFbavsuqrLyfpxuFDAjTqAkUwIoW+FLn:fQ6pNSb9lRnskLA6sSGFbcsuqrLyfp8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622553294, "uuid": "c77bc6db-1374-48d9-8b4e-51a8ddff3367", "value": 861696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622553294, "uuid": "3804304f-4d9c-45d1-ba08-ed07d1530193", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553294, "uuid": "777870af-df29-40ca-bc85-15b2f8f429b0", "value": "\u06a9\u067e\u06cc \u062a\u0623\u06cc\u06cc\u062f \u0646\u0647\u0627\u06cc\u06cc 01.06.2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ac9254c-c2a6-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622530611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622530611, "uuid": "17b125bf-954d-4e9b-b4d4-58af26e0eebc", "comment": "Malware payload (RedLineStealer)", "value": "3a0fe14240026f4313f16bb2977011c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622530611, "uuid": "d486cf23-a319-4821-aaaf-8ad72f200487", "comment": "Malware payload (RedLineStealer)", "value": "7aa70a8207b52b53d870e321dafe9269bc641a868ba9d695c89a3cd2327154bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622530611, "uuid": "4487c448-2149-4bf5-a537-450e686d81b7", "comment": "Malware payload (RedLineStealer)", "value": "a71c8773dc29d8752a2e00a2bc9541ccd0102365", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622530611, "uuid": "e4de86ae-e5fe-428e-871e-75e21a8705da", "comment": "Malware payload (RedLineStealer)", "value": "e02d9c5693381829af9f3189ec1daf85b415be0c1794141b162351e1d541967de320a12b53a90c6c1df7fa213a832816", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622530611, "uuid": "69f31675-4c24-42e6-b104-8f40663cb832", "value": "CB84DD49F762ECE4FE6B1279E17119F22F019C1AE5D9286F218DBE2538352520097CFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622530611, "uuid": "90df7fcc-df6d-42a5-b31b-8357570f330d", "value": "8d36f6a979fb5de10175121e64553b84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622530611, "uuid": "5120cf5b-014a-410e-9bd9-22ab91a3d5de", "value": "3072:lSSlOqmz0enJ+FZ9U8eL/uF+R/tpsV7vtU5aJpYwtdi71YcwAglyyl5lqJbn7RLi:lS2/9SuF+ktJfdie3lyQlCtXrVYHd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622530611, "uuid": "8ca35d9c-8011-4885-af34-d50db5b3336a", "value": 380416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622530611, "uuid": "908b5a41-7cae-4d73-b6da-98e98df70d81", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622530611, "uuid": "eabb0ea5-81e7-4ca8-9e0d-098460a8e04e", "value": "amazoninvoiceAF0388d83739dee83479171dbcf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa762163-c2bd-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1622540542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622540542, "uuid": "2d10d77a-4c0f-4e61-9e9c-b21e740cd2ab", "comment": "Malware payload (NanoCore)", "value": "8b92689d71f38e451b1ece8cc89cba21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622540542, "uuid": "a471f881-ab49-49eb-b3b3-817a086d3115", "comment": "Malware payload (NanoCore)", "value": "7ad505522923b8da1a1760d411f600878388ee56e6aba962704a510fb06346a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622540542, "uuid": "831d8504-f361-495a-8647-c2abcf786e4d", "comment": "Malware payload (NanoCore)", "value": "e85e91796048b9a0901d63c3026125dea4898a27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622540542, "uuid": "189168bf-83ba-46b3-ab9a-1ab9f2f89041", "comment": "Malware payload (NanoCore)", "value": "e32f140dccd63702ea569066a4b10c66ee0a507a36c29099d3a997d5662245f8fd210d3542b17e6b83739c860d23fc4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622540542, "uuid": "1a113735-6c20-4a8a-bbe9-e9ccb5a46bd9", "value": "CD842353F3D58ADEF598CC36B89766E400707B29CC1AB39B72D02B8D0F63645DB44299", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622540542, "uuid": "a5e8a892-fa33-4938-b16d-465ab2ab6a9b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622540542, "uuid": "1d761343-982e-4800-8457-a96661c0d75e", "value": "6144:7DF5SVZCrUYONO1JYdakjvPBgaG/xweYyvKOcTA6J+Q8n572tKGNid5e9wfE86BM:Kj/jNOTrkjZgj6e3yhJ3CR2MSn8u+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622540542, "uuid": "c100ebf0-1fdb-497b-8132-716808d30211", "value": 386048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622540542, "uuid": "3ec437bf-5a26-41df-a243-f19e26bb83c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622540542, "uuid": "edee730d-501d-404d-8fc2-62e4f998f34f", "value": "RFQ#21040590409448.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e062156e-c2b0-11eb-875b-42010a9c0053", "comment": "Malware payload (Stop)", "timestamp": 1622535049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622535049, "uuid": "4a02532b-8ee9-40af-bddd-6df7e83eb71d", "comment": "Malware payload (Stop)", "value": "77fa49a77b27b8fdcbacd3a11c4c7d7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622535049, "uuid": "a1c3e14e-3f6c-4ccf-8349-47a53308a9f8", "comment": "Malware payload (Stop)", "value": "7b9f94c4f4bb298359bcfc5cf187f9b6191914857c1f90bc69c31a8d1deae6c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622535049, "uuid": "f7dfa883-22de-443a-b277-ec5abf710178", "comment": "Malware payload (Stop)", "value": "ea1598ef3dab70773cb0dade8e9ebcbb9fa90b77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622535049, "uuid": "b52d4a3d-4a75-4284-b0bf-1775adbbfb4d", "comment": "Malware payload (Stop)", "value": "f327b898f6b47a167bd1b81f4d1a5811fe8b1bc7f662dcc62257ffef0e72e4e59a3487158565a9fa7bcd5f8d8a2481de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622535049, "uuid": "9ef5dbfe-e4cd-4206-9465-98a77d729378", "value": "E605F100A6A1D034F5F735F45AB7527D95297EA1DB2810CF62D4ABEE66386E0EC3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622535049, "uuid": "18f55ee2-d5d5-4b1f-97be-f5ff294274cc", "value": "2f20facc3edc1d8ba24ede1f07abf090", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622535049, "uuid": "29df3079-4403-4da1-a285-05dfa87084c0", "value": "12288:nKYGvVPVr2zjQp5LB78olmyBCvwMSRTOg13hCABQl9CTUl97CFxnDlVrvYerRHi:nKlRVr2zmiKMSBzRxCgm74xDnPtC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622535049, "uuid": "081111a2-2040-4d19-b5c1-779d4cb07bbb", "value": 861696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622535049, "uuid": "672d23ce-1675-4786-a96f-5705727b0acd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622535049, "uuid": "70c72590-8688-4b10-b4e7-f1d025e432ad", "value": "77fa49a77b27b8fdcbacd3a11c4c7d7e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3136f1ff-c274-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622508986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622508986, "uuid": "0fa7e0f1-b729-49e1-87af-43c39c0f4873", "comment": "Malware payload (RedLineStealer)", "value": "81d47a0f05d3cbec10c7d2949b9c036b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622508986, "uuid": "320cc79d-fac9-4f88-b6d1-91f49f52ebdb", "comment": "Malware payload (RedLineStealer)", "value": "7be71571a00545dfdb75191d56a0b21269e9895b63411589deaeef42512c7b70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622508986, "uuid": "3c018fb9-9ff4-4f31-a1c2-a31965acdceb", "comment": "Malware payload (RedLineStealer)", "value": "74c6b397bd0c5e9429bfc0f1bf06dee364febe25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622508986, "uuid": "450b778b-accf-49f0-91c4-99e5bd523e78", "comment": "Malware payload (RedLineStealer)", "value": "16ba0f9b0c82e0661572ce0c2d205468ac87bcccb789a9c9561298d51a09e0922a32bb85b30b3b11fd44ff66e8bbd9e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622508986, "uuid": "6b4f7c13-1c8d-4211-afca-5189891558e9", "value": "68658D306E84DA64C6DC3777872FD5A403F5ADE78A31A70FAE5E3AF428724253A06345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622508986, "uuid": "28526fd7-a851-4abf-9e4d-171eb4c9bc82", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622508986, "uuid": "7c4ef0dc-2b02-4506-9cf0-b8e2b5c5f661", "value": "24576:1WOvYLgg2cRZkjtKeQVY9FycmCZhCNr/B7uy0t:1WOi2Cqt0Co7B7m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622508986, "uuid": "c319b5cc-48f7-4df3-bfed-ab032617e109", "value": 1487264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622508986, "uuid": "2a4f0016-6dfb-42e8-aa3c-7a16de82dc46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622508986, "uuid": "ade59da2-ef70-485f-93b7-0bb64ecd35b3", "value": "81d47a0f05d3cbec10c7d2949b9c036b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d94690f4-c27b-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622512274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622512274, "uuid": "72e58d46-349d-4e49-b931-5820d4219e72", "comment": "Malware payload (RedLineStealer)", "value": "54e6efe52e0f25ca7d2a761e95e2ab8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622512274, "uuid": "cef5b858-6591-43bc-9d97-beb811612b73", "comment": "Malware payload (RedLineStealer)", "value": "7d73d55b357073267eb27a78d355fdf4c69f36c9f029cee364f89b6e45a231a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622512274, "uuid": "b836f6db-c9bd-48e9-95cf-cab49acc4cf0", "comment": "Malware payload (RedLineStealer)", "value": "ef775dfde401afc360459761b7f2367e5b71c2d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622512274, "uuid": "ca859eb3-8ce0-427e-a08e-af25369efff7", "comment": "Malware payload (RedLineStealer)", "value": "44508c80828877a6ec5a3481ba42c4575d32428c98422a17ae9711616b4a757700e83263856c6fe257d6337906d334dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622512274, "uuid": "f33e13f6-e2c7-410e-8fd9-545a0eed4f0b", "value": "11B524189CBFC86CE43B49F820CCBB1D9A0FABBE897D68D75244285F57071206759F26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622512274, "uuid": "784a0d37-b020-4e19-82dc-30cd08ba6067", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622512274, "uuid": "40a2d7fb-6beb-4903-a9db-2af17e5cc841", "value": "3072:oAgEVky/ZmyDE3vRgaCH3s/ChGqizmubFypkXbN0TjoA4Jemuh:oe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622512274, "uuid": "53fdab98-1f7d-4569-a010-4fcb3d77ac2c", "value": 2477056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622512274, "uuid": "2bb898b9-b826-4ac6-9b4f-b4c17b8263f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622512274, "uuid": "3395bc48-ee23-45ba-93a4-b7141a0787cf", "value": "54E6EFE52E0F25CA7D2A761E95E2AB8C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb4b0ec5-c2a2-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622529001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529001, "uuid": "7c8b08cd-483d-4e0e-9227-5f149cbcf658", "comment": "Malware payload", "value": "18b02788ac70b266a2bc26da3d49743c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529001, "uuid": "f2d4bf54-010a-45ab-afe1-2dab734d3991", "comment": "Malware payload", "value": "7dce107f03eaeb9834f9c1a822dd42ef01a058500dfc275fc595f2a3f83e4198", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529001, "uuid": "360d317f-1480-4948-ae94-f9d4e7bf5ecf", "comment": "Malware payload", "value": "ea41591265bf92372c1eda6afd785582f3b46ae8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529001, "uuid": "635d229a-a8ee-4772-8a86-83b09f12db93", "comment": "Malware payload", "value": "89d09a8d32cf33eee3b4cc10588e4adf7f7d52077ae7a2c09b85a043b7208aae4da1f272da46cba74dd64887ec6a7593", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529001, "uuid": "69783d9d-89aa-440f-aaba-ea86539af2f3", "value": "9A652B157AE7409F733449EA42A4FDED884F3AAA183C31C57250A71B47A0949C7E2F7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529001, "uuid": "a1fcdb63-0333-4932-a9e6-487f6ef24f7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529001, "uuid": "ea681c3b-59a9-4a96-9c37-75345913add5", "value": "12288:Ya9W8sAsAIhqKFs+63p6rjUctHPoKtFq6NztPskw02zXXxtkOBYL9HUjs6esfV1P:Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529001, "uuid": "254a166e-2523-489b-972e-17964c4b598b", "value": 1463808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529001, "uuid": "6f09afec-5315-4f1e-a6e9-dd97801c19ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529001, "uuid": "7d49ce28-fa84-4495-929f-66b051027c83", "value": "Swift Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5b05f84-c2c5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622544051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622544051, "uuid": "72e8482a-a538-4416-96d0-cd32dab1f3f2", "comment": "Malware payload", "value": "eae59708bca0453042245ab2f448c04b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622544051, "uuid": "5a4ac3b8-0e75-456d-99cf-289cff1fbcd9", "comment": "Malware payload", "value": "7de1cb68c44e2762ecb7756d5b0f7de4c70f92ffb93adfc2d2c9f5c192eda5fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622544051, "uuid": "2fb08af1-437d-49b3-8206-ecd134150ace", "comment": "Malware payload", "value": "717a9f6e07a30d7463dfad28a9c95e202f19e066", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622544051, "uuid": "585b0976-3cc6-4f11-b626-f8d42b687ae7", "comment": "Malware payload", "value": "e471acf3541ff9e00d9bf0ae4539a17631dad131f387c584d976b472c5463d5effd716fe131aea1b9bc6a411818b58e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622544051, "uuid": "63808a2c-d0eb-479d-970d-7ce802fa4103", "value": "64747E10A7A0D034E6BA31B44977927C962A7DA1EB2450DF22C47BDE56F46E0BC313DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622544051, "uuid": "90dfe307-bc25-4d52-bf43-f9d9523ecf85", "value": "65eae6e52b44289274f3a58ea6f50195", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622544051, "uuid": "73c778bc-5b58-4179-bb24-e4026644d4a1", "value": "6144:4R+ImlbprK2MW1GDeNIyAW5CPhJS3JIq/x4fa1kuPtU+UetiI:4m9rKMMyN4WYhEZh/xbuhFe3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622544051, "uuid": "ce9fcb0b-5783-462e-a255-7f29ec27b2ae", "value": 343552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622544051, "uuid": "921636d1-5ebc-47e4-bab6-316dbf3a5d35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622544051, "uuid": "5ec6a9fb-79c9-4e4d-b7fe-b99517e7286c", "value": "SecuriteInfo.com.Troj.Kryptik-TR.10342.27133", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4df3a42-c2ac-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1622533232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622533232, "uuid": "3dbb691a-7323-41af-b902-b13cc1e34739", "comment": "Malware payload (ArkeiStealer)", "value": "34a3b690d5b215495fb0e3923f0b32c9", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622533232, "uuid": "60d1df0a-03d4-4537-8666-7fbf9a72df19", "comment": "Malware payload (ArkeiStealer)", "value": "7e03cc1398abecf3508dcf3eaea8dfc4096ad531b5b60271896af24e78be35f0", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622533232, "uuid": "d0744f56-ce33-40ad-bf16-27f972e000fe", "comment": "Malware payload (ArkeiStealer)", "value": "7c3e024b14df7c4648e116b64ab13fb8102e4b14", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622533232, "uuid": "a602fa2a-30e0-4bf3-9ca1-59aaf01cd05f", "comment": "Malware payload (ArkeiStealer)", "value": "f38dbe18ade736f38832f65eabab5940147accd1abd945b2a650da61ac87b0cc860b7b7c872c27abff65ea091cdca702", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622533232, "uuid": "8cf2e63d-6365-4aea-812f-c3dfeef8df86", "value": "D8E4E000B690D035F5B736F45ABB927D992EBDA1EB2850CB13D5A9EE57346E0AC30313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622533232, "uuid": "6cbec494-d67a-4b75-b93e-d4c007049ca1", "value": "0479728b0bbbaea2fc170e4fb90137cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622533232, "uuid": "b160a77e-8ff2-4bbb-aa2b-22aae36375a3", "value": "12288:ETSaqJ8zB6mNUtbzLJl6Q718sIjvxLpyLt2dEtcnbYNr/1CjO3vPWoWo:EE8zBS/L6QysIr7y+EtcENrtCjGv7W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622533232, "uuid": "e04c20eb-1a0e-4158-9c7e-2ceca8723e0c", "value": 669184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622533232, "uuid": "a6b209f6-41fe-4c7c-aeed-703f4d6bcfd9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622533232, "uuid": "9ba751d4-f487-4ad3-8e6b-4c0781724478", "value": "34a3b690d5b215495fb0e3923f0b32c9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba82f22f-c2cf-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622548300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622548300, "uuid": "efe1031c-3ac0-479c-acf9-5227a1e66f03", "comment": "Malware payload (RedLineStealer)", "value": "6a4f058858522c6293e122a6e6cc5b16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PIK MOTEL S.R.L.", "colour": "#988E94", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622548300, "uuid": "4bf8e64e-2285-4160-a23a-da3eca5ac8c7", "comment": "Malware payload (RedLineStealer)", "value": "7f5fb937bb138c7e292ec64f79ac0b6d887d47a8b3e21153c1a05df91dfb823b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PIK MOTEL S.R.L.", "colour": "#988E94", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622548300, "uuid": "c641ea89-807c-402b-b698-46a26d10a9b7", "comment": "Malware payload (RedLineStealer)", "value": "6c6acf5e2496f7c838a91db2c2830ab977f3d796", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PIK MOTEL S.R.L.", "colour": "#988E94", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622548300, "uuid": "2e21c733-e912-4f67-a781-f37abee957c5", "comment": "Malware payload (RedLineStealer)", "value": "94a17dc0a0c1d6f299ffb4349d10263bae79bd5b5c400b8a899242a1a4b6c03f79c7f4eb3643daea305e8d1d48847cc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PIK MOTEL S.R.L.", "colour": "#988E94", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622548300, "uuid": "0f3f94d6-7af1-4c77-b275-101dc6b64d44", "value": "F794AE00B690D035F5F236F44EBB92BDA53DBDA1EB2450CF22D4AAE956356E0AD31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622548300, "uuid": "3bf16e9d-a763-4b72-bac3-2f27bc2ae7c7", "value": "0479728b0bbbaea2fc170e4fb90137cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622548300, "uuid": "989f1941-daf7-487a-96c8-c787e1342ac6", "value": "6144:uwDutASxuBLK+W0debiHvO4+z7DDN1YndXGAS3a9KBubnjVMdAC:uwDuuSxuBOz0dEiHlc7vNGJGT0b2dn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622548300, "uuid": "aba1f1d7-c41c-4a90-a723-8962e3bfb0c7", "value": 410024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622548300, "uuid": "9c38dee4-032e-49c9-aa2d-225b8bd06789", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622548300, "uuid": "90c1f3bb-9e3f-4b85-b618-0b33f140a049", "value": "7f5fb937bb138c7e292ec64f79ac0b6d887d47a8b3e21153c1a05df91dfb823b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b97ebd35-c2ac-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1622533266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622533266, "uuid": "06dd6021-e4ce-469f-a32c-93cb8a3343ee", "comment": "Malware payload (RaccoonStealer)", "value": "1283bb60ea45dd67238b151fe3e54678", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622533266, "uuid": "4368a9a8-abc4-403f-bfd6-c5d76ee822ee", "comment": "Malware payload (RaccoonStealer)", "value": "7f78e0070621f2411ebc5e29bce329deffe301bb419c85136d9bdcaa8e618f59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622533266, "uuid": "da20d0a4-a25d-4317-928f-91e016daa7cc", "comment": "Malware payload (RaccoonStealer)", "value": "3701707bc97564162a2e2b38c7c1e44f9dc225a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622533266, "uuid": "160124d7-a85e-4014-bf3f-7a1a5a8ca208", "comment": "Malware payload (RaccoonStealer)", "value": "014e1a7b66bd75262001afd0aba5bd111d96cfebaf7cc2611c65ddb11a8047d2091d995f0beb57bd9b8338067a600a07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622533266, "uuid": "74733d56-2082-479f-a5d2-bae72601558b", "value": "16C4D0007690D035F5B336F58ABF627DA56ABDB1EB2440CB63D0AAE956345F0AE30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622533266, "uuid": "0d0af1de-7e80-4dea-926d-d4949ea8b297", "value": "f9bd684309ec108423c625f7e337de4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622533266, "uuid": "6eb581c2-2a97-476e-af0b-2a5b7fcf4536", "value": "12288:UgBYsk25RBnQAlI/eQd0gmdYhfE7S1AiYcVs+T+Gr/Z8JrjyqNLZtQ:UWzRB02QaShfE7QAeTRr/aJrjyqDt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622533266, "uuid": "97b8ce3d-8024-4b43-acfa-d2680095f0f9", "value": 592896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622533266, "uuid": "8fbf2955-07f9-4e00-bfd1-d24f27b13116", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622533266, "uuid": "e226fbd6-322e-4413-8ecf-bc371215ed75", "value": "1283bb60ea45dd67238b151fe3e54678.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "939ea119-c2a8-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622531485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622531485, "uuid": "38845705-d3ef-4de8-bfa1-c434dbf02ec0", "comment": "Malware payload (RedLineStealer)", "value": "4fadfd7807a38d0498995cf94556cc1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622531485, "uuid": "a87718bf-882c-4173-8bef-5ade51d0569e", "comment": "Malware payload (RedLineStealer)", "value": "7ff8de714cd1be1409b0c13a946c21f945a0bfdc8fd7e0b1a0f4e20f3ba0e80a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622531485, "uuid": "96671d0d-00f7-46ac-8234-40998b9c92d6", "comment": "Malware payload (RedLineStealer)", "value": "c7d020f3e1b23f676b41e5f1603247877f493604", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622531485, "uuid": "f8b908ae-c5de-4d39-861b-a6e195c4bd8b", "comment": "Malware payload (RedLineStealer)", "value": "7e62ea0c0bdaef5b0f8ad8bb612c6d3901b7cc5bf169ef8787ae460aa3de2103cebb781e0b91a85790fafb67e28e67f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622531485, "uuid": "cda2f12e-b8f0-4ef1-906c-3ee32dd26084", "value": "64848E10F690D034F5F336F44ABB92BC952E7DA1EB2850CF22C46AEA56356E0AD31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622531485, "uuid": "5ac046f2-68b2-47ef-a924-e302632c0259", "value": "ddfa50a7d17fa7288028195442f05ca4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622531485, "uuid": "239afb88-6734-4ab1-9a1a-60b2d306ed78", "value": "6144:N7AWrCBbUD0BMC16KJFf05IZ/oYjAt6kEaxKIWlPwnmC:N7AWrCBA0BMC1vN0IZ/oYqEacP7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622531485, "uuid": "4e924578-ba27-499a-acec-ca524dd8d751", "value": 401920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622531485, "uuid": "6c1f6cf6-912a-41a5-8982-9b8ce39bc982", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622531485, "uuid": "90ba7cfd-d067-4579-b40d-e71bd5e17f2c", "value": "4fadfd7807a38d0498995cf94556cc1d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4536a89d-c2a3-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622529206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529206, "uuid": "0d409351-9be7-417a-adbe-1782f003d916", "comment": "Malware payload (AgentTesla)", "value": "427190636653622159bba821ea52cc7e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529206, "uuid": "2d1b7742-9146-43c4-957e-40ebaed3d507", "comment": "Malware payload (AgentTesla)", "value": "80ef601f22b023786e457852b1723ef80952ea8e2f98f1e387bebe043bfa1d59", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529206, "uuid": "6448a72c-1c69-4535-8d18-6216c3c3c011", "comment": "Malware payload (AgentTesla)", "value": "54c6840afe6456730df4fa7c2fbe81d5411c63e6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529206, "uuid": "7ce23051-ceb2-4fa2-9c70-c9b06c5e5c23", "comment": "Malware payload (AgentTesla)", "value": "0531a7aea99a1164a8216a07b7fda93c19849ef9c6be9cac6bf652e34594963c7cb81459b9915dafab3428c7bee71033", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529206, "uuid": "943b8304-a3b0-4950-a877-6def5df65227", "value": "0405E12612A99BD0E6BDD7B840A4D8B303F1B9D3EB01CB3DAE9C54D91095B8085D277F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529206, "uuid": "8e043f8b-83d7-41aa-85f1-8ffc4805492d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529206, "uuid": "ef69b4c5-74e4-4df3-9f08-0674f25604ad", "value": "12288:MtCs4bmlb6NGE2u0UuCOx9hmkv7nT3isU4Gnt9ZhnkONJ1Er5ueP0b2jnQIBxZHO:vqaXuvrhHv7HUXrxJ1U5uesyLQIP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529206, "uuid": "882ec12a-3738-4c9b-8e17-aa49ce666d9a", "value": 844800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529206, "uuid": "d244b1ed-02f2-4ae7-bbbc-5ad172ba8343", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529206, "uuid": "c6079dfc-6447-4764-840d-33de5cce5f23", "value": "Quotation EQRFQ2020269AS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75f4839f-c333-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622591135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591135, "uuid": "974060f9-ae38-4b39-af13-0f5bb8a518b8", "comment": "Malware payload", "value": "bd7734d9ee4a6d9aca03e96d5e951805", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "BoomBox", "colour": "#3AA072", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591135, "uuid": "cc34bc28-d211-42ac-b196-b13c96e0fa7b", "comment": "Malware payload", "value": "8199f309478e8ed3f03f75e7574a3e9bce09b4423bd7eb08bb5bff03af2b7c27", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "BoomBox", "colour": "#3AA072", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591135, "uuid": "d6e82270-a6c9-46ea-94b2-e7789fdfcd83", "comment": "Malware payload", "value": "fc60899c6d0468ade1abd8e66bdf2ed4fe7e24f3", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "BoomBox", "colour": "#3AA072", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591135, "uuid": "57388b79-2fdd-458c-b035-94dfcbe2920c", "comment": "Malware payload", "value": "d4a56030cecf68309d82f00ded674d616e27f0ff3b4870d2d9b7fe6824bdebde5564c8359cc2f23fb4699615f78806ce", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "BoomBox", "colour": "#3AA072", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591135, "uuid": "0e5c3ad8-e2e7-4439-b2d5-7de154aca09e", "value": "AB524B05BBEC4725E1FF4BB998F296280638FA164922DF6D2CC4560F9C337448A12B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591135, "uuid": "56ae0a80-270c-43b4-8221-194a51b6b5ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591135, "uuid": "c282ca32-aae3-46f0-9c0f-cd6db9dae122", "value": "192:UBYCN8pSCRBu9n+qajxm3Cdia6difDLeqCtkMBpFEtKeUCp+3rf:ZZrX83CdiaoweqQkMBO+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622591135, "uuid": "05ca6a76-b209-44ba-bdc4-af8dc74fd367", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622591135, "uuid": "aa380c2c-d6ff-47de-ac24-10adbc8dc23f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591135, "uuid": "2932107a-d6eb-4729-a99a-555fe734b869", "value": "8199f309478e8ed3f03f75e7574a3e9bce09b4423bd7eb08bb5bff03af2b7c27.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a865ae2a-c2a3-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622529372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529372, "uuid": "ef5cc1bc-cd0c-4e69-9934-09ed5ada4cd7", "comment": "Malware payload (AgentTesla)", "value": "80ab2d3ba7ac3caf31c737c489062427", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529372, "uuid": "0f2c7442-cb66-4b4a-81d1-3fabc283ff42", "comment": "Malware payload (AgentTesla)", "value": "822698a4aff7b2404e000e0dc20c158a9e5ddf5fd23e6231aaef80c21f802c89", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529372, "uuid": "b239a7d8-6445-42e7-893b-dc486b30f72e", "comment": "Malware payload (AgentTesla)", "value": "b26db0e19bd3ae8d324885079220efadefa4b142", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529372, "uuid": "4f4d00d7-1ff5-466d-abff-fc0a277afe88", "comment": "Malware payload (AgentTesla)", "value": "d6a912069d179566887e224a9b81bd174d3086d13c7bf07659e7aab53e2510cc62de59d7459471bb0b59dae7ccc5f83d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529372, "uuid": "fbccb0a6-28ad-4279-b3b4-338396a5e148", "value": "6DB4F1A131B85B1DE5BE8BF44170914007B1B66F32A2E74D5ED2B1DE1D23F418BA4EA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529372, "uuid": "968ba728-4b8c-4af4-aeaa-b6d4152d480c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529372, "uuid": "a3095017-870d-4b4a-b7f6-7d4749d3dc48", "value": "12288:iZvHWz0MPCSFC7tFewTSVqvRk/zoLZnaCBAY:ixHWAipQ75TSq6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529372, "uuid": "88c27cf6-3c8e-48c9-abbf-862847c014af", "value": 513536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529372, "uuid": "bde4a90a-b033-4b46-a255-2a3d36625edb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529372, "uuid": "4eee5265-f503-461c-a074-41d7e019c633", "value": "Revise order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebcc463e-c2ab-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1622532921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622532921, "uuid": "aa3e82a6-6a24-44e5-be45-9a64c44a7f04", "comment": "Malware payload (ArkeiStealer)", "value": "7afd7cf62e26c6848c8223290cead458", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622532921, "uuid": "1738fe78-5373-4376-ab51-9b99827ead79", "comment": "Malware payload (ArkeiStealer)", "value": "823049f3cc1a45aa640b421ef451cdd250a6250bc2a9ac65051d631ed4262491", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622532921, "uuid": "3c53abec-766b-4431-b660-f367fb487904", "comment": "Malware payload (ArkeiStealer)", "value": "bacbb7897e756305e5236abe4d09d55105b2739e", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622532921, "uuid": "4bea0239-3baa-40ec-858b-ab5473e77d9c", "comment": "Malware payload (ArkeiStealer)", "value": "4924da4322e28c2687a59a6bc7d24a2322aa3eb3015b6351287e41685d3358d3da678510d23296e9b8d2b0d0cc142ebb", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622532921, "uuid": "e157a2b8-cad9-423d-8e80-a1531a689979", "value": "FA1633C073E485BAD7829575ACECB7B6409683440F2D24D377B4E24DAF29822F927E5C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622532921, "uuid": "ec536499-187e-4fd2-897f-7cbc3f5d3974", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622532921, "uuid": "a4ac4aae-8679-41bf-a9af-4d29ce6c9f06", "value": "98304:xpCvLUBsgDAFcgEYk7A/BBGuwvoZ1E74BCgVybcko+MqE4O:xCLUCgDAOgEYk0ZBGuwQZ1E74+o+xO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622532921, "uuid": "09adc6f3-e04e-44ad-8b86-dcc089e06666", "value": 4372030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622532921, "uuid": "85d88a0a-65b6-43f9-85ea-c5db956ae70e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622532921, "uuid": "314ac141-f967-458e-a171-cabf60c83823", "value": "7AFD7CF62E26C6848C8223290CEAD458.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dda46d46-c29b-11eb-875b-42010a9c0053", "comment": "Malware payload (Stop)", "timestamp": 1622526025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622526025, "uuid": "c3b37670-ffb6-4730-9967-100e2e3f0d06", "comment": "Malware payload (Stop)", "value": "6968e4b56566c31ddbc5f67aadd40dca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622526025, "uuid": "bd4937eb-5c89-43ce-b5be-24beffebc6dd", "comment": "Malware payload (Stop)", "value": "82b8c3ed64a41126bfd663ac2c20800146279d5c93f59080490afe114c5b3e14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622526025, "uuid": "9de606ee-0d0b-42e6-a2b1-052c640919e9", "comment": "Malware payload (Stop)", "value": "a4b7af63c342b2606e8252c33d58d7b1624d6f4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622526025, "uuid": "a72417bc-678d-4fb9-a2fa-918a33719a9b", "comment": "Malware payload (Stop)", "value": "c58494c378b038945729925b5d7aceec87956f3cea4de46c257c803fcf0844246c0dff0e9edf539ae7ed37d3cf234989", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622526025, "uuid": "7ea8250d-5aa6-40ac-9aec-814a55c7d88c", "value": "7105F1006790D034F1B735F98ABB527CAA2D7DA1EB6851CF52C4A9EE57386E0AC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622526025, "uuid": "89540df1-c38c-4e35-9597-addb71a454a9", "value": "f9bd684309ec108423c625f7e337de4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622526025, "uuid": "565a2323-5cd1-4fe4-92bf-f29b29a6b6a3", "value": "24576:JYuBRjuzK5mZ+jq+gk15VnhBMlqEvegdim:JZuOEezVnLMlpeR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622526025, "uuid": "162f3c4c-dc40-442b-8df0-1fbb77076010", "value": 864768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622526025, "uuid": "a759eb3b-f305-461c-9049-ba97f35f1a34", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622526025, "uuid": "a31e63ba-9440-4382-8b4e-2563986fb0f1", "value": "6968e4b56566c31ddbc5f67aadd40dca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c304210c-c2b3-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1622536289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622536289, "uuid": "15ec5684-3e14-4038-8f7c-83544d5d2243", "comment": "Malware payload (RaccoonStealer)", "value": "a1fb703772796ca2876a6e1a4e2db9de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622536289, "uuid": "e1eb2b57-13e8-4342-8a7a-1cd65f02f864", "comment": "Malware payload (RaccoonStealer)", "value": "82d290c62cb838a94e1948ba84c2a90c42c0ad44bb79413ea0b8ae2560436c8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622536289, "uuid": "38240c9b-0093-4cf0-8caf-0a2ab296ddcf", "comment": "Malware payload (RaccoonStealer)", "value": "ce15bd338ef5fce426665d21f3694730572a1e04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622536289, "uuid": "7e95ab50-f787-41fe-b374-c758a9d4c166", "comment": "Malware payload (RaccoonStealer)", "value": "e637188311ff3093afb0dc014de2c0a0466fe36bab4f19a75163cbdda4e8edc2952db78ca89d98ceb6f56f97b0908ee6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622536289, "uuid": "633ad69c-6e7b-43ce-8bde-e0d8cfbbb82a", "value": "5DC4C000B690C078F1F736F48ABB926D656ABDA1EB2450CF12C1A6EE56346F0BD31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622536289, "uuid": "7f0ff427-46f3-40fb-ac9d-eb1f878d9b49", "value": "04270520ff7500328fbe7b31f4e73eb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622536289, "uuid": "dc584af5-f439-4589-9736-f3c4db3c7466", "value": "12288:AeB5Aifo3bVo5T2OzmWjNg4IXupgEFVaSG6MhddZed8:Aa503bV+9NVI+WEFwr4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622536289, "uuid": "661b934d-ade4-45c5-829b-903a507bd928", "value": 595456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622536289, "uuid": "ed8d3702-b280-4edb-8e3a-cb59074209e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622536289, "uuid": "8ece859c-030b-44b4-a68d-b9b8df358382", "value": "a1fb703772796ca2876a6e1a4e2db9de.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6de64913-c2b3-11eb-875b-42010a9c0053", "comment": "Malware payload (NetWire)", "timestamp": 1622536146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622536146, "uuid": "4c546900-a49e-4776-aad2-b068a9004312", "comment": "Malware payload (NetWire)", "value": "01bd85d866b124ca273b0fece793916b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622536146, "uuid": "ed0ce173-479c-44a2-a152-4382fd28f9be", "comment": "Malware payload (NetWire)", "value": "82dc13144b5d22e2e75fc7dc783439e2c1e93dbe630411d3fa62b77b27645e12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622536146, "uuid": "2f15aa03-ef36-49e3-a8ac-54fb5adadbe3", "comment": "Malware payload (NetWire)", "value": "d7ae58f95432a18437a4518c274eca8de0ea116b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622536146, "uuid": "71340aa2-b3ce-4f94-acad-944f739bb749", "comment": "Malware payload (NetWire)", "value": "b0ac51bf4125e81d41bc0a8f5d47570b46c69044d09a044de1d615de8d464a070786a71c4eb5f8cf9d2ee1723f9cb773", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622536146, "uuid": "807cde13-320e-4c82-b843-2288a357cfa7", "value": "C4E49D62F2914837C1290D799E8797A8AC29BE317E18E96737F67C8C5E392813C351D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622536146, "uuid": "3b57765c-5fdd-4063-bf65-fe5730edad2d", "value": "449021d3d5fea66598eeba9c93aa4705", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622536146, "uuid": "7bc93e42-69aa-43b1-9a25-afec775ed962", "value": "12288:3kIquSFoM9SJLcThopnxJ/5JKcut4n2O4XP2OzeRtSQQNyLV:0tBvSJLcT2xJ/53cI2OEP2OzaCyZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622536146, "uuid": "ca82eede-ab42-4236-897f-9160fec71c16", "value": 716960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622536146, "uuid": "f1fa03da-8ca7-4466-941e-2b518cc8501c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622536146, "uuid": "a9c49ef4-ed00-414b-9dbb-fee4e4c50abb", "value": "Shipping Documents_Bill of Lading 910571880,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a50c7338-c29f-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1622527648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622527648, "uuid": "44c579dd-2043-4c96-b31f-d957261b5a70", "comment": "Malware payload (SnakeKeylogger)", "value": "f9c68160d893ed707b7d2ed9462c513d", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622527648, "uuid": "95489292-ae06-4396-a72a-557950c3e514", "comment": "Malware payload (SnakeKeylogger)", "value": "8366581c798a02d81cafa7983f7f77108c91f8ede2171793934bb1b5b71bf459", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622527648, "uuid": "06ddbf7a-138d-4368-9e7b-c2cc76d2a991", "comment": "Malware payload (SnakeKeylogger)", "value": "bb12f776f0110f3f677c6bf81823844225d350f3", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622527648, "uuid": "da2802df-559f-4e03-a927-4ed21fe26273", "comment": "Malware payload (SnakeKeylogger)", "value": "5d186830a581e58f54167da9cd23ddd033ea176b1c027bb20a3148b12cfc2e7ec1390a1b9f5e38ae2d95291920091e02", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622527648, "uuid": "56e36607-71e6-4cee-9e58-4b0aba0beafe", "value": "07C3BF9276A3D506CD4F43392CE682CB2752BC114E7F42B7B7A5FB0ECB75A84490261B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622527648, "uuid": "f786e09c-c81d-4762-a544-f183d6ab4228", "value": "3072:gk3hOdsylKlgryzc4bNhZFGzE+cL2knApioo1gaSNAPZesWFPO7YiR6PJEcjjaPg:gk3hOdsylKlgryzc4bNhZF+E+W2knApG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622527648, "uuid": "02bcd361-fd9e-4536-8592-0816084d8ced", "value": 120832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622527648, "uuid": "640745f7-8181-4ce6-9fa9-6c938fdfd435", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622527648, "uuid": "30bdfeab-cf45-4fa5-8087-a9d2a8137328", "value": "IMG_61_023_088 (1).xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a56013f1-c2fd-11eb-875b-42010a9c0053", "comment": "Malware payload (DoubleBack)", "timestamp": 1622568022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622568022, "uuid": "81fb697f-6943-4fb4-8454-97a2a854c336", "comment": "Malware payload (DoubleBack)", "value": "9171c8fc7d3b2aeb3763d477d5718b1d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "doubleback", "colour": "#E06F1F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622568022, "uuid": "a2bd32d8-d7eb-4e56-aae4-adc5e9a57238", "comment": "Malware payload (DoubleBack)", "value": "83e0d55b4cd73be3bf89729408e8f62b1533becf3478ce5666317c3f4561ca0d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "doubleback", "colour": "#E06F1F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622568022, "uuid": "2181a227-034f-4bc1-b1c2-d5e7d586bdf4", "comment": "Malware payload (DoubleBack)", "value": "8a6363175e7d7d4726865334e3652dd0fc9de35c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "doubleback", "colour": "#E06F1F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622568022, "uuid": "95d067dc-aa7b-4cac-81fe-f834ca90603c", "comment": "Malware payload (DoubleBack)", "value": "3a081ad48d6477e521587f481a4904768a09b3fc4e3250a5daea18bacf9b746dabc3bd5f0278111d8233eb40e281f182", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "doubleback", "colour": "#E06F1F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622568022, "uuid": "d383579b-ad20-4ed9-a339-c37fea45725d", "value": "A8F39D11B491C475D4BF0630857AF976ABBDFC109FE099DF27854A390F200E2BE39A66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622568022, "uuid": "3a49d18a-fc59-4ced-836e-053ce9c252c3", "value": "417f7622a54dc0215ceebcef36d65906", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622568022, "uuid": "055bb613-bc0f-4eb2-bee3-c65dd344382f", "value": "3072:MUJ9s/PLzRDyc1AwpjIJ/ITTwToHDMNAOV7R226i8:dnGZ7TTTwToHANbRPA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622568022, "uuid": "14e770c1-1a8c-41de-b254-d26b2558715c", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622568022, "uuid": "1f3b5430-b921-41a3-a585-0cb96440f4bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622568022, "uuid": "cc213e18-2c91-4279-9a29-56ec3400e77a", "value": "3571.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fe08639-c2a3-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1622529143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529143, "uuid": "9490e1dd-624b-4bc1-9f69-2f53d5ac364c", "comment": "Malware payload (SnakeKeylogger)", "value": "d1cb9faecb05c65be169b8fb9b2bb8e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529143, "uuid": "60f97d49-9f1a-474f-b7d2-aa4513b23ca6", "comment": "Malware payload (SnakeKeylogger)", "value": "8420101ac815871f85aa06a7f951cbc6a0c0e77c1fbaf1ca1806fb07b11e868b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529143, "uuid": "13611e9c-7140-4cc1-a1f5-d3b8a3140c0a", "comment": "Malware payload (SnakeKeylogger)", "value": "804c019da843cfdd53a4b0e2848e1beaa7dddd5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529143, "uuid": "795f125b-c096-4c34-8b8d-7229fc1b8ccf", "comment": "Malware payload (SnakeKeylogger)", "value": "4a9c3f295004fe6c764a8635b40c8ada335d1472c73b63002dbea1e3a77b25d88719da1adeeda2a3d248f746484b4722", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529143, "uuid": "f2872605-beff-4562-ae95-79cdfd92821f", "value": "18158DF8F49898B2D14EC772D791ACAEEB6102FE1243496C09B9DACC1B0379E9F4D445", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529143, "uuid": "590d1450-da7c-4de7-ac32-06a1584e12f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529143, "uuid": "a02e9caf-3805-417b-8941-16c9e40cafbf", "value": "12288:K24AUitCrhvT/d3v6uHuOlTZyCngEys7oCs539/+BdY90/fmyd3s:K24itCrDv64fTyCngEp7o5R+9fmyd3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529143, "uuid": "c46a6129-6a91-4479-8db1-023f4299cf07", "value": 875520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529143, "uuid": "9a91c220-083c-4d1b-96fe-2866329fb43c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529143, "uuid": "4a0492c7-0a2b-4190-b5fd-a9ea577ff1c6", "value": "NCwcKbnGXe1Irfd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "428612f7-c2a3-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622529201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529201, "uuid": "2563c205-8354-4bf4-ae20-a94beac7c969", "comment": "Malware payload (AgentTesla)", "value": "8d434a4fb3c762fba0982b16e65cf6af", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529201, "uuid": "bfa2c9ed-8876-4f57-96fc-ed7edb4df401", "comment": "Malware payload (AgentTesla)", "value": "8420d27611804077e65e33f2fe136d9e023e8749f4eca541de227b1c58c10526", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529201, "uuid": "cfd7b357-9130-42c0-9d20-04b6a39ed648", "comment": "Malware payload (AgentTesla)", "value": "150548c02d5cb27718fcbed64d83966ae05895b0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529201, "uuid": "2ef88c7d-66e3-4b3f-8e08-17fa3c22ee94", "comment": "Malware payload (AgentTesla)", "value": "3c909b99f1a7b72e6d6450194cea096c2e2dd9a2c66fb94affb2a5f0e52203ae214a3b432add40c8b45d1e8632319715", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529201, "uuid": "82055ee4-e99e-4ee2-be4d-102234c21acd", "value": "9F358DF4F558A8B2C24DC731C791ACBE9B611AFE1642491D0AB8F6CC2B2379E8F4D445", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529201, "uuid": "1f39a9ca-79a8-4025-9f6a-c560f8e54f7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529201, "uuid": "b7ca0a2c-39a7-49cf-9e0c-22cd6a138925", "value": "24576:uU61v7rwCB5GbGv/vpDW7JssU8nEWHvvLe:V6uCB5GW9WNsuLHvvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529201, "uuid": "2f3970e2-4820-434d-86b4-ff648b7ca498", "value": 1070592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529201, "uuid": "f05c1612-4c6a-414c-b626-3040ff718f60", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529201, "uuid": "137bc38b-82ec-4b61-a506-5a5a86db5a3a", "value": "DHL Documents .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dae4adda-c29d-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622526880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622526880, "uuid": "7c083cdc-2ff6-4a4c-a6aa-3f6de8b04f9c", "comment": "Malware payload (AgentTesla)", "value": "43f1a5fad4ebe69c5ec3d1f659f775c6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622526880, "uuid": "fa2fcc26-ab74-4db1-ab83-1861f58f63f3", "comment": "Malware payload (AgentTesla)", "value": "84fe49ddfb1a7e1b6650a7fd180ecd6604802fc19c69d7b0e24b641cbc0ede25", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622526880, "uuid": "918ad955-9e99-4f11-a6d7-5eb40f1c3c71", "comment": "Malware payload (AgentTesla)", "value": "186dc75bec5fdd6d88f6435b5d298b97186d4508", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622526880, "uuid": "14774875-38a5-4e7d-94b2-0f0c18ef7840", "comment": "Malware payload (AgentTesla)", "value": "bf85d7f55db19f81606accb752fcebff7d09091637a0743724bfa3976c500d919473751a1d5085506c8cca50a17f94a4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622526880, "uuid": "f493000e-ee83-4800-ae82-995b5e34bfc3", "value": "AC157DF4F59898B2D24EC772C791ACAEEBA111FE1203495C0AB9DACC1B4378E9F4D445", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622526880, "uuid": "fd312573-8607-44ec-b615-61cf24ca208b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622526880, "uuid": "6b3da657-7ff3-4fb4-981d-d431b8c5e3ff", "value": "12288:AfZdwUIJrhvTz0dQIXX6hV7BOIdMk+BGccIS2MTLlZFA0cw5C1xZyRqYhkK:AfZdoJr4Qi0V0k+UcfFMTLDQ1xjYhL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622526880, "uuid": "adb3681a-1fff-48d9-a6bc-cd6c32b2efd8", "value": 888320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622526880, "uuid": "07db000c-3a6e-4bc7-b04b-310f1a5942d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622526880, "uuid": "f3aa0f4e-0cff-4d72-9c92-f0fdff77d136", "value": "NEW ORDER00459.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24007728-c2a3-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622529150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529150, "uuid": "4b3177d2-4a26-4c0f-8d5a-0facf2c41521", "comment": "Malware payload (AgentTesla)", "value": "bd62634f46d8767f8164665bdffe5147", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529150, "uuid": "197f6846-052a-458d-8048-8566b349aed0", "comment": "Malware payload (AgentTesla)", "value": "853110e989850daf0136ce2af401835a5d3fd3035102d10bd93080ed7a48bcf9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529150, "uuid": "48d9ceff-0ce6-447e-88cc-9133794a3c1b", "comment": "Malware payload (AgentTesla)", "value": "a237280f3630da7346f5b9603162f2b9cf6e3ac2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529150, "uuid": "ebd41ed9-c669-421a-a88e-7e2af100d70c", "comment": "Malware payload (AgentTesla)", "value": "62bab3c604c0207cb07993e8687bdb02a9b218fd59b205721b0eeb741aba90cbd93bc6badcd8d1432289eb8ede1135df", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529150, "uuid": "a02fac75-8d43-4e35-8275-8eb46ae44c74", "value": "8B354AF4FD59B8AAC10ED731B29098FDD7631DFA018A4BA906A7FECD5B037494B48481", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529150, "uuid": "5dfd947d-e6df-4eed-8e17-89f0e21b931c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529150, "uuid": "ae4098f4-cb1d-4a72-a76f-3f063b44112c", "value": "12288:QtTQchqrhvTBYvo9QKJsUmennjWtoyQeiRuhJa1y55Z0Xj7ICfLc:QtTBqrUvo96onjWiy9iRuKsZ0X4CfLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529150, "uuid": "395822ad-0b18-4045-b86c-6b290ec17c8b", "value": 1077760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529150, "uuid": "d3816026-a67b-4c4a-a8fd-bcd5fd9f59e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529150, "uuid": "60735b79-dfb4-4776-861d-0b6910df8d9f", "value": "New Order,.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fceaf94-c2b9-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1622538807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622538807, "uuid": "70449378-ef20-4ab1-87ae-43107146a29f", "comment": "Malware payload (BitRAT)", "value": "d28580366ee2bb9ae81eaa67f7482182", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622538807, "uuid": "94ffc3fd-fdfa-4ee8-ab77-b74591d2a60c", "comment": "Malware payload (BitRAT)", "value": "85ba34242c6c231c5cad5de3996e443148da47505a9fd3a6f41af32fcfc22652", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622538807, "uuid": "3823a604-2030-4e02-bc25-354392323b54", "comment": "Malware payload (BitRAT)", "value": "df0bba081e2fcd8b45bcf206632823a8da273a1c", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622538807, "uuid": "bfd0a068-5f09-4c63-aff2-ca4502fb3ee2", "comment": "Malware payload (BitRAT)", "value": "15110acd593b2d676e8e36559fdfd2515e72d4f383956dcb80d0cf4a1454bb99aa90c51de54b6efebe2925036b4b7585", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622538807, "uuid": "1657cb60-ff70-4190-a71d-1e655df6c21f", "value": "71C5F0B2B3545217C1A91A3BB711B51066A3FCFE61F9A309E71E72B6FCBE7029410253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622538807, "uuid": "42aa6431-402f-4b37-bca0-4c5f14d7b98d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622538807, "uuid": "427e5801-e2f4-4140-87be-9365f7074f0b", "value": "49152:QWHp7bBGRPpaif65XFH6hLufnSAq58PUYY0D:QWJ7bBGRP0SYFHILq5q0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622538807, "uuid": "927da1bb-c55d-4bd6-8a8a-3ee3517580a5", "value": 2586624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622538807, "uuid": "69edf4a4-de42-4e22-bcdb-7c7567a47f4b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622538807, "uuid": "c1fb4244-ba45-4615-b1ff-b38c3bde29d4", "value": "Booking Confirmation 645476578686879 -copy- PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10aa75aa-c2aa-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622532124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622532124, "uuid": "5e433eeb-1cf4-4562-91e4-44d4bfa7e49e", "comment": "Malware payload (RedLineStealer)", "value": "e9902820dd1d4a220d688bd5afc08fd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622532124, "uuid": "a09ac806-8aa7-46a5-b80a-af753d2db71d", "comment": "Malware payload (RedLineStealer)", "value": "8627a84c9d7b57ecb30690c2cb26130b173ed49b0e79b509c66d8b17a2f744f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622532124, "uuid": "13dc8720-7e9d-47fb-8955-7da428d54879", "comment": "Malware payload (RedLineStealer)", "value": "45a11d4787150af7688718b228ea9fe9e702d111", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622532124, "uuid": "8796a569-8987-4867-ac10-a294e087c746", "comment": "Malware payload (RedLineStealer)", "value": "ef3e74b064d5df836582dffac8f2e8ba3cf18298bc7fb9e9de20df235e08c4f7cb817ed89fe87be4a4e3e933fb8249e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622532124, "uuid": "15f53062-9ed8-4078-915b-0ecbbee25348", "value": "C8542C0AA6F45962DE995F3460B20A10E7F09F38E622F7C70644312F2DB6B739C919D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622532124, "uuid": "8b9fc414-e41c-4d33-9a1c-79db4e5d40dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622532124, "uuid": "dc7a138a-0c18-4501-a7df-30f811b4c050", "value": "3072:DEnyWb4my9E9+DU5qCYoEUdloayNHkc83jMA4i96HFCg7HyJCBH/2HPRAfAfBiH:4UZC5EylxyNfq3g7HyJ35Afy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622532124, "uuid": "2c2a529b-41d3-4ad0-8d3a-8c14d7dc19c6", "value": 286720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622532124, "uuid": "7b972ea3-b7c4-4539-ad1e-4045bc1f737c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622532124, "uuid": "108c22e8-d53c-46f5-96d9-caf04673ebff", "value": "E9902820DD1D4A220D688BD5AFC08FD6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a822c01a-c29e-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1622527224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622527224, "uuid": "3804b52a-d308-4ac6-86db-6effcda3746e", "comment": "Malware payload (Loki)", "value": "10f85dcfee955f92a9844d895fe3ba0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622527224, "uuid": "f68a1fa7-e925-49d0-b8b4-a3315483a52c", "comment": "Malware payload (Loki)", "value": "8670f301f46ecea66e76cd8c9557d59ec71ef3b210384dca666fd3e9b771dc05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622527224, "uuid": "743e0db0-b12b-48af-8e43-7c86dd854128", "comment": "Malware payload (Loki)", "value": "f8f4ad213a49acc17c571f9bb25a511874b0f08a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622527224, "uuid": "6ff40fa8-2507-445b-bdc5-8a4a034eb6dd", "comment": "Malware payload (Loki)", "value": "69a447289d6424cca7ae12f86dbfbd468faff72833f0db08207518802e6b4cca3e8af77d90028ea1fae2a8342d186e1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622527224, "uuid": "b81c8945-79b2-4a18-ac68-80c8b8f25840", "value": "6725AD7E32817ACEC92BCD72C9949C21F671A0B6470BE317506715AC9E8D6ABDF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622527224, "uuid": "3610e531-6112-4d33-9137-b8886586623f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622527224, "uuid": "f23a2123-7869-40c8-a6ec-513f46796fec", "value": "12288:hgEAzJNx3g0Zlscoqz6NSp2u2Kee2PX/EWWy5DUeipCcZfDx050lgy6y/Ebqz09Y:ezJNlXoeM3Ewey5Z6BD5IbqQO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622527224, "uuid": "9d4aff64-d21b-421d-ba6a-b66c5e47f2cd", "value": 994816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622527224, "uuid": "1534e792-42c7-4f65-8557-ff759c530f23", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622527224, "uuid": "961774bb-ba8d-4ee2-a898-6abb3d03415d", "value": "20200237 Item List (84EA) - \uc0ac\uc591 \uc801\uc6a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fcc2ae6-c2d7-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622551450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622551450, "uuid": "41253ebf-c99f-430d-91d9-fe6ad9c7b5fe", "comment": "Malware payload (AgentTesla)", "value": "eb96c2601a7c35ba9e35166719e90eb1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622551450, "uuid": "f8cb9743-75c9-49cc-a10a-9da0d9784cfc", "comment": "Malware payload (AgentTesla)", "value": "871f01cc001e16724a82ab86149156a931ebb5f7508526d9b68480d8282b34b2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622551450, "uuid": "92ebaef4-fbb8-472e-b963-61a5b87ded03", "comment": "Malware payload (AgentTesla)", "value": "632a7635d995fc72eb16f262588005b084b6611e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622551450, "uuid": "e74df48f-cfac-4e16-b0cc-dba9068aa922", "comment": "Malware payload (AgentTesla)", "value": "1c26506cac25f25c1712e55b24951dad29b2d9701d678553eb5a919e766fa1d28b37de60bde34233e2d79015e66b5027", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622551450, "uuid": "44838ea8-b04e-4c93-919e-795c2cbb0132", "value": "7E055AAC325075DEC867CC76CAA82C64FA6174BB570BC207A01716EDAA1DA97CF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622551450, "uuid": "1e2ee528-bdb8-41d6-ba0f-a84605b6b98c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622551450, "uuid": "51bd324a-0226-4719-a098-309c2cbdb29f", "value": "12288:0TTP2qNMsoVR1kbMa0pjx7NJxR44mJnD6N2d2ZKw1rAgySgn4eWmkcyi3zlF4x+V:KTP2d1uypjx77EJAe/kc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622551450, "uuid": "0da3a44c-36c4-4629-8c6a-0f3b07b64539", "value": 865792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622551450, "uuid": "825cad35-e273-4e91-941e-c8323ed2c5fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622551450, "uuid": "b47fa40f-3cf7-4fca-ad89-58336bd21210", "value": "oTzvcTbKCL2ueA6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd74ca66-c298-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1622524683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622524683, "uuid": "2a32d8c7-b524-4ced-bf02-8bbbfa4802cf", "comment": "Malware payload (SnakeKeylogger)", "value": "c4bfe91d0601ad08ae096ddd3e385f0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622524683, "uuid": "0f242396-0788-478d-b579-0479673a12d8", "comment": "Malware payload (SnakeKeylogger)", "value": "87932e3f351db6470ca7db200698ce9575588d897e76b61742ea6a8241f723b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622524683, "uuid": "c7c62292-41c7-431a-bbad-98206fe036ae", "comment": "Malware payload (SnakeKeylogger)", "value": "8a5225a5660ec08d3c93afd27e4e3459a4b10a78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622524683, "uuid": "54729040-8d71-4944-9dca-8cee428f617d", "comment": "Malware payload (SnakeKeylogger)", "value": "1d1d6600ef10177698e32b8cf7e2a3f2ca593e8d97b35edde795a5f96037c13afb530bafae04d2afe6aceaa059ad1b89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622524683, "uuid": "1bb7281b-b18b-4a84-86a3-a260c9fd7507", "value": "B305D07112999BE4E67DC7B880A4D8B303F1B9D3EB11CB3D6E9A60D90091B4496D237F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622524683, "uuid": "e5fb1e99-03a3-45f8-ab97-a55291581a2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622524683, "uuid": "b3f46728-0c41-4465-bb46-2ba627d19524", "value": "12288:CgzKIbZKLXb6NOJNo7DW3odXr+slvmmRBxTx9vOACe6EUdLD:ntaG7KYdXq+mMRv8VdL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622524683, "uuid": "dc225ca8-3b19-41c2-9cbb-11f20b8faaf7", "value": 821248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622524683, "uuid": "88541b7e-1096-4d16-803b-e1f2e8d92586", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622524683, "uuid": "c5505d15-9bf8-42d5-9337-8de5f4103249", "value": "brgvIqdwRIWt7Ty.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7555f114-c2db-11eb-875b-42010a9c0053", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1622553338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553338, "uuid": "a766d621-e973-499e-b18f-c3aa07d0610f", "comment": "Malware payload (AveMariaRAT)", "value": "839e0e7254b66381ba8a558f903fb09b", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553338, "uuid": "6e7fca63-5c65-4ed9-9328-b79e2ff1247f", "comment": "Malware payload (AveMariaRAT)", "value": "8832f0c3e356fc56f6c8e3da8c93923b34548f40a2ade85d466ff2aca01f1289", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553338, "uuid": "ec5d95ab-72b9-4ff2-8fc7-ae77ea0bcd57", "comment": "Malware payload (AveMariaRAT)", "value": "771afd89165125768b48f634d36a6d3d1bf90419", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553338, "uuid": "ba293afa-2276-4b25-a15b-b5d6fc0343c5", "comment": "Malware payload (AveMariaRAT)", "value": "1f13aa7768e6880ba840ccb5c7622b4e87411c2f84a0756b941fd68d7e4f0e646fa9776dee0c3d5e81c5194acc8f294e", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553338, "uuid": "00e855f6-97b4-461b-975b-dddc945f17ad", "value": "D374E1C17240D449E0370B70447BD63896BA7E09A96441AB3BA9BF2F36F51939473BCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553338, "uuid": "70c6f34a-55ee-4e86-ab83-87f730870456", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553338, "uuid": "c72f87df-15ee-4378-82c7-d92493cba424", "value": "6144:eQqYLMuq4fRD0es4gwvg9AZZi+klubKJCzCp:LjbqFtGij4+p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622553338, "uuid": "30836900-5d1d-4f53-a7a9-b658319bf661", "value": 367657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622553338, "uuid": "e0684cb3-ecba-4e1a-bf13-23e641f59252", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553338, "uuid": "af9e35c1-bba0-4cc7-8c9e-c2fbd3bb1cd9", "value": "globalquotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3498e4ed-c2bc-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622539915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622539915, "uuid": "74e5db37-6e13-44f4-bc19-306cda5b2dd7", "comment": "Malware payload (RedLineStealer)", "value": "4bd648324c9063dbf6c621686a56a166", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622539915, "uuid": "c860721b-c5e3-4c6c-9fe1-71876fee5f12", "comment": "Malware payload (RedLineStealer)", "value": "8868ce65c7fb73b3b89c48f97e16249139f94e759ff44d955e493f0651ae5f3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622539915, "uuid": "5dc7f599-8715-4f99-9b97-f55ccf432edc", "comment": "Malware payload (RedLineStealer)", "value": "76df5b68d50f6855df7733fb7d843d62b6f4b970", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622539915, "uuid": "4eea40e5-0163-4038-9ac1-518c5b85bac0", "comment": "Malware payload (RedLineStealer)", "value": "35777b600fd0f7fb5de47f1cd4068d0b113fe48e919e96ee8961a7b49c376b4f74b540daaa6a0df0db8dc24e9b67be88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622539915, "uuid": "b57fa690-32b5-42e5-875c-bf4f41fcc561", "value": "F8849E10F690D035F1F335B45AB782BCA629BDE1EB2450CF62D0AAEA56356E0EC31747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622539915, "uuid": "81155661-9ec9-4cfe-96ea-7dffd52939cc", "value": "2f20facc3edc1d8ba24ede1f07abf090", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622539915, "uuid": "c70200bb-5038-4ddb-b885-535779ffcb95", "value": "6144:YsPRbgl+ueD/FYvv0amaB0iAPzJvTFfd4Les0bkUA+0SP3UO3V1:YsZ04Dt+MamxiiJLFF4LX0YUA+07+V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622539915, "uuid": "752b97f1-4b0b-4304-ba8a-99e288c497b7", "value": 398336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622539915, "uuid": "92e8405c-e30c-44cc-948a-cdc7d1ff8f98", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622539915, "uuid": "7b0702ef-cd9a-496b-a3ac-fe548e359b06", "value": "4bd648324c9063dbf6c621686a56a166.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99f7298c-c299-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622525053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622525053, "uuid": "9aba3951-1f14-415f-a96d-6defd69e1f58", "comment": "Malware payload (Formbook)", "value": "27328e5b19bff264e6fec39f39aa199e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622525053, "uuid": "e0525e2b-d063-41a8-a14c-fb51a3e4bad7", "comment": "Malware payload (Formbook)", "value": "88e02acc2b0e228bb25a6dd348bd39020deca3970d39c8ea60522d45dd435194", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622525053, "uuid": "781d1065-154e-454b-80cc-fdd2f36cd1cc", "comment": "Malware payload (Formbook)", "value": "a7092c8849ad4670ffe82de24db4babd6a1bc112", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622525053, "uuid": "47020f47-d384-4aeb-8fd1-fdaa1872cf4f", "comment": "Malware payload (Formbook)", "value": "a9908653a9533dc00555dda4eb964a803e6433b255af8e826a180aca9c61d2d4c2ef10adc7e9c69947d0c8876f02623b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622525053, "uuid": "6782bda8-e394-4038-890b-894d56480019", "value": "0D05E172129BDFC3C2BE40F88956D967C3F280FBAEA5EBB42E8170D477D170156412A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622525053, "uuid": "416badd9-99d9-437d-b15f-3d7168c1be69", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622525053, "uuid": "e57afa05-09af-4070-9fe3-0bc0b7903544", "value": "12288:W7Eb6NdqoKAQ14SjzlNxd+xb/BQwV87BqjNY0kGcWD13LHi1mWTn6nr2EnQrEp:XbR5+bOwK7Bqju0k96pLITncDnQr8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622525053, "uuid": "a75b6487-542b-4e56-aad5-ffbf99e0787c", "value": 835072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622525053, "uuid": "c1e82634-c94f-4340-bf5f-091cd2360321", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622525053, "uuid": "a4c8f5f3-8b3b-4774-ae36-3e48685676c3", "value": "PI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abfcfe15-c334-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622591655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591655, "uuid": "857ac3b1-dab2-4973-a468-568f783cacc2", "comment": "Malware payload", "value": "bd05e95b88b41cad419d450b10f801c5", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591655, "uuid": "575e75ed-89c4-4984-ad2b-178b26f34d9f", "comment": "Malware payload", "value": "89016b87e97a07b4e0263a18827defdeaa3e150b1523534bbdebe7305beabb64", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591655, "uuid": "bdd9a7fa-f66b-4005-b74c-9e13f128f6f2", "comment": "Malware payload", "value": "6de2eb459ea44224d0bb08f72229478fbc3c5707", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591655, "uuid": "07042c59-98eb-4c6c-9dbe-00013a4f6d0c", "comment": "Malware payload", "value": "daff241d7443c654fcee6f9065a4634c44ce8995bbc12d9fbae7d1a6caa3bbc843a0ed862b438e03a929c98af6a6d54c", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591655, "uuid": "9f38e397-8958-4648-91f2-3db2526c35cb", "value": "1B45D09F65A6086AEBD15536C4528501DBF3B8011336AF5E2E1D12D90FDB3F8CE78A38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591655, "uuid": "4a6a64e3-efc5-4753-a0fe-2b4caf91062d", "value": "6144:ElaMCErK9RL/3IGn9qetACotRyy71zTWOw9cmS82Xlpvqvs3Se6BGDF:9KQRLdqwAgO7XvYfe6Eh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622591655, "uuid": "bb053b56-fec4-4469-b28d-7b1698d65f7a", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622591655, "uuid": "5764c9f4-60e2-4c2e-b0e4-220803884190", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591655, "uuid": "c3522a9f-8477-42ea-bb2f-be0fdb603f14", "value": "89016b87e97a07b4e0263a18827defdeaa3e150b1523534bbdebe7305beabb64.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af946641-c2ce-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622547852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547852, "uuid": "a5309996-a02c-40bd-b6f0-958ba0118a68", "comment": "Malware payload (AgentTesla)", "value": "88a5dc6ec87d0ad253dd9c1b3f9acb95", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547852, "uuid": "323fc14c-f392-4b9a-a27a-a84f9002ac93", "comment": "Malware payload (AgentTesla)", "value": "89da4dfd51c3687174195db8904ae0fdcbfdafe69a3d202592ed2fbd4a2d9dc9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547852, "uuid": "681c1e45-f245-448f-bb12-f9164f0ec26a", "comment": "Malware payload (AgentTesla)", "value": "a1a0d75bc0a91d3c6a1e0d01c68e7dcd16700b3b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547852, "uuid": "97edbf28-4d98-4867-b6a2-ff626681cf2d", "comment": "Malware payload (AgentTesla)", "value": "d087ec55f1040d5ef08fc2d813e82b17a7c2aabaeaa91ae6bea2c27f9a9d2486b36399efa348dcebd950459a2807ed96", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547852, "uuid": "280afce0-4d2d-429a-b323-9b69853672a1", "value": "6FE4338A42CF28F8A12CACDD2551ACE9CBD8CBD0ABF8443750D7CE156F391DC1A4D969", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547852, "uuid": "c9d632e8-f0de-4203-b7c7-b590ae32feb8", "value": "12288:ejO47T8RX6VkxG735QbnGTEN+eOvLCxiO8K9JDu7rnxhgwcpLmKon+q:ivTKFkqGySzCuGNarx/KonR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622547852, "uuid": "c51b9fa9-b97c-433e-bee8-18527c87ff3b", "value": 702244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622547852, "uuid": "6e8efca3-e682-43de-aa32-4625e2f39637", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547852, "uuid": "8c58ecf1-392c-4be1-9912-cb03d054cb80", "value": "PAYMENT FOR MS FOB 4-25.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d9ceb95-c2db-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622553298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553298, "uuid": "27ebea46-6ea3-4a60-8468-b5441163f6f0", "comment": "Malware payload (Formbook)", "value": "5ec3457e824f2987ab7860905c05dc0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553298, "uuid": "1b0560ed-14f7-433f-8c09-e6dc40342852", "comment": "Malware payload (Formbook)", "value": "8b9f1214c8bbcd596ff1eb9bbf1daeb4b32a1790b0b5529b79190b0b541dba68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553298, "uuid": "8f2cee96-0cfc-44ab-aa93-137d53dd73b7", "comment": "Malware payload (Formbook)", "value": "6cb97f6496abeb48ea15d12fea7f65701cedb841", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553298, "uuid": "9d8eadd5-5c0c-4ee9-87c8-0ea26639e1c8", "comment": "Malware payload (Formbook)", "value": "d388f72d5f3af4ac8fd84742c0b05da2fd0e09604daa009d5e2e69e0efa987a0ea0bf24d4d4dae216fbfe9a75ad04549", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553298, "uuid": "a0ac51b7-0b86-4de8-ad7f-3ff98d997719", "value": "2CB40106355888BEC4113638048E5E6396B77EA54ABCB37BB78C7B4C8D713C9B91E742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553298, "uuid": "68926b4e-2ca3-43ab-869c-68e2a454002e", "value": "3909d7864c2e0d24a030b54d0b8b5e05", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553298, "uuid": "cbb28b6d-9d23-4725-8fb5-3a124506985f", "value": "12288:vMe+9wkiPmOzyJEqju3YR+cdInzbKw8SI5:UDfikS3HV38/5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622553298, "uuid": "caa3cb5f-000d-4eab-9fa6-cab25a45bf5f", "value": 515072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622553298, "uuid": "cb0fbf65-f0fa-4cdd-b18d-f33ac5bd0550", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553298, "uuid": "067b862e-ef88-4dd1-ba4d-a9e1e4919eb5", "value": "FT-UPS2021000308084-27052021164546.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e114edea-c287-11eb-875b-42010a9c0053", "comment": "Malware payload (LimeRAT)", "timestamp": 1622517441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622517441, "uuid": "b10fcf25-dccf-4911-9a80-4ebf8e125d7a", "comment": "Malware payload (LimeRAT)", "value": "a89a92fdd2950542f0b87379b639a060", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lime-RAT", "colour": "#331175", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622517441, "uuid": "875db3c7-2e03-4167-991f-40d76eb579a4", "comment": "Malware payload (LimeRAT)", "value": "8b9fd93906cbfe3753c41220bc9ad789d0cc7f279ccb223b7ced9e965a544c52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lime-RAT", "colour": "#331175", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622517441, "uuid": "ef667586-150c-4711-a622-114dbc298876", "comment": "Malware payload (LimeRAT)", "value": "3be24b5932ba4c8b8aac0e21ec46b59de50c2289", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lime-RAT", "colour": "#331175", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622517441, "uuid": "0fb647b4-9ad1-48ae-aa3a-73d76a023e1d", "comment": "Malware payload (LimeRAT)", "value": "ccaa845f9aae12a0add77643fdc52ae90d7c01fdfdbfa27d53fbeb14910d08fc3f2e2839b5ac5cec04f283f1a7c5352c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lime-RAT", "colour": "#331175", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622517441, "uuid": "969c684b-6b76-4ccc-8bde-6b797a068707", "value": "49D26E14B7E14345D3DC1AB20F7161650FB0EE1BA93BFB6D0CC950931A5BED18A98AE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622517441, "uuid": "9fef6490-4d79-4388-b078-5c5b814ad2ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622517441, "uuid": "5964e896-f9fa-4e36-a061-2568c8d34242", "value": "768:vp0x6txrwNbo6iUJn45NV14loko/Zhyj:vpzdwN8wJ4xCs6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622517441, "uuid": "74ac5a86-8994-42e3-9f1e-621d06d0b7ae", "value": 29184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622517441, "uuid": "f79d79e7-53da-4a6a-a01b-bf475b536d63", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622517441, "uuid": "1fc4ff9d-601e-4f5b-b871-5a00766a7a9d", "value": "85a1uZDu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a3fd122-c32d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622588458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622588458, "uuid": "a762bc27-640d-46d3-a892-19b5d8f703fa", "comment": "Malware payload", "value": "74efc35a8b06d9d94ca1252c0f638f0b", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622588458, "uuid": "70c77419-d051-43d9-bd4b-d478c2b64bd0", "comment": "Malware payload", "value": "8bcd7b55aedae9851b12c98228344807ba8df431fd2a3a5090a20662c5c95385", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622588458, "uuid": "7fd6d14c-cdc5-4aa5-8807-4688c602561e", "comment": "Malware payload", "value": "068b138b47ac71598366dc74228b01a4b689db1c", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622588458, "uuid": "f9d0f0e9-8aac-4ca5-a3f6-af676d82b92f", "comment": "Malware payload", "value": "54b2e1fa6041a2bccb8d0b0e25d16b35f54f139d6022ad64bd3ddfe473df945f55059b21b0d4f8343cd9edd38d06747d", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622588458, "uuid": "b5de7dee-4929-40c6-8084-2ed53887b3b8", "value": "AF62116E1DC863A7196D4A93FF48008C4E79D372A1356084FFB9C09C2D6941CEEC5AF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622588458, "uuid": "c4f73c96-18cb-4e99-868f-e2bf372186c6", "value": "192:YoLzggVPfuOElbFP+eo1ZTDk5LZZVLBD9xui:YqJfEtCO7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622588458, "uuid": "6aad757d-cdbb-4f86-ad86-68c21e0079bd", "value": 15079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622588458, "uuid": "afa77c18-66a7-4d0f-999a-2c6b614794c4", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622588458, "uuid": "8101b8c3-8821-4fba-9f1c-bc25a9fec183", "value": "DeployingLibrary.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06090ba3-c2d6-11eb-875b-42010a9c0053", "comment": "Malware payload (njrat)", "timestamp": 1622551004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622551004, "uuid": "08fd65e8-c707-4389-9225-fccd6e318a86", "comment": "Malware payload (njrat)", "value": "4fbc4a387ca2f6b2f9d22a1548e89e7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622551004, "uuid": "6a656c16-7a79-4d01-a5a0-4abe0c10bc23", "comment": "Malware payload (njrat)", "value": "8c9d614da4ea17f4261a105adbe73992c0df1f5639310f78db244fdf3fe338fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622551004, "uuid": "f40ff3fa-f0b6-41a8-a60c-270d2d7378d3", "comment": "Malware payload (njrat)", "value": "52c315f1e4c83b0a013d5eb7089628bb84a6eaa0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622551004, "uuid": "11a38836-af82-45ac-8a51-40397dda2a23", "comment": "Malware payload (njrat)", "value": "e91edc406737e142e551c0baedaa7c26aed52c3f75c59ffb7076ae27a1699353df6bf7a29bf02b9d5f153474a761c337", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622551004, "uuid": "711e2239-d6b9-4b15-bdb6-8babb8b38f1b", "value": "16547CD2F11045EDEC6A173264270CA249A32CBEE6B9D15D71FA36233BF71A3401A95F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622551004, "uuid": "c5635748-0bb7-4532-a73e-cbfeab9620b0", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622551004, "uuid": "92b956c5-fd6b-4832-9330-998bb9baa730", "value": "3072:jLk395hYXJbxh0VqBoU3LAzIMIDjqKValeJthCgBDrnp:jQqbWVqB0pIDjqKVa+th9B7p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622551004, "uuid": "79c5f73f-a1c3-4b19-bbd9-a20719d04526", "value": 294048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622551004, "uuid": "9326214e-6161-4bfd-a2e0-aeb79f6f010e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622551004, "uuid": "a3ee1a02-2541-4ad5-8f4b-c3830ce0a6ee", "value": "Order417.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f8e2231-c2cc-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622546859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622546859, "uuid": "698c9b41-626d-4287-8d47-d1cc7a5ccd96", "comment": "Malware payload", "value": "b8f1480b11a9f7670e8341866e34732b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622546859, "uuid": "c54574b8-3c8d-42d4-9faf-ee77fe5ad05d", "comment": "Malware payload", "value": "8cf3363d9f695f207df6c5bdee42592a28ee288419acd8a8157dabf2ebc51069", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622546859, "uuid": "b2addb47-b38f-44cd-8914-1d9817fbabec", "comment": "Malware payload", "value": "5c4f836b1a6bec5740c4b7c58a8560c4cd3194fb", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622546859, "uuid": "8e602232-596d-4b58-a38f-3670f1aec623", "comment": "Malware payload", "value": "ae5a86e17b6ccbf3992a917d686c31913b246033bdfe39e001744ab4d8bdab7f0c6925c323f0f9dae4ba6fde373f81d5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622546859, "uuid": "64354c12-0351-4e91-ac8f-88c93ace3a78", "value": "C15533351BB070099BC2534889C9B5B9DA08B27AB35542E8AC77F9A0D9101CFB3DB677", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622546859, "uuid": "5ff246af-883d-4a7d-9b51-7416144cb69b", "value": "24576:9Bcw1/kn1ElS90rZrnm3BFK5pAuQStXQzbPeXbLegRuOP9hjobAgMSjo6hK6Cehx:z9s1ElEeZrUEWuQS5QzbOdRLPmAgJKhC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622546859, "uuid": "b7e856a3-cf09-40c8-9f6c-6584a6c7f538", "value": 1377448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622546859, "uuid": "8f81a721-e400-44e7-962e-1368ba86f0c2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622546859, "uuid": "387b8865-42e9-461f-bcaa-d8841b718cb7", "value": "RFQ-14000135846_Scanned from a Xerox multifunction device.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe3211f1-c333-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622591364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591364, "uuid": "5b1593cc-e62a-4173-b63c-e3f74bf3b182", "comment": "Malware payload", "value": "9625d2daa2439106253de04423960090", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591364, "uuid": "6281e1c9-6adb-4cd3-93d4-3643a14b48c2", "comment": "Malware payload", "value": "8df6ba945aee768c422eb69a7a3c7d095bb55edb9959532a71db4711fc67f7c8", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591364, "uuid": "877e3d9c-c3d0-451e-bcdd-48de30db019b", "comment": "Malware payload", "value": "16a993cce7920f07b7bf62e338e8cab8c7c98440", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591364, "uuid": "be9363ee-d827-4670-a370-d18d0e8a08bb", "comment": "Malware payload", "value": "fc65a75d20c8ff500abad069be3c8361414467832337aad09ab0eff6a5d80b0b39a07df540a09fcbdbd75e7affd84892", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591364, "uuid": "cd512ebe-66cd-47f7-8b72-412e0a666f1e", "value": "E8852302E5EEB45B8FE5463C6B16644F2D8730BED069DAA2185E433EF1C4F9B145E0B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591364, "uuid": "3347176c-323f-4f59-b8ea-7f53de0bbb2c", "value": "24576:VJ6bSYhOnNDdbUB4B9YiI7CvJoNOHy3I9hOTA7iW:76bb0DoUYqYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622591364, "uuid": "b6be392e-836b-4841-847c-2947a29f5911", "value": 1750794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622591364, "uuid": "7235749f-7628-45e8-9c46-5bb98c056ff5", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591364, "uuid": "372dc188-8779-4582-8922-cb2010668d97", "value": "8df6ba945aee768c422eb69a7a3c7d095bb55edb9959532a71db4711fc67f7c8.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28ae9001-c2ba-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1622539036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622539036, "uuid": "46de5735-a2ed-4d90-9353-6d8e79421811", "comment": "Malware payload (AsyncRAT)", "value": "f21ea07292184b1d90936ffe99315ccd", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622539036, "uuid": "610f5095-d15a-42dc-ba89-54d60a5e5a6c", "comment": "Malware payload (AsyncRAT)", "value": "8eff4ea3ac297fccca052aa83bae4ca6960eb8bb27fe2d77a5b12d1303ac0ae6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622539036, "uuid": "5cf86d2d-6e77-46c3-a48f-83addd228342", "comment": "Malware payload (AsyncRAT)", "value": "09caf889505943e5f4e29948c1e87d3b89660ec8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622539036, "uuid": "5a9b9f9a-ac33-4803-95cd-09e4aceccc02", "comment": "Malware payload (AsyncRAT)", "value": "cc00aa9eccf98d9633185877a67baa29c2a0457b820ceca0d8abdce645f6e888f03c35c01081e11816cd29cb041de6f9", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622539036, "uuid": "7264988e-c1ea-416a-89f8-1ebfe1ce674c", "value": "9C055BF4F55898B2C24DCB33E691ACADE7631DFE124349DC49A4FECC1A2374A8B58446", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622539036, "uuid": "72bccc3e-f85e-41b5-aee6-217aa920ff1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622539036, "uuid": "f115df2e-949f-4dc7-b1a6-c124f7dfec0b", "value": "12288:rAz0g3NrhvTlb7QKFdc0VOkz2P2ab/G8AXiUL5V8McnFk+h:rAzfNrLBZ8kKOaCRiYH8MSFk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622539036, "uuid": "f7fb63d1-42ac-4d53-bb7c-9fb514443f85", "value": 861696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622539036, "uuid": "13357540-a2bf-46c2-8ce7-572612bf6532", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622539036, "uuid": "67e04b10-7d05-40be-a655-adeada2fcca6", "value": "182b00d5248751823ba57e73714aa247.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2b44e58-c296-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1622523860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622523860, "uuid": "b004cbd8-5a0b-452c-9eb4-3bf7cbc69eb0", "comment": "Malware payload (Gozi)", "value": "3d38578600e828c447707199822dacd4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622523860, "uuid": "601daeb4-ab66-44fd-8722-ba77f9deac33", "comment": "Malware payload (Gozi)", "value": "8f8268c13ddc484a180cff0dd8e764e328897e7a978d0f45e9c26de57f233106", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622523860, "uuid": "4c678716-b45b-4966-954e-c14d3ffaeb79", "comment": "Malware payload (Gozi)", "value": "b83a8cbcd1b9467406461cbdf58d0bdd4cf8a3a5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622523860, "uuid": "58a3ea0e-1c18-4f61-8213-0549c566ae57", "comment": "Malware payload (Gozi)", "value": "394c2fe11e9c59c4a5d32e07343211643f7e067b6d473121c594fa2a2414d4bc2b14db961c48496559e5d21e97ce7a9c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622523860, "uuid": "b7be4666-acce-462c-a0a2-3cf9ce4fe747", "value": "C5E46D00B651C039F4B621F44E6AD2BCA62D7EA16B2411EF73D15FEF9A295E06C3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622523860, "uuid": "8838d107-14ae-4379-9ecf-31b83890e5af", "value": "f19b9a7ea08f6e7335d27d1febeab85f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622523860, "uuid": "f0f14a3a-8350-4532-9f1d-f14e669b92a2", "value": "12288:djCT8mUIP/MfzluXxWok8sRX0yad9ePV7wU9eOjSA4lhHDenPe19hgU/yutzozMo:djCThrolQxWok8sRJFSAk6e19hgIDc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622523860, "uuid": "957cd967-68df-42d8-aa0c-fca52954341b", "value": 698368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622523860, "uuid": "5384b190-0ab7-4074-83e9-43cbcdb5ae2a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622523860, "uuid": "b91e360c-9d44-408d-ad19-c9db6714c7b0", "value": "Know.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37c2087e-c334-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622591460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591460, "uuid": "5d5d8cc4-f61c-45d6-85f6-db698341a465", "comment": "Malware payload", "value": "44011659d6f589e6b654f5ef0e1d8b6c", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591460, "uuid": "e8c42bbb-0450-4e09-8b7a-954603cb181a", "comment": "Malware payload", "value": "9059c5b46dce8595fcc46e63e4ffbceeed883b7b1c9a2313f7208a7f26a0c186", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591460, "uuid": "884fb62f-cfd0-4013-a220-861ba3bfc1d1", "comment": "Malware payload", "value": "aa5589fe1e149ef2e4274c7d548782c86b4838f2", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591460, "uuid": "e1f5ac7b-ffb1-4f7b-85e1-93ec6b275e58", "comment": "Malware payload", "value": "1318a351c4acbcc24212f43abb756f4bedf8b1c5f4b3e52af175345923090616f72f9715c607b3450a8f4c0841b1903f", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591460, "uuid": "967b77f8-2d78-4864-b0c3-cf701532c8d8", "value": "6F75010CD7BAA164CF47253E9FAF931FFE2271AEDA3573411768CA74A5E0C24284E845", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591460, "uuid": "3df67e8e-18d6-435e-8b9a-169af1d82213", "value": "3072:bUWfHAzfuhQbUNjLYjZp/mTbcXngw9uQwRgWAHoAzUGZ/plx:bMfsLYtnv9/tF7ZXx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622591460, "uuid": "395afbad-571a-4276-be68-a5bf945fbaf0", "value": 1663636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622591460, "uuid": "72d34334-81ab-419d-b926-1f05e3a2a438", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591460, "uuid": "f1dc2f4d-e8af-459d-87cf-702faa7250ff", "value": "9059c5b46dce8595fcc46e63e4ffbceeed883b7b1c9a2313f7208a7f26a0c186.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "750accbe-c2e1-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622555915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622555915, "uuid": "05981fea-0d3a-4c27-ae78-72aca0e39809", "comment": "Malware payload (AgentTesla)", "value": "8f6c981fcbd608f48663a6f2ce74ca83", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622555915, "uuid": "e225ffa6-6b18-40d2-ab0f-d64475c5b3f0", "comment": "Malware payload (AgentTesla)", "value": "90c7959a7ecbe7db2456646377716cd8cfa9c68ae284dba2085d00803153b2b3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622555915, "uuid": "08283a72-fe61-4ef9-9031-e532d6ec67c9", "comment": "Malware payload (AgentTesla)", "value": "32a7a4f6042701a9222f6f14f57bfa9c254686c5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622555915, "uuid": "d2b4d2e6-4d39-4f18-a68d-d2558586c250", "comment": "Malware payload (AgentTesla)", "value": "a988dd03c426e1215a62bf6a390746f0ccff4a916c395ca63be62c902afea7a65ce8e80f7f146f2fd7be7b4dad00de41", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622555915, "uuid": "d48f55ac-ea80-41aa-9c03-fec1eea27e96", "value": "1A05E132329D9FE5D33E83F884D0D46343F0A0EBFB16EA3D6E8490D95A92740DB515A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622555915, "uuid": "949ea477-9567-4e19-ade8-f02d4d625d5d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622555915, "uuid": "211d15c8-6908-4994-bfc2-869bea3a531a", "value": "12288:LGjy6N7dZqCYvyP3mVvfAIkcN3aDxW7ZIiZ+pRmXqz71OHqdmZQQNRLlA4:LCY6mvfA8NeYImgdmGkF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622555915, "uuid": "a023ff2b-fbad-446e-9b01-74942743a12e", "value": 819712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622555915, "uuid": "666782c1-719a-49c7-8d50-66d31b545bb8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622555915, "uuid": "c94a0bb8-18d7-44ca-9e09-98c2ab5c09c0", "value": "Scan 31.05.2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3f042bc-c29f-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1622527673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622527673, "uuid": "d223e515-1eae-4b5a-9918-aa770d454a76", "comment": "Malware payload (SnakeKeylogger)", "value": "c261ef7fec717e5dc11adce0174593c5", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622527673, "uuid": "ddb9ab8d-325d-40a8-b955-583953af9856", "comment": "Malware payload (SnakeKeylogger)", "value": "9102836463c2d92a62c730a869acc1a6616286c2ffe1bc6874ad0e4a3aeb18c2", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622527673, "uuid": "f7212c7e-cf88-4402-8f39-f815b093c99d", "comment": "Malware payload (SnakeKeylogger)", "value": "d9dcaa68ca000e5b2c1b589688d61cab7ab1cc64", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622527673, "uuid": "dc47fc30-dafc-4d1c-a8dc-1848910c1e12", "comment": "Malware payload (SnakeKeylogger)", "value": "f0f6afb59dc1507a3fb3bcda281f35e2a21c8dd6c1f53547e4083721edcfe31bce87e2c761545730c7b90a9ab580a30e", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622527673, "uuid": "c8256753-bb94-4ef3-affb-d858c7e7d216", "value": "90D23EA6B2D6DC05DD4903754CE6C2E66627FC516FA3938B3289F71E0F71AC08903617", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622527673, "uuid": "32bd6c52-1c89-401b-b59e-639819c1d4a8", "value": "768:Tik3hOdsylKlgryzc4bNhZFGzE+cL2knAJ6OiCkrHfQGXh:+k3hOdsylKlgryzc4bNhZFGzE+cL2knV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622527673, "uuid": "eb0d93a7-9faf-4c36-972d-e837057c385b", "value": 28672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622527673, "uuid": "bfb1dea4-5506-413b-b3c6-793f2c41be9c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622527673, "uuid": "ebd880bb-e572-4517-88bf-51226b58c657", "value": "IMG_61_023_088.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d12126f7-c2a2-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622529011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529011, "uuid": "81b251a6-04e3-45f5-b809-59b03e9fe25a", "comment": "Malware payload (Formbook)", "value": "dfcd78fdae6fd410cd14b56afa872470", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529011, "uuid": "4021d3d3-bfb9-4f01-9a28-b51b7a061953", "comment": "Malware payload (Formbook)", "value": "9193d6cb634d0be563a786dbb165b8991093c451aac3a4d82c7bde0213f1e106", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529011, "uuid": "f4c5231b-63e2-494e-93d0-3b664cc5db95", "comment": "Malware payload (Formbook)", "value": "bc90aa7e3b15de05d8ebc5ce58eb4a4aac93ea44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529011, "uuid": "7a941ad6-bfdc-4fcf-bb7d-e12d68c208a7", "comment": "Malware payload (Formbook)", "value": "759b15012b37fb401e7423d9a439779676c5726bcd3d6ec5770a2f6fd0e40e004c6c72132bd6e94ce51f17353b3c3737", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529011, "uuid": "342a6f21-ed45-46b9-b692-81a0365f4ce9", "value": "A805EA3FAE40E4D8DB5380F06C76857ABD44F93595994D0BA6C19A942032283F8E7F7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529011, "uuid": "4b2af3ee-56f3-4cec-b89d-49b7f4c2fd37", "value": "94537eeb5c6167a2aa384d9fb854874f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529011, "uuid": "1b99825f-b6fe-4330-8b37-290f4ceb4dc2", "value": "12288:1auFxy2G1T02tUDLxf/z7pXXqcyuX2heP:1auFxy2G16xfL7p/2heP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529011, "uuid": "afcd598c-f0d8-446f-8ebe-6f68ee68a5b7", "value": 847511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529011, "uuid": "ae610dcd-1eeb-49ed-8e2c-27ae18771e19", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529011, "uuid": "2c9e040c-2ef5-4907-868f-c7e421fb48d6", "value": "swift.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8cc0888-c29e-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1622527279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622527279, "uuid": "0a3853e9-c20f-4731-889c-a02e722c40ce", "comment": "Malware payload (NanoCore)", "value": "a6f8144418df830341227d890b000b14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622527279, "uuid": "3bebc05b-c44d-4586-bd67-0b6107f06645", "comment": "Malware payload (NanoCore)", "value": "91dde5ab420de328614c1828324948dfb5e0bc231aba011c29fc48d1a1f5e306", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622527279, "uuid": "b39b5be0-e052-4220-9dbf-472e8306e1d0", "comment": "Malware payload (NanoCore)", "value": "03f4d78060af3535ad45de6192a2f5d13028b4dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622527279, "uuid": "7c9e7188-c3b9-4d73-9c8a-86cd4044b950", "comment": "Malware payload (NanoCore)", "value": "dec6d0c684e9b4cc0206f287fb23705c12d6aabe600455f6a5dd5d3f743f58cf8cb8c5cd49d3d6a0c71f39f4b017f498", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622527279, "uuid": "b947adc0-af74-4fb9-842f-ec4c81e7f5d0", "value": "E6157BAC325075DEC867CC76CAA82C64EA60747B570FD207A02715ED9A1DA9BDF201F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622527279, "uuid": "ef989de9-ba3f-4b09-9c59-112b4b4a3d61", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622527279, "uuid": "6c952c4e-014a-4f43-bac8-f73b8f1578db", "value": "24576:IMARs8WNmFEre700i0UAZM15D7JdSQEBOFh6wzduw:IBRzQhn+ZM197J8fk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622527279, "uuid": "7e4f1eb0-e8eb-4b1d-baec-a802d81548f8", "value": 897024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622527279, "uuid": "2ed375ff-8f4f-41c2-9480-3363be0c5ad9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622527279, "uuid": "7d79a96b-24a1-460f-abcc-b48168a41cc2", "value": "PROOF OF PAYMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "724c0d9d-c2a3-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1622529281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529281, "uuid": "e14a6eea-c06b-4627-bd31-9d66de32bde4", "comment": "Malware payload (RemcosRAT)", "value": "edb141bc33c19e6f90f7f6eec3a3912c", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529281, "uuid": "5bf30810-7f68-4b50-9188-6ecd5cfd3858", "comment": "Malware payload (RemcosRAT)", "value": "92a7e167629bd14c88a03ef1b6719acd143082c495972a829f20cc588fd6e084", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529281, "uuid": "4f24127e-5729-4736-8651-ec9cd60c71b8", "comment": "Malware payload (RemcosRAT)", "value": "b88f901a610af033506ec3a5213819a4670e3f29", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529281, "uuid": "c30a6609-7e51-495d-b2f0-b54ba88db079", "comment": "Malware payload (RemcosRAT)", "value": "026139f2788abfe825e3451e1a9dd58c5bd4f3d5be7b09727a3c0403f2f02f67b15ec424a915006c8e2cc4bbe77aa575", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529281, "uuid": "85b1e8f2-f3e5-4dff-9d0e-678ce1ac2cb1", "value": "E191C7479FBE82887826FC34CCD7A02EF5C08C78DF9CE274454A5149C5BD795439D862", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529281, "uuid": "c7c4f930-6027-4e77-960c-b059979dab9f", "value": "96:xDRBskOf+UDf0XcdlvXw9tw5+Bi6w5gRBlD5yfID+XcdjuXtI+tyw5E:xDRjOfVDf0XcPviI6/RpyfID+XcFu9IL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529281, "uuid": "ccf25eeb-ada6-4e79-8808-992456f88f70", "value": 4323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529281, "uuid": "0a205a0c-14b4-4a7b-af39-347131ae3d07", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529281, "uuid": "a14f0055-8194-493f-8b2f-13db56839c97", "value": "Report.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40caa6f7-c334-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622591475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591475, "uuid": "5999e4e6-cab5-4fca-b3df-1daf7f1d9f1b", "comment": "Malware payload", "value": "e405285f73ddb8986cbf31b9ca864f1b", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591475, "uuid": "42d8c691-5e97-41b2-95eb-78b3bc6651b7", "comment": "Malware payload", "value": "9301e48ea3fa7d39df871f04072ee47b9046d76aa378a1c5697f3b2c14aef1d6", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591475, "uuid": "b373c410-3865-42c5-a864-f9016372c0db", "comment": "Malware payload", "value": "ae2a555cf0d0cb188743923e8062410424d4b7c6", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591475, "uuid": "4f1d11f9-1b6c-427d-9c5a-cc7042064357", "comment": "Malware payload", "value": "40a01b88a45515100ee4f9ae94d415aa5c11aa1f93e70011401aa058f8927b893605109056de2cd58603b01d0c07a4fb", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591475, "uuid": "ff62bb86-535f-4626-b0ad-f512739fdd74", "value": "0D852301E5EEB45B8FA5467C2B1A644F2D8730BFD029DAA2185E473FF1C4F9B145E0A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591475, "uuid": "4e92ab86-5103-4030-b791-f2220da61e2e", "value": "24576:LJ6bSYhOnNDdbUB4B9YiI7CvJoNOHy3I9hOTA7iO:t6bb0DoUYqYO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622591475, "uuid": "5ad9d346-3cf2-4030-b1b4-9da9eca4b902", "value": 1751008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622591475, "uuid": "52fe2000-97f0-4813-bc0e-cc449faf3abf", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591475, "uuid": "4946357a-eb14-4e9f-a695-8697d2552e82", "value": "9301e48ea3fa7d39df871f04072ee47b9046d76aa378a1c5697f3b2c14aef1d6.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c090886-c2db-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622553296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553296, "uuid": "39e983eb-434c-489b-aa05-00f67f1576d6", "comment": "Malware payload (AgentTesla)", "value": "7a2d3781e0d32d714670fcbe6a032d76", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553296, "uuid": "7d625d9b-e931-47af-9c8b-fb83122bfe67", "comment": "Malware payload (AgentTesla)", "value": "93c9a425312881a52198ba582e20b7859e76737c98a76498f66ec84105cdacbe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553296, "uuid": "457b17f2-89c1-4a50-964a-56dae2a2f00f", "comment": "Malware payload (AgentTesla)", "value": "0d18b081a8ed29590947b6a600e2e64cbb6f4669", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553296, "uuid": "70357e46-5edf-497d-a34a-43e3cde16534", "comment": "Malware payload (AgentTesla)", "value": "cd0780ead4b661df431af3f3cac272a6a7282880f30f9c464834d9e1df38507ce8cede5c1292ac1e15735bc8f2e709a2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553296, "uuid": "82f969cf-c212-4111-85eb-d3c75161be0a", "value": "4135AEF5F48888F5CA4DC7B2D3929CADE7A145FE4202491C0BA8DBCD1F8379A8F19546", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553296, "uuid": "52dfafc3-5ead-42d6-9676-191b3f3cb2c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553296, "uuid": "2c7f5a9c-419d-4af7-a291-3cca567a540e", "value": "24576:VyH3hi2AYVErzj2NKBUolD5MG6nnjqKoe:QRnKrX2NKBZlD5MLjqKoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622553296, "uuid": "7763e5fd-6e7a-4634-803c-fac8cbb3bd0f", "value": 1117696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622553296, "uuid": "c87b7621-db75-4ceb-897d-ca5ac8689de8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553296, "uuid": "40e89f1a-7941-4873-b0e5-349ff97d06c5", "value": "10041 .Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1c6021e-c299-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622525093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622525093, "uuid": "bbdc323e-ea1f-4151-9571-fc8334b9277e", "comment": "Malware payload (AgentTesla)", "value": "b25ee822fdc27ed5b094caaeea59d32f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622525093, "uuid": "6f4fdc52-284f-4150-9730-009b79d530aa", "comment": "Malware payload (AgentTesla)", "value": "9415ebd7080b5163c9d32b6a1516ae854ded25d34544bfb5e0bd3a127eeac6d7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622525093, "uuid": "15bdcaaf-487c-4329-a675-8ba8a4ac426f", "comment": "Malware payload (AgentTesla)", "value": "5ab7d045bee0a81bfd3370d590106e1f22a20c98", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622525093, "uuid": "a9573422-2f7b-479a-9a49-40482db9d454", "comment": "Malware payload (AgentTesla)", "value": "8d839d91113fe27eb34ca00fce7ba36dec43d553c4386f4b16c2eee64d4692919ffe81b792860232cbbea893f37730dc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622525093, "uuid": "0b4b8a21-9864-4659-8f81-1a728fac77ea", "value": "F30559AC325075DFC867CC76CAA81C60EA6174BB570BD203A02715EDAA1DA97DF241F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622525093, "uuid": "1fe70bc0-3b64-4d02-8ded-43a4d7d8a628", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622525093, "uuid": "534f4fb7-4bc9-4618-aeab-f3b8a7a076fd", "value": "12288:Jr4516rC5LIEFwfScFLZKxCdNEWG5i49iTnvhYvE3ibOkcYx2DCH6dt4yQNaoaH5:A6rnEFwfScW2EPi4Qzv6bORNV4Fs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622525093, "uuid": "cf98b006-eac6-4934-a2fc-c95b12ff6bea", "value": 867328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622525093, "uuid": "d07ccd1b-179c-47ce-a547-ceb93b90565f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622525093, "uuid": "ec8c709b-5ca5-433a-9b74-563d8c0d342a", "value": "RFQ_SMK01062020.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c860a947-c2fa-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622566792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622566792, "uuid": "f12f8cd9-6b73-4724-a952-e3beb16af0a0", "comment": "Malware payload (Formbook)", "value": "33ee03d23b46db572d468b232c9f0467", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622566792, "uuid": "6bf3559c-6529-4020-a10d-1c4144613379", "comment": "Malware payload (Formbook)", "value": "9416cf9bce8ee79e68457b114b9f55e6752dff6867cfbfd23c53a53bf13a9a5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622566792, "uuid": "d0e93f59-f566-4bde-beb7-3daa4a29008d", "comment": "Malware payload (Formbook)", "value": "9b67936033f06704e98c0ecbc54735c4cea127c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622566792, "uuid": "57e6102e-ef39-4ba3-94b2-7928073b9261", "comment": "Malware payload (Formbook)", "value": "49fea509fa9c1376ff79f2fd1d762e2f0a91b3167130a36dc5479acaaf6c8a1e9c775652b703a973add8855a7f88aad4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622566792, "uuid": "89acd070-9e0a-4e07-b5c6-b05dadd77e60", "value": "F4355AF4FD59B8AAC14ED731B25098FDD7631DFA018A4BA906A7FECD5B0334A4B48481", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622566792, "uuid": "500e4b64-7f76-45f7-8641-b05a2abeeb73", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622566792, "uuid": "8b453867-2fc4-4cb9-888d-3acf8777a7f9", "value": "24576:APY+brT3w+DQ4ujbpwC1aEj7cIvxq4CfLc:WYADSfpwC1ZfUFLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622566792, "uuid": "760ab44f-4d91-4df2-9d96-ecdd61d2250f", "value": 1095680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622566792, "uuid": "19fbc0e8-9431-4bde-be5a-da870f827f9f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622566792, "uuid": "f6d70100-401a-4882-be7d-d36926a33622", "value": "Payment_Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9d5e948-c2d5-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622550984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622550984, "uuid": "77b576e8-55dd-4239-842e-b9e74c9217e1", "comment": "Malware payload (AgentTesla)", "value": "94d95a90db3d08e39f50da1ceab6a822", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622550984, "uuid": "1dcf9aef-3b3a-47eb-91f8-c723396563fe", "comment": "Malware payload (AgentTesla)", "value": "946ce73d2cfd1cb09ec17f2fdd637ea44deef62248dbb1c57f6a158a75bf6c29", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622550984, "uuid": "2d8977f5-6251-46e2-9dc2-87678185fe93", "comment": "Malware payload (AgentTesla)", "value": "842e47320fcf74bdd9d741167db3abc513af1674", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622550984, "uuid": "5ce48118-98b9-45d7-b37f-06f58a943ed7", "comment": "Malware payload (AgentTesla)", "value": "478f174ee2b9dd09d6d470ecbf12c94f575900205b46e73f6060d412b1ceec283fb6810d930490d78c17d4cf1552f52f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622550984, "uuid": "1c3406d5-23e4-4c7d-8792-e4e1e64654dd", "value": "30C4016032A88B18F4BE87F55130A11013B5B6BF3466E70D9ED2B2DD2E36F5087A4E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622550984, "uuid": "0f4b359c-8b67-4db6-b3da-c189fade92fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622550984, "uuid": "9d5fdb4d-372a-413c-8c48-572a8ff6752a", "value": "12288:IovSW4q5X7yaFsbSmb9pqkf6O2XfUG1a99K3fA9ALySE2:IESW4YX7yaFlmrqC2XfUG1YK349TSL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622550984, "uuid": "406fee25-4a0e-47df-9226-535a8b9b76a5", "value": 567296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622550984, "uuid": "67315599-5c2e-447e-9ee1-53778c313c2e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622550984, "uuid": "b9e1dde0-25bc-46de-a2bf-054d670b85ac", "value": "INVOICE PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85dcc4c2-c2ad-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622533609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622533609, "uuid": "cd8dca47-8cf3-409f-ade1-f6b5eef56f49", "comment": "Malware payload (RedLineStealer)", "value": "b3eb11aa6b722a1e0bc280cef2dcec3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622533609, "uuid": "bbecc908-8f9c-4f4c-987d-4da9c70b6fcd", "comment": "Malware payload (RedLineStealer)", "value": "971fbe867e2548d5d0261218d418128db71f67d0cb0aea0bec55c34296442d87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622533609, "uuid": "6ab32e24-4d72-41d5-8992-c2eed70ce259", "comment": "Malware payload (RedLineStealer)", "value": "9c3ad8284f90a49cfe70813d21f6bd31d66ea7e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622533609, "uuid": "c17c86ac-16ad-475c-9fa3-46bb77aab8b3", "comment": "Malware payload (RedLineStealer)", "value": "00c70421e98dc413051872d61ef896c7050a41437a8fa1635cd6f8245c05cbddc4cbc421e858a77eb32dbbc8f5bc7f2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622533609, "uuid": "2319d4cf-909f-438d-967b-f370b23d806a", "value": "9D849E10B690D035F1F336F44AB792BDA629BDE1E72450CF62D4AAEA56346E0EC31707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622533609, "uuid": "63f04d6c-6d28-4440-8879-d53ae5bb3c84", "value": "2f20facc3edc1d8ba24ede1f07abf090", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622533609, "uuid": "be6e6ada-e9e2-4e2a-96b7-133cf7ea3dad", "value": "6144:FPkRbg1ueejPFYP/yqHaB0yAPzZQROh1/LjCDHPF4DbPzUgd:FPg0ojdeaqHxyiZHljCDPaDc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622533609, "uuid": "0db07474-a697-4052-96b3-275233b520a8", "value": 397824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622533609, "uuid": "d9166d9e-bab1-4b05-b0f7-3ff12640d80e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622533609, "uuid": "449e491a-ee35-44d2-9dd3-5b706cd76a55", "value": "b3eb11aa6b722a1e0bc280cef2dcec3c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "589fe663-c2eb-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622560162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622560162, "uuid": "cfa830fa-07e8-464b-911f-4922b13fad1c", "comment": "Malware payload (AgentTesla)", "value": "4104abb811f971c6de971943eb47c9b4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622560162, "uuid": "8f68f5c1-dfe7-4b99-a0bf-bfaf73669eee", "comment": "Malware payload (AgentTesla)", "value": "97660b0a53d557551f406f971bada8f0018180ae891ae43eca4965fee9eb187b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622560162, "uuid": "19821d68-955a-4464-853e-164e6971b822", "comment": "Malware payload (AgentTesla)", "value": "cf42a267f84839e30ba40875ddcb72e361117ee1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622560162, "uuid": "324fb6f0-21eb-459a-bccd-4142eebdec4b", "comment": "Malware payload (AgentTesla)", "value": "56fd67a16aa11a5f88aba10d4af0af1da950953d6cc2c66bdd2ddbc276ce6c785ec17b580f920c55c52670ff3a196094", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622560162, "uuid": "b17ce317-9b4b-4051-819b-f1dfac7f56f9", "value": "DCC4F1B136B88B18F8BD4BF4023160801776BAAF3556D74E5ED171CA1E32F918BA1E53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622560162, "uuid": "7a60e76c-bfac-4c41-a168-534335bd6251", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622560162, "uuid": "16c7eace-e87d-4010-94df-bf5a5c9774e0", "value": "12288:uKvHWfGFcfwbLAocaYHeuF/ofM3WJm7h+eX7rgAPINdf/071zte:u2HWqw6Lu+u+fMGs0+rgAMfSte", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622560162, "uuid": "7280000b-28e4-4463-bb07-f3aafbd59b87", "value": 573952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622560162, "uuid": "169fe9f8-6133-46c0-b1c3-ad116593b1b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622560162, "uuid": "19e86e90-8956-4e36-a830-7498272a1d94", "value": "Quotation 56302.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40abaa25-c2cb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622546378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622546378, "uuid": "dcf64f7a-5b9f-4ad7-bd9b-4fc5838d5eda", "comment": "Malware payload", "value": "c7be836a18ab2f136955800e698254a0", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622546378, "uuid": "96c0d283-9cfe-4e92-93f3-d90be448a32c", "comment": "Malware payload", "value": "97d1c8d5cdc6a75accc14c9df6e588c8c154e20488feeef2d542d7268a45903e", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622546378, "uuid": "119d7ba7-0244-4349-9fa7-468770de423c", "comment": "Malware payload", "value": "42d412d0dc4665d6689d86be05aad85949f84fc4", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622546378, "uuid": "c410f695-4dd1-4284-8770-f37a618ba88e", "comment": "Malware payload", "value": "e93b9e818e5f758f92299edd2ebe3e85aa108e2369dca4f9df3f8d281374ce1c3d8268584b7c97ccc756603fd79842fa", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622546378, "uuid": "e8aba186-e414-48de-b774-c0088a241d58", "value": "6CA3F13113FE522FDF418E73F4C9116BD06F092A9BA647462C74E295235FAC3DA79282", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622546378, "uuid": "8e7a92c9-c8f6-47a0-9c60-1e688e230b38", "value": "3072:IDGWiDNSo5+XklfIzQf0FfitRE6xXOpJd/Wr9Ei2:OiV5+XcIcf0FfitREiXO1urS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622546378, "uuid": "8064f83b-9e13-4b03-a69b-5df0b5806287", "value": 104886, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622546378, "uuid": "feb674b7-14ba-4059-abe8-c39bdb6f7e23", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622546378, "uuid": "26c0e221-1f59-4b93-bc11-11a603984edf", "value": "job_presentation_41118.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "091abb1d-c2ce-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622547573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547573, "uuid": "b760dd06-6ba7-423a-8c0d-fbe0568813b7", "comment": "Malware payload (Formbook)", "value": "958b46473acadafb02ea38355ec436c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547573, "uuid": "bca44cbb-b968-4fe8-aecf-03a9c1df4e20", "comment": "Malware payload (Formbook)", "value": "97eac548a519771c90d729ee721eaa2519782e6aa0dbedc9cef35e938f68858e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547573, "uuid": "2fa6f44a-a61b-4073-87f6-182f1b11428b", "comment": "Malware payload (Formbook)", "value": "708a8329bcadbfc20e8172f8d3aea91a252e4939", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547573, "uuid": "fada1e38-47f6-4087-bddf-aa847e3580d4", "comment": "Malware payload (Formbook)", "value": "0d55455dd0785c8d76b948c9dbe5688a5f9e4a79aa4d6ac7d2adf349edc3b22384efc2bba6f74fa1db334251231ccae2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547573, "uuid": "382e7c0a-07de-466e-8f53-d61573193f20", "value": "36358D642BD95644F5BFE7B449F2807103FA7C925221C99CAAC43C883E737C6C99E729", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547573, "uuid": "4cb358b3-81e6-49b6-a1a7-4d11d27c771c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547573, "uuid": "bfc5e195-8d2f-444d-a787-fdfafdf7f213", "value": "12288:xQ6ZlNs1rg16By57+54K6NbwZ9YyzQEHJRL0e5C7IpVhUAT7jplygsBIQh2CAJO9:xzZlNs46By5d+zzxjLD5KjUpU0fO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622547573, "uuid": "fef25e39-26d7-4207-a9da-ab84e92a2d57", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622547573, "uuid": "83f23a0f-797e-42c6-b511-d079fdba0e32", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547573, "uuid": "719c6805-c9b9-4550-a87a-7a40b3642871", "value": "SecuriteInfo.com.Trojan.PackedNET.790.3409.21765", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eb9f80d-c2aa-11eb-875b-42010a9c0053", "comment": "Malware payload (TaurusStealer)", "timestamp": 1622532121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622532121, "uuid": "c6db2523-88ba-496a-ac16-bf306817f848", "comment": "Malware payload (TaurusStealer)", "value": "806697436f2d3569cabf4d43606f0a9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TaurusStealer", "colour": "#FC255E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622532121, "uuid": "a3efa510-6170-4310-bddb-32a67b93ca2a", "comment": "Malware payload (TaurusStealer)", "value": "9934672222ba1c499e60bd3838783c433f10cea9be633cb9f6de7eab3c0db865", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TaurusStealer", "colour": "#FC255E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622532121, "uuid": "79587d2b-367b-4a09-8036-3eec85a513d5", "comment": "Malware payload (TaurusStealer)", "value": "e1713da12db7873d8682a4ae50bf570b6cada9e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TaurusStealer", "colour": "#FC255E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622532121, "uuid": "4b64d2ce-9880-4012-ab74-3eaa836fc9a9", "comment": "Malware payload (TaurusStealer)", "value": "3b95baeb3c5e61b735ecb025fa239bdf09544cc726ab7be60c17f7c1f73c58a6fb8fcf13e3d465b84ed1229cab45c920", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TaurusStealer", "colour": "#FC255E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622532121, "uuid": "0083a460-6097-4d31-b96c-2e584ca34b44", "value": "A6A5CF2A2235EF26C394AA748BD3D63F1311EA237121379F1ADE1B6662471367C4137E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622532121, "uuid": "5ff3e3cc-b47f-4a6a-b228-64d93f2086f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622532121, "uuid": "bd66fed3-3c68-4d32-8690-deb2faada06a", "value": "49152:dwT8pWP8jI51U20AB2bG9+/kY6FIiKOU:dQcI5+2j04skY6FZfU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622532121, "uuid": "69c2b84e-b868-406b-bb39-d960a37f8321", "value": 2141696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622532121, "uuid": "9154befe-d89f-4018-a85a-5d2b5f24916a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622532121, "uuid": "3a40d798-8498-4006-b0a7-a2ba3cc6535a", "value": "806697436F2D3569CABF4D43606F0A9F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6fd4d98-c2d8-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1622552214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622552214, "uuid": "fbadc328-3ad7-41e3-b5cb-20c99bc1ba30", "comment": "Malware payload (SnakeKeylogger)", "value": "bf8f9cbfbd259e71dcb7d4bd2173ef9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622552214, "uuid": "9469eee8-d90c-4085-9527-97705d9e7058", "comment": "Malware payload (SnakeKeylogger)", "value": "99c4e230e968a95c2f008b91cbb60998d21585ad7db8e93281e1ae24c2d10720", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622552214, "uuid": "f892dfc8-ad7a-403d-9a5f-839a7d33df54", "comment": "Malware payload (SnakeKeylogger)", "value": "5ced612ab29b75c9d77ce46b92203dbe813a5bfa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622552214, "uuid": "ed3cad39-3571-412b-95c9-782474ba4a8c", "comment": "Malware payload (SnakeKeylogger)", "value": "215556d101c941098ad6f78792d360d26ca1cf1443f9e9c484a0fd50a27fbd0644fd151e47415e57afc2ae16a546ffa2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622552214, "uuid": "221878a2-72d5-4a1d-826f-1973de9097dd", "value": "59F4D136329A9FD5D33E93B88090D4B303F1B5B7EB23EB3D6E94A0895991B40CB11675", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622552214, "uuid": "7f62258d-228c-47a3-b82f-469ed35c7e6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622552214, "uuid": "3051de1f-7f91-4692-a79d-ac213f6758f9", "value": "12288:RswTF6N9WRTNjsnDNb4estZd9uTdSxlfen++LzJSz8ncBjRMZiRK81CTt:qRWKNHOZXuTdiZYtSAUO+K81CTt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622552214, "uuid": "d71c5064-eb4f-4b80-8562-f9126bb5f2e7", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622552214, "uuid": "598f5217-0677-4a07-b067-9d3902e016d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622552214, "uuid": "93ec46af-0127-4538-b57b-33d6bc27249c", "value": "INVOICE AND PL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0b84901-c2bd-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1622540660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622540660, "uuid": "1aabf16d-6e03-4dbd-9149-c29438c5f25e", "comment": "Malware payload (NanoCore)", "value": "851389f4e368f1405aab9077cfceb04f", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622540660, "uuid": "9a839937-b6fb-4001-9889-e07095742a14", "comment": "Malware payload (NanoCore)", "value": "99d776c83c23f8f267fb1c2a0d2ca21b1f8d991b4f42bc5b8696b4f88a161677", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622540660, "uuid": "330d0e97-a5a5-4ec0-aa30-9be3632f97f1", "comment": "Malware payload (NanoCore)", "value": "4f0e3128ebbd4693d277745603c44ab4108cbc81", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622540660, "uuid": "7f12a8f5-2826-4a46-8b34-4cc5077eb540", "comment": "Malware payload (NanoCore)", "value": "cafa93d58b5aa4f7f6521e1934f4fee76e4f6d3b8e7966b3677019c125f03e26bb505c9adc683f1a18454830add991a3", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622540660, "uuid": "de8c6486-27e8-4aed-a01b-5d1cf7942694", "value": "B6E4335FA927F8CF6AE7E0B821DA971FDC9A74736FA3401435094948E07787D8B844CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622540660, "uuid": "177c9f98-a7ca-43c5-b00c-058e266c28ed", "value": "12288:zgYPtbif1gB22xxcYHkzZyoVLoJfNkrF3Ne8z94AphF6iq/jpXXPY:EAtbMOB1yYHepAfN6pNeK94ApRq/VnA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622540660, "uuid": "b633bb04-4fd9-4994-a8b6-b362c59b6cc4", "value": 680902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622540660, "uuid": "9bee2774-2dde-4fce-9cd0-dd6c36700422", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622540660, "uuid": "1df0df10-8c6c-4bc3-ad0c-9972621609b4", "value": "Asif Professional CV.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67f374af-c2c9-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622545585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622545585, "uuid": "a1765ba7-bf85-4d55-aeec-e6b2bf6dab9a", "comment": "Malware payload (Formbook)", "value": "600a9bfff38e3949762d34448a2d1fb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622545585, "uuid": "11e75e64-dffd-4f47-85b9-44f8fd222b70", "comment": "Malware payload (Formbook)", "value": "9a3652f2ae0372d7ebf9a4f2002ddf16d1e11c70fc623df581a117deddf6542a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622545585, "uuid": "2fd6e7c0-c24b-4da4-87de-e8ff5d0f36dd", "comment": "Malware payload (Formbook)", "value": "7747e239695b64c3f89178fc562426cf343900e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622545585, "uuid": "21c7c5f3-3b6c-4584-a1c3-98166698b794", "comment": "Malware payload (Formbook)", "value": "e7bf1b40811998eb0a3a29554c9e360ea0f1053cba9f13ecbf2cdc3130af0cb737476706743ca7570cad10d622528dbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622545585, "uuid": "6f57e496-5ef8-4ab4-9079-6eac50a428bc", "value": "BBB40203FA95F877D8DD247BE420E1615D7E3C728268598372B89F5C9C6A0E18B3D293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622545585, "uuid": "c6af56db-96d0-4792-b659-f332bbb3f5d6", "value": "6349db18596ebf564d02723a6dfdc378", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622545585, "uuid": "33d28550-c534-4202-bcd4-78915fdf7b9c", "value": "12288:lbh8bChcqY+o64lToacqVTfsh9hVYOaEAItLt:cWhcj+o64lEapZsh9hvaUt5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622545585, "uuid": "6c5dbffd-55a9-4df6-9865-81027f064f19", "value": 517120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622545585, "uuid": "72670ce8-80b3-41c0-9b32-4eaf947946ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622545585, "uuid": "6e159e23-2f4f-4171-8ec9-c3b9b6188710", "value": "Neworder.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ff079c9-c2ce-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622547746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547746, "uuid": "0dfa2fc5-f77f-4a97-afb9-4ade858ead22", "comment": "Malware payload (AgentTesla)", "value": "bf6117d4fad0497d063372f909130b52", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547746, "uuid": "51b5d4ef-b0e3-4b19-8c63-d2e79193afe1", "comment": "Malware payload (AgentTesla)", "value": "9aaebcf0df8cf361b10e071e4feec5c859dd110c2f5be32a1154442d8106f274", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547746, "uuid": "2b7a0fe5-c357-40ed-9e83-1da5a73d74e7", "comment": "Malware payload (AgentTesla)", "value": "676879a15ee2b560ef118b3817ee28ecf6980fc5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547746, "uuid": "ea77aeb3-a00b-4622-80ef-77c8b050857f", "comment": "Malware payload (AgentTesla)", "value": "d618eb8068bc716db88233c13ffdb90b32f0b623c05d71f457a8a62151e3023acea5b51e6b3c52e250ab73c37189d03a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547746, "uuid": "4c71c972-9e41-44a8-bf52-7f56ac6340dd", "value": "3EA414B4F0B716E4F14BC9C429A8FDA50A3239F3E8CA1931137C62449FADB946E5944F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547746, "uuid": "482384ad-bc14-45b1-8171-4f82c3719b76", "value": "6144:mRdZLsMCMpPeJujdp6vfbRFFVLv4c1CQWhfkC9w3i8:SLsMCMpmJujd0bRFFVLv4c1CQnj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622547746, "uuid": "7ddfd2bd-8b23-4803-b533-72445db95fb5", "value": 482148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622547746, "uuid": "9cdcc68f-ab37-4156-9a3f-dad79ab27109", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547746, "uuid": "b7a57cca-3ce3-4dd1-a3fe-fdd780fd06a4", "value": "22.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59eae635-c28c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622519362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622519362, "uuid": "fa01e88b-c2ed-44fe-b66a-326e8145cca3", "comment": "Malware payload (AgentTesla)", "value": "c8ae2567b77ac2e57d65a33b08abd848", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622519362, "uuid": "e4d64349-960f-44ac-99a5-541613622c8c", "comment": "Malware payload (AgentTesla)", "value": "9b4ad6f6cbd7d9d058d41592162db3a3766f6111ae02a83c58780efaf929068f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622519362, "uuid": "6b085489-64cc-4a96-ab14-af78ac8f9075", "comment": "Malware payload (AgentTesla)", "value": "91b5b99227ebb5665c55a21ab31544f96d6a35e9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622519362, "uuid": "5b7f1027-fef1-4de3-ad4d-6a18092a7d3a", "comment": "Malware payload (AgentTesla)", "value": "d8531cb9a2db716487a2ecf850e4cf2e68516022d867d9f2acb7f42d79664f0f63f2ae31166f209fb3744c6d718f34c4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622519362, "uuid": "0a30372a-9688-42dc-8f28-b85a36ecd960", "value": "0E05E131129A9BD4F6BEC7B840A499B303F4B5E3EB06DB396D9850D81491B80C6D277F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622519362, "uuid": "cf47ef4a-ddd1-4705-8c1e-973cb3d0fc85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622519362, "uuid": "ce18a8bf-7cac-4f54-ac1b-5e9b3e0b5009", "value": "12288:8kgSMs4RZJb6NUroqaVyrK+4SnQYtEYGiFVBGhE8pLTnQJbFk6fs1iG0DcBfKkjK:8i45HrHnH4FYTxGa8pHQ126PDEiW6Ut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622519362, "uuid": "4839f002-9a0d-44bf-984d-5c9c11d5da9a", "value": 865792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622519362, "uuid": "d72c2e68-1d70-4a23-896e-0a91a2895a6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622519362, "uuid": "9711260e-06ec-4920-a2bc-b6d8d0bdb8d6", "value": "SecuriteInfo.com.W32.MSIL_Kryptik.CYQ.genEldorado.20394.24337", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3e67417-c2b6-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1622537605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622537605, "uuid": "30038278-ea6d-4ad2-a106-b009d9224f9b", "comment": "Malware payload (SnakeKeylogger)", "value": "1c4c0a15f1b28ebf97a87896dde1eb64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622537605, "uuid": "cc082b30-20da-48df-bcaa-e8cec4b6ad8e", "comment": "Malware payload (SnakeKeylogger)", "value": "9b8215762bb6f3827f0b021733408caca180b0d285b0f79f0c091c62a495756c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622537605, "uuid": "15bb826a-4aa8-4f56-a76d-eba56ef0b9c0", "comment": "Malware payload (SnakeKeylogger)", "value": "37456316b9347db2fd986d712d885dd426df17dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622537605, "uuid": "e69e7cf4-90c5-43bf-8517-7b4751e730fc", "comment": "Malware payload (SnakeKeylogger)", "value": "46ffd54f811fa919c818a8144b649cc41268846262826aebd354bdb0c8a6a62641ce9b2bd5bd0e4c7f3e8b03b3379aaf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622537605, "uuid": "b9c85fb6-2809-48f6-8c93-ad49e291aa86", "value": "A524E009A797C162CA870EFBE5E7E5F946F19F406D47885BA0043E0FB23338A6B50716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622537605, "uuid": "d500f18a-533c-4511-a2fb-b2b528817ffe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622537605, "uuid": "ad58bb37-2511-4d94-8008-b87650ec3c54", "value": "3072:6KvO/bIeaTgTUYl7xJISpKWhFleaCG/hmP40txsg9QdseKpHK9jznQ26t/vAI2yu:6KvOD6k99CahFgk8Pd+g9SQK9rKoIEL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622537605, "uuid": "e56b9d44-3a45-46e1-af40-00eca78e4306", "value": 221840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622537605, "uuid": "619a5786-4441-4752-8c4b-a7adbf6de667", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622537605, "uuid": "fb1e9a14-6a62-4d35-9c57-abd4712de0d6", "value": "SecuriteInfo.com.MSIL.Kryptik.ABEZ.13975.6966", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8458889c-c2cc-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622546921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622546921, "uuid": "04b2fa80-b7a8-424c-8b04-045a9db97973", "comment": "Malware payload (Formbook)", "value": "d2fb2971a57e525d77780382d36881b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622546921, "uuid": "a7c1b78f-e316-485f-a73d-f23514003ad2", "comment": "Malware payload (Formbook)", "value": "9c1d6191badf084113871feba0049fac8a2bb5761136877383579cdcf7cd781a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622546921, "uuid": "9d86d73f-d88e-4664-897f-aca18a440a69", "comment": "Malware payload (Formbook)", "value": "e1d66e1948f9914dc867e5e5c7cb48987f075990", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622546921, "uuid": "d2624cea-b515-4697-a46d-ede366a2cf17", "comment": "Malware payload (Formbook)", "value": "d410fa2a787ab9d7b64012b29ffb75354ecab70e2fd945e48c8766ad7a8a7cf291bd3012c03778d20bb0696086799e8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622546921, "uuid": "852f3fda-3397-4dd7-aeca-61853a8c4399", "value": "0A34121E73E089EBD2934A75CE27EB39D3F792400702785F47B52EA758A26C2C9165C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622546921, "uuid": "5afe84a2-71bd-47ec-86b0-36c77db1ddb4", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622546921, "uuid": "9a28651e-45f4-40cc-806a-75c25a6c8910", "value": "6144:8Qq+MyG6Z+ecQFrZ1/XS5u9vFf3zPy6gmSrp:TA6Z+erPvmu9NvTyrp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622546921, "uuid": "c0aafda9-1a42-4dcf-8107-00d1cadff434", "value": 240314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622546921, "uuid": "9d2c01ce-e9df-4f71-aa15-5f91006ce611", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622546921, "uuid": "c6909e08-62ae-44ea-b39a-50364fc8297e", "value": "r8903321c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "237086f6-c2a5-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622530008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622530008, "uuid": "4f74b2db-d2d5-4f59-bab2-bce0042031fd", "comment": "Malware payload (RedLineStealer)", "value": "b4fe9844fc91cc3619b50acf562fa572", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622530008, "uuid": "b89d44e2-1f0e-470c-bc6f-44d7d3d7c05e", "comment": "Malware payload (RedLineStealer)", "value": "9c57d0fc5a49debe9dbb49bfebe011bcf249542f6bbd4eefd41c75c3b5ff7d51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622530008, "uuid": "ec38c8d3-d25a-4911-8165-b6e02f92991f", "comment": "Malware payload (RedLineStealer)", "value": "0f50d72f74aeeed2ae4037f4d95efbc04c7dab4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622530008, "uuid": "43b17703-a639-4309-b13a-328c2eed43d8", "comment": "Malware payload (RedLineStealer)", "value": "7520d29235eaaa1f87e7161d1e07177fb61973fffa46b9295fa0a15968f8b6611e43a8e7ca50af812996e64a92360e7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622530008, "uuid": "5cae4a23-3735-4502-9ebc-f6ac4e59c5d9", "value": "CE849E10BB90D035F1F336B44AB792BDA629BDE1E72450CF62C46AEA56356E0ED31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622530008, "uuid": "1ca058e8-ae07-42b8-b61f-ba3154fbdf7a", "value": "2f20facc3edc1d8ba24ede1f07abf090", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622530008, "uuid": "aa1f49a7-846f-4ef7-9dd6-65b44fae3ef7", "value": "12288:aAJ0ojde8qHxyiZLLVPd/roiic9OmQZ3H:aAre8qH5R5rDidmOX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622530008, "uuid": "9359abca-e0a8-4bed-a294-69cc25ddedb8", "value": 398336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622530008, "uuid": "1e983225-323c-4150-9bce-f83a529fd37e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622530008, "uuid": "9aa3f6ee-2e9f-4f16-a054-324764af1a98", "value": "b4fe9844fc91cc3619b50acf562fa572.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cda43dfa-c330-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622589994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622589994, "uuid": "84b69f08-9fbb-4337-a114-7f9eba7670ff", "comment": "Malware payload", "value": "4b61ef9f7ade869a41f3dc2fc387ff3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622589994, "uuid": "5bf56f3f-27a7-46c0-8eab-0478e3e4f56d", "comment": "Malware payload", "value": "9c90f3930ed5151870991ec5c5555181b4478f2ab41a20a0f77f0ebe49c2c4f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622589994, "uuid": "9dda97dd-b71f-4930-9c60-477b2877c66c", "comment": "Malware payload", "value": "2de8aa0b6599ee040b045a1f8ae98699d2b5ef0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622589994, "uuid": "ff28f5bd-9071-4da0-af2a-a1393bba4718", "comment": "Malware payload", "value": "3278e3a48f0613945eaa82def558bdc6b3e98b3f2900684efdc7b96109bb6fe33ea6818882a1255be1ccd0606b1734e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622589994, "uuid": "f4278f71-cf28-4ed6-a480-fe59fbd879b3", "value": "BF35CF306A52C038F4FB61F857A9DA38941DABA0771C68CB63D55ED9D6385F8AC3021F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622589994, "uuid": "2c528b30-3855-4cb0-866f-d0cd6deb884a", "value": "60f1da2d26406f6f3578f73785af8e9a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622589994, "uuid": "4288b9a8-9820-419e-b914-d18fa478d4cb", "value": "24576:ozwRYs/K7ziuKU4j9MvDkwosOnjcVZCTbxAMLF4WI:ozwR1/KX/aADkjjcCJLF4WI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622589994, "uuid": "e14a6ef3-cf8a-43c0-b9ac-6a02141f7e0f", "value": 1103360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622589994, "uuid": "3ba65e2e-4537-4ade-96ef-169767edddf6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622589994, "uuid": "2dfd108a-2c9b-46c5-9395-e3c3c86799a6", "value": "9c90f3930ed5151870991ec5c5555181b4478f2ab41a20a0f77f0ebe49c2c4f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1723d403-c2ae-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1622533853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622533853, "uuid": "6405828d-ca4f-4976-9311-3bbaab3c89ae", "comment": "Malware payload (RaccoonStealer)", "value": "e547317c7c8b33e16f2a0b23f7790915", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622533853, "uuid": "ae51ed7a-fcf9-46d7-b397-bf91f6f4d794", "comment": "Malware payload (RaccoonStealer)", "value": "9d03f0739a3840f5461af1d6ffa96a34c8a0df1b428b58825d95fe3a43a55d92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622533853, "uuid": "48c898ac-6130-498c-84f6-cb9602862e13", "comment": "Malware payload (RaccoonStealer)", "value": "bebc66726f0c51243c789b7783893accf7734717", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622533853, "uuid": "af539985-4dcf-4b0b-85d6-61432a45271f", "comment": "Malware payload (RaccoonStealer)", "value": "a838c34d252041b601dabee2901a2e45ffb954146c1021569088f668b4493e617702718bfee4d0fa9b847ba2d5e4542e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622533853, "uuid": "77b72874-b3ae-4428-9fc2-1c3450aa4e42", "value": "5365231177C5C9FAD18141785C80B7BA24AA9E260B509EEFBBD43B0F1B337C2E539649", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622533853, "uuid": "56aecd03-c03a-4263-88c3-5838b54a2538", "value": "011a034751880c1944da3b5ecc18520d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622533853, "uuid": "865e73e9-edd2-43d6-9bb4-792edf1a84e3", "value": "24576:e9btxEOqJ7X7agBge3wKSa95hiZekBVhWiBI/otvP/II83Mdxy0YLCQjVGFmrsh:eNNarWgBRDSc5hi7Vh3BI/cw3MeLCph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622533853, "uuid": "bcd26f3b-d408-4814-b10e-4212f5b32a11", "value": 1439810, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622533853, "uuid": "65a97d27-f723-447e-8c5a-5c93f4d94293", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622533853, "uuid": "ad4bad0b-f635-4f22-83bd-c42afa347f42", "value": "E547317C7C8B33E16F2A0B23F7790915.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f8b74bc-c301-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622569623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622569623, "uuid": "7459a8fe-2ae7-486e-9e39-afac66fb1cfb", "comment": "Malware payload (AgentTesla)", "value": "a68e75b82ae97115dd765457abb6aa0d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622569623, "uuid": "20499124-84a2-42af-bd4d-66d5d5ddc98b", "comment": "Malware payload (AgentTesla)", "value": "9e2b806476de6e81da439af49317235a4f2b46b19f57b820987fdff948daadfb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622569623, "uuid": "76b564a3-2c79-4958-80d7-684845f8d3ca", "comment": "Malware payload (AgentTesla)", "value": "5d9b85f4a4e658f83f310d6f47d3e802159fb0ab", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622569623, "uuid": "c666d64b-2fca-47a2-a752-ae3f56433e29", "comment": "Malware payload (AgentTesla)", "value": "93b6562f4345f723d6d2a71e68d82b814640b4286817a234666bedb55d2ff1257eaa65bb8c7601db67f632c3aadf7685", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622569623, "uuid": "47b2e7f5-6f1f-4523-a9c7-724cce52c564", "value": "87158DF4F59898B2D24ECB72D7959CAEEB6102FD1203496C0AB9DACC1B4378E9F4C445", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622569623, "uuid": "e2feadf0-8517-4709-ab1c-963311aefd8b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622569623, "uuid": "2d89dafe-ace2-450e-8a65-c1d8798aabc9", "value": "12288:pSAgMRrhvTcvC12lN04OZ3E/chLSVZLfPWrNvceV34WiTK8BB9:pSARra46/cSbfPW5vdVoxTVBL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622569623, "uuid": "6ccd12d6-e2c0-4840-a4e4-ea8ab16f92f3", "value": 915456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622569623, "uuid": "63bf427a-d0c4-4827-ad39-3b0db4d6d3bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622569623, "uuid": "15c3cc8d-6e80-4b72-b43d-8f1fc19f649e", "value": "Purchase Doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03b1dff8-c2b0-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1622534679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622534679, "uuid": "e60343b6-a1e6-4e54-95c1-e0022a06022b", "comment": "Malware payload (BitRAT)", "value": "bd2eebf121fa09ab93b12a229b9a9167", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622534679, "uuid": "65fbca75-9181-41b2-8107-c955ac570219", "comment": "Malware payload (BitRAT)", "value": "9eaeb836b2d9925ac064bc1007b34b2e3f67048b185b6f94a294624d918c39a2", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622534679, "uuid": "e647851b-4188-4bb0-8c24-3ba3078e129d", "comment": "Malware payload (BitRAT)", "value": "7ee3e0ae24bbf41b276731580e5ca73dd423e95a", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622534679, "uuid": "33aef067-ec81-444b-92e6-de50a79659b2", "comment": "Malware payload (BitRAT)", "value": "e4c5ee37a447f756e8bdb52d0f5a340f2885855bc47e23982f464220fbc9d34ac83c2415b2e556d6b8f92ece8d83ca34", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622534679, "uuid": "7a6e6523-86ab-4b37-a134-20a82f744843", "value": "6CA5330EADDCB401B8E09594325018A779CF1EE6128276E81EF31C7C6FB5D075E29EB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622534679, "uuid": "aede99f2-aee0-4b86-a2d1-98d5e51f5fb0", "value": "49152:mRAnUpeQFnoEOdA4+0LowgTiXeXaqSl/JBQfRvJGCymv7HnF5id:+eQCEOLDEwCiXeXa5JcFJGdmTHn6d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622534679, "uuid": "9ee77de5-6068-403e-9ba4-b3dc7d51749c", "value": 2182456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622534679, "uuid": "43ac0f2a-e053-4d1f-bb3d-e3b28750028b", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622534679, "uuid": "2a1e5edf-e665-4d26-a368-7f9f288d1056", "value": "PURCHASE ORDER.r01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5578dda9-c334-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622591510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591510, "uuid": "4e6419d4-1753-4d8d-b231-1018b09ef6ec", "comment": "Malware payload", "value": "abc16dfc1faf07096ea72a9101aae749", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591510, "uuid": "97229a97-4cf6-40e2-ba4e-ab1a3f8676bc", "comment": "Malware payload", "value": "a098cfa13d7b0a4b12021508c935f2ce7c395a24e8aeed6090e3121ef831d816", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591510, "uuid": "f966c842-6592-41bb-abbe-b34298ec61fe", "comment": "Malware payload", "value": "02014ec63e3023dd3bb22b8314eabcbbc4bb61d8", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591510, "uuid": "fe40f7c5-94b2-4804-ba7a-f622e676e013", "comment": "Malware payload", "value": "c04f0c62af9729900c75b9b9ed067953df5fbf9b3ba3cc00b4970f1a96d89f7aa88b8ec5c19c2e53fac5eddebcdc99e7", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591510, "uuid": "3dcfd057-1f6d-412b-88b5-509a3c2acea5", "value": "0E851301F9EAA706EBBF4E3C1B92804F15573C9EED24CA973149333E71B0B61945936A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591510, "uuid": "6b864531-b1ce-4cd5-bdf6-349a62e00ab5", "value": "24576:kihwsJ6bSYhOnNDdbUB4B9YiI7CvJoNOHy3I9hOTA7i:kihb6bb0DoUYqY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622591510, "uuid": "412ac937-27eb-4925-9458-f9d43088fbf1", "value": 1818112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622591510, "uuid": "7ea31d9d-15b0-4eaa-94d2-17d1d0fef980", "value": "application/vnd.ms-outlook", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591510, "uuid": "b3d74011-3e49-4f20-ab5f-145354d06579", "value": "a098cfa13d7b0a4b12021508c935f2ce7c395a24e8aeed6090e3121ef831d816.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "658a52f7-c2cc-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622546869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622546869, "uuid": "f30d7176-c946-4f1f-a037-9b5763265661", "comment": "Malware payload", "value": "da2126e2cda604526dcde3b43e4d6324", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622546869, "uuid": "8dce4e83-ab81-4512-9936-ede19a67ea67", "comment": "Malware payload", "value": "a0a88617e9a2856010181974fc124915a3e90638c899ac3526597b071944d393", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622546869, "uuid": "f57d5469-c891-45ff-9662-493f8b393991", "comment": "Malware payload", "value": "ee49d4eebca3c8b1e0047647ae790b8e6381c1c4", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622546869, "uuid": "ee6b93c3-65ba-4af2-b8db-5d3968b7f39f", "comment": "Malware payload", "value": "54b7ab934311fc260f052628c7f12e1210a999b68fb1a7baaf1e03e8c4577427573d3c886c2bd4c50f32ecef55208939", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622546869, "uuid": "d4fc6bb4-7d25-42b1-a208-801abcb6f020", "value": "82E4237179F058129FD8A38D85E9F0A8B709B13BF515DAF8DC63F8B0E9041A670DA361", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622546869, "uuid": "cf376fd6-23fb-48ff-bc1c-67273add4024", "value": "12288:jvhskobLeqfZMvuzSOP9W+FZENbhC3bALFyhSj/w6hdk6CVKvhO:DeXbLegRuOP9hjobAgMSjo6hK6CehO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622546869, "uuid": "1c19c976-6752-4a06-bc4a-04728fe1d7b2", "value": 702560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622546869, "uuid": "3faac48c-e344-4bbd-98ed-7d4d885ba4d8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622546869, "uuid": "475f0324-d5b1-42a5-9d47-10e8849b64d7", "value": "RFQ-14000135846_Scanned from a Xerox multifunction device (2).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad15370c-c2a3-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622529380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529380, "uuid": "80b66935-cdfd-4258-a1cf-31b7c8a5ed21", "comment": "Malware payload (Formbook)", "value": "ae9eded43ddbdd67f0e47a4e7e3c4732", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529380, "uuid": "88510e49-845d-42fb-944e-0b408d1d0f5e", "comment": "Malware payload (Formbook)", "value": "a3bd048ef9380fada8db051e46d9ef46c8fb8d5c4780474f1667962dd682147a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529380, "uuid": "0c18b584-12e9-4c9a-982a-a23b2783e849", "comment": "Malware payload (Formbook)", "value": "b213f9d3b44ce0a603c842bb7ac290742f2582cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529380, "uuid": "db800d06-81df-47e2-aa34-bec2dd132d4e", "comment": "Malware payload (Formbook)", "value": "934b110d9fc1f03122ea8101d56e38ca55b99ddc5a4abedf068f4c37582f40ebdc465e357a4d2ae981cb3dfec15fa302", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529380, "uuid": "f9089b35-d455-4038-ac05-52f3edf313d2", "value": "AD75CFAD3250B6DFC917CE76CA949C64EA61B4B7970FD213A06311DC9A4E69BCF100F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529380, "uuid": "24e6107f-c106-4758-ae0f-1ff13fe31a66", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529380, "uuid": "1038f3bc-194f-4b21-9cf3-b22b8c952892", "value": "24576:XbrrCGKh9zNHxQrfV7ZIyU7Q6i8Jv0C8FaOK8PeA+DeXrqTNFI:uGcNH6jBOySQ0Jv0Je8v+DjNFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529380, "uuid": "06cc771e-4b95-486f-80f5-8fe9e245482c", "value": 1688064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529380, "uuid": "4e2f47a7-a902-430f-a222-67f9e37bb2be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529380, "uuid": "f3a1ab22-871b-4292-8517-0608ff0d6aa2", "value": "Purchase__Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2847079-c2ac-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622533308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622533308, "uuid": "497649a2-e9d6-491e-a7c6-76a0d69d9c3d", "comment": "Malware payload (RedLineStealer)", "value": "ca4210a09fe14628bf8eaa87a09c34f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622533308, "uuid": "b8374af8-aed6-43fd-a350-4d7e6490902a", "comment": "Malware payload (RedLineStealer)", "value": "a481ea6b643ad753a5538ec13c9f270e426e2a389c78ed9f48a0616f6a69ef4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622533308, "uuid": "01f19a41-e049-4e90-9ea6-625c5a70549a", "comment": "Malware payload (RedLineStealer)", "value": "70495c4080b3c3588ad7554f4d4c7faa2c94e6a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622533308, "uuid": "4b07611f-27c5-4529-a806-b4f57359b6de", "comment": "Malware payload (RedLineStealer)", "value": "6f956841f33a93367f04029260cbe02fa595275ecddc1de8e95b76b608f3d651aa12a1687e7da467fa4ac68397657434", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622533308, "uuid": "42c4e47b-2664-4eb6-9551-d32ee63801f4", "value": "06849E10EA90D034F1F336F44A7792BDA629BDE1EB2450CF62D46AEA56346E0ED31707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622533308, "uuid": "3bee2680-5def-45aa-b61e-606f4153a5e8", "value": "2f20facc3edc1d8ba24ede1f07abf090", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622533308, "uuid": "773b3c3d-9d98-48c6-9fc8-70775b7ba505", "value": "6144:7tRRbgl+ueD/FYvvPamaB0iAPzJuJQZheIJ6IRXAYN73GRM0Cp54P3UPk:7tr04Dt+HamxiiJDhfjHwrW5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622533308, "uuid": "01b51f1e-9f74-45ad-aa1a-a3c34b185f39", "value": 397312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622533308, "uuid": "e461dfe0-5c11-4750-a7c0-d043adcc41cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622533308, "uuid": "dc473f8b-db74-4fb0-9970-8c0d938e9cfe", "value": "ca4210a09fe14628bf8eaa87a09c34f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abd40cd3-c2a3-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1622529378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529378, "uuid": "16c8f446-da91-4b70-b5a5-293e1d4c6254", "comment": "Malware payload (RaccoonStealer)", "value": "bd0e3041aa05db2ba9bf35c6c4f99304", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529378, "uuid": "28d7a1f5-af6b-4e6d-9435-8ea059208238", "comment": "Malware payload (RaccoonStealer)", "value": "a4d2e783e7cc4d889422ec448ddcaadb489cca746a534c7c26669874137f1e15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529378, "uuid": "fad7d766-2e25-423b-8bf5-66db3705b661", "comment": "Malware payload (RaccoonStealer)", "value": "c108a911a3c75c07ddac8e76db143ba9117396e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529378, "uuid": "06e30fb9-d446-45d8-a5de-597c949a4a4b", "comment": "Malware payload (RaccoonStealer)", "value": "3ff24f946c8d565d45ec67ed70f9ed947b29c761a51cc98c76fea825c50115834694f97019780d7313dacd507d935406", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529378, "uuid": "2b0092e7-df4a-4ba5-9419-ed5555bcc24a", "value": "D6C4CF007691C039F5F332F489BBA26DA56ABDB1E72440CF22D56AEE56346F0AD30717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529378, "uuid": "7298d356-ae9a-4249-98ed-34a13ed187df", "value": "99012338f1bbaabe225761bf7cb06050", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529378, "uuid": "e7466790-1dfb-44c0-84a6-a22488863b58", "value": "12288:a35HaFZj1xJ5P2QW0JQCSXdb29Fq4WiR1jFds:a35ij1xICSXdnKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529378, "uuid": "00adf8cf-eb20-4563-a65b-786498a54d1c", "value": 596480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529378, "uuid": "0fcfc9fe-910c-4206-b29a-1058eae958d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529378, "uuid": "f842a7c4-3ddb-48be-b939-3abffce71e48", "value": "bd0e3041aa05db2ba9bf35c6c4f99304.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7ada764-c333-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622591245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591245, "uuid": "44e702b8-21fe-46ff-b794-fa62f3320ff6", "comment": "Malware payload", "value": "600aceaddb22b9a1d6ae374ba7fc28c5", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591245, "uuid": "01c7693e-8c67-4a87-bb62-b73dcf1d33ef", "comment": "Malware payload", "value": "a4f1f09a2b9bc87de90891da6c0fca28e2f88fd67034648060cef9862af9a3bf", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591245, "uuid": "5c3cb19c-5350-41ff-b015-d09aa608ee3e", "comment": "Malware payload", "value": "19a751ff6c5abd8e209f72add9cd35dd8e3af409", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591245, "uuid": "ab1d98ec-ab0b-4c7e-8347-9221d193c351", "comment": "Malware payload", "value": "4112789b3b4328e3c41c3be149184c5252ecb93a41ab6ab24cd931c17724bf2c284f0f3892cf466d90460f71ea1eacf7", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591245, "uuid": "efdd2fa5-8332-4aa7-a3c2-5e2f8ad5bf64", "value": "7454D000EDF4A3B4D85F193805E76612DAAEF91286FCD895E779091C8F301E17EB6227", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591245, "uuid": "9a8a6d1d-b4b1-4e6c-8aed-3f3bd1c298c3", "value": "f53eecd5bf1a2e30ecfbc8b8b3676e60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591245, "uuid": "f3e17bd9-973f-4f89-9d9f-db85caf4ec2d", "value": "6144:wCJXBrPgXOySX4fx3xgGoSqs5OH420QmZ:ZvOSXMx3x1ob/T0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622591245, "uuid": "01e6d5f8-dba3-439e-8eaa-08a023956ab2", "value": 283648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622591245, "uuid": "87d48741-8d0f-408c-aacf-1604ba7387b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591245, "uuid": "5ac004bc-2bb5-4288-804e-6e7eb14f19ae", "value": "a4f1f09a2b9bc87de90891da6c0fca28e2f88fd67034648060cef9862af9a3bf.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47a389b5-c334-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622591487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591487, "uuid": "bbaf457b-b9b8-4462-a934-42b336545971", "comment": "Malware payload", "value": "14515299fb9511643c12e3ec8e1ac257", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591487, "uuid": "0bb48090-5d90-40c8-a5d9-f57afd0266c2", "comment": "Malware payload", "value": "a6a2ef55b2ec7dd247dd2977af27a6acccc3bb69449175b246ea7835b40947a8", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591487, "uuid": "93a25341-68fa-4c91-9883-cc9d3705818c", "comment": "Malware payload", "value": "6e107a71fc6b65a3850465e5cb48a6ae8822820e", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591487, "uuid": "66737a63-1cbd-4859-a7df-5648ad863e11", "comment": "Malware payload", "value": "f25ed75b4639315cbb38c26a678a19b43a01985122a2f01a80bf5963e7648743bee96e0251b18ecd1475abc0fc3d7f62", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591487, "uuid": "475eac95-a625-44b7-96c5-530de9a5e7ea", "value": "0375E1369A11BEC9072D2D018C4F1FD70D2C5AA38AAC9376EE8C116692DDA51CF3D97C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591487, "uuid": "ac07804e-ba42-4877-a2de-45cb7695ec3d", "value": "12288:0ROXV/IoWjsinN8orndcBPwnms5I1kD4Lrwzh:YOXV/I+iN8oRcLB1k8gN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622591487, "uuid": "6cc691b5-333d-45ea-a63b-30115561faf8", "value": 1664418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622591487, "uuid": "ff5dd0f6-583f-4de8-b447-ab4d75dd3222", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591487, "uuid": "97232054-3d20-4097-af6e-da0d63c72ee8", "value": "a6a2ef55b2ec7dd247dd2977af27a6acccc3bb69449175b246ea7835b40947a8.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4549928d-c2db-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622553258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553258, "uuid": "12e4374d-7f39-4729-8896-c6838771facf", "comment": "Malware payload (AgentTesla)", "value": "59f3f4ca574fbd1a872cf8e735ae6912", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553258, "uuid": "b6d2e576-62ec-46f0-8876-3c7b49a29d0c", "comment": "Malware payload (AgentTesla)", "value": "a7c40e554814f511f8a33265cb7fbcf813e5a57f5bb89e66f9e82a45ebfe5cbc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553258, "uuid": "74777148-dfaa-4f96-951e-c50975edffae", "comment": "Malware payload (AgentTesla)", "value": "6ce0f95fd1829c0cd290f0ecc944ec3c92abf0a1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553258, "uuid": "77db21af-6d5f-4cd0-9ac7-bfbe24c9d852", "comment": "Malware payload (AgentTesla)", "value": "00a3d71c262e39e80aac0008bd227b40cf57decb4574dce39601ee3359f3dd330d2a9397fe478ea0fb0d690abdf170d5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553258, "uuid": "ac16feae-5f86-4ca5-9017-6579c488d415", "value": "63455AE0F14898B1EC0ECB31C6B68C6997237EFE6972441D1A6DF65C1B7338A4B59C06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553258, "uuid": "a05a1093-0204-4c36-a0a8-f4eef0247858", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553258, "uuid": "35663284-f3c2-4f65-a00f-f4cbfe47c259", "value": "24576:u5JsrdlsLnkmiRvdhm10EUvrACqk7+Ljr5:u54UnkVJi0EmEC9C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622553258, "uuid": "021fc5ba-9c70-46b9-b69f-e2fddb7db408", "value": 1248768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622553258, "uuid": "919d7754-f850-40f8-9197-2a7d30f13e12", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553258, "uuid": "18647b25-ca80-43f6-9d8e-87b4d6ffa248", "value": "revised offer 67843_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cc66204-c2df-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1622554881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622554881, "uuid": "ea12cd78-6db2-46f3-a514-a9520b37a116", "comment": "Malware payload (GuLoader)", "value": "73f1d754f5b74906061d0c374a1ee1e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622554881, "uuid": "091a1b99-3a72-49c8-a1f9-b8437c0f4777", "comment": "Malware payload (GuLoader)", "value": "a7d94673cc8d4e0826a9a240bd1d161b34bec3bea25c036a94df69240015469c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622554881, "uuid": "0f136a7a-373d-45aa-942a-66b161e0f6bb", "comment": "Malware payload (GuLoader)", "value": "6942961bab54d82a358acacf39c7ad39b00e7e23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622554881, "uuid": "5a12058d-2fe3-4077-95ec-9adda62d849c", "comment": "Malware payload (GuLoader)", "value": "d61995e3222e9b7a1b096b6e3f9fd00521c8e268bd1c80649d559d648fa1160988cd9031a6a88c4ea2d7013dbc54bd96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622554881, "uuid": "a9e4c81f-fcd6-43b1-9e36-7a5177548efc", "value": "43C30FCF65A5AC2CE6DE2EF4AC34A48707193C00AB14522F71C8EABDAB705A17DD1717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622554881, "uuid": "8ff623c9-d0e7-4f53-94d4-8ddccf3ae5ae", "value": "153a31799770099c7b08b378cdd5eb59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622554881, "uuid": "4cb4b579-b0aa-4581-8ef5-fecf3ff32213", "value": "1536:9KNipDQlK8hgRDMGo0WY4lFPa1P4qrt+iKTUGFE:Iflv+g8/aaRt7PGy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622554881, "uuid": "71a7236d-ee17-40fb-b81b-a77835cf60b9", "value": 126976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622554881, "uuid": "ded5f2c5-34ce-4fee-9eca-7898b2ad7e84", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622554881, "uuid": "07e553b1-1d72-42cc-acaf-5083e4896c1b", "value": "MJH.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8bbb482-c2a9-11eb-875b-42010a9c0053", "comment": "Malware payload (Stop)", "timestamp": 1622532030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622532030, "uuid": "ae969b10-2212-4ed8-b604-f77a036980a2", "comment": "Malware payload (Stop)", "value": "5a553df6ee3c2cddd76eac5fcc9a1394", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622532030, "uuid": "3230a885-db9d-40d5-b7d3-590c394f0c01", "comment": "Malware payload (Stop)", "value": "a850c06053e2ac68a1a197718b2f2c42f0ce30af615d39f35456aec79ba85df2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622532030, "uuid": "1c0e204d-d27a-4104-8dfc-882264f3c922", "comment": "Malware payload (Stop)", "value": "c0364b2f6681c0aed903f62c50784d7785492aa8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622532030, "uuid": "8ffe5ab9-6338-4da3-bf3d-6eb6a268ff6c", "comment": "Malware payload (Stop)", "value": "0a37e0fb816d1c059e26bf1d2078cb67728f8191ec11fd67ffa10f84e269bc5c5fe72257446e945022a13e91829807d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622532030, "uuid": "06fea5c1-6c08-4947-9fc4-cf03a1c7353b", "value": "2305F210AB90D035F1F635F94ABB916CA52D7EA2D76851CF62C06AEE27306E0EC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622532030, "uuid": "4679f5d1-71ca-4aa7-9a63-3b3ede2c9349", "value": "24591330049b4c946140004b0755a204", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622532030, "uuid": "b5dbd1a7-517f-4b44-99de-af43f0a0525d", "value": "24576:ammOvY1gRhbnDnsvKCqqF+drDPLXhrioPfvOtXsDMN:aE0tsDhrio/Oj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622532030, "uuid": "59579ad6-26a9-49be-a526-8defd0c28636", "value": 868352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622532030, "uuid": "d1b12b1e-4dd3-4f2e-b8eb-2d6ae7871d0b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622532030, "uuid": "97877796-05b1-4943-bb35-02115d51d7cf", "value": "5a553df6ee3c2cddd76eac5fcc9a1394.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caba3a12-c29e-11eb-875b-42010a9c0053", "comment": "Malware payload (ParallaxRAT)", "timestamp": 1622527282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622527282, "uuid": "755ae1a8-d5e4-4db9-a147-784d1a5496ac", "comment": "Malware payload (ParallaxRAT)", "value": "a67f4fad7dd342600c8ff5e5ede970bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622527282, "uuid": "ce3d854b-a7b7-424a-837a-e1c39c16e018", "comment": "Malware payload (ParallaxRAT)", "value": "a88998b7b275d866ea3aec24b45488299384a2d8e0f2db60447f26bd550856ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622527282, "uuid": "51dbfbd3-3d59-4ece-bcfb-690256cd5742", "comment": "Malware payload (ParallaxRAT)", "value": "e5fb210fab9cceb1a3c674de2aaefbd951ba4e92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622527282, "uuid": "38c4e274-81b1-40b9-90c4-e501636dc67d", "comment": "Malware payload (ParallaxRAT)", "value": "b8107ac734684f250ba750b333929b71f00194236025384bd59442a2292c5263348d017811023e193be9c03a86dc543f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622527282, "uuid": "bd2c0a61-2239-4965-8edc-36815e98bcc6", "value": "01A58E7136406876C1230F30B90DFB7AF16F69FC0FB661C75294AAB8293D142961DE7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622527282, "uuid": "b68b18db-4978-49dc-a6f3-29e821726f44", "value": "1694a5ba33cf6c0c1112f62087671cf9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622527282, "uuid": "4abc9727-206f-4e1c-821c-6c9212a7c5ba", "value": "49152:KEWzRJhI9v5cQ52BEcZ17xatMGOG9pg4AFOkkO6xVzM:KprhInT52BRZ1xatWG9pg4AEkkO6xVzM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622527282, "uuid": "ef2ea193-af80-46da-a1c2-de14588eb70d", "value": 2106298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622527282, "uuid": "35ba2e1f-44ad-4de8-8654-3612d47da8f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622527282, "uuid": "b2b1b841-a3fb-4d01-916f-33c156a90a2e", "value": "a67f4fad7dd342600c8ff5e5ede970bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d2b5ec7-c2e4-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1622557029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622557029, "uuid": "797999e5-5f4a-4085-bca5-400d23f3e9cd", "comment": "Malware payload (Loki)", "value": "6cbc9bfb34f297ea2afd8c55111aadf2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622557029, "uuid": "f4e60fa8-8d58-4d1b-b0dd-ad0a92194268", "comment": "Malware payload (Loki)", "value": "a9b0173e087fa0c22544734ea476afba2ac75d32b22d88abcfea206517dded8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622557029, "uuid": "c54815fd-3a3d-4c69-9974-012553dd889a", "comment": "Malware payload (Loki)", "value": "bc2e26a57cb0caa95c3d1a6cc4f96f4c67d158b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622557029, "uuid": "e8404156-b4cc-46bc-8358-9dddba9f13ef", "comment": "Malware payload (Loki)", "value": "23ba8d7d55734169c67ba3d8ba29b740f1662fabc05ce9a69a52459cd20e02a8cf718f06d25a14035feef4c719b70fb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622557029, "uuid": "5857edd4-b333-48e5-9c10-dce8e172c157", "value": "CFE48E23F3904537C22E19395D4B47A9A938BE317E45ACB73AF97D4C0E3A69138261D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622557029, "uuid": "78277308-28c0-42d8-9861-d41afeb7c641", "value": "449021d3d5fea66598eeba9c93aa4705", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622557029, "uuid": "f065a677-d86e-4729-bdaa-6fef05e9d786", "value": "12288:3kIquSFoM9SJLcThopnxJ/5JKcut4n2O4XP2OzeRtSQQNyAV:0tBvSJLcT2xJ/53cI2OEP2OzaCy+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622557029, "uuid": "13f1cabe-19f2-46c9-8e4b-838d5695e06f", "value": 716960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622557029, "uuid": "db6866ea-d703-401b-9077-e0523e7c751a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622557029, "uuid": "78859e6e-ad09-4d87-8e48-5c6714d141da", "value": "IMG22056512379696.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca547911-c279-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1622511390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622511390, "uuid": "6051dde9-0562-4d67-8702-c9457671b96b", "comment": "Malware payload (Loki)", "value": "a578f5f6e8ed102ce055b6268ec2ac31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622511390, "uuid": "012c5788-4e97-4144-ae44-7c8ff810333c", "comment": "Malware payload (Loki)", "value": "aa9570887695577e03ee3b6dc119e2776ad158e0b9654505cd59d9ed86b61cb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622511390, "uuid": "7d02c124-f79a-4eef-940f-327737e71860", "comment": "Malware payload (Loki)", "value": "7ce4f05425354292b248d60792ea4b22e49c4dc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622511390, "uuid": "7c0c274a-8228-44db-b7b7-6791ffa3a598", "comment": "Malware payload (Loki)", "value": "ed13a55de7697e4a90a89165be3bd49c336cfe6f0d8e48f6d3b82a40f5696d376ab971537e0c00439ed64d962f3e52b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622511390, "uuid": "1b64385a-160d-4df2-9b36-3973c0d0a95b", "value": "AFD48D22B1A044B7C1AB5E389D6A565C943ABD303D14DD6B3BF93D0C6E39781392A3C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622511390, "uuid": "03d418bc-8bef-43a5-bd69-f83fcb3dfc09", "value": "714a3b874a74acaea53440e0df5bf09e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622511390, "uuid": "7c7056e3-7899-4f50-abed-1001a982cf55", "value": "12288:Gfs2jw4dbRgrTzzMg9Leqa4S4i2qlW1HSGfaL7fJj2owk6TpD2HbMFeQ9NyXu:G0UwnrTtgdtHQemyX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622511390, "uuid": "5b4beb31-5be2-4102-afc3-464788fff95b", "value": 654448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622511390, "uuid": "2e968587-7d19-4440-ae5b-d7a96fe2edb0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622511390, "uuid": "685b2a3a-a14a-47ae-bb32-5a741ace4a38", "value": "EUR_odemesi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecd09919-c2a7-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622531205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622531205, "uuid": "978e9d16-cd72-4421-9a18-96618df22c3e", "comment": "Malware payload (RedLineStealer)", "value": "88902d8c1fe48ec25bea48a883980dd0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622531205, "uuid": "ee08b2a5-e6ce-49b6-8f6f-42370eeec066", "comment": "Malware payload (RedLineStealer)", "value": "aac29d1263aa4cd9db1afe81a56218321daf3d610eb972a2365379b71ab5c392", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622531205, "uuid": "8a42c330-6997-4aa1-b02b-b284cfe08e8c", "comment": "Malware payload (RedLineStealer)", "value": "775206cad4504b5947146920f5b1a23d51df97df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622531205, "uuid": "c69b3385-4cfe-467b-b1ca-6a1090754d93", "comment": "Malware payload (RedLineStealer)", "value": "7f0fed92b2018f7734f7c43e0b865ab1151ae3f84725aa146b8cb9cb9e8c02e1208cae003a2c9fb2e0c92f12809553fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622531205, "uuid": "ee649ac5-704c-4c04-9ba2-6a471c69ef97", "value": "79849E00F690D035F1F336F44AB792BDA629BDA1EB2450CF62D46AEA56346E0ED31707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622531205, "uuid": "32185bd8-bf7c-44c4-97f5-c736b6222984", "value": "2f20facc3edc1d8ba24ede1f07abf090", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622531205, "uuid": "3ddfd7f0-aceb-4a94-8456-d93ce343c06e", "value": "12288:ztb0ojde3qHxyiZBN9pJ/Cd4Qi3gqZMh5:ztVe3qHzNPw6Qic", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622531205, "uuid": "d86a28e3-27e6-4bab-8f85-a7c26e658e9c", "value": 397312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622531205, "uuid": "78d04e6b-dfac-4ec9-8d91-d82817f472a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622531205, "uuid": "09ec4b32-94ae-4a85-b29e-64f914b4e26a", "value": "88902d8c1fe48ec25bea48a883980dd0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dd6e05c-c294-11eb-875b-42010a9c0053", "comment": "Malware payload (Stop)", "timestamp": 1622522724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622522724, "uuid": "31091c68-bff0-4edd-afbc-c66bc8ef34a4", "comment": "Malware payload (Stop)", "value": "e3f1494aa7e4ac2820943e4017e3039a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622522724, "uuid": "6f8f4ce4-239d-47bd-9cde-d6c351910048", "comment": "Malware payload (Stop)", "value": "aae53c40087ef59b3bbae319ce4a6894ddb3576f451dfa5d46af57c95614ca76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622522724, "uuid": "1d93f70b-e3eb-444f-adb9-9774b7c67cdf", "comment": "Malware payload (Stop)", "value": "a592157a8901909d843d7fe6eea3bbb5abc3d89d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622522724, "uuid": "07ae980d-d96e-49cd-8e38-74f69dc73451", "comment": "Malware payload (Stop)", "value": "0c56e5b2b3b3f2cdd716a5e652dad6dc5f0c46752ffc9a104f99b2e77ad233e5a68c43c6090fd8fc8d24739cc052a861", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622522724, "uuid": "8b430666-af53-4811-ab6c-2452f7ccaf34", "value": "1D05F100B790D034F1F336B549BB927DA62E7DA2EB6450CF52C4A6EE66346E0AC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622522724, "uuid": "a4b9e7d0-fde5-4782-8de9-0eda462150d6", "value": "ddfa50a7d17fa7288028195442f05ca4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622522724, "uuid": "44d5c8b1-66f0-43a3-a347-b37b74ee47ab", "value": "24576:hjBBbWV88nDqaNoYzzxP3ZEeH6YYxqREMPm:hk88nmaNRztZEeH69W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622522724, "uuid": "77532ccf-a6a7-4784-b7f9-879db49a9e44", "value": 865280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622522724, "uuid": "d2b8ca88-8c74-4749-9e04-5d80bd910ee2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622522724, "uuid": "8db36c14-df8a-4218-ad61-3a1af787ab12", "value": "e3f1494aa7e4ac2820943e4017e3039a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c85c0b7e-c2b3-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1622536298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622536298, "uuid": "3a0febb6-8078-4ee0-9be3-006ded193466", "comment": "Malware payload (ArkeiStealer)", "value": "5cfad779246c0e136f67716f7c933c97", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622536298, "uuid": "28b57653-c0e4-47f2-901f-ded3faf764ec", "comment": "Malware payload (ArkeiStealer)", "value": "ab19f685983e8f405cbbf21303df6582418d0b22f0490cd699aa95c6814ec7a4", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622536298, "uuid": "8ac9c385-fbe8-4c80-941f-05e534cc40ce", "comment": "Malware payload (ArkeiStealer)", "value": "5a20da965b4be37497b9f8cd9c1dfe72b8232881", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622536298, "uuid": "400683bb-0b21-4711-af9b-9e5f43829b5b", "comment": "Malware payload (ArkeiStealer)", "value": "2a28baea49860f9f07ac870c26a45d0c21a9c9bc9e5022ac3fbdf021f2308c4f61d3942fb8dbb6196efb24c4da3b4b86", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622536298, "uuid": "143095d5-a09a-491d-8619-bf0d6edbb3c5", "value": "E305F1006790D034F5F736F58ABB926C9A2A7DA2E77450CF52C5AAEE67341E0AC30717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622536298, "uuid": "0fd1a7a8-ba30-4590-af42-2bb777124a88", "value": "04270520ff7500328fbe7b31f4e73eb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622536298, "uuid": "535cb292-b589-4745-8596-eac82880a6b6", "value": "12288:kSULqXXBr9xcoWrHJhi3DetWRdCAXhm4fNn6wc/ZCI0B9ddFAJsjj0f0xMTdiNyv:kHer9xwDi3DegemgrPEzP/Pw0SdiB0b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622536298, "uuid": "de416ba1-1fe9-4e8c-8c0b-6390b54ef86e", "value": 867328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622536298, "uuid": "d69f84b4-66e3-46e0-a6e5-adf93b75497b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622536298, "uuid": "fc56e7b7-e942-4f98-aa4e-a6010c5df361", "value": "5cfad779246c0e136f67716f7c933c97.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "958d3fb2-c2a7-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1622531058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622531058, "uuid": "40ef6125-6fc3-4669-83c1-d80950111aae", "comment": "Malware payload (GuLoader)", "value": "89486bd4ecc73276f4f0c6b6c19db98a", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622531058, "uuid": "57dffbe2-1210-4c9b-9b9d-d6b0ef0cacbb", "comment": "Malware payload (GuLoader)", "value": "aba7b9d3f04b89ce4e3eb7e1c92dddcf106a5b506cd511c3373c8f149d68ac71", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622531058, "uuid": "00f60d06-2015-4931-a1ce-c552f24f7809", "comment": "Malware payload (GuLoader)", "value": "c343b6e8972bcd1ac12ae38c7182b5f954af7f73", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622531058, "uuid": "6749e74c-ee82-4a7c-a29d-a09532990179", "comment": "Malware payload (GuLoader)", "value": "e29d9bfd2850dca9485fb6c9ef15a7bc9c1838d1933c84a56d7ddcd2c806e97e7864a79f8aa58f0478a98c70e2680721", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622531058, "uuid": "9546441e-c213-4135-82db-746bcf3f94c1", "value": "8D45235BE2D1ABB1C02D5A30A46742748AA9ED45FF4EB5B3530DB781D2F072A1BC3709", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622531058, "uuid": "0cd8e50b-ec52-4196-a0a9-176c7e648e9a", "value": "24576:zr5gYcHJ0+W3gpgVI3xBYeMjit7wQTN1/eYjsi3cat:CYQ0+gyBGeMjit7ZTXmisbe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622531058, "uuid": "debfbe5e-e8c5-44f8-a2c7-dc029b575f5d", "value": 1274392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622531058, "uuid": "d98db912-ea71-4b48-bb4b-63023f751362", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622531058, "uuid": "c4888c71-300f-4e0f-b4fc-2e71fe6cf308", "value": "Order Form 2021.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce5f1ccf-c2a2-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1622529006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529006, "uuid": "9bff7e31-5711-4537-8b2c-11988d59e5f5", "comment": "Malware payload (SnakeKeylogger)", "value": "0c059b7e102af0f822a4e75bbade827e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529006, "uuid": "139d93a4-c9bc-4d95-9538-7c4590ed419b", "comment": "Malware payload (SnakeKeylogger)", "value": "ac81d63e6eb0e60eb42c394765fd3b43bd84696e6af868db075b858bbf68650a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529006, "uuid": "7dcc705a-a6a8-40a6-9b11-c88efb2facdf", "comment": "Malware payload (SnakeKeylogger)", "value": "8b126428e3e8023bd80acdfe3dac908c1557b748", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529006, "uuid": "4ade9b1d-54ec-4634-9441-b951731102b1", "comment": "Malware payload (SnakeKeylogger)", "value": "0335502a95767788c7e54aa1033109d19a2ef3069a75867bec7bb8c450c274fd6a5da6471ef71f06bffaeff0f24f968e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529006, "uuid": "29b59c59-3c5d-4ec6-bee3-221543cab85c", "value": "79256AF4F158D9B1C14EC731C691ACFAAB611DFED602491F09A4BE8F3A3378A8B49445", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529006, "uuid": "915dc8d5-f65a-45f4-a6d5-b089548e6ea0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529006, "uuid": "3f0504e2-4a8f-461c-aee9-ea44c96dbfe6", "value": "24576:9wWamugrXwgIfQxzsAnuSGtqCVIU+pVN8T:6W/nhuzSU5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529006, "uuid": "0e5d544e-512f-4db3-80f3-5c68f0a3f214", "value": 967168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529006, "uuid": "2e05a666-dc0b-427b-b4bd-0f1fc770726c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529006, "uuid": "319f231f-3388-4ea4-821b-2694fc185210", "value": "I43OS23pg7HNqXI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2e906f5-c2a2-11eb-875b-42010a9c0053", "comment": "Malware payload (StormKitty)", "timestamp": 1622529041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529041, "uuid": "8c63bb05-be11-4945-8273-6a9897bad4d2", "comment": "Malware payload (StormKitty)", "value": "8ea6c4d417452512a1d8494f6174bfbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529041, "uuid": "a0c09624-4027-4a7f-b702-80d3101e9b6e", "comment": "Malware payload (StormKitty)", "value": "ad3423277035a3176174fb40bf0b8ca4812f87d79298176fcc40aadff2a2ad9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529041, "uuid": "fb3f0f95-ce20-48a2-a3ab-aab87d054aef", "comment": "Malware payload (StormKitty)", "value": "9c64d2120d34e7fd23d6ed780b55bde5dcf8d3bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529041, "uuid": "586c5778-5f1d-40f0-bba3-4435db9aa8b1", "comment": "Malware payload (StormKitty)", "value": "e2768a7b7e191d23575528bec571f53095596ec5cad5c41d87f5f3ba544f3220582526aec9452965877679dd16e8e5b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529041, "uuid": "6ecaf784-9771-4a15-ad1e-cbf40ac8ddcd", "value": "C335232176C0D458E8310BF59A8DC734A73C9FEE8EC5024323523BAF6DB96A34D56B25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529041, "uuid": "19668d13-2e1f-48c1-9670-c99d5069da10", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529041, "uuid": "9d38c422-a807-4ac8-8943-2b49036889cc", "value": "24576:9MB73LJCj18NCpLcjOg3Unl2KEbEuHat3C:+Bvk8WPl2KE3at3C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529041, "uuid": "d99abe7b-f5fc-40a8-8edc-454246e3f6a6", "value": 1115171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529041, "uuid": "b916185c-a31b-4613-b68e-ec9b7632d970", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529041, "uuid": "ab002958-b6c0-4ba5-b253-1121b10cc69b", "value": "CONTRACT_SCAN627289222.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1406090a-c2a3-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1622529123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529123, "uuid": "c986ca26-0138-4974-b3b8-d046fd2f8379", "comment": "Malware payload (SnakeKeylogger)", "value": "1531a3969feb4f864a4f668d790e7712", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529123, "uuid": "61358653-344f-4c52-9800-cc3aff8e7014", "comment": "Malware payload (SnakeKeylogger)", "value": "ad8a65037fb14622244f636c73e0ced6a3b4bb8ae7c1ce46c55cc1bc0c847d5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529123, "uuid": "b26f67e8-14e8-4bea-90f6-426ae5b224e4", "comment": "Malware payload (SnakeKeylogger)", "value": "dc854710b9c98578bbec691c92066f78559bdd70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529123, "uuid": "97b331f3-1cf1-4eb7-b709-cf2bb6b47706", "comment": "Malware payload (SnakeKeylogger)", "value": "0f1727f8897bb667300b41365e0271e4d0cf704cf0d22e3b170cdcfbe974ff6b4868f04257e1ad4cb41f762081bf3ec5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529123, "uuid": "58076a8b-c100-48ba-9ccb-2d7bdd75903e", "value": "B1055B2439EE50D9F173AE754ED8B59AEA2FBB333B029C591C91034A0623A41DDF253D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529123, "uuid": "a3e06f65-f060-468e-bb85-c1c0e3a0849b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529123, "uuid": "14aafa69-fa5d-4857-9a83-ce6aec17efa7", "value": "12288:fJjeup/Z9Zn9vRzzgShAXnKmvl89gQAZX1NCCpfUX2EAKa5SHJTBScLZjg0j9RN5:BtRXmXKSnBE/bN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529123, "uuid": "2f385375-10ac-40bf-af66-39fcfd81f65f", "value": 836096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529123, "uuid": "26182759-8539-46d3-9bfd-888fc64ed164", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529123, "uuid": "8ec0b2b0-00e0-4fb0-a332-c3fdb0ce62b4", "value": "PO-20210601052211.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca62d2de-c2a2-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622529000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529000, "uuid": "400a9a36-bb0c-4f88-84b1-31516dfdc18d", "comment": "Malware payload", "value": "bb2442ea37040c89e26ef7940b241c90", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529000, "uuid": "921b31c5-8ea9-4afa-922e-279027fc44fe", "comment": "Malware payload", "value": "adcdd8a392fad9744d51ca0e8f08d7daed61e616b78558dbecdf45340e61d906", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529000, "uuid": "6f38975e-7ae4-452c-b342-95d1f2d7afdb", "comment": "Malware payload", "value": "9b9db6fb7d6534061d9c1800df0f194b14a55750", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529000, "uuid": "9447e97e-d416-4683-b8ea-bc386f25cbe0", "comment": "Malware payload", "value": "66fda7bbe2f3e3784ec457d2ab3f45ef05fc3a6109f63594de5b46a505df0b00489af2c8af6eed18f401e7057ab7dbb6", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529000, "uuid": "b13f15fd-fec3-46a5-ac8b-8d0fb3e7587f", "value": "63E4F13331DBCFD0D23E82F4C1A0E0E313F190E7EF52DE791D85989A26B6B8449599A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529000, "uuid": "e1269540-a0a7-406f-9e5d-413b2f210a40", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529000, "uuid": "ee380d72-21da-4cb1-8ffc-4f135d0d8ee4", "value": "12288:wWSjpG6NAtqhNkl1OwBEOErK6q8Nvca7YceEEsHzEJ:0j8tyyl1jZovcazebEzEJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529000, "uuid": "a3fb17b9-94c2-48f9-bffa-f9816797bf9d", "value": 714752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529000, "uuid": "d5375e72-c942-4b55-89bf-98c3c0b5de2a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529000, "uuid": "4049987f-e940-42b6-b2da-312168a52aea", "value": "DHL_AWBNO#907853880911.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7c7ea36-c2ce-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622547974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547974, "uuid": "a2123713-7c7d-477d-a833-317c557cfafa", "comment": "Malware payload", "value": "dce26c05e7bbb22e3ae23b3e0d76fe0f", "object_relation": "md5", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547974, "uuid": "86c5a567-a44e-4bae-add2-47c7351b3c20", "comment": "Malware payload", "value": "ae08292d6f9c48c95cc77316a22a9768c5f4511ab67f974c186aaa186f3c6286", "object_relation": "sha256", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547974, "uuid": "67243115-580f-4d68-9b90-28ae9386805f", "comment": "Malware payload", "value": "8e0148e5ed38b30ce9d3e17904606087308562e1", "object_relation": "sha1", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547974, "uuid": "3f389a35-75af-468d-824d-a2fb4a80f250", "comment": "Malware payload", "value": "aa525b5e4c9e856167add37b28e31252fa77eb51f23677d0462ff838cfc86dac06f8fc0c6ac1fedc65ee6ac1816cf227", "object_relation": "sha3-384", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547974, "uuid": "1e55c18c-a798-4dfc-bce8-9ac9868f624a", "value": "2481DBDC2533A4B9DA722553E00DBB7D82752EA7F40E74F09A8481012F66F8DD268F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547974, "uuid": "532ca2ee-1272-4de7-900c-92abcaafd90b", "value": "96:nap88TsgCMSzcoPdztqBuHMDPJ96JMJ4m1SDFqMe1:nap88KMYVztDHMn6JMJoxqMe1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622547974, "uuid": "a47aca37-5445-44da-be92-1fa6f9b8bfbd", "value": 3837, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622547974, "uuid": "96370943-2e60-4edf-93f9-28a6f07551ea", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547974, "uuid": "bb5fdfe7-4f5f-46cf-be95-09a056c494f7", "value": "ae08292d6f9c48c95cc77316a22a9768c5f4511ab67f974c186aaa186f3c6286", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25a21f35-c2a3-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622529153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529153, "uuid": "48815037-54c1-4e6f-a612-ba7d351542d2", "comment": "Malware payload (AgentTesla)", "value": "fc25477e7874a702b9a94458c3c3961b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529153, "uuid": "c8e7c8b1-fb60-4ef5-9b5e-c4985a95e063", "comment": "Malware payload (AgentTesla)", "value": "af1076fd5339badf56bfabd56b73e09d27c2aa40916499d9cded1f984536f6d9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529153, "uuid": "cdaee384-54ae-422b-b212-ad1a562c3f4d", "comment": "Malware payload (AgentTesla)", "value": "90654524dc754e37c81dd6acbe88d369a25b74d3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529153, "uuid": "c7e219fd-840c-45ea-b252-d8c8e36bfee3", "comment": "Malware payload (AgentTesla)", "value": "05679c2d6cec6c21bd63c29dfe3bca7bbf16c3fa6b3aada3b8012b1d1454aa11b0da43cff9eadbbb684afa9fd8b8f524", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529153, "uuid": "9153c46e-80a2-4d4d-b878-a35e342e2fb0", "value": "04157DF4F59899B2C24EC772C7919CAEEBA212FE1243491C09A9DACC1F4378E9F5C445", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529153, "uuid": "795a9e99-e2cc-4499-9c00-46dde096dc02", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529153, "uuid": "33ad6617-33fc-4bb3-9e25-b19a53ef1a51", "value": "12288:8WHIcDrhvTfq76I4MdCDz+bRdT7iYJA7GTTruvsf2pvasMRAt:8WHbr5gEwRFidATru00MRM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529153, "uuid": "acd675d2-5ace-4132-9ae7-2568340e09f6", "value": 903680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529153, "uuid": "03df4642-924b-449e-b7c8-62bf58baa523", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529153, "uuid": "de5776bb-d467-4d65-bb9e-d323f3759e63", "value": "Order-Confirmation-PO-0756-200-KG xls.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae45081b-c2b3-11eb-875b-42010a9c0053", "comment": "Malware payload (OskiStealer)", "timestamp": 1622536254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622536254, "uuid": "fa270614-9372-4d4a-90f7-b1d5053dbc02", "comment": "Malware payload (OskiStealer)", "value": "6bc34d0942aafd77c276b4ad40c02916", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622536254, "uuid": "115c696a-a13d-4a8a-bc4e-0149f7934343", "comment": "Malware payload (OskiStealer)", "value": "af5be809b9f2e228721690b1952e2ac310c60c18cc0f4bcf3f9f82c228aea5dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622536254, "uuid": "b80c86f5-a493-4718-b856-01c805dab4ec", "comment": "Malware payload (OskiStealer)", "value": "47bc620195cac49a8df1b0af45fc8716638aba42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622536254, "uuid": "8f33632a-6a1b-46c4-bfe0-13f60d02bfd7", "comment": "Malware payload (OskiStealer)", "value": "9a75734908f5853e019842fa489bbc781d10ced49b4a277c43d98da44b5e0255433b15c93cf5adf9c6e2ef04f5b76cbf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622536254, "uuid": "41c92cd2-943b-491c-894c-2bbfe1f45826", "value": "742402819B68C267CA810D79FEF5D2F18E70DD40BCD58ADB4800BE5F7A757829A1172C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622536254, "uuid": "129219d9-e1fc-40c9-98db-7db0a85a054f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622536254, "uuid": "98d1b060-b839-4ac0-b2b5-a9365cdc1326", "value": "6144:LZRG57mttfUeAIQHuA36cdA73jS0KCzgdM3HPEL:LWyeeAItC66ALjNP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622536254, "uuid": "c4dcf853-e6ff-408b-a8fa-931148b5528d", "value": 215184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622536254, "uuid": "ec1265f4-021f-4ed0-bb73-831870ac1cb2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622536254, "uuid": "c69e317d-430d-4a9b-8c99-ffbbfff81efa", "value": "6bc34d0942aafd77c276b4ad40c02916.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2d730d2-c31b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622581010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622581010, "uuid": "075af80b-a930-449b-a201-3fc1e75bc327", "comment": "Malware payload", "value": "b54998e4e8b3c1e4227f909bd37e6421", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622581010, "uuid": "b03fbf25-3919-44d2-a979-1417944d7f89", "comment": "Malware payload", "value": "b0df38b511841d8098a3fdcfb2193db7003b28d260095c4b84dc63e380c5a7c1", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622581010, "uuid": "dd8b7512-7dd9-44f8-8a0f-ae4ac5d54053", "comment": "Malware payload", "value": "71d8b359db954a78289525e49e9010749093ad4a", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622581010, "uuid": "ccfabc35-84e9-4331-bd80-0848c2c1b0ee", "comment": "Malware payload", "value": "fea7dcfcb30cfed9a3f3d13d753998e2dce5454c9055170530ddd83b8f7790530d005036dfa7308151232934e39f8594", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622581010, "uuid": "e8f3a5da-a024-40d0-afd4-cdd91c0ed1ef", "value": "6D02A516B916B69093FFA2F831790D44A17A18B7037B8F6177820F632C119B49D5D8FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622581010, "uuid": "ccb6140a-75e2-4dc1-93a4-8ddbc57edd81", "value": "192:VZaEcpyXvf+7sF4CyVQByoKo1siOBtNItUtqjG:HalgXvf+AF4CyVQByikbsUtqi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622581010, "uuid": "5a541e0e-8162-4be4-b9b0-02dfa9a88122", "value": 8512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622581010, "uuid": "693c6066-8a6c-48c3-a8ba-d48119cbd090", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622581010, "uuid": "919ba8a3-e400-42ef-8f98-158741e44faa", "value": "cu_Clients-Status-062021-1.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "787c65d4-c2db-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1622553343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553343, "uuid": "ecaacff6-95e8-42e8-9712-8d85c511b243", "comment": "Malware payload (RemcosRAT)", "value": "b9133a178d4e9e41d78fec7d03b96990", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553343, "uuid": "a6b8d95b-980a-4d67-9b68-21a4a48db0eb", "comment": "Malware payload (RemcosRAT)", "value": "b1849476d3b8900288d6bf7c9ac229eba5e64d665398302a0842c335259f6560", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553343, "uuid": "456ec348-819d-4288-902d-8fe47fa367c7", "comment": "Malware payload (RemcosRAT)", "value": "d09adebff84e2ae99df3d1fe91e76b6b1a2e7721", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553343, "uuid": "ce6fc2c0-94d7-4828-9949-2213b4002ea9", "comment": "Malware payload (RemcosRAT)", "value": "ce344570a47f5ffc676b5bdc6aa856a4feec1553bc3dbc2f93c25550130ca30e7a0604661f91bc57839c37e428ccb6b5", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553343, "uuid": "342d4257-5eb8-4b76-8663-c3aed8e642b6", "value": "7591B6479FBE82883826FC34CCD7A42EF9C08C78DF9CE274854A9149C9BD395429D862", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553343, "uuid": "ad9bca23-4147-4142-a124-a07f92c9a894", "value": "96:xDRBskOf+UDf0XcdlvStntw5+Bi6w5gRBlD5yfID+XcdjuXtI+tyw5E:xDRjOfVDf0XcPvSPI6/RpyfID+XcFu9u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622553343, "uuid": "bb6e1bc8-d71f-4148-94b7-7c3d842cd301", "value": 4323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622553343, "uuid": "9a2ed2c0-06a4-4d95-83b9-558574ab3789", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553343, "uuid": "96be211c-f001-468e-99a8-bbf0469a95c9", "value": "Report.110034567733.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39da0f47-c2a3-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622529187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529187, "uuid": "167f431c-ef9b-481c-9c53-95a5fe3082c0", "comment": "Malware payload (AgentTesla)", "value": "09440ff5fdd4fce8fcd0f32f0162da93", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529187, "uuid": "9d0d02b2-f9eb-4338-98eb-c412e7ee2a17", "comment": "Malware payload (AgentTesla)", "value": "b1a6632f9427bd2408be8699aa1b4391bd3b0e7b9bb017664a988e6666cfabdc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529187, "uuid": "2f9933b7-b940-419a-a584-d421bbf3b59c", "comment": "Malware payload (AgentTesla)", "value": "e2855da7b8990f42cf32fef5bc7d2b0fe8465b00", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529187, "uuid": "4c35a231-c4b8-4445-bece-ee1b8b38391f", "comment": "Malware payload (AgentTesla)", "value": "be16748f7d9184bd184460c26f872a9646103498eef3f6c993fefcf9f045aa914df3b34488647891eb5b9a2aac2d9779", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529187, "uuid": "dbd2b67f-d0fc-4c3c-9a37-7b597dcafac4", "value": "1015E137129AABE0F2BDC7B840A4D9B303F4B5D3DB11CB39AEAC50991055B8485D276F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529187, "uuid": "8b0e7876-758e-4b86-b2c4-c255d2527793", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529187, "uuid": "ca398164-b15d-4043-a366-4ca436f2bf07", "value": "12288:Mt6xM8Nx4+Wb6NlHdLpLXw4ehGK47wd7Z+zUOexImjz3FbfAyl2f/sDmDH7hDj/g:tYd+HBpLK5UW7Z+0xZ31oFfUSDHxj/0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529187, "uuid": "6004c6dc-8881-4d5f-83ac-c87b8700cb7a", "value": 880128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529187, "uuid": "5be6a8c5-5fe4-4549-9eb0-30b5b9924445", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529187, "uuid": "1e5710a0-c92f-429c-a00d-7b28cbe35b64", "value": "PO-45009#66566-Order xls.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "347a0401-c2a8-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1622531325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622531325, "uuid": "7550b696-6e71-49fe-8846-cf5b7085e929", "comment": "Malware payload (RemcosRAT)", "value": "f7c5c0167fc413a06f90be1aeccd5ffd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622531325, "uuid": "d8f1605a-5605-460b-abff-c1fd7f1cb496", "comment": "Malware payload (RemcosRAT)", "value": "b275490304d8b4ae0894b33319e3db7df9927986e2258ce3bc7f9b4037bc98b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622531325, "uuid": "21e8264f-e025-4dc6-b837-2d0ec201f1c2", "comment": "Malware payload (RemcosRAT)", "value": "188e772bea55a9b690784529f0f7ae36b071598d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622531325, "uuid": "d6bd70c0-0a9f-4568-9c4c-f0d218d7b275", "comment": "Malware payload (RemcosRAT)", "value": "570fd8d60a503c377ac08a3e99876149a8e69cc0f7a7083dffb6f68c1b345498769761f3f9dcf396ff9b4bcacfd9a811", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622531325, "uuid": "1a324406-03be-46cc-8453-57a29d264e76", "value": "D9F439EC325075EEC867CC76CAA81C64EA6174BB570BC207A02715EDAA1DA97DF101F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622531325, "uuid": "77570703-a86d-448b-abec-c8ee78f1b6aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622531325, "uuid": "87ac576d-6a1f-437e-8472-923b8d3f08b7", "value": "12288:V/BRJVAfOT/fQpcXeOOaZ9fW3f3kKgggBfm+rWJxenaZ0KwGCqLluaOtG7DgEQAT:dBRJVAOT/fQZzwW3f0ugBmY8xenaZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622531325, "uuid": "6f5de613-61cc-4ede-9ddc-ef2854c5525d", "value": 765952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622531325, "uuid": "aabfd02c-c29f-4f94-b96c-4b2c05c9c946", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622531325, "uuid": "29078f9e-ee53-4968-b237-f71cef5b2266", "value": "f7c5c0167fc413a06f90be1aeccd5ffd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c2417fb-c2ed-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1622561081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622561081, "uuid": "3f81995b-1dc6-4be2-8835-779b50e23ea7", "comment": "Malware payload (Loki)", "value": "70c534bab2292f5c426e1816a5f6a6ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622561081, "uuid": "c1bf6aeb-94d8-4075-8bf6-24c0cdded91a", "comment": "Malware payload (Loki)", "value": "b37be7f126109ef6a823dd28be1cf9dd9dc1513bad982eb3fae486db27b1250a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622561081, "uuid": "184973f6-5172-4ad0-9873-b48470409e3f", "comment": "Malware payload (Loki)", "value": "bb0adc97274fc86ac02dc199cb27efea4de26480", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622561081, "uuid": "2f526f39-6003-4875-ae3a-bb30978ec869", "comment": "Malware payload (Loki)", "value": "a7c83b452164be10b72d10f44fda2991e327dd96860a5bcada85fd824c5642a72144ab97ae7615e7e1a252232ba1cb32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622561081, "uuid": "9e145d0e-a4dc-4276-97d1-ebbd3246a9f4", "value": "90F4C03112599BE0E6BDC7B880A4D87303F1B5D79F12DF39AEE960D91491B4086D23BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622561081, "uuid": "3dded22f-85be-4090-9f58-d99e1615070d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622561081, "uuid": "870c95f6-d3e0-47e6-b8e5-1fa078c3a75c", "value": "12288:+m6ChNBb6NpiJx31Eam6Q2cnHE19KisktCleWGxAjlHEI5d8ahMv:93d38zHH69KiskmevxAjlkM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622561081, "uuid": "07ce719b-bc2e-4099-8a9b-ab29d9b13830", "value": 780288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622561081, "uuid": "49bae17a-02bc-4c51-9201-1642adb08724", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622561081, "uuid": "52587d56-887f-425d-8280-ac527e9e4a29", "value": "MT103_SWIFT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6ca0ba7-c2a2-11eb-875b-42010a9c0053", "comment": "Malware payload (njrat)", "timestamp": 1622529047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529047, "uuid": "9910e753-86a8-4fcd-a1aa-0740a231c528", "comment": "Malware payload (njrat)", "value": "8fc71419cb93aa49aa32a7dd18a919ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529047, "uuid": "f90a5163-81e8-4b46-b8d9-98f77ea47529", "comment": "Malware payload (njrat)", "value": "b3b3272c31da409d7ce9fffa5dda883512ae12c3f1c18d48cd65a4a4ecd241b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529047, "uuid": "fbca4ccd-567a-40ca-8b13-0bdc9684b808", "comment": "Malware payload (njrat)", "value": "ae71be0172b7998f5cc65cf53b77fe43f3b98c7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529047, "uuid": "cb3a94ba-b728-4e3c-8af1-a398adee91c6", "comment": "Malware payload (njrat)", "value": "f2ac6c1b5fe931a00b4d89a5ad28b2eef321d6362b7d88cdc1b0ff55b9822797bf7eaf92d662c0a12abedbc31a12e62f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529047, "uuid": "9462124e-7653-419b-bb10-6453eac5e504", "value": "C5B21B4E3FA98856C57C1B7496A5965003B091470423EE3F8CC554CBAFB3BDA2D48EF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529047, "uuid": "3d8493b2-3d76-455f-a99a-f9b2642cd236", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529047, "uuid": "45515619-ad5d-414f-9fab-6f3d0d11f72b", "value": "384:vY324bcgPiJLQrfARGSRUJsbY6ZgvSMBD3t8mRvR6JZlbw8hqIusZzZeT:4L2s+tRyRpcnuT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529047, "uuid": "4d869a58-a52f-45fb-a6dd-41ae1ab6ca8b", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529047, "uuid": "8cb4afd8-5a58-4788-893c-fb730ad1315b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529047, "uuid": "6606d0e2-e29a-4b91-b585-dcffefa48440", "value": "8FC71419CB93AA49AA32A7DD18A919CE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2155b493-c2ef-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622561787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622561787, "uuid": "624d062f-b373-46cd-a101-66141e823ec4", "comment": "Malware payload (RedLineStealer)", "value": "cbc401ba725ef670f23455cd69be1b05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622561787, "uuid": "96909340-ea49-439f-95f3-c4adcc97a340", "comment": "Malware payload (RedLineStealer)", "value": "b4ea43c602bde1888827885b6826e461b3e6e449ae45f62d64834e2eb0308635", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622561787, "uuid": "9046550f-30f8-4b05-8ba0-7f536757edef", "comment": "Malware payload (RedLineStealer)", "value": "f086150154a0ad793084c09cf8904d96385f714a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622561787, "uuid": "63864f51-36ee-4f65-8c42-5bdd7c77abac", "comment": "Malware payload (RedLineStealer)", "value": "792a1a562252b1f576a9908c9e116c0b591f80ce1b741a3cea1b5a076c255181169f6bedbb7b11c8c905771bce667341", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622561787, "uuid": "9224c936-517f-41b1-8ff0-6cfe6e3a6e03", "value": "99849E10E690D035F5F336B44AB782BDA639BDE1EB6450CF62D46AEA56349E0EC31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622561787, "uuid": "78015d4e-4aad-4fb3-93a1-1e00123e74b6", "value": "63c85c090ca4b46213d1d3501aebeb61", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622561787, "uuid": "e177f5f7-556a-4d1a-9c39-28b36a816795", "value": "6144:ygRLQW27u9bNhuNZgYZXzrk9avFUfGPArGxlb31rCkTAIezwtnC8h7gGd:ygRc+FvuNZ3XzrDy9rGbZrCtChk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622561787, "uuid": "3e4dfc64-b698-4b1e-9de5-464bc56d5aed", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622561787, "uuid": "70a39ed6-d6b7-467b-9349-22e8883af5a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622561787, "uuid": "6fb1b77b-509b-46f3-ae6b-a2a133bdffce", "value": "cbc401ba725ef670f23455cd69be1b05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d8c5d7a-c2a5-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1622529971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529971, "uuid": "b62cec2e-d77c-48f8-b3e0-8651da3f75ce", "comment": "Malware payload (RaccoonStealer)", "value": "12e0e8122d17ea0cdba371809797af1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529971, "uuid": "dcf297d6-f103-45c5-a543-e0aa002cc17d", "comment": "Malware payload (RaccoonStealer)", "value": "b5197b6a21d9f96c27767949b5de32b402f6470a505d9276f640d09af0f87c44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529971, "uuid": "d0d97eb8-61b6-4112-a33a-cfd018a84464", "comment": "Malware payload (RaccoonStealer)", "value": "401f3a83983ca061b1705263db298c5151a89ffc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529971, "uuid": "3e2f3bd7-d4ae-43c9-940d-a3a012b97f97", "comment": "Malware payload (RaccoonStealer)", "value": "048a529cf1bcf1ef468d7900e0b36041e2f5ef35b626d6d37eddfe556a00c5f3086797c16b373717fdeac5b3fd429210", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529971, "uuid": "0dd02115-f5b0-4067-8bf8-558bd18c5601", "value": "C9C4CF00B690D035E5F336F499BBA26DAA697DB1EB2450CF22C46BE946346F0BD30717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529971, "uuid": "ba5d90b1-be03-4a90-b169-90d3c0ad5dda", "value": "0479728b0bbbaea2fc170e4fb90137cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529971, "uuid": "c2019d56-1e24-4bcd-990f-61c6c1aa8a6b", "value": "12288:QnJ8x8pVB3LyOYeW+vb8lmq4IbdRK2pdR9wXkgindpxq:QnJNVBmGvb8lFbfK2priXkg4p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529971, "uuid": "71666403-58ee-4c4d-acde-782d21e7fbec", "value": 593408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529971, "uuid": "01dd763c-b76f-41ed-95b4-5ba0940e555e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529971, "uuid": "36111bb1-6d5b-4d00-b8d4-d9ade4177702", "value": "12e0e8122d17ea0cdba371809797af1c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "687a19ea-c2ca-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622546015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622546015, "uuid": "f15f0477-542a-4b39-bfbb-0458b6255d1e", "comment": "Malware payload (AgentTesla)", "value": "9b21588d2508f6ee790a9cc0a07a3d3c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622546015, "uuid": "8cb6ea03-4506-44a6-acba-629f12c99e7b", "comment": "Malware payload (AgentTesla)", "value": "b6e849dbf8a6e0c66ea21d32b10c9a749cf877e30892f9f07e2bb0b769588f8f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622546015, "uuid": "41ec0af2-11e3-4b7c-a3aa-6fd8510bf700", "comment": "Malware payload (AgentTesla)", "value": "d96f2e511458c38fd7e03045ea172682a5ce6da5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622546015, "uuid": "7956c138-c240-4b04-9610-49f3df51f736", "comment": "Malware payload (AgentTesla)", "value": "9ecb3b60e24f76011865890328fb31443dbb42dacfdcf3dbb0d12b576d18fd25ff007b38a306dcf681cfc3578dae62af", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622546015, "uuid": "b4f1c173-f1b1-4622-935f-9a81cd9929b3", "value": "3FF1AEC85B631C15656AA35B8D9777211C73BA19CBC2CF881C2692CF18BCBD21F8C4E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622546015, "uuid": "8e99ff63-2119-4876-a3a0-10bb413fe7a6", "value": "192:ERldqcbk4xFyx/FtgdyZzGZPyUTg00fOXauyVOxJF+jB2rv+zneet:kmcbk+y9Ftgem0f9uy+c2qzne+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622546015, "uuid": "3084526b-1bae-471a-9003-a4c1749c4b72", "value": 7905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622546015, "uuid": "bba571b6-2fdc-4a59-a84c-a4e42ea13297", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622546015, "uuid": "b865d42c-7335-4d72-92ce-023ebbb601b1", "value": "first Order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3afd4d6a-c2db-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622553240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553240, "uuid": "d5949b4a-542c-4bb6-a5cf-909e6605f9da", "comment": "Malware payload (AgentTesla)", "value": "44b3a2250bc7cdf1f3366082599914c2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553240, "uuid": "02fd20db-068b-441d-94fc-1d2c14718a33", "comment": "Malware payload (AgentTesla)", "value": "b7f5689996e93950b9d784e9c3c6aa9f6585e2c974b5611b99f43e6a5705ee85", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553240, "uuid": "c12d84fc-1586-4d0b-af42-a30184c54537", "comment": "Malware payload (AgentTesla)", "value": "5f19e0211fe9170c27dfdb1b6382fa57f8339e76", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553240, "uuid": "15301f5e-a396-4428-b62d-f25e40db58e3", "comment": "Malware payload (AgentTesla)", "value": "a37a018b51e2400a757e62c35809a2d2509ac010c21d45ebd7f016823cdfdd3d4429be8c7e15aecc5e57db8dd62fcefa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553240, "uuid": "e5b475df-15e4-49eb-8dd0-668c1723463f", "value": "B8257CF4F4A898B1D64DC771C6919CBAEB621EFD12124C1D0AE5BE8C3A3378E9F49444", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553240, "uuid": "ff9ba5d1-eee1-49d0-bbba-2f193633cbfc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553240, "uuid": "97fb5a66-7702-4340-be71-f9185f76e70d", "value": "12288:JN888JrhvTIJLF1nhe4mGDtn06WjTmZ/QWMBfrmGWkD3hpsyMnmU4zKpC482:JN8NrYLnnhna66TmiWM1RhpwnV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622553240, "uuid": "9343b6e3-bbcc-4f33-a738-47b711f399b2", "value": 1013760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622553240, "uuid": "6f32f367-6559-4f8a-8c4b-7a0b43141c36", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553240, "uuid": "ec14563d-2ed7-4617-9150-4b3bad95d149", "value": "005267.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5efcb90-c2bd-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622540562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622540562, "uuid": "e5f5e319-564e-4d52-a832-ee4ceb5dc82f", "comment": "Malware payload (AgentTesla)", "value": "aba95938147b1769800b95da4242619d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622540562, "uuid": "8215aa9c-0729-4665-96ef-7eabd7008b4d", "comment": "Malware payload (AgentTesla)", "value": "b803051e105410eaa2cae67bc2a63ed82dec091d1ff9bead9ecb13bcacde652d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622540562, "uuid": "d08e0b1a-d9b5-41f0-b933-38771a0892fb", "comment": "Malware payload (AgentTesla)", "value": "b71fc65fc1af4aac7d26357235424532be858682", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622540562, "uuid": "ce23c2aa-97d9-47c5-846e-b84a4a9aa03f", "comment": "Malware payload (AgentTesla)", "value": "7d5eb543e78149bd614c7fdafb5927337c8230d3c8b1637ada29be4f36dbcd252d06d8ff416e404ad361ade513a8b084", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622540562, "uuid": "f858f1e3-cd3e-4195-98f9-f134f826fa2c", "value": "D7D423F1D497E10BA9F90F376ACEB610D4052EAFCD4EF213D84159BE02865E72B086D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622540562, "uuid": "3ea30e4d-0547-4fec-a67b-0620628b65eb", "value": "12288:0HxNGobs/6Jm9OynC5HcPM+OKjK7yPyBNi7ruGMhjW9q2:0HXGobafBC5QOGK7yPyBNGaGMcq2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622540562, "uuid": "9287386b-1fc5-4e04-83c3-41954faffdb0", "value": 630523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622540562, "uuid": "84662cb7-a36c-4ff5-b444-ff5d04f72513", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622540562, "uuid": "a77d65d4-7a65-4749-8e09-e7a5f6b8dd96", "value": "SCAN_20161017_151638921_002.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3704b993-c270-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622507278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622507278, "uuid": "4ca5de1b-49c0-40f4-b18d-95af5e2cc6b1", "comment": "Malware payload", "value": "4fb331e4e5c6094e731690371687b110", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622507278, "uuid": "13ae16b0-ec28-4b5e-aa5f-e090fa543a59", "comment": "Malware payload", "value": "b8226e0691779280f1cbbcba93d41e01bc26a7ad37c88bc3b835e72c1376a7fe", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622507278, "uuid": "c87474c4-c636-4e07-90df-8822d9891e68", "comment": "Malware payload", "value": "bcecaaba6462550c61f7ed572e2c06ef8f3f378a", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622507278, "uuid": "2b257964-5b6d-4371-8fdf-fe3fc5e7f2d9", "comment": "Malware payload", "value": "e0ce3b75a1146f86f7d4c4b4a1df291247d42b1e1df5a7486273a617eee6e92574d6d5f76f0a4d1b8911155e0595b6a3", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622507278, "uuid": "3521d4a3-454b-49fe-ac0f-4f637f02078f", "value": "48F423A542CEFD48EA3A3D3761C5039DA197ACEB93150F420E73DB22D99A6F32511F18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622507278, "uuid": "927455c5-2e67-4a8f-b012-3ca460e95b45", "value": "12288:HMc+2YnB6YTbkvA00E+XvQNBzcytqew5W99QPR69Ke+SajzvEnj/igo7tbhzdSNN:H8sYvkhRzdoW9yRCh+vwnj/it7vBSj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622507278, "uuid": "c817f918-0f89-431d-a393-5f80831b6c0e", "value": 739063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622507278, "uuid": "57a8bf1e-7b6e-4047-b3ac-91ee1e2459eb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622507278, "uuid": "048c74c7-3e39-4613-b334-c62d2b7d23ce", "value": "Brown_Forman_Corporation_Letter_of_complaint.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a3ce481-c2f7-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622565426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622565426, "uuid": "7aa01161-2817-4936-8a29-f6eaf1f13518", "comment": "Malware payload (AgentTesla)", "value": "30467fd98253f96d877581e5af9c18f9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622565426, "uuid": "9db0ced7-644f-4c06-91ad-a020ab0174d5", "comment": "Malware payload (AgentTesla)", "value": "ba2f1fec0f5aafdb9e3397e143fc1be81a7bcb52dc86d47c0524382f0b19fd41", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622565426, "uuid": "7757269c-1b3b-419c-99c1-9921de248284", "comment": "Malware payload (AgentTesla)", "value": "a85593c451358239cd07293223f706118459e718", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622565426, "uuid": "53d2753a-b580-4117-96fd-5d184edf908a", "comment": "Malware payload (AgentTesla)", "value": "75a0c8404370a812869a9a54214b38fd64297d5333d2607019d0128701d2c9cd5f4a4cbe1effe64be6c4a757f21a6140", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622565426, "uuid": "7c4aa369-f64e-4192-9a27-575406721557", "value": "3C24F132B347B561CCBA89FE5CC6E0B04AB7BB17681BA9096048F6585D73FCD4BE0146", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622565426, "uuid": "f5c5f32a-b156-46b3-a9b2-9f248b4702e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622565426, "uuid": "aa87f73a-d1d0-417f-99f8-3702024e6fa2", "value": "3072:boE9VsULdzPtxrHHkuY2Ui/MeoX2tyRNiR8K5IIOw90P6UECAs2zTJQdseKp3KvJ:syVLPfT2rXX2tZC2IIOpP6GKSwKvnpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622565426, "uuid": "082f31a0-9fc7-40d1-bc61-66b2ce86e596", "value": 221696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622565426, "uuid": "b7bd41c3-18b1-41bf-a4fd-6e83d48cbfd8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622565426, "uuid": "d439f797-239d-4b50-9b7e-15420c6e7767", "value": "SecuriteInfo.com.Trojan.PackedNET.792.31772.11502", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bcfd2db-c2a9-11eb-875b-42010a9c0053", "comment": "Malware payload (Stop)", "timestamp": 1622531740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622531740, "uuid": "8dfe9215-1701-4a18-80de-1a2401e0f7c0", "comment": "Malware payload (Stop)", "value": "cceda4334e6bbcf701e20d5b49b30944", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622531740, "uuid": "0834d777-6531-4e1c-912c-a5782fce2cb7", "comment": "Malware payload (Stop)", "value": "ba5a9f8449c3570fb68419a86636718c848562a6d97b6f4cc2b72349d7e42397", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622531740, "uuid": "d3b1bb4f-d55a-47c5-aa39-ff6f55b6f999", "comment": "Malware payload (Stop)", "value": "9ba63640e095365ed00bd055bf98ce5770274f0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622531740, "uuid": "5a304ea3-3f8b-4188-aef1-c7036bdeb9d0", "comment": "Malware payload (Stop)", "value": "03dbb4c5e6036e2d3b8b5ee76f14ecd5f91619d978a2ad74449a4f9943c43c72dc93009caa51a573416284c2658b323a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622531740, "uuid": "59815b8a-b49a-48b0-8e1f-b9d5f3a93f66", "value": "C805F1006760E034F1F736B54ABB927D9A2A7DA2EB2450CF53C8B6ED66346D0AD31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622531740, "uuid": "73ada38e-ae37-485b-bbcd-3010fe736ea2", "value": "ddfa50a7d17fa7288028195442f05ca4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622531740, "uuid": "cc615819-589b-4831-88d2-00cebb1cf16e", "value": "12288:NZVM68OBF9xpSCJ1eqKSZJ5qph/sm/T0a8qdTWwIfoji8h8UQPM5:NkOBbpJ1PRZ0hkY7T7If8lGxPM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622531740, "uuid": "31e16985-a598-4bfc-991a-068690d324e8", "value": 865280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622531740, "uuid": "5c35abfe-86ea-4c26-8e7f-e6c6ef3cd976", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622531740, "uuid": "cbc76d3b-bffc-422d-9d26-f60f5ace5489", "value": "cceda4334e6bbcf701e20d5b49b30944.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb9790ab-c2da-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622553053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553053, "uuid": "2c17f597-5c81-4d2b-9823-7c0887d51d27", "comment": "Malware payload", "value": "c9f8349ef19ac06559da00a6a3990b5b", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553053, "uuid": "0d48ecf6-d75c-4a0b-8dc8-f302dc8858a2", "comment": "Malware payload", "value": "bae27fcdfb5f6d1b14d0588af9fed0e6c85ee30d5f9d4060a6827d8f62cc446e", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553053, "uuid": "9abe8a58-d601-48d3-8598-54eeb3503022", "comment": "Malware payload", "value": "e546cb01d3d09ca780fdfcfe61eb88cd1fc331e4", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553053, "uuid": "0d9718e4-2f5b-42de-9e5a-fe676bc4c947", "comment": "Malware payload", "value": "acf2afc3a0a5b57ddf237fd6d53cca72b07df60420fa9fae2c5f289a4f1b9d407fc709e571b54a9d8d846a320c06232f", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553053, "uuid": "87335749-9d13-427e-a890-ebcecb88871f", "value": "B8C3BF9272A3D506CD4F43792CE682CB2752BC114E7F42B7B7A5FB0ECB75A84490261B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553053, "uuid": "de18e5eb-f5a7-47c0-ab6e-e74cafb08dd5", "value": "3072:tk3hOdsylKlgryzc4bNhZFGzE+cL2knACioo1gaSNAPZesWFPO7YiR6PJEcjjaPp:tk3hOdsylKlgryzc4bNhZF+E+W2knACG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622553053, "uuid": "3df16353-e695-4fb5-897f-1886d3484ab4", "value": 120832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622553053, "uuid": "b77608c2-40e9-43ad-836a-ff79241e9e67", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553053, "uuid": "b6c5a8fa-e7d8-4d4b-b3f7-8eb72dfae230", "value": "PL_087451037.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ac8f76e-c273-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1622508653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622508653, "uuid": "059c0c84-8091-4c7d-ae8a-85eef9c30d48", "comment": "Malware payload (ArkeiStealer)", "value": "f2bbc0dfa4750f068b845166be2bd8f6", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622508653, "uuid": "c151c898-b56a-4dfd-9457-ac1b661b9b5a", "comment": "Malware payload (ArkeiStealer)", "value": "bbad903c167cb3dc56ed2b858f30f7b5bb3f3ee17344b094c35fa93086cae137", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622508653, "uuid": "e3120ac5-25ac-46a3-be22-d18d79cffe78", "comment": "Malware payload (ArkeiStealer)", "value": "99d1170f1fc2099e4a60de5cb4d639a67f9c5c37", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622508653, "uuid": "92009ebf-4dda-411d-816a-b84d0649e714", "comment": "Malware payload (ArkeiStealer)", "value": "d36d00991390fdae937695e9fef94e6478965970256c3dfdc73644f2d6217ba2438860c2480c07f213c9bbb6932aceec", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622508653, "uuid": "460189e1-313a-4cfd-a4e6-7010baaeda80", "value": "13E4E170A791C135F8F201BD957A6A6D9D3B7DA3AB2450CB12C53BEA26306D3AD30707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622508653, "uuid": "93bcdb6c-e755-481e-8531-b84381b44288", "value": "c8e47f7be4ebb5701228fea37e8d0168", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622508653, "uuid": "ac7d20cf-4034-4398-ad4a-85d684f07385", "value": "12288:zsKVhzj7ltMqQBECQxkOWZ19gHnfEnzIyDxjhcd:Dzj7IqRCQ+OWZ1qHsnzIy/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622508653, "uuid": "7dac3978-f326-4a90-9194-e97fc252e311", "value": 689152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622508653, "uuid": "a36e6749-d9cd-4072-ab7b-eb632af7b32e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622508653, "uuid": "eb9a27f6-c789-4e81-a639-c581eb7c18c2", "value": "F2BBC0DFA4750F068B845166BE2BD8F6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "509cced6-c2d4-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622550270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622550270, "uuid": "6ea63e5a-043a-4740-a999-c86889e5ab33", "comment": "Malware payload (AgentTesla)", "value": "ed93b52a8c4f2c43ab126f2202ca2099", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622550270, "uuid": "bd5c0428-3585-4386-bed1-cfc6dbe52c8a", "comment": "Malware payload (AgentTesla)", "value": "bc446fa301275de673049e230f48c5c3d19026eddc98b04012077d4004badefb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622550270, "uuid": "f1a2a262-32e1-4606-9198-ee7485e13ef1", "comment": "Malware payload (AgentTesla)", "value": "9d0cd28d9f9690274d1fdd7bbe1b460ac89cddd6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622550270, "uuid": "ef086707-8cd7-49fc-af77-419559e21206", "comment": "Malware payload (AgentTesla)", "value": "78b14c2e8c9646c865c926867e94975f6af48e8520b90a26f0d3d0b34a7c4ea0b361211320788cedc80fe4c344d64a91", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622550270, "uuid": "77611fd5-7e73-406a-ba44-6179b9c67766", "value": "E6C4CF8D7650B6EFC85BC9768AA46C64EA11787B930FD703A05316BCA90D69BCF101F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622550270, "uuid": "b6b0afc6-d72c-4a57-bc9e-299ff14c0e97", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622550270, "uuid": "28d22b6b-da24-45df-8a96-d967022a4791", "value": "12288:h4PKV+9wu1w5VH9k3CPjdLHFZaCM01cQFPP0Sc74Rp042PP31UYnq0L:hgaT519koMsZ0U7+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622550270, "uuid": "c796e6b5-a63e-420b-bbc1-27406f8a9cd6", "value": 562688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622550270, "uuid": "3b834b4d-2512-4654-8579-1e1ad2e97d21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622550270, "uuid": "27d3cb3f-cba7-45fa-bb36-852e8c278621", "value": "LOT 345678003.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad5e482f-c308-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622572760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622572760, "uuid": "e42a5044-180c-44dc-b924-4e2cfb21b375", "comment": "Malware payload", "value": "a626197742592ccb7bc3a329fa901a74", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622572760, "uuid": "0dea17bd-c9c4-4e93-abfa-c904ee515041", "comment": "Malware payload", "value": "bebbeb607ec113f513745165eb70e8f6190475cf136aa094f3d389a2c25ba701", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622572760, "uuid": "2b44aff5-51db-4d62-8e3c-fb6da165ac56", "comment": "Malware payload", "value": "9aaff017a8d21912ab894b03d0e9a4b4724f7d2f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622572760, "uuid": "34f955df-a5d8-4e2f-9d31-c5ba57fd4d25", "comment": "Malware payload", "value": "4c1eb2ca0752efc37225de8376b6a0395d20470c794bf4a5f00dc1330b83c019b35a665a71a8b0432f51e5d7647dab58", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622572760, "uuid": "bcded199-b079-4115-8c21-3e4fab453393", "value": "2393E95FB384033A06B20265A60E76E5F316843D6336CA202C5ED57D3316C799BBF6E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622572760, "uuid": "7ed2e717-8f11-423a-8197-14ed60923f63", "value": "1536:IYrxjacEqnzCJXq+HXptode00/iyw1bGa3M3d/1htDN2uHG4Ja664hHG9WuK91Ui:fFV0bAY4+vfvFYAX1UBU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622572760, "uuid": "487ef2a7-a3b7-4f91-8fe0-c0da9f741264", "value": 96630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622572760, "uuid": "d4e53b11-4ccd-4d09-96ae-5135d5058b3d", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622572760, "uuid": "5bd82d2c-796d-4ea0-a41d-18a66fdf6ab0", "value": "Clients-Status-062021-1.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34fb8880-c2a7-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622530896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622530896, "uuid": "0dce3f50-7049-4547-908b-5031d932df33", "comment": "Malware payload (RedLineStealer)", "value": "a2c4c3596c727bff0d052f2e62f40810", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622530896, "uuid": "b3c2f7e7-ee63-49cc-a3c8-8dfffeaabdfc", "comment": "Malware payload (RedLineStealer)", "value": "beef9882631d740d3cabb7ce14f299c1fc0e47e6cef65ff7e023ac4437d067f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622530896, "uuid": "beffd4ef-0425-4422-b2fa-56ad50c90bee", "comment": "Malware payload (RedLineStealer)", "value": "b2dd49bd3eea26895ac9cfe42504604b65942c3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622530896, "uuid": "b8b22c10-3e6a-47f9-a9b5-2875d3895f5a", "comment": "Malware payload (RedLineStealer)", "value": "c83ed0d0938b7915f9fe8aa32b6e08f4a9c8d339276457d271eca50c5263d63b7fe96afbca7b2397b5357fcfe654a526", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622530896, "uuid": "9618cb04-9c7d-4d7c-a76a-912bcbe2b5a4", "value": "E5849F10FA90D035F1F336B44A7B92BDA6397DA1E72450CF62D46AEA56346E0EC31707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622530896, "uuid": "b67dd071-13e0-4950-98a7-5c9d356aca90", "value": "2f20facc3edc1d8ba24ede1f07abf090", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622530896, "uuid": "433f8c0d-cfd3-4c38-9931-acf6e21716c5", "value": "6144:Yr0Rbg1ueejPFYP/BqHaB0yAPzZ/9N6F07SZOoK69MPgEITRcPGPzUAXI:YrQ0ojdeJqHxyiZX6F0K3EjITR4r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622530896, "uuid": "67e4e0dd-fe5c-4459-a258-0aaf95f7af48", "value": 398336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622530896, "uuid": "1c3b14ae-2651-4d7e-9a4b-172687f99399", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622530896, "uuid": "e8070166-511d-4573-a4d1-41c292fb926b", "value": "a2c4c3596c727bff0d052f2e62f40810.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "056a616f-c2ce-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622547567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547567, "uuid": "3010c259-167a-4124-9147-f9fc2dae3b75", "comment": "Malware payload", "value": "7fe42c8271b6d54367f1bea258a0d821", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547567, "uuid": "2feb2c49-fe45-47fc-b81e-7e7cd6f626ad", "comment": "Malware payload", "value": "bf77f5d9f2e3284b7bd38c1c8450a81290fb6e4545f4e66707040413daefc2b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547567, "uuid": "8cf03c66-aa85-433d-90b0-1f819c3ae8ff", "comment": "Malware payload", "value": "5fdf4606e463f5d92160ec7cb051d0ddc8d5e4df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547567, "uuid": "b932ccd7-2c8d-4560-b1b3-730f8cdc2bc5", "comment": "Malware payload", "value": "de49467f6354639f275f863b26622bbaff913889d9eea2513e4d15afb3781b026b5eb3258c24e805b113cb76fe344820", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547567, "uuid": "f8cd9783-f2d2-4b3f-8872-0d3cca32df47", "value": "5C747E10A7A0D034E6BA35B44977927C962A7DA1EB2450DF22C47BDE16F46E0BC317CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547567, "uuid": "f3ae4f20-9db9-449b-a925-f3d290e7141a", "value": "65eae6e52b44289274f3a58ea6f50195", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547567, "uuid": "1374eb14-150c-4bc9-a112-68f52d68fe23", "value": "6144:yr+ImlPprK2MW1GD0NIyAW5CPhP2KtXlPtUNNiI:yABrKMMgN4WYhtAV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622547567, "uuid": "59fdfcaf-ca92-42c5-bb60-287b8809ef5e", "value": 344064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622547567, "uuid": "212ca80b-9136-4da1-8de1-9537f2ad0d45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547567, "uuid": "3bfd8fe7-a7e9-4d26-af89-d7b04d033b86", "value": "SecuriteInfo.com.Troj.Kryptik-TR.15526.14317", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81fb6746-c2dd-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622554218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622554218, "uuid": "b01b09e0-e169-458b-8679-b53a25c5c2a9", "comment": "Malware payload (AgentTesla)", "value": "378ad04ea9867662eb5fc237b882d4fe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622554218, "uuid": "12e476eb-7a9e-4aab-b8d1-b70c1141ef70", "comment": "Malware payload (AgentTesla)", "value": "bfadfb761d44021eb935ec613326ee43d659786c8c5127a44191756cbf7c5546", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622554218, "uuid": "686ae76b-22a8-45b2-b60b-ee7aa327d448", "comment": "Malware payload (AgentTesla)", "value": "9e286932d933b6a5a303093ae5dfe5d9a2f5d331", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622554218, "uuid": "89cb0f16-8578-4264-97cd-f8d888fb3684", "comment": "Malware payload (AgentTesla)", "value": "35b6c6d0912f118536ffb91e019d07ec6a5df128880e8b68e0f926435c4921ea1cb37cc3b80af573d28c66519015e7d7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622554218, "uuid": "11060aa5-52bc-4c93-b513-2c28fc31b40c", "value": "A574236C32C0747AC64391710CB66765EFF2C31D8768A62727E85F3E1CD59A38A2C653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622554218, "uuid": "ac616be2-8679-4a95-83a7-1a7ae935d4f7", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622554218, "uuid": "c680213b-2523-4737-af13-c18cbbeb191b", "value": "6144:8Qq+jQjvczRdkMGfRBityZqMTUrCK7I9BBI8POc1aADk+Mmyj8NOQp:TC0zR1GJBOCqMTvQIuQfDRdyahp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622554218, "uuid": "8af28c63-8a06-4a29-a59c-06c226f3e9a6", "value": 348899, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622554218, "uuid": "86a07e47-24de-4b3e-8582-78f3411c4df1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622554218, "uuid": "73b2cb0e-9cb2-44e6-8c94-13bd297a6ee9", "value": "1092991(JB#082).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aa0f343-c29f-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1622527550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622527550, "uuid": "af0cb007-18ae-4d90-b41a-b38f225346ed", "comment": "Malware payload (RaccoonStealer)", "value": "a2209ec8a3533d25e654a3cc3492a0cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622527550, "uuid": "a112d386-bf96-4dc3-9d62-8b84e52139ab", "comment": "Malware payload (RaccoonStealer)", "value": "c014da0473a1f16ebcb8b1b1d6a5655d0f240474874b1e413643c459f3279a15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622527550, "uuid": "756dfff3-fd9f-4a66-acc0-62583d312aca", "comment": "Malware payload (RaccoonStealer)", "value": "6314dc5728f1164eabd936cf4b9027167eaa962c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622527550, "uuid": "0217cdd3-3e58-46dd-9e22-843feac2fe2a", "comment": "Malware payload (RaccoonStealer)", "value": "5d44b5682b03329bbab3900acf70a6553191951eff9379daf8a281b94d8d45c1e940de1cd0b77d295b57add49e65d98e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622527550, "uuid": "9a1fbc78-5f72-48b2-8b18-bbf153edca34", "value": "40D4D13176A1C031F4FB01F445B642B965BABDB15B2410EF62D42BEE5E346E0AC31B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622527550, "uuid": "a67bdcb3-adaf-419c-9cfa-44b965c7d8dd", "value": "1b2eb0959f4570acd48df61d115e8278", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622527550, "uuid": "062a6677-a0ed-4f72-98c2-d7e390afa032", "value": "12288:AHJNn+piIaw1zSzxwknDubM9OMYz1lNQosXYSOU:knnsaCSdbuo9OMYzz9U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622527550, "uuid": "9f01f323-e962-4dd8-95a2-3350056f655e", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622527550, "uuid": "89b3ba19-c7b5-431b-bde4-f5526ccfc52b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622527550, "uuid": "0d2c78d2-662e-4244-a9b4-229a16da6e6c", "value": "a2209ec8a3533d25e654a3cc3492a0cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fed88b50-c2a2-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622529088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529088, "uuid": "48df9bbf-b993-4cf5-89b2-33c29f291ebc", "comment": "Malware payload (Formbook)", "value": "c10a7846dcb098b6ffd4178a2fa61f08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529088, "uuid": "5ea67058-d8be-4e22-b1e2-cf7b0ffa5dd4", "comment": "Malware payload (Formbook)", "value": "c0a85e3d2a434a3d0fde56c52dc8bd8b2989e803e24250661762946f807a7fc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529088, "uuid": "ff798453-20f1-4e08-84cc-5d76e37a102c", "comment": "Malware payload (Formbook)", "value": "6330ae1086cfba1365256b699df2fe0438ff3fd8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529088, "uuid": "bc455853-abe7-48a2-9b5f-d5e4b916c36c", "comment": "Malware payload (Formbook)", "value": "08b1c8896768f113b7dd741d5aafab434becbfca6de6ac7e22b404744b327f61fec46407d2b9954c7cae18c56b965902", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529088, "uuid": "e6a1358b-ce40-4827-88c1-ca8a651c698c", "value": "3975E0AD3250B6DFC457C872CA985CA4E76070F79B0BD613904715EDAA2DA97CF280F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529088, "uuid": "11af96cf-3376-465c-ac64-cd27963a7b72", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529088, "uuid": "52f7b028-b61e-4834-9e20-0cc324870c43", "value": "24576:klVxpe4+hECQ2IPFdYy1ZjUxGptoxYmNVVGOxiM/BNLbBQPK4YdP+IRVuOalEixE:U9+7QhV/UxGpGxJOIiMJNZQPKdd7Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529088, "uuid": "234955bd-bce1-4664-8934-8cc158b5d293", "value": 1702912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529088, "uuid": "f82a8fbb-edfe-49c7-9bb1-c6f1d060e7dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529088, "uuid": "9bd3d7b8-aabd-4b5c-a909-c61d3b0fad99", "value": "Order_Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ebc0a78-c296-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622523772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622523772, "uuid": "0c3c3fd4-0d6b-40b5-bb6c-04b2d712d42d", "comment": "Malware payload", "value": "4567910e5ab113f08eb7edd48152074b", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622523772, "uuid": "d3f9e890-e894-49ac-9719-02315a42c69b", "comment": "Malware payload", "value": "c0be2b35778de9b2feb0740482b838b4b774e6870cf12f18799624b54cdf97f0", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622523772, "uuid": "59f0816d-6eb8-45b4-a740-404365b6dd57", "comment": "Malware payload", "value": "af5213aa157cc35875778cdf85bb70673b66e53b", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622523772, "uuid": "47030467-8501-4c02-8edd-ef0d4d4ead33", "comment": "Malware payload", "value": "a7567708a8a74d89a8910c1ac5976079e0bbc11ba29f5a46f3a8b9320c45f7810ce0a0a7d8c760d5a8f664cea9d215d5", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622523772, "uuid": "ac3894c4-f8f9-4939-803a-4ccfeafe1fa0", "value": "F7A3F13113FE522FDF418E73F4C9116BD06F092A9BA647462C74E295235FAC3DA79282", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622523772, "uuid": "d60492b8-b03b-497a-b55a-384caadb6328", "value": "3072:IDGWiDNSo5+XklfIzQf0FfitRE6xXOpJd/Wr9Eib:OiV5+XcIcf0FfitREiXO1urv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622523772, "uuid": "3f5e3fcb-660b-41bd-806a-8588acc5f100", "value": 104894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622523772, "uuid": "cd307b65-2657-48cf-98a9-d57939d08d36", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622523772, "uuid": "044dac3c-ba90-4821-909d-3931f9a345b2", "value": "info_10621.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23dd22ba-c2dd-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622554061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622554061, "uuid": "dadc2693-6fd2-42b0-9c44-f1102fbf1813", "comment": "Malware payload (AgentTesla)", "value": "2df0ea060515231f54f92e5056de5be8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622554061, "uuid": "9b2ffb5d-4a7b-4218-9db8-8107d4d2f313", "comment": "Malware payload (AgentTesla)", "value": "c1ad3f41f8cb6a2735908b39d8e926861959019cf90c7d60570c0ef0a7cbc3b1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622554061, "uuid": "1e4388f9-ef7b-4139-9b96-f7f2df760886", "comment": "Malware payload (AgentTesla)", "value": "0c929fc9028f7fc70962e22535f67abfe0afe041", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622554061, "uuid": "199e0760-aede-4575-9b50-270747fc3925", "comment": "Malware payload (AgentTesla)", "value": "622c9dd7d397f52cdc7dce34410a1111ced711de06a43d329376a5588e9029ed6cb007e25310cee05437aec2a5d805f0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622554061, "uuid": "d9d41d0e-1f43-43b9-ba1f-0e1a200ef462", "value": "C7055AAD325075DFC867CC76CAA81C60EA2074BB970BD203A02715ED9A5DA9BDF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622554061, "uuid": "ed5085f2-8b59-4008-8ca0-8979d49bed13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622554061, "uuid": "f2488f20-1d3d-4fb3-aa80-e9890f890060", "value": "12288:+C1eeetbwlbquct8RPd39GOfp2K6jZMplxqKPCeuE3FkoVaUPVe8OyjtY/OJGZ6H:p1eeeFwlbquFd3gOfOjZMpmKN2C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622554061, "uuid": "94de8d59-f848-47a9-862b-c1da9f655982", "value": 846336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622554061, "uuid": "79ea7c04-d494-4d32-a244-4a9fca483bdf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622554061, "uuid": "6ae88160-1060-4597-a787-74af083e5d77", "value": "\u041a\u043e\u043f\u0438\u0458\u0430 \u043a\u043e\u043d\u0430\u0447\u043d\u0435 \u043f\u043e\u0442\u0432\u0440\u0434\u0435 01.06.2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af72b1fb-c2a3-11eb-875b-42010a9c0053", "comment": "Malware payload (Adwind)", "timestamp": 1622529384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529384, "uuid": "3d5e5e29-2d9b-4618-88e1-4efb17cee809", "comment": "Malware payload (Adwind)", "value": "45cf302955e4d2b0e0a30dc1c49ddac0", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529384, "uuid": "d38c555c-947b-4cd7-9721-594f6b5dbf65", "comment": "Malware payload (Adwind)", "value": "c1c8c97d61298cbc22b8ab7341f80784b4c9cd665e641d2895beb2b8b445a6a5", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529384, "uuid": "d4ea7dab-87cd-4535-9edd-2cd7d48bbca3", "comment": "Malware payload (Adwind)", "value": "cb8c7695f1e1424b889d4ddd84822dd2e69c48e5", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529384, "uuid": "2095b98d-5dd2-4903-bd9d-b61750696797", "comment": "Malware payload (Adwind)", "value": "0e6b7dd346769f3bbff382704f92165c3f36926a55b4c926f32e40dec0c1184c2cc3cb779d5aef90d4db706229291064", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529384, "uuid": "6884bbc7-cd68-4b16-9081-51f44c7a3951", "value": "816423CA0CD4B470F167D6B517CCBFEB9B2E1DA9C978A92B23104DDB59F9112302A931", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529384, "uuid": "779c8796-1f32-48bf-a05d-868c299a46dc", "value": "6144:uo+OYedXZy6/Yjln8W+RmF2jke/6wHrL4rdfSim+HyV:uovNdXwkYRnuRMoJHwZfSim+HyV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529384, "uuid": "5d85bf32-5dd6-43b5-aa2c-e1c586931823", "value": 321748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529384, "uuid": "390be4af-4553-44e0-8199-8f49135739b0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529384, "uuid": "f50955b9-a8c5-4f9a-8979-1fff5eb281cb", "value": "4Li7SMlvwu2ja.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d81e020-c2db-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622553352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553352, "uuid": "a338d3af-00b1-4ce5-9213-45a44a2d3773", "comment": "Malware payload (AgentTesla)", "value": "ab33310824a43c0836c063cb32937f8b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553352, "uuid": "48284acb-51a5-4933-be86-b1b2b3a153f0", "comment": "Malware payload (AgentTesla)", "value": "c479ffce9f101b07f4f6983b3f90f7187966554681051145610b16d84dfc59ed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553352, "uuid": "672aa32b-de50-4a85-acb7-61aa0dc29218", "comment": "Malware payload (AgentTesla)", "value": "60af23fedec2aebe375b4b2469f75e4fe5e3629d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553352, "uuid": "54fb7420-ad7d-48e8-b369-8bf7ce54b5b8", "comment": "Malware payload (AgentTesla)", "value": "79b39a94421c145e8bb165a42b3455906e97e815699cfcfe3143421e8e4a6fa6395ac2af1330a6dacc87e43f6f2b0c9a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553352, "uuid": "f0d4f440-baaa-4ee9-b353-8f57a41fdd6c", "value": "44256C993140B8DFC457CCB289AC5C60EA6078BF431BC20B611326AE999E797DF152F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553352, "uuid": "1398ce50-cf8e-43c8-b583-d89632adaa39", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553352, "uuid": "ed1f2887-9a08-4cd5-be84-1c9f3460ba46", "value": "24576:3rk7fyz+syjI4koNq+HmwaVpGDNQtkqdH:3rlIj2+Hmwa7GDNQXt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622553352, "uuid": "752c6dd6-56bc-42d1-9dd5-f77e4a55baa6", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622553352, "uuid": "7faa3a37-7432-4edb-b1bf-5dfa26d3c0e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553352, "uuid": "72a38e58-34b3-48f9-87c0-56d4945ae4a4", "value": "Denko 562182.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb5b313c-c334-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622591681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591681, "uuid": "53ea95d6-ff0f-442d-9e49-3788f89bbf29", "comment": "Malware payload", "value": "8ece22e6b6e564e3cbfb190bcbd5d3b9", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591681, "uuid": "25632754-7b5f-402e-8073-cf219597695c", "comment": "Malware payload", "value": "c4ff632696ec6e406388e1d42421b3cd3b5f79dcb2df67e2022d961d5f5a9e78", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591681, "uuid": "932160f4-cf3d-480d-af79-dd05ac7d2f9d", "comment": "Malware payload", "value": "95227f426d8c3f51d4b9a044254e67a75b655d6a", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591681, "uuid": "b90e1bc2-9187-4d89-b045-5c1e693cd158", "comment": "Malware payload", "value": "a12df5c595b03c54314e310c8c11b984fa44def2f29cd7db5494a06e409a83fbc7fcda807985454747930a8aa0bd78de", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591681, "uuid": "3b3caff3-cf13-4b09-ae40-61ee2a912f7e", "value": "8854C00665E0CD30DE6A0F770B71DBE31D2EE6F2EAE44984E64B8E5F16300416C75AB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591681, "uuid": "b93c1ff0-929c-430e-a31b-a52acb86e413", "value": "bfdc3c80c56a38472bdbb1c4998142b4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591681, "uuid": "5d61be74-2049-4ad3-ac46-146201b75b67", "value": "6144:LUeZMRpbWn2Qsb57etoPnhoHCPlSHm5kvnnnn28vyd37:LUXnuEt7eOPnhoiPl6m5kvnnnJvw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622591681, "uuid": "f234a7a6-b3dd-49c6-96cf-82c111de9dab", "value": 284160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622591681, "uuid": "26ca3077-b616-43fd-8d89-b53e66f9f477", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591681, "uuid": "f792614d-eaa7-44fd-bb91-f4222f1cbd0f", "value": "c4ff632696ec6e406388e1d42421b3cd3b5f79dcb2df67e2022d961d5f5a9e78.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdfe0a01-c2ce-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622547984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547984, "uuid": "6effad9d-dad5-40e1-9f0c-3c527be10720", "comment": "Malware payload", "value": "c1277f0e2a1cca89bcb187e12c8655dd", "object_relation": "md5", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547984, "uuid": "35bb34cb-6b93-4f06-8f7e-7e42a65884ac", "comment": "Malware payload", "value": "c573e50dea472e8d90c89c652a3000953e2cac444007069ca2c08cbaee16be6b", "object_relation": "sha256", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547984, "uuid": "a18746af-ff68-47f9-bba3-e24c3364fd77", "comment": "Malware payload", "value": "075cee429d8c540bad9ca8f09ad082fdc525d20a", "object_relation": "sha1", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547984, "uuid": "63f9c753-c6a4-42af-a69d-bbd9b7eabc02", "comment": "Malware payload", "value": "5e2eb166dde36de9f6a2678f9acd53a6aa8a0881243b2fc8d932fd23d09e9d2f0e867b564d6022303aea1c813892109c", "object_relation": "sha3-384", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547984, "uuid": "a89b4899-94d2-4734-84aa-51dbc6d6d8c0", "value": "2581CBDC6133A8A9DA323553E00DBB6D82612EA7F41E74F09A8481011F66F8DD368F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547984, "uuid": "b004fb04-c3ee-4dbc-be6e-28f4b0af31aa", "value": "96:nap44nsgCMSzcMPdztqBu7MDPJ961MJ4m1SDFeMe1:nap442M8VztD7Mn61MJoxeMe1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622547984, "uuid": "43f7d9fd-31ae-498c-a41c-0590d868e8f6", "value": 3837, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622547984, "uuid": "3fde5232-c545-4dd2-816d-50bd94babc64", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547984, "uuid": "64bffcad-1ae3-4e3c-b3a7-c4dc1806beaf", "value": "c573e50dea472e8d90c89c652a3000953e2cac444007069ca2c08cbaee16be6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c88d03aa-c2da-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622553048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553048, "uuid": "1827d068-8d67-4b7a-a9f4-30b984da168d", "comment": "Malware payload", "value": "93819018eb34f8c5e4a2385f2bb5d592", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553048, "uuid": "3ab6ae7a-9f0e-4823-ae6f-6ce0b0565c04", "comment": "Malware payload", "value": "c584d4691284d390817aa3f810f2aa707bacd890ff6df97175a72c8337090655", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553048, "uuid": "537807f2-6e3d-4faa-90f5-69917e7fa60a", "comment": "Malware payload", "value": "9236b6a515c3b810086636d9bd3f6c5b7da9efc7", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553048, "uuid": "a63dbc04-9eec-4876-826b-3e9b4700e6b8", "comment": "Malware payload", "value": "588777fc9cee2135a430f3eea3997311cd8d2f3e9431f55f8244217bb5107b061d606802766224fdb06b1d015b6f281e", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553048, "uuid": "56f4b983-88e9-4ebc-9ba3-f4b4877a8779", "value": "7BC3BF9276A3D906CD4F43792CE682CB2752BC114E7F42B7B7A5FB0ECB71A84490251B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553048, "uuid": "7e33d7a7-57f5-48db-bde0-1bbfa9cd447e", "value": "3072:sk3hOdsylKlgryzc4bNhZFGzE+cL2knAnioo1gaSNAPZesWFPO7YiR6PJEcjjaPk:sk3hOdsylKlgryzc4bNhZF+E+W2knAnG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622553048, "uuid": "4784c1ca-aa17-4725-9ce7-202faca71677", "value": 120832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622553048, "uuid": "2bc610e9-a030-4e05-b50c-8811f173a7e9", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553048, "uuid": "d794d1a0-34ea-4075-8cd5-b88736ea31c8", "value": "INVOICE & BL.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6819d4e1-c30e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622575220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622575220, "uuid": "213ac7d1-1356-4f0d-b4ec-df7353570270", "comment": "Malware payload", "value": "1ae4d6a5c20958063c09eee0c1377146", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622575220, "uuid": "a02549fe-16f5-444e-be38-0124d1fb4d2b", "comment": "Malware payload", "value": "c6095efbc3fa0679130dad3a60448c62b1a5484bf21bce1e7da68c3624c73bc1", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622575220, "uuid": "688f2877-f3d0-4ba2-80f3-66419cc74f32", "comment": "Malware payload", "value": "cb4735075f6ec340194d01208e6b4f34ca2761cc", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622575220, "uuid": "63cccfe5-a0f1-4ae9-8d2e-b7ac235c6ae8", "comment": "Malware payload", "value": "33f389c9821e27b3b46a4ee2c594510b52a6290451ee188ee8d1e156b9bb7a35a1102c1c1f1c291dc7e8a0a66a708b1e", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622575220, "uuid": "c187ea94-d833-4443-8506-00c93ef215c8", "value": "A402B516B916B69093FFA2F831790D44A17A18B7037B8F6177820F6328119B49D5D8FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622575220, "uuid": "fd1b39f0-d8cd-45dc-82b7-5ac8836358d7", "value": "192:VAbGcpvXvf+7sF4CyVQByoKo1siOBtNItUtqjG:ybv5Xvf+AF4CyVQByikbsUtqi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622575220, "uuid": "e17f0bab-24ca-4e53-9f15-a932d6fbf1cc", "value": 8517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622575220, "uuid": "99d869c9-a589-4bfe-be03-765faf2fa00f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622575220, "uuid": "f1e73929-667e-4b89-9da8-00b3ebda5d6d", "value": "cu_Clients-Status-062021-1.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6240da3-c2db-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622553447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553447, "uuid": "c12b39a0-41e1-4af9-926a-c4c523caae37", "comment": "Malware payload (AgentTesla)", "value": "91ddd11a2e082ae3bfab11c255fa2020", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553447, "uuid": "46f0af70-6cb1-4de0-8e16-74c4bdda668f", "comment": "Malware payload (AgentTesla)", "value": "c65dd45fb74c07111e2af32a6fae4aa6c8035950f0fe2b4a162db0439f85beb1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553447, "uuid": "7fe5c507-46b2-4c42-a740-9ccf4e9e8e55", "comment": "Malware payload (AgentTesla)", "value": "6bfa8925e311f8dec43ab209ab4839aca884d2e8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553447, "uuid": "965c8ef2-986a-4a2e-8eae-8415b0e31588", "comment": "Malware payload (AgentTesla)", "value": "ab5bf6f46e1cc2c8c2216bea5616ad0c93e77cd3004e35bb82e732d915d3bdf3f9c7f1cac55f44cb66efc894db2655c8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553447, "uuid": "17400646-cc13-4237-9fd9-6e99fc2bd672", "value": "C74529F9F241D4D0F51E95B2CE90BEF846126DBECA070D1B026A7E89353779B4B3A046", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553447, "uuid": "29a4013a-ecd9-471e-b7af-bbe95e902292", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553447, "uuid": "1ea7fe4a-2725-4af0-b304-306e887b5f5b", "value": "24576:eiK9FEDAgnMrxXR21iIBa4NP3Ju+EO7GIfNV1:jNBa6P3EGG+v1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622553447, "uuid": "f5171af7-7114-49a1-94de-ff9fa3f733b6", "value": 1183232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622553447, "uuid": "d5485ada-ba51-4db7-86d7-09ef89d609d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553447, "uuid": "aab592c4-1749-47cb-a9c2-9e5bf8cfc423", "value": "PO 12398.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1af21f5-c2ae-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622534219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622534219, "uuid": "5fff4df7-31a1-4e2d-bf40-dad7d44f99f9", "comment": "Malware payload", "value": "22ba311614e7f32e0cf640ccf4332aac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622534219, "uuid": "5d64bff3-a1b2-4437-a8c5-31bbf3838164", "comment": "Malware payload", "value": "c80093c797c2a14fbe1fb155385bce36db05bdaac63fb63656f37bfe27e6bb6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622534219, "uuid": "3cdd91ff-27df-4e12-98d9-99bd2cb5730d", "comment": "Malware payload", "value": "d2a8f06db2fa76e0d673d9ebb2db464dbb7096ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622534219, "uuid": "ffdb1596-b055-4594-ab30-6f0f4e595f77", "comment": "Malware payload", "value": "4c9a4d85f21a9379db6e10411dca8267d59aa48bb47a71986d43018a3743f5d366e8569960ed503f11248f2ad2d60ec4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622534219, "uuid": "927f61f4-3436-45f1-b450-276ae5936c8f", "value": "0A64C010EA42C038E9F662F846FEA27CF51C6B61434C75CB53E56AF6A3782E47C3145A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622534219, "uuid": "d1a60ccb-ab05-4eb4-bda2-1774f463264e", "value": "6144:f07t1Z2BYfYlH8/qe2vdQA7R6SST0XbPoqwiku2tdZR4c3g8Yrr:f07t1Z2BuYlEqe2lQA7IhT0XbgqwJdZi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622534219, "uuid": "42df0da3-5cfa-4cae-8837-ea8acd44f2a2", "value": 331974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622534219, "uuid": "46ca0db6-8871-4cf7-afd4-c86b2aa1d08b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622534219, "uuid": "4a803c7b-3135-47e1-82bd-a5aa13b34411", "value": "22ba311614e7f32e0cf640ccf4332aac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "631e3618-c334-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622591533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591533, "uuid": "c41e0d61-81c0-4e00-8fbb-07699f4152d7", "comment": "Malware payload", "value": "38b6350d870097140de562bc359c8bae", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591533, "uuid": "12ba9286-5806-4c97-9c6f-d7ac1d44e55b", "comment": "Malware payload", "value": "c95553a61737cf5bd154fc530d14651320bf1765a93363caa266146310ae3c2b", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591533, "uuid": "e6cb80c2-6b15-4880-902a-ee23a8417637", "comment": "Malware payload", "value": "67e7de31a5dc07f3fb8a10e2f8e8fb01754273cd", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591533, "uuid": "1f9b1d16-1164-4de1-84ce-00cb302c528a", "comment": "Malware payload", "value": "bb984c880e940bc1a595b4ba588cc26bf6b2fc05c50c5eb135d8508cb0d7d72e59f702d0ba2b788022eeeca16e6eedbe", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591533, "uuid": "7d57bc8d-69f6-422d-a539-66882729322a", "value": "F3852302E5EEB45B8FE5463C6B16644F2D8730BED069DAA2185E433EF1C4F9B145E0A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591533, "uuid": "a2f9f5ac-393e-4b07-a551-5f4451a8c454", "value": "24576:VJ6bSYhOnNDdbUB4B9YiI7CvJoNOHy3I9hOTA7io:76bb0DoUYqYo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622591533, "uuid": "ba42f08a-4693-47f2-9c3b-3b0956088a2a", "value": 1750795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622591533, "uuid": "dd8a2d69-61b8-432a-95ac-0b14b361d3c4", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591533, "uuid": "f1b58964-52e6-41db-8aa5-d8a355136946", "value": "c95553a61737cf5bd154fc530d14651320bf1765a93363caa266146310ae3c2b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0585b890-c2a3-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622529099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529099, "uuid": "1665b4af-40d4-4491-90d2-39568f9aa3c3", "comment": "Malware payload (AgentTesla)", "value": "3ffb40cda8d4ac072ff5febf9bab5def", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529099, "uuid": "ca0fd6c7-2918-4173-8ec9-2ec62d8a0c18", "comment": "Malware payload (AgentTesla)", "value": "c97c2d72553b6f818ebb58b1ac6157c7e072b628015577973fa862ca0d2ecd77", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529099, "uuid": "5f765ace-d014-4548-8732-fe63ee125cce", "comment": "Malware payload (AgentTesla)", "value": "7112d37c6aa3f17d3f0ccfc08dc545f3bfb593be", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529099, "uuid": "3da5c0fc-c21b-4912-a558-8eb866008d87", "comment": "Malware payload (AgentTesla)", "value": "32b4d4d8df682fc9afc60c35b09df50047f00ae29451be779b08c5f1a0f3b71b4922334388956252d6da1a5dc9049741", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529099, "uuid": "7035c410-e206-4363-948c-a406d28866eb", "value": "7E355BE4FD59B86AC14ED731B28098FDD7631DFA028A4BA906E7FECD5B037494B48481", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529099, "uuid": "0a830df2-2f54-472e-a78c-1e8b289f8e5b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529099, "uuid": "a4413aac-897c-445f-a28a-07392ecb8296", "value": "24576:nVPaPrOWEaN29SXqQic+ukyu5C46CfLc:nVCq37BQicgBLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529099, "uuid": "21055190-0079-490b-b496-cc91e6801c38", "value": 1118720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529099, "uuid": "5113261b-f26f-4d62-82bb-8cd120ea6e2d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529099, "uuid": "05ac8fbc-deba-41af-b739-86aa150767fe", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ed2b52d-c2a6-11eb-875b-42010a9c0053", "comment": "Malware payload (Stop)", "timestamp": 1622530537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622530537, "uuid": "b902f056-af7b-43b4-b9a3-0ad570fca82a", "comment": "Malware payload (Stop)", "value": "d5d87a9ddbb8270ab43876de5c509129", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622530537, "uuid": "08ae3660-efcb-4d8d-a4b0-55fc1f15d2a0", "comment": "Malware payload (Stop)", "value": "c99e4f2caf88e6ddf956c1473da6202a35eb235bd9dc835241785f2174476ec5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622530537, "uuid": "6f6b6ab5-32c4-420d-b0dd-a11176855f46", "comment": "Malware payload (Stop)", "value": "da422ddec5dd3bfffa23964ebf9b5ce012a50eb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622530537, "uuid": "1ae02f1c-15dc-4855-8550-5dc20da3ff89", "comment": "Malware payload (Stop)", "value": "5bfbb3dcb7d576b52ec826b7b06a8bee3e15e46005d81a90a2cde8749f1de718df80515fe9e08044943c4d72eaa200ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622530537, "uuid": "267af670-307a-400a-8bcf-278d528bacb2", "value": "5E05F100B6A0D034F5F376F5967B526D952A7DA2E72850CF23D4AAEE2A345E0EC30707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622530537, "uuid": "6bc89974-222b-405b-8c21-03ec758ce345", "value": "2f20facc3edc1d8ba24ede1f07abf090", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622530537, "uuid": "5b8ffb6d-9f49-4f7c-ba5d-a2d95b6e812c", "value": "12288:J0pGvVPVrvzjQp5LBuTpjCSwT7DHzMbz4ltVr2+TKOPgYRKVa5iTwSgvnr34k64i:J08RVrvztpuSkHljrzWKRYdwxzos/1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622530537, "uuid": "9a03604b-3b8d-4931-8e4c-219d88b90382", "value": 862208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622530537, "uuid": "7e4d7c1a-e7f6-470d-8024-0c953a35be10", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622530537, "uuid": "dc170ff0-8eab-46b8-8f86-7f8f5b3c7bff", "value": "d5d87a9ddbb8270ab43876de5c509129.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c74d947-c334-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622591549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591549, "uuid": "32ed47ba-c23d-4d56-8b9b-6a730ece1456", "comment": "Malware payload", "value": "f5a9d696828051d4487dde248a973658", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591549, "uuid": "e1288f82-5dea-4ff3-bf2c-508afb82ee34", "comment": "Malware payload", "value": "ca83d7456a49dc5b8fe71007e5ac590842b146dd5c45c9a65fe57e428a8bd7c6", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591549, "uuid": "7a41e379-8fdb-4fcc-80f4-9b2819ca109b", "comment": "Malware payload", "value": "0588cf19b8058d5a842f9d3e9b02b3acf2524d71", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591549, "uuid": "78ab92cc-1407-4ed0-b54d-eaf05af8f38e", "comment": "Malware payload", "value": "f43c5256047a046bb35f7a27863255e09d9b8986d00503abe4c76734757df3f73a928c8a1779e062c3706e6f0b3b836e", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591549, "uuid": "0a1f47c3-0033-4215-a563-61fe2db05950", "value": "2C85F1325A11BECD032C2D219C0B1FD71DA84EB38AA95276EECD117652DCA91CF2D97C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591549, "uuid": "030a00ac-cc1a-4aae-bc60-b2a2616f3f08", "value": "12288:Mm+EHsGXLROXV/IoWjsinN8orndcBPwnms5I1kD4Lrwzc:MmhHR9OXV/I+iN8oRcLB1k8gw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622591549, "uuid": "6ad2c4fb-6ce9-4d7d-b286-e1d8edeef563", "value": 1805635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622591549, "uuid": "5e07d94f-66e4-48f4-86eb-a6fa46de1990", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591549, "uuid": "5d883ff2-40d2-4dbd-8e7f-dee9ad970c2f", "value": "ca83d7456a49dc5b8fe71007e5ac590842b146dd5c45c9a65fe57e428a8bd7c6.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac8682e4-c2bc-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1622540116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622540116, "uuid": "f26f58e3-d354-4f8a-b826-df9382443c88", "comment": "Malware payload (Loki)", "value": "caff8e48d053af211cf2964868f1acfa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622540116, "uuid": "e9220389-db0a-44e7-8cf7-2f7422663c91", "comment": "Malware payload (Loki)", "value": "cb4c7251ab8b703ca6f52e0a0497e4814655cce0af71292c827e7622f2497cdf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622540116, "uuid": "e7fe3473-a754-4570-9386-77c436856f6f", "comment": "Malware payload (Loki)", "value": "cc0d58bad5fbf7680f8ee61aae21eb4f9a653385", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622540116, "uuid": "6a3ad269-273a-4cd1-9a2f-f978363d734c", "comment": "Malware payload (Loki)", "value": "511bd4df8129b0da2cda25a8e70167bede870a713a520d55c214359cd5ac98061c6e39f7332efc44ae045573579e684e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622540116, "uuid": "dceff10b-9d47-4a0f-8580-5896834be7f7", "value": "CC057DF4F498AAB1C18ED732CB90DDA9DB6216FE52038C1D19B4AA8C1F4379F9F49405", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622540116, "uuid": "ca3a15c3-8b36-4438-97a4-211d7e7460a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622540116, "uuid": "bb72815f-a45b-4f8b-867f-c9789c536dd6", "value": "12288:af7R4vT/2zHykweOLXHImA2DDXEoylGdiq1qaRJtH8iPLcMNkaj:abzHMeVmRYoyOH0aHtc2LcMNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622540116, "uuid": "78a7efa0-5d86-4ecc-8374-3fdcdcbc7f52", "value": 865792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622540116, "uuid": "d58298c5-3c21-4dbb-b38d-d829be41bc63", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622540116, "uuid": "af78509d-fe63-41dc-9c69-92ad6c32c573", "value": "3257980ZDEFE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1220e946-c299-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622524825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622524825, "uuid": "92253ade-78b1-4e36-87a2-831f35743c4d", "comment": "Malware payload (AgentTesla)", "value": "b4ae916da2fc9f01d740f9b30540683b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622524825, "uuid": "7bac5863-f244-4bd9-ad90-4fec893b68e5", "comment": "Malware payload (AgentTesla)", "value": "cb5886b32d69ada891e76c44fe52aab8f9c4c247683dfea49d15a7c56fa9aad5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622524825, "uuid": "960cfe49-5be2-46a9-a37d-639b750bb0c3", "comment": "Malware payload (AgentTesla)", "value": "ed03dfb832bce874829c6ce935b634f2ce97961c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622524825, "uuid": "67a19013-b92e-46e7-ba22-fe5c0cee1a58", "comment": "Malware payload (AgentTesla)", "value": "2bca35b8c9867c4ce8c691b6f980c859e1fc8c31f728ab9ae43860f58ac6d7f1ed415e32cc323c647952bae470571db0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622524825, "uuid": "84303e02-b659-4cbb-8a84-f7fb487c1a55", "value": "E6E433C13FFEC0019925A1DC4CE726AD9784F2A2E64E039B1B151D90DA723AF68C587F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622524825, "uuid": "871e075d-7a8c-44ad-ab27-198164c1b8d9", "value": "12288:QOBCDBrx5ZloFRzBixRzzHtLGHqEvuS7oDXJMA/FmpD1ktO0748Z6e0rsEe/:QXxrZl6RzBeRzzHtLiquMD0ppktO074y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622524825, "uuid": "b69cfd49-02bf-469f-8239-ed9ffddafd66", "value": 664674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622524825, "uuid": "ee65617d-f6fa-431d-a359-cd2a7e99a81e", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622524825, "uuid": "1203e258-5b82-47ce-822e-3e8674374eca", "value": "1092991(JB#082).r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e694cc7-c2e7-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622558373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622558373, "uuid": "6538adee-247f-4518-86d3-ac7a92ae9ab3", "comment": "Malware payload (AgentTesla)", "value": "95f298a059540d591a86e304633891d5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622558373, "uuid": "8706b5d4-5b82-496d-87cb-59a47ab7edbd", "comment": "Malware payload (AgentTesla)", "value": "cc142b7644620489d2089420393e993da44646556e480d3351731abbc39be90f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622558373, "uuid": "0185f24f-e152-44b2-ba9e-7d78d2935ece", "comment": "Malware payload (AgentTesla)", "value": "aa213dcbb1ba427426b6d160bbf9d5c4d61468a6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622558373, "uuid": "67730884-0e8a-4be6-8092-149808de9376", "comment": "Malware payload (AgentTesla)", "value": "97ec2cc5277465059b71f219ac2d6d66bd677307b2d4291990d7627102f6b2dd1bca0ea77938977b6a5102bb2577409e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622558373, "uuid": "c49ae3d1-891d-419d-ab92-8187e4d53025", "value": "12456CF0F094C8E6D95FC7B1DE56AC3466A26EFD5151440C06A9FB4D2BB3346268EC0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622558373, "uuid": "04383511-6dbe-49e0-b544-9923e35cb776", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622558373, "uuid": "25e2676d-5ba8-4fe5-839e-2bc01f251322", "value": "12288:PV4k07YrhvT3VJS9y3SPwQ9VUwxlGRcAjhwPne6/RcYDIIKiroMxR6QCbe4MqfLu:PV4grRV3HQ9VJahczIIKMb6Q94MqHfM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622558373, "uuid": "ffd37ae4-a2c8-49cd-b313-9c98dbe94048", "value": 1189376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622558373, "uuid": "6b3a7817-e2b6-4b60-aae9-3ab05a7a1fc6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622558373, "uuid": "edbce266-a6bb-4c60-a510-450da992ca7b", "value": "P0A2249.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0424145-c2a2-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622529009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529009, "uuid": "86a87064-7911-461e-bad7-5bcf48d84d85", "comment": "Malware payload (AgentTesla)", "value": "daa5cdc8c790bd4ecff76920589f447e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529009, "uuid": "709ed17a-de0a-4fda-b9b1-094f4e023ae0", "comment": "Malware payload (AgentTesla)", "value": "cc1500b501635e035e0950f991ebdce110c0a8b16cebdee094c6c6c024eb7f0b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529009, "uuid": "bf5a234a-6d80-4ab7-bd40-a4177dc859b0", "comment": "Malware payload (AgentTesla)", "value": "030a280d356862557c5df73bb86d6efb59ad8b17", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529009, "uuid": "9b242082-01fc-4993-949b-605a3af87594", "comment": "Malware payload (AgentTesla)", "value": "126be2c6d2e5e794722ee1195a5270235635a014d251ae37a5a4fa35f01115ec548d73c921272461ece3eb28c0a06959", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529009, "uuid": "51a4bf0c-13cf-4d31-a747-55882118d527", "value": "CE25CF251A0D6BD1D3AE49B1809C9D6BC3FDBD935BE1E9281DB020AD2DF17704D206BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529009, "uuid": "3d8ba45b-cf39-43de-97f1-1ab995b56e2a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529009, "uuid": "a6c9ac1c-ed7c-4526-ae7b-5aa7c9527554", "value": "24576:Z1MmCW9pFgXRCeXtBN1mvIHjQHgW0LjnTtrS9R:UWDKXRCaavzH6nT9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529009, "uuid": "bd9d16b7-3950-4d82-bc00-03298bb5354a", "value": 992256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529009, "uuid": "a331e322-9a12-4ab5-969e-5dc79858b9aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529009, "uuid": "7fb1c78e-a888-4c46-9754-0d337b0fe4aa", "value": "1WwWy65zpOg5lnd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9be981c6-c2e8-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1622558986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622558986, "uuid": "bd1104c2-3847-446d-a560-8d2b76da2a04", "comment": "Malware payload (SnakeKeylogger)", "value": "4b6889f89612bdb36af89bab54362e91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622558986, "uuid": "2ddf174b-357c-4516-8c68-100b3dc4e2bc", "comment": "Malware payload (SnakeKeylogger)", "value": "ccad900a2b6cc694ce849b5013b62f54b94be27d5adc750e79bfefbf1b7cc89d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622558986, "uuid": "3334bc48-26c6-48a2-a650-7ad98b52cb74", "comment": "Malware payload (SnakeKeylogger)", "value": "22c9398b9730db79702974f6f564abe36856d728", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622558986, "uuid": "987c6b33-808d-4202-b151-9c21f31d6ebb", "comment": "Malware payload (SnakeKeylogger)", "value": "5b560e8f20b6ef6af79a559dd01f183c5b1b29e9300e74703609054160898c5995865ffc0a62ad15b296bf970ce05f69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622558986, "uuid": "78c7a807-f66b-44f2-8848-f48026d9f5f7", "value": "0415BE23F2CD9BDFC23987B886B4C1B303F159A7AB31D9387EC1A09D45B27589A111E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622558986, "uuid": "d8f5121a-5548-4365-b875-511e4c78ad73", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622558986, "uuid": "be3d6bf2-f22b-4d02-bdd5-6943b92fbc6d", "value": "24576:ySbgGX47b3rHEoD4+UZohXlfHrQhtuCwtlLingy:dgiYLFDFNnY9wtwng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622558986, "uuid": "fca289cd-ad0b-4729-860f-83c6dc8a0bb7", "value": 886272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622558986, "uuid": "4bd4f7ac-9a8f-4699-80ca-af2917a1bbcc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622558986, "uuid": "68bab1e8-a41b-4099-a560-2f164469557c", "value": "TSQ20200814QU1- 100CLT-200J.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a40db425-c2b3-11eb-875b-42010a9c0053", "comment": "Malware payload (DanaBot)", "timestamp": 1622536237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622536237, "uuid": "cd465b64-fbe9-458d-9397-924c825298df", "comment": "Malware payload (DanaBot)", "value": "eb8b5f153ca04d3820f4a2dd9c18720b", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622536237, "uuid": "647cc3a4-2915-4149-9104-ed0f436bafb3", "comment": "Malware payload (DanaBot)", "value": "ccae35d3b441d2baac43ecca7a851b30668a827c161cf3949db352220bd2cc03", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622536237, "uuid": "19259b65-0784-4e7b-b84a-d79487544716", "comment": "Malware payload (DanaBot)", "value": "cc180986232aa0d114f6c80e039cfb6a375d5a88", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622536237, "uuid": "81e047de-3438-4ad4-b69e-68da0c7618d0", "comment": "Malware payload (DanaBot)", "value": "23b85adf12cb84fd6c805085eeb981c5ebf989311e95b6158a3e1dd0e1b38ccfbf6a9571fe8623e8e61d5616811b2921", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622536237, "uuid": "f1351571-cf9c-4228-8a33-6596f9d5a164", "value": "94563310E961E036F2F232B56E3B566C662B3E95DB1010DF13D8A6EF5264AD1EC3071B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622536237, "uuid": "6230f13d-db52-423c-bf79-d87a76b503ed", "value": "0479728b0bbbaea2fc170e4fb90137cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622536237, "uuid": "5f50cccd-7328-4f28-bb8d-40bbedc05a75", "value": "196608:W8PoAmPHyrEe9D1g80K6mCS6UlBEgPBg6w:JPzIyrQNSzkgZvw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622536237, "uuid": "ed668e5f-f329-4466-be4e-85c7f543a1a7", "value": 6333440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622536237, "uuid": "cd3c8ba3-9395-4847-9bd5-4c34b2e4eee2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622536237, "uuid": "0a4c4879-f19e-466d-a938-67506129cf1d", "value": "eb8b5f153ca04d3820f4a2dd9c18720b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22574b52-c2a3-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622529147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529147, "uuid": "4700a455-4719-4557-b4c2-2fcf1376f26e", "comment": "Malware payload (Formbook)", "value": "1cebb408bfa7f1dd659c5e7b3e7898af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529147, "uuid": "37838a2e-581e-4069-b4f2-309f06d29112", "comment": "Malware payload (Formbook)", "value": "cd0240ec5cc27ef31b2a4fc449fb09078ad4a67b2d0743a39588956c9cbf6dc1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529147, "uuid": "416a9c70-69bf-44c2-a9f8-877e25d368ea", "comment": "Malware payload (Formbook)", "value": "c1899db6815e5d4034ca0686ecc2ff7c5f72bda5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529147, "uuid": "325aedcd-5730-4d1d-b492-8439a2a2b37a", "comment": "Malware payload (Formbook)", "value": "07550d6bb4bd918650210da30e7c43479d1fe17a07692bcb64b24525b1ded111895cf12559996eff4c753347451c5829", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529147, "uuid": "c112a4d4-36b7-4320-a0b7-c85fd84ba0e2", "value": "69155BF4F1689BB1C14FCF72C29DBCAE976101FD1242495CCAAD9BBC5AC374A8B48845", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529147, "uuid": "4a11c0ed-273d-4bc4-9669-fada44b816f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529147, "uuid": "45558288-8d96-4ce4-8309-934a2c404347", "value": "12288:M/lZYk5rhvT6sMvo31Det5WHmaNB8lNCHnFI5cntW25HtsUqG:M/lZRrksF5e3WGM83+nsotR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529147, "uuid": "bdbf087e-546f-4a4d-8799-c0d1eea3e06b", "value": 954368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529147, "uuid": "3d68af37-d762-4996-bda8-08e411d98181", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529147, "uuid": "d796c684-3116-48db-85f6-e98da130ef92", "value": "3D For New Inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e63eb3f-c2d6-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622551233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622551233, "uuid": "dc415237-adea-4d41-b823-6a5c9b4cf8b2", "comment": "Malware payload (AgentTesla)", "value": "0498664ba7c638d057a6754fa46095f5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622551233, "uuid": "e2a2423c-a3a3-45be-af13-5925fe2fd188", "comment": "Malware payload (AgentTesla)", "value": "cd39582c37832642af07733f3445011cd7be2b753d70784fce6815ec754f93a0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622551233, "uuid": "557789ac-b57f-4808-9739-74e3efd50ec7", "comment": "Malware payload (AgentTesla)", "value": "794c53326f14857b0f91ea8522c74b1b3534811f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622551233, "uuid": "40fffc51-918b-4bd4-8bf2-38666b0b6cd7", "comment": "Malware payload (AgentTesla)", "value": "0dc6b81aa418ab21b8066712fd59bcbe54b2457c863f67a8923cac7ee083f5f5926d7afae71c07c9b9150e0e74baa74e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622551233, "uuid": "2b6ceefa-e3ee-4437-ab2a-b524b4a41633", "value": "48156CF4F59898B2C14EC772C691ECBEEB611AFD1243491C09E9DE8E3B4378A8F49445", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622551233, "uuid": "e16784e2-7850-4900-8dbf-2d8f69733619", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622551233, "uuid": "a40471c0-b53e-4c96-aa99-bf1ce40e5a7d", "value": "12288:qfZdwU9ZrhvTh1/H0p/gpqYi6bKMIAaETuI4ywiAnbY57glT+My:qfZddZrjVMYieIApbcbY57gV+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622551233, "uuid": "271f7685-4dcb-44e5-b012-30bc0eebb27f", "value": 919040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622551233, "uuid": "1313db49-9111-41b7-8c81-74f81501b81e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622551233, "uuid": "5b484de1-76b2-497e-9db4-f2a894424e7e", "value": "GOE2103001 SHPT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39d09026-c274-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1622509000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622509000, "uuid": "8686d18e-a2f3-4b13-b9f5-701872e27db2", "comment": "Malware payload (AsyncRAT)", "value": "1b76fa2e5d3e1a4f55ba0bb9eb8728a1", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622509000, "uuid": "3155c09b-ed56-4f6a-a1e3-aa7b7964fb5a", "comment": "Malware payload (AsyncRAT)", "value": "cd706f1f829de6745dbbbd89ee6297eacd015b18d2705dfa0ff89b6f9290467a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622509000, "uuid": "d8c4eea5-ebb9-40f1-a99f-a5a3de957b19", "comment": "Malware payload (AsyncRAT)", "value": "d56fe98044662b21b12e716b340c5b74ca5c5e4b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622509000, "uuid": "853add64-f2b4-450e-aa55-df7bf7c4f00b", "comment": "Malware payload (AsyncRAT)", "value": "9d69c68669485dfcaadddddcd72bccfcb5e7089a7109354a5d32ac1ff57a88716b922fb96d5e30586d5e8baa3447acd0", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622509000, "uuid": "9cdbe810-7f46-48bf-851d-488d8e3dbaf4", "value": "4835231473AB2711C5AC0578D0EA6D84A3F9AF8CD233D28B2CE9D65ABF1C3624D71B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622509000, "uuid": "1af5087e-f38f-454d-8c2a-bd034fb4978b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622509000, "uuid": "6e384cfd-6815-494b-bb3a-817377404f04", "value": "24576:JpwUZO8sLkWUqfmSe27gNMoG3kY+T0SkxUbOm24Nr:JpwioZmSVcNMF3OT0lUOm2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622509000, "uuid": "b306f955-e523-4289-841a-3fe998a90aa0", "value": 1076224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622509000, "uuid": "1ae2d88a-ac64-4527-94c9-cac6ee4b69ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622509000, "uuid": "0083daee-12af-41b9-a773-dda61dcb960d", "value": "1B76FA2E5D3E1A4F55BA0BB9EB8728A1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fea64de-c2e6-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1622558054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622558054, "uuid": "00ab9e72-b075-46a2-8489-38882574e05f", "comment": "Malware payload (SnakeKeylogger)", "value": "1eba2d52aeabdc0c6b366e2f1013d34c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622558054, "uuid": "bf56162f-dd8f-48cc-b4c2-bf43cd978686", "comment": "Malware payload (SnakeKeylogger)", "value": "cd9064af78ceda0457713c4bdcb45659bcb34fc941fe43e32deda4231d8e9929", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622558054, "uuid": "053bacbb-0100-46d4-9475-d3836da2f554", "comment": "Malware payload (SnakeKeylogger)", "value": "c51b79dbc218ba3cc7358b4a015df24d92f08898", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622558054, "uuid": "4596cfc2-31c9-4f17-ba4b-8f46bce2fc6a", "comment": "Malware payload (SnakeKeylogger)", "value": "a1190c1f71a6343f4b99b1db886182ffb5c2aaf263e394a5bdc948aef4d240a42d4f4fff93ca82e360c72b9f042949cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622558054, "uuid": "eb8a5c49-0078-45cb-871b-15bc5483b52f", "value": "B115AEF5A6C921CECC169E3158253D3456237E3BAE3EE20A948774557BBF0C389724A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622558054, "uuid": "03302ac0-e6a2-4a79-9707-d9eac96ca1a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622558054, "uuid": "9bf4a7df-cf8b-485c-bbf7-15397a25fb69", "value": "12288:PI/o+LSV1P1gs+JohOsnNiW1McdW6M7iFkv1HPKnioqypku9wHxpFvRojMFMv:P9+OV1P65ohtNl7MOFyRhoqy7oZoH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622558054, "uuid": "7970c60c-e0a6-4bb8-b9e3-657703138d68", "value": 931840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622558054, "uuid": "189073a1-2bee-4284-8edd-483731675daf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622558054, "uuid": "fc9161e7-4eff-4b59-9c79-ce63c478944d", "value": "JPRC Refinery 4th Expansion Project.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f6693ba-c2e8-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1622558831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622558831, "uuid": "c1aa918e-ddcc-43bb-8748-6e25dfd35a7a", "comment": "Malware payload (NanoCore)", "value": "605d813fff2c053da32e37684a525473", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622558831, "uuid": "7a6e707b-e12b-441b-aa22-b71cef82913e", "comment": "Malware payload (NanoCore)", "value": "ce0da80a1292b31b966d27bad03c4943c030c256835c668510938999b7772fa4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622558831, "uuid": "7f6ef617-ef62-48db-b846-034cb42610d8", "comment": "Malware payload (NanoCore)", "value": "d1da117cb9cf0e024aa4d16edf06f4d82f0a1c56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622558831, "uuid": "c8508f44-49ba-4dbe-9ff6-77ef93e16193", "comment": "Malware payload (NanoCore)", "value": "3cbab0e95417a64805885ae0399e442b68c7fc37ba9b704263fa6e76364d093954d76345e21ca0d6f07266bbe82e3089", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622558831, "uuid": "45b5e37f-4c5d-4be4-9c4e-03b96eb3190e", "value": "8555E043E340C4B6C47A1730C5974FF16EBABD20DBA29A5B6BA07D2D7D723406E21B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622558831, "uuid": "a13fa11f-a041-4b48-ae46-a8819ae37877", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622558831, "uuid": "4e132cfd-3371-4ef6-a086-3e94d20b4886", "value": "24576:AAOcZwdf+OD0+4xDFQ5sXqAE5yPyXdBwKLiB7G335F4c+E6Hg:ef4PYeLEyuP2GZF4/Xg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622558831, "uuid": "ccba4f77-4ea8-4fb9-9554-d9e88a02d584", "value": 1352099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622558831, "uuid": "2f85aeb6-2a4c-4186-b3d9-e62ded4b1b3f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622558831, "uuid": "2525072f-d467-49c8-97bc-ca0b157743d6", "value": "Payment proof.jpg.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d439179-c333-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622591147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591147, "uuid": "a7bd3a05-6185-478c-9c03-a28e74b16806", "comment": "Malware payload", "value": "a3369c4bf67cdb3f4be6772680b1e215", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "BoomBox", "colour": "#3AA072", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591147, "uuid": "c776ec35-d101-474e-9547-6e46774e5abf", "comment": "Malware payload", "value": "cf1d992f776421f72eabc31d5afc2f2067ae856f1c9c1d6dc643a67cb9349d8c", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "BoomBox", "colour": "#3AA072", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591147, "uuid": "b728dff9-1512-4a99-97f0-1accd0496165", "comment": "Malware payload", "value": "9ec1ce776d13c26f28d2346d2b4e974cb8ee9566", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "BoomBox", "colour": "#3AA072", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591147, "uuid": "a9127549-3e6b-48e9-9882-daa0055b8e43", "comment": "Malware payload", "value": "36ce88476d84776473e0fe55a77ac1da63b8e676c0b3546170e0156a3c39ca109f1054a20077fcc0076c509777333f50", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "BoomBox", "colour": "#3AA072", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591147, "uuid": "79353854-9f2a-4cdc-99e3-5f610f744567", "value": "0E522A05BBEC4725E2FF4BB998B296240638FA164922DF6D2CC4550F9C337448A52B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591147, "uuid": "a29f463d-2ce6-410a-a7bc-c010baf19ad5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591147, "uuid": "2c43b892-fad4-433a-a55f-2c2994d2012a", "value": "192:cBYCN8pSCRBu9n+qajxm3Cdia6difDLeqCtkMBpFEtKeluCp+3Cf:hZrX83CdiaoweqQkMBe+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622591147, "uuid": "de014c5b-ddb1-4475-8355-ffbc48f5c36c", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622591147, "uuid": "05ebac59-4f18-4538-88b7-363127a4a60c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591147, "uuid": "7b517f2f-c3be-4a95-8ba1-ba7b8435db48", "value": "cf1d992f776421f72eabc31d5afc2f2067ae856f1c9c1d6dc643a67cb9349d8c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c1ce1b1-c29f-11eb-875b-42010a9c0053", "comment": "Malware payload (Stop)", "timestamp": 1622527526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622527526, "uuid": "af7486a7-1ac8-42dc-86c0-942b9cd7755c", "comment": "Malware payload (Stop)", "value": "7cfc44ba1c64254ae98ee93a9d29afd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622527526, "uuid": "34deda83-c50d-44d0-abee-704552ed09db", "comment": "Malware payload (Stop)", "value": "cf98b1f7e33156c7ed25ba1e303e76dea6bfc3141cedebeb19656e36d7e5e8d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622527526, "uuid": "340446ef-b932-403d-b9b1-dd76598a12c8", "comment": "Malware payload (Stop)", "value": "d5e37db0c951044c0397536a5292d8fb4f597358", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622527526, "uuid": "1d73aa73-3236-4e47-a0fb-6c6eb068f223", "comment": "Malware payload (Stop)", "value": "315eb7ca1ffbe99a542cba3f537e66fc8d3bb244d5e90f24e7c9aca47a60c0a6f3e008418799b7f9f3bfd4b64941861f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622527526, "uuid": "39480388-57d9-4ab8-83ee-23f7c5041e99", "value": "1A05F100B790D034F5F336F489BB927DAA2DBDA2DB6450CB13D5AAEA56345E0AC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622527526, "uuid": "eb78f2fe-f3a0-44e5-8b71-824c53d76727", "value": "0479728b0bbbaea2fc170e4fb90137cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622527526, "uuid": "0a53bcb3-177a-4916-815f-59a9a9d25694", "value": "12288:d++s8MjB7wNMpyfxQYHnglcFZN/5OdFxf2mVyzxIURHI+d5xdvt7NhKhMALDr:dMjB/S7NxO3ozqU9vdZ13KhMALD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622527526, "uuid": "c6feea75-7746-4617-93e8-df4ef93d9f68", "value": 865280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622527526, "uuid": "c5f2fa83-e927-4ae6-896f-92e26ec57cf0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622527526, "uuid": "79d209c1-a72e-498f-a721-071367987ced", "value": "7cfc44ba1c64254ae98ee93a9d29afd6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea6be400-c2af-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622534637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622534637, "uuid": "f5d6df06-466a-4d0e-96ff-4b2c70a45828", "comment": "Malware payload (AgentTesla)", "value": "d849c78710fab820267674747a2f3010", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622534637, "uuid": "80606aa4-f3e8-4fc1-ae3c-04438230cae0", "comment": "Malware payload (AgentTesla)", "value": "d08222dfb92c317e63590fbe016ab4cd1f462b1aa49ab5760ad6f9f0eaa22f32", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622534637, "uuid": "610cb34b-d8f0-4642-adf7-c4298bc7d7d7", "comment": "Malware payload (AgentTesla)", "value": "a693ed67475c0ea8aeb7ec0ee1ab7fb5786e5dbe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622534637, "uuid": "c0a45ea9-f2d1-4f23-949b-1de87930c48d", "comment": "Malware payload (AgentTesla)", "value": "0149927ef62f53a8a5c82f51e5274c3fa699e60004d46c9f4d4d7f9c15dd34e8a30166308bbc0bf73ff2f1b153a2c660", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622534637, "uuid": "5e859191-65d1-4c44-8880-91398767bde7", "value": "55C4016132B99B18F0BE4BF8513061401375B6BF3662E31D8E9171CE1E36BA187A1F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622534637, "uuid": "f81f7142-14a9-4e1e-9a5d-499af3757771", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622534637, "uuid": "bbf41c24-c2a2-40c8-a3b5-3889890cb952", "value": "12288:GzvcWsnvKSCsx9/CRxYT1uDR/Fvxb+bT2dR:G7cWsnvKHoITXR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622534637, "uuid": "648f53bd-a96f-4359-ad99-88dc69c39ca1", "value": 572928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622534637, "uuid": "7139ab53-940f-4655-9f43-7d2f7ae46d83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622534637, "uuid": "ed5ffc9d-3022-4d1e-9254-11979c4405c6", "value": "New Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7865083a-c2fd-11eb-875b-42010a9c0053", "comment": "Malware payload (DoubleBack)", "timestamp": 1622567946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622567946, "uuid": "78eef8a0-94df-41eb-9ce6-eebe942dbf4a", "comment": "Malware payload (DoubleBack)", "value": "c41a21a821bcdea1d3ab26ebef055eed", "object_relation": "md5", "Tag": [ { "name": "doubleback", "colour": "#E06F1F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622567946, "uuid": "c36dcf23-20af-4f08-bb9e-bd118eb76044", "comment": "Malware payload (DoubleBack)", "value": "d1d0ac76e59b9e2a8ae3a433e0186d74fc61417c89fe5ee4b93c02faa1dc58f8", "object_relation": "sha256", "Tag": [ { "name": "doubleback", "colour": "#E06F1F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622567946, "uuid": "bf8b1a8c-e32f-4c8d-8d57-96c12a56de89", "comment": "Malware payload (DoubleBack)", "value": "912c8c1792dd33bac263df4b71242078d74741e9", "object_relation": "sha1", "Tag": [ { "name": "doubleback", "colour": "#E06F1F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622567946, "uuid": "38227896-6811-4a6c-86a8-72cb6117d5ca", "comment": "Malware payload (DoubleBack)", "value": "9c1386d71188f2e6e60d72a90608fee774a027e05c7e67e1a1540ba823b8f03ba7fdfb12c8548721b30c2eb5b0236e26", "object_relation": "sha3-384", "Tag": [ { "name": "doubleback", "colour": "#E06F1F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622567946, "uuid": "6c7914a7-3cd8-4147-9a95-c979ce0078c8", "value": "EC14124E3150D042EFC8ACFC42C9D9F5CB59FF7745494A43A798369DACB3CE0984AA1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622567946, "uuid": "fb1c7382-e028-4e3e-b96e-ba1d49c00084", "value": "3072:Ghtf+HhTi14PyY63IbwFHKzke41kwph4FW20vKaCLyPKlogs9FlNrk5aWADzS1+5:GzW5i146r3tqwN1fzK8vLC2PKlhwFlNl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622567946, "uuid": "da472729-e039-44d8-aa40-6830e003e6e3", "value": 191493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622567946, "uuid": "0ff4e82a-6c5c-4981-8389-5bdffba85442", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622567946, "uuid": "60002842-44d0-421e-b6ee-b4b7fd6da657", "value": "document-37-1849.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6550b45e-c2e0-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622555459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622555459, "uuid": "e43219fb-f1f1-47aa-9ab4-5a50dd3ea0e1", "comment": "Malware payload (AgentTesla)", "value": "1b2eb1374c64a2c099289bd84e153b55", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622555459, "uuid": "b7d7c3e2-455f-4fbb-a82b-1dd1950fa1b7", "comment": "Malware payload (AgentTesla)", "value": "d27f09f3fbee726abe5888abf59e05c5f196df368a203796d80920e45596036a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622555459, "uuid": "aaf6db86-0a52-4597-ab1b-4743a157c3ea", "comment": "Malware payload (AgentTesla)", "value": "1ad0e3fae859635d316b15941450aeae3c8b85d6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622555459, "uuid": "f7f37ab5-5d23-430e-ba0f-65aaf424f5bd", "comment": "Malware payload (AgentTesla)", "value": "3de2dd96cf97071e20578ba2422eca9506188d61c69ab3f73ecf105a0dfc7042a43f47c19010fbc8f213cdf674827b6c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622555459, "uuid": "afd4881c-d37b-4148-87df-8f559e566fba", "value": "61F4DF6430AC5705E8FD67F90F60D4B013786D9A3812E22E6DD13DCB3ABDB4306A5A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622555459, "uuid": "51e247fb-7086-421f-9002-b3022ce86e7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622555459, "uuid": "c38a0a7e-1e31-4043-95de-f045fdb0ced2", "value": "12288:8cMHu3oUBVZsW7NS2U1pFedmbA/f/XbiZv37W:8cMHu3oUBVZsaSN6aA3fbi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622555459, "uuid": "7a39d42c-23b2-4163-8c6e-7faddd1bd26a", "value": 729600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622555459, "uuid": "42352cbe-b75e-4d70-a066-1ea538f619aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622555459, "uuid": "7cce6aae-6494-4c6a-b5b8-2094f9207ee8", "value": "BANK_STATEMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e31bab6-c2ac-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622533006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622533006, "uuid": "04e2461a-5cf3-41b0-a4c4-bb6bbb1c275e", "comment": "Malware payload (RedLineStealer)", "value": "29478edc8e43ef9e5fc8fea97a657cb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622533006, "uuid": "b2e98fe7-1b70-46c4-b530-72a51ffcd521", "comment": "Malware payload (RedLineStealer)", "value": "d2e0e8c973c2e376d189271f581d1ffec730f8ca41dfc1e3d9ef0b675366ee9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622533006, "uuid": "140be709-4f35-4c0b-9b89-53ba5c5a0833", "comment": "Malware payload (RedLineStealer)", "value": "6b308ad83dbbd5e59322212f2905fa4565c80785", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622533006, "uuid": "bf385704-34c8-4cc3-a476-888f45e14b55", "comment": "Malware payload (RedLineStealer)", "value": "b98be9cd24d38e8f4d81161b56f6be4ab73e4fca1ab30e4e222e42c8166f273b855c151b668f366691d2a2e7b2bdccb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622533006, "uuid": "3d24b4ba-a2ad-46da-9567-f0499689995f", "value": "D6849E11F690D034F5F336B44AB782BDA6297DE1EB2450CF62D46AEA5634AE0EC31707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622533006, "uuid": "3aacba42-1e2c-449e-9cbf-f2435e9b15e9", "value": "2f20facc3edc1d8ba24ede1f07abf090", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622533006, "uuid": "5679d564-5443-4847-944c-9b4688501860", "value": "6144:HzdRbg1ueejPFYP/RqHaB0yAPzZAdTQAIJJahn1JlukXvgCqabsffGZXPzUPxXT:Hzn0ojde5qHxyiZ2/mEjbXjUeZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622533006, "uuid": "dc079d64-ebb4-45bf-b362-a877101a699c", "value": 397824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622533006, "uuid": "fb896243-d185-4856-b5fb-a03b3fa537fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622533006, "uuid": "1785baec-f8cf-41b6-9acd-24f5e7cfba91", "value": "29478edc8e43ef9e5fc8fea97a657cb4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a87d119d-c2ae-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1622534097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622534097, "uuid": "81cce8f6-b23b-4140-bd1c-ec60f10accd1", "comment": "Malware payload (Dridex)", "value": "ed4a0ef6074d660acd7fa2eb1d3a39e4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622534097, "uuid": "2259c4da-7762-4c6c-9fc5-e96842854358", "comment": "Malware payload (Dridex)", "value": "d38468c2101305e7c40350a3d9a0954d45d1a0d88af995db4f94313b1f91b529", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622534097, "uuid": "0ea98c76-2893-4821-a03d-e6477cf014b4", "comment": "Malware payload (Dridex)", "value": "52512817a8b597b6bfa831f6103e9b231f74dcbb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622534097, "uuid": "f6cde9e4-f2ed-4b47-8bfb-4c4bc00f3091", "comment": "Malware payload (Dridex)", "value": "9d319ed6f473e4ec8db268e80f913b60fae526c6440a21ae158e4148a6869a584c44d3879fda2ee4e6faff8b0da3619a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622534097, "uuid": "aecfb0fe-e195-48c4-8ac5-f5d0175b9ff9", "value": "F505CFA435C6F431E07250358F49DAF80729BD159F7A8A8B37E01F4F6D7E9826A31722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622534097, "uuid": "d68cd8e4-04dd-4164-aa54-a84ffce8f5b6", "value": "af4953a80e6bbb56eab6af93a1f6269f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622534097, "uuid": "59c708fe-f79b-421d-a025-679b76c18add", "value": "12288:60FMqViYh3MhVh9tb7CFWrmAdsDTnN88J1HgIsENpMO:5LV3MHjJ+We3NvuIsENyO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622534097, "uuid": "40c2acbc-d516-4bd5-ba2e-58bc838ce591", "value": 847872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622534097, "uuid": "285173be-45f7-41e3-8e6b-279a4668248a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622534097, "uuid": "34e4b256-db8c-4d12-8aeb-e4688f8ebb92", "value": "tugsj.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38482ce5-c2a3-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1622529184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529184, "uuid": "00bfa2c0-fca8-4d42-87df-b75f63414001", "comment": "Malware payload (SnakeKeylogger)", "value": "407d5af74bb6f175a8e980de32b78237", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529184, "uuid": "deba39d1-7df3-47b6-9a11-c52076be37d8", "comment": "Malware payload (SnakeKeylogger)", "value": "d39a464291fa300bcea8d82eff8aefa28cd2828eb5fcc559d805749f8e471f90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529184, "uuid": "a62f61f0-7cdf-4801-b16a-48b7c20ea259", "comment": "Malware payload (SnakeKeylogger)", "value": "eb69ee1383bf82662424ded2239b94d2da9e1fc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529184, "uuid": "a78202fa-94c7-4304-986f-25254f6041a9", "comment": "Malware payload (SnakeKeylogger)", "value": "eebf6e96fb6af605bfd3460c13ce7c69e46227ac54e70b1dd53a8d4bbbe1165b75a37f0753130dd966a36e68eb25d532", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529184, "uuid": "d1d8f055-c4be-472c-9706-310f6f333fb1", "value": "FA05D13222699BE1E67EC7B850E4D87303F5B493EB11CF3DAEA950991091B4486D237F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529184, "uuid": "d4825040-62d4-4c0c-adac-92687d45f497", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529184, "uuid": "28b33060-22c2-4aa0-90b3-3bd1575982d0", "value": "12288:ccK5+3ohghb6Nccx8Y0rA8rFMYoih1gxx8M5sXj6EaPzFYZxAj7Q4Do7k1jJMaRy:qaPMxarFjRheX5sXjfuDUCjCa/IRAW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529184, "uuid": "95bbeb93-e9d1-4d46-968f-b0dde171df5f", "value": 844288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529184, "uuid": "efc144d8-9297-401c-998c-cf948606c984", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529184, "uuid": "483c73ff-0679-4b96-810b-7ba506d3d581", "value": "RXElzx0112021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "131947ca-c2a3-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622529122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529122, "uuid": "19b701a2-3f35-4c27-ac17-f843cb0c8f65", "comment": "Malware payload (Formbook)", "value": "266bab51a4de290dcc0989b60283e502", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529122, "uuid": "3374afbb-74f2-451f-9759-7229acddc6d1", "comment": "Malware payload (Formbook)", "value": "d3b19cf0506617e6ac964656ebfe51f1c3066337b66bfdb48bd31b44ff61e7fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529122, "uuid": "192acbcb-e83e-4e1d-94d7-fc1b5fed808b", "comment": "Malware payload (Formbook)", "value": "99db20966cf4c4d4434b6a53058be600d08b5340", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529122, "uuid": "d0a2c2ba-7758-4059-903c-19bb5089b45b", "comment": "Malware payload (Formbook)", "value": "e08a8081c4483ea8d272176b31946a4b3fd643e3c0c6a274b5bc994aa3e60ba9c41ad1da9221062204f6dca928ec75b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529122, "uuid": "97aebfb7-a101-4897-b46a-229187275995", "value": "5434127436C944BBE94F6234A17F2225F7FAE20A01561E1F0BA85F3D1F281DAC593647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529122, "uuid": "91e6cde2-9e43-47d4-9a22-49eea73d2cd4", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529122, "uuid": "5ddd9d0a-35e2-4bfd-89b5-cea40ce87c63", "value": "6144:8Qq+fBmjlXIudthk7viF4ozPFyJ+WcMZIdwp:TfUlX9uji3TFEAMZIdwp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529122, "uuid": "c50984f0-73c0-4d24-86d7-4fc8d1a5e84f", "value": 234979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529122, "uuid": "497ddd82-8aa8-4398-b908-de33c43714fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529122, "uuid": "8b7e8bb5-3bff-4541-95d0-a0b12755f87e", "value": "AWB 224000318400 - 224000318040.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7417ad35-c334-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622591561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591561, "uuid": "d135d28f-7b00-4eb0-9509-adce63d7d83e", "comment": "Malware payload", "value": "4eff082ff333e204ffd74106d31c4058", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591561, "uuid": "4cf23f47-2314-44bf-80e6-38588c47edc7", "comment": "Malware payload", "value": "d462a1e98e6698debf6f32f9eab4f5137ab194f8e6cdda971ebec16403b0799a", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591561, "uuid": "fe1afdf2-3ab6-4ac9-90c9-3c7156354107", "comment": "Malware payload", "value": "9f2d499aed9adc36b8871a8eb363feb3ca81df61", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591561, "uuid": "102bf1aa-7209-4a7b-b520-6f9216c8b45f", "comment": "Malware payload", "value": "ca5c82229dc68f3351cf84b327a9aae2fe472884cbc9ab1970b45d5dd3acc728f0af187efb4975b8590d7a9c5682c8ad", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "EnvyScout", "colour": "#32A074", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591561, "uuid": "6dffae37-e76f-40ca-b4ae-d0930ab63339", "value": "EE75010CD7BAA164CF47253E9FAF931FFE2271AEDA3533412768CA74A5E0C24284D845", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591561, "uuid": "a45c2e97-7d40-4fa8-9ddd-55f06c3f8007", "value": "3072:yUWfHAzfuhQbUNjLYjZp/mTbcXngw9uQwRgWAHoAzUGZ/pln:yMfsLYtnv9/tF7ZXn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622591561, "uuid": "71bdc71d-14c4-4cf6-9424-72a93fe8bb0c", "value": 1663422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622591561, "uuid": "2b4a89aa-d333-4fb6-bc33-213764df3e5c", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591561, "uuid": "c494e145-692b-46a0-8def-d1b9306e0a94", "value": "d462a1e98e6698debf6f32f9eab4f5137ab194f8e6cdda971ebec16403b0799a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fac986a-c2e7-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622558429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622558429, "uuid": "d8d09129-9ba7-471b-ac63-307e912e44c3", "comment": "Malware payload (AgentTesla)", "value": "b11fa743bd3398d115819ff250f4d38d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622558429, "uuid": "7bfc9296-07c1-449e-991c-8102915051b9", "comment": "Malware payload (AgentTesla)", "value": "d62ce921914a6155bc30a828bf248ca2cf9ef582f500a4bffa0a0a614496ba9c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622558429, "uuid": "9d17746a-040f-4b86-9311-997af1fea344", "comment": "Malware payload (AgentTesla)", "value": "c0461e0e470481b9458972f92c093fff0d8c62f0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622558429, "uuid": "f5c8d9d3-af1c-4a8f-8d60-2a5cd7aa5b44", "comment": "Malware payload (AgentTesla)", "value": "5186a71fe13a3e0576bab465b838cc6147d41bb4323ba930cb25b0a6df1aeef35cd16310263ac29de9d5186320cb5019", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622558429, "uuid": "ea7499ea-b356-48bc-b73f-740f1143408e", "value": "190520DD766072EFC857D462DEA82CA8EA5134BB931F4213902715ADDE4D89BCF240F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622558429, "uuid": "7870345e-dc98-4348-a1a9-46adceac7936", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622558429, "uuid": "604944c9-b1b1-47a1-935a-42f96c24e272", "value": "12288:V4x40nYcND0r5xQIYH287XAjrqqfKhipqZEzBuUdDD7JSU9kQ2EOFAS+EeLUIvKx:2uq01G2fyqf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622558429, "uuid": "1438ab9c-f5ab-4b61-a5a4-9b741e5b6596", "value": 796160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622558429, "uuid": "7a19c671-e092-46d6-8d65-8d11dff56ec2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622558429, "uuid": "a81fb564-eca7-41e8-ac53-45ad5d32f593", "value": "IyDovyreMWGMFKKlumjesnYPKgraHKSNsRYmJCE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1995bf88-c335-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622591839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591839, "uuid": "a588418a-7729-4ea8-bc9f-06a87731808b", "comment": "Malware payload", "value": "d8b09942b58a15a697068867abe59a4e", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591839, "uuid": "e2bf3359-eefd-4ba8-8246-4afacfd0fb0b", "comment": "Malware payload", "value": "d7c05bd68e8bde3d13aa7dbd6911461104d06715da15d3ee7f75136fa8330cc2", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591839, "uuid": "27530a54-e30f-49a5-ab62-3b69f699e98f", "comment": "Malware payload", "value": "e1491c7ae53bbefccd589437877f48ecdc8a36a7", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591839, "uuid": "8c19d2ad-11de-4555-9458-6638f0581afc", "comment": "Malware payload", "value": "5a21d3d95c45d37a5ec243ccf5c8e2ecf968d0cbcc89657886232345861686f5740a45e62b0d34ef5c8e65d4ed6134c3", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591839, "uuid": "adf870fc-e88a-413f-b14d-427f6ff361ca", "value": "DD11890817852F54E2718E335C3AF3268763FE178A7BCB5D4D98D0483C65620B86AE66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591839, "uuid": "bd77ad56-fe33-40b6-befd-fa45829d7d31", "value": "24:85U47hF9y6lTyA6e8+/ClRTV+134I0Wpm5:8i4tF9y6ltrulW1oIne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622591839, "uuid": "70506427-27b9-46c7-b293-69a1b6abe660", "value": 923, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622591839, "uuid": "1e392c61-1c2d-4da0-b87e-e0a455d54db6", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591839, "uuid": "c50ba7a5-a129-4563-ac3b-67a3cdf77b66", "value": "d7c05bd68e8bde3d13aa7dbd6911461104d06715da15d3ee7f75136fa8330cc2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2bab43e-c2a2-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622529014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529014, "uuid": "10fc07a6-31e1-427d-843b-8f5cdaf3f919", "comment": "Malware payload (Formbook)", "value": "5a753312023258e790c05f59e8086ce3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529014, "uuid": "123e8bb8-830c-497d-842f-456aae42a8ce", "comment": "Malware payload (Formbook)", "value": "d857d2ffbdaab5c6866d6e50027dba89644d703b9081218a0e943db3c9cae310", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529014, "uuid": "28e1fe3a-e3aa-4ca7-b1ca-b543f9245895", "comment": "Malware payload (Formbook)", "value": "36e9693a76081baf4e554f796a7b59ca11a204c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529014, "uuid": "ade9ae71-7ecb-4ff3-8fb5-5e1fb2bd13f2", "comment": "Malware payload (Formbook)", "value": "f71a29d41cecb82bc238988b7121e80ccace0c216a074b2f4bc94e9f79141b7a9761a5c4b5067fc5ce521582e50aeb24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529014, "uuid": "077080c8-e58e-4ed8-8a91-fac452be2363", "value": "0635BE7E32817ACEC96BCD72C954AC61EA61A1B34307E323506311DC9E9D69BDF181F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529014, "uuid": "486eed85-ca62-4bf5-9ffb-bbdc97da9763", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529014, "uuid": "0e1d6910-a983-4881-9860-25a0fa796121", "value": "24576:H9preTfCLTpa21pmtkXuCtUhhpLXwAx2BEd7IFqYRkC:H9bfpa2/VtuhZXSEpIwOD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529014, "uuid": "36f6ef55-62b3-4627-a508-34185db02444", "value": 1119232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529014, "uuid": "f939ce93-64a7-4cf2-bd9f-e98441c69254", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529014, "uuid": "56072736-097c-40e2-99f3-f280ca6effaa", "value": "\uc8fc\ubb38 090521 PTJAYA 8 \uc6d4 \uc120\uc801 \uacc4\uc57d \ubb38\uc11c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd1df91e-c322-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622583980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622583980, "uuid": "8b236629-f507-4503-9a0d-16cf51ebb9c6", "comment": "Malware payload", "value": "519fd9707fb5a02c260872cf6de1df33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622583980, "uuid": "bd6a21af-6dc4-46f0-9f8a-0628c5b3dd01", "comment": "Malware payload", "value": "d885a2034e825199486fbe2eecbf1098e07c8ba36ffe3cca2518e3f332c48f28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622583980, "uuid": "a4e2b93d-0eef-437f-acb0-d1ff0f010926", "comment": "Malware payload", "value": "fb84309618d4465a6700342d9758fec65fa1eba1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622583980, "uuid": "b4519436-2580-4d1f-a0ed-388f5854403d", "comment": "Malware payload", "value": "3719ec220d02f3b4033e84eee24e476638a5788c8768e822c1c9a7fd29d121e3162272d097dce39d9f1e4d2d53e90cc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622583980, "uuid": "f3f4c71f-9315-4981-a41e-87b706b491b4", "value": "A234126D72D1E237F64106B205BF377ED53BA20213A0191B2B651FECBE2524781972CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622583980, "uuid": "212e8fe3-b837-4100-9bbf-5de1eb515d76", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622583980, "uuid": "671119ca-8cb3-4bd8-b61c-feb6d5786499", "value": "6144:8Qq+GnfmnC3qPS8moNyLapYUNJmgwKb4p:TzPFFNqINHxb4p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622583980, "uuid": "313f9d2c-9a66-44ec-901d-0e948fa2e8cd", "value": 236068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622583980, "uuid": "3c08e723-d345-439f-b83b-e1c26c004591", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622583980, "uuid": "ec506d63-282c-441c-9495-7c268c8b2614", "value": "SecuriteInfo.com.Mal.Generic-S.4772.26142", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4978cd75-c2e8-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622558848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622558848, "uuid": "ce37769f-3ace-489a-8fd3-8043e444f0e0", "comment": "Malware payload (RedLineStealer)", "value": "880669e46b3195aa9dd1fba3a668d76f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622558848, "uuid": "e3b1ed48-ed59-4d6c-9bc2-2d644511bcae", "comment": "Malware payload (RedLineStealer)", "value": "d8ed5b288ac2b5f908d544a8837d20a5c30464e1f0d980c9c2b974533c9d1e35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622558848, "uuid": "d6c47dd6-293a-4d7f-b413-0ef25a9ac50d", "comment": "Malware payload (RedLineStealer)", "value": "613f890bc721b2b9da18786fd11b76c3b9c5e2cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622558848, "uuid": "084211bb-9f7c-4d1c-a6a7-2e057ce46aba", "comment": "Malware payload (RedLineStealer)", "value": "d9bd4b3a710f70daae34996a7ff7f2766c60a2149f983d8a4ee6f3893cc0a50e42110e958e1248cbf835ac8cdc1a9795", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622558848, "uuid": "31540f0a-5bc7-4a5e-a54f-c47213d72d08", "value": "29849F10F690D035F1F335F44A7B92BDA62ABDE1DB2450CB62C4AAEA56346E0EC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622558848, "uuid": "46811b09-497e-4001-9510-3b75d3e6a8b0", "value": "63c85c090ca4b46213d1d3501aebeb61", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622558848, "uuid": "134f6fb9-547d-4624-b103-dc08f1b5504f", "value": "6144:rLxLQW27u9bNh+NZgYZXzrUQTpfkJesZODJSBOSiqjZjHnDwX0x3wC8hzJ:rLxc+Fv+NZ3XzrqJ2oBOSTjZDm0x38", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622558848, "uuid": "39d8e342-d80b-4787-80d4-ee3cb985845d", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622558848, "uuid": "221bcb33-c85d-4f6a-8fe0-d4948f31a97b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622558848, "uuid": "75b94e00-b8b1-4f9f-956c-b7c64b6cb515", "value": "880669e46b3195aa9dd1fba3a668d76f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a004d91d-c2a3-11eb-875b-42010a9c0053", "comment": "Malware payload (Adwind)", "timestamp": 1622529358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529358, "uuid": "7538cea5-09af-4815-8bb1-c134cfc71e92", "comment": "Malware payload (Adwind)", "value": "dac83780c3390d1f2a0b4fd7e568a308", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529358, "uuid": "10a74ee3-5773-4f85-8c57-7b75db079565", "comment": "Malware payload (Adwind)", "value": "d93081cd5585e41c642ca14c71f9c784741443d5ffc2aca3918f5ee94ae09457", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529358, "uuid": "1bcd8091-2244-454f-a7b4-a80cc72b30b2", "comment": "Malware payload (Adwind)", "value": "026bfb3f40a3c80adc3ec63c42e75a6a2bea0be3", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529358, "uuid": "ff28f1da-a32d-4f95-87e6-7bf6734bee66", "comment": "Malware payload (Adwind)", "value": "fef2e01ed972ff2f3aed3ed3f85d8f570772eee08c278dae6d0b9701e92c823b9eb3ba6cdbcf8fe9284d2614289b8fc7", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529358, "uuid": "e29823be-5bbd-4f0c-a7dd-1d5c609888ac", "value": "7464227CF2703370D8A9D9B77A1EE963A9F19AD94D49D0CD2C60CF5A830042F5ED624A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529358, "uuid": "589aa6e7-6dc7-4611-a3eb-95dbc90684e3", "value": "6144:l7T4SKqNh68ftvzoN05qWrKnujwKnB28MKQZcogsVpjPwp+y2BVrKNgkmXfMC+:ln4SKch6Ovzj5qiGujwKnB5gfgsDMp+a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529358, "uuid": "8ed64279-4bf9-486a-9ca5-10b72fb4878d", "value": 316169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529358, "uuid": "243bb35e-70dd-4c75-828d-108bcb134c96", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529358, "uuid": "e8946dff-7aaf-465b-86ab-94bd925c6a7b", "value": "GcIjPdkftDUegrJDmoRZv7.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0b06161-c2da-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622553035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553035, "uuid": "457df7b7-cf61-4b32-b763-bb91939be9ce", "comment": "Malware payload (AgentTesla)", "value": "ceeedc713249ae7aee31841c389393b8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553035, "uuid": "b756ee3c-5702-481d-9c6d-7e62b7b578da", "comment": "Malware payload (AgentTesla)", "value": "d9c745aa956faf9924734fc856bc69a23820e0d76b37a75c0889bdd2e53d4415", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553035, "uuid": "1022f10f-0161-46ed-adec-74b0da2a9997", "comment": "Malware payload (AgentTesla)", "value": "e486de368a011933936173cb22058ff06d0a1bee", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622553035, "uuid": "55499269-5e4e-4b56-9eab-215771c4be81", "comment": "Malware payload (AgentTesla)", "value": "a815127e695c5145d64f5a052bb67709d52c06a7e6169d6db0937d5a742ad205949d82903afc363ef86ac9910d2bd9b6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553035, "uuid": "0a008947-50b3-402f-b3e2-aaa1dcb7d70f", "value": "ACC3BF9276A3D406DD4F43392CE682CB2752BC114E7F42B7B7A5FB0ECB75A84490261B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553035, "uuid": "2af3669b-bc10-41c4-8c2f-8335b1a2868a", "value": "3072:Uk3hOdsylKlgryzc4bNhZFGzE+cL2knAsioo1gaSNAPZesWFPO7YiR6PJEcjjaPF:Uk3hOdsylKlgryzc4bNhZF+E+W2knAsG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622553035, "uuid": "8eccf1c9-52a9-40b4-bfc0-38be60591038", "value": 120832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622553035, "uuid": "db023ca2-371e-4067-8993-fd8c176223ea", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622553035, "uuid": "30c55f76-3f02-4c6b-895e-4b502d923cf2", "value": "IMG_01_76_308.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01f0954f-c2a3-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622529093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529093, "uuid": "8dbc07ce-de34-478f-8758-556ce62be1ad", "comment": "Malware payload (AgentTesla)", "value": "eb1f3b2f6198a04e21c8f7dfcc907821", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529093, "uuid": "15c1d033-6567-4afa-ab7a-1525d5a7ebbe", "comment": "Malware payload (AgentTesla)", "value": "de9b4feb3c9f574b78a0a0ef478bde2778a10d0482c5b1f82f50627acaf9ef94", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529093, "uuid": "646fe53c-9021-49be-8ab5-4ae18cebf182", "comment": "Malware payload (AgentTesla)", "value": "0aa50bf846abe5e1743c842454f659c92404dcde", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529093, "uuid": "da4b1cb1-0946-41cd-9ba6-700b057ae2fc", "comment": "Malware payload (AgentTesla)", "value": "36af83a18483e6f4007c9c11befcf0a1e47613345060f9c847d4f04d558a85524d01aac8847409263adc470300b9c933", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529093, "uuid": "f78d1efe-fb87-4540-828a-6b5cc0cb6d75", "value": "8B35BEBD7251B6DEC417C8B2CA949CA4EB6064B78B0BD713901315EDEA6DA87CF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529093, "uuid": "6d496e60-1dda-4eb6-8511-adbcc4d784e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529093, "uuid": "69d0137d-18a1-485e-a619-2041526dea54", "value": "12288:4iCpG6N2YmHbUQayNgahfxsyTSE93ibNijSOidh4AHpWAjrfFjqDCd8b3N1x7VWu:4iCeHbUQdhhZsRFsjSOOTNXIS4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529093, "uuid": "7e7b9563-fb09-4ec7-a538-1c5e375fa1ed", "value": 1099264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529093, "uuid": "196b4f11-459f-489f-b984-5b3fd2ba5d04", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529093, "uuid": "bcc8e548-0418-479a-8d23-66f4ecaa2d29", "value": "Bank TT remittance Application order 76533 SHEET.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84917260-c2e2-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622556370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622556370, "uuid": "6fff070b-bb5d-4899-9bd3-f8cd0d2c4823", "comment": "Malware payload (AgentTesla)", "value": "348506e3f77730d2e4b683b4602a2138", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622556370, "uuid": "c0626176-deb8-4af2-ab20-db917e0bf1d8", "comment": "Malware payload (AgentTesla)", "value": "df2f7c58d54c8c6acc6c1dc4b23a423eeb00ce1817633275668c827069711e12", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622556370, "uuid": "1c21c422-7e7c-418d-bf72-ff8796a1377e", "comment": "Malware payload (AgentTesla)", "value": "abd0d68aea3bc196a9207dc5a6c69ef9f049bce1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622556370, "uuid": "5e05e818-225a-438c-997e-e0173702dc10", "comment": "Malware payload (AgentTesla)", "value": "9486291c8f6c529bd1d31eb9c333c3577f685aea9fc9528f9aae72ef68093891e06388bc2330349301af11a3c2e5855c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622556370, "uuid": "4852e241-8bab-4580-bed8-bf269928dd4c", "value": "E6256BFCF198A8B1C1CEC771C6919CAAEB6115FF5202495D0AB5DE8C3A7378E8B4C485", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622556370, "uuid": "e4237582-b7b0-4f66-ae0a-3636174becc3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622556370, "uuid": "5bd4185e-7c29-4f73-b325-3bb0b01ee2e0", "value": "12288:NWUA0FDrhvTy3WrjaoQ3zAD2LcXVqEFWcxvpFCDrce20x831sys6MUseXJ/0/7:NWUNrYSavw2uIcxRF5e20mlsys69sA+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622556370, "uuid": "412b3b2b-f3ad-4ae4-b4b3-6c48564130f1", "value": 1014272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622556370, "uuid": "063258ab-38f8-4c1c-a02f-87da480aaa1e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622556370, "uuid": "b7966853-68ba-45a9-831e-8695ebca3547", "value": "FedEx Receipt with Reference Code.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b1db361-c2ca-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622546020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622546020, "uuid": "db688fcb-d8c7-4f03-9299-c2fbf9f0cef6", "comment": "Malware payload", "value": "3dd9caeae82c8e2a066542015560485a", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622546020, "uuid": "76afc235-48ac-48ac-8c45-e4bf19168728", "comment": "Malware payload", "value": "df91f20f8204e6d0e1239202c58d438143ccc560ac5ae8b2d8cf8e49aaae3708", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622546020, "uuid": "3ecef7e1-745b-432d-9c07-e0025f74d881", "comment": "Malware payload", "value": "3b0fc9b29cd7708ea584d2423f7db8880d74012e", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622546020, "uuid": "e8924a62-f0d5-4777-af01-dfc9f2c83d91", "comment": "Malware payload", "value": "ae4523444bf766f3833d0a6002817ba12c8fd4cff603e04aee301e245a39b3cd41ebda6dfdace8b8d3b37dc0fecc662d", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622546020, "uuid": "e3466cc2-30b5-4f2b-bd17-c124bf234bd5", "value": "2F12BF9C8FB66309DB336639840295AB7A42F14F2A67540F744287FC81D2EE1337FA84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622546020, "uuid": "7a52071f-98a5-4206-898b-724e7d90d305", "value": "192:ZMABVcV5JnWrKPfvEdkGsJ9s4cTERRA+o3Mz:PVOWrKPIsrsDEocz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622546020, "uuid": "35fd90b0-8981-4a62-b772-e7d499633448", "value": 9053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622546020, "uuid": "99f67bb7-9b48-4043-aaf7-782ea59ecea4", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622546020, "uuid": "0a8d2ea5-499d-4cc7-952b-f99b7955b6ec", "value": "30.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d3b49e8-c299-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622524951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622524951, "uuid": "7b4934f8-e9ec-4364-9e56-bb6b1e6c915c", "comment": "Malware payload (Formbook)", "value": "d22eb9a392a01e69b484f998699d6f54", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622524951, "uuid": "61d412e0-d3cd-4882-89b9-cb2539d45f9c", "comment": "Malware payload (Formbook)", "value": "e17293b0ef3043d7848a7c453f86df5e654c459e03b0393187bba78d277b57f5", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622524951, "uuid": "8d15324c-451d-4207-bff9-2ae75612fc81", "comment": "Malware payload (Formbook)", "value": "feaeb12a8d931faa7e38dae6d220d72a409c4051", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622524951, "uuid": "c67a373a-d052-44b4-b364-6720ab0edab0", "comment": "Malware payload (Formbook)", "value": "a46c2d6772703a7fc9df7c32ea6a2e8192c44cdb46135a351624ed074c967532d3835d87a6b11cc26c7a7f7f48ee1dca", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622524951, "uuid": "8282c6f8-972e-4fb3-aa8f-da3ddb82fc41", "value": "35F42355EE257B6690360D2AA2BFE075F4A98DBB8F01061BFC3C9543811BC9987D313E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622524951, "uuid": "a5ba7839-6ab6-4aa5-954e-d818696d296a", "value": "12288:wl4SX3fJfsic0kJnErsruBgRq/HFfCYbPDy+kEqvBQEy2Qh2knlJooIWtEeWdEYL:yfJfQ0mnOsruBgRq/HlCsPOREqviEtQk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622524951, "uuid": "dee7a6fa-59bf-4346-9860-369dd52828ba", "value": 729242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622524951, "uuid": "4fa86798-9ffd-4829-844d-7719ebc8d7d1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622524951, "uuid": "3d9ee7b7-6477-4718-b313-c800e3533b04", "value": "Swift copy_9808.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0f1c22f-c2e9-11eb-875b-42010a9c0053", "comment": "Malware payload (Hancitor)", "timestamp": 1622559451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622559451, "uuid": "8a2f5274-d672-4ab7-afc0-1480acd04167", "comment": "Malware payload (Hancitor)", "value": "ececda2520781c7ebc255f84452cbf21", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622559451, "uuid": "255bfd14-ff07-4b57-b87e-85b9bbd27b21", "comment": "Malware payload (Hancitor)", "value": "e24fd0a04de0b2d0e92a28c38e180d97fe2445f34c2c8179bf3e34e27ed337dc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622559451, "uuid": "f7dd5ceb-ab85-47c5-8428-2fbd42028185", "comment": "Malware payload (Hancitor)", "value": "964744cd96515aae69afb4a6f230284e44991812", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622559451, "uuid": "44cc985b-9330-43b6-8077-1ee5f5bfbf1e", "comment": "Malware payload (Hancitor)", "value": "2ef81e0544eca8c4a507e5c13c7ff64788de68a4cced45b08eb33e4bb2257573b70f9f1d563343bb22f3f6d5c149f65e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622559451, "uuid": "c1fdfff0-19b3-4c49-b1ec-6daa9eb8c22b", "value": "BF54BE1136D0C072C19371798414CBB49BFEB83259A65B4FBBD80FBE4F28AD1976538A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622559451, "uuid": "f8c62de6-88cf-4483-9569-325c137832f7", "value": "411b674661565b29999ad62d862b7384", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622559451, "uuid": "b1629429-3fee-46d5-b0ac-04a56b0cb7a3", "value": "6144:cVkB9znKvyJtkaqrKgW1zI5mMS04UYW2S5jGzHd4:cVkB97JtkaqrKR3MV4JN4EHd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622559451, "uuid": "55abb0d8-5efa-415b-a2a5-465b5a2c7f1a", "value": 292352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622559451, "uuid": "41de827b-90b5-4967-a4fb-f58a70fd356f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622559451, "uuid": "d82676ce-a221-42b0-9cc2-397c9f6c82fe", "value": "jax.k.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f19206c-c2a3-11eb-875b-42010a9c0053", "comment": "Malware payload (Matiex)", "timestamp": 1622529115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529115, "uuid": "318c9ae0-bf8b-4334-a484-280b65ce799c", "comment": "Malware payload (Matiex)", "value": "ed616b6f6f4e721e7054f79c0ed97965", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529115, "uuid": "c2630308-d39b-45ac-bdff-cb69f45fa64a", "comment": "Malware payload (Matiex)", "value": "e2cc9190fe85cc536d84e955955607e74988009c10aa7668b9ecb32df056f0b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529115, "uuid": "c0a479bb-52ce-4941-8633-d55cbc92b005", "comment": "Malware payload (Matiex)", "value": "1d9f8307df786eb7c92f3fa7c8f0ffdc825680ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529115, "uuid": "aa75e33a-09b3-468f-9aad-f3d1100aa511", "comment": "Malware payload (Matiex)", "value": "1ffa5ef7f193425df4cb04596384a123f524472dc241feac9cc332df94fc8310cc1c166d1644e9eb22c797f5a7cbb14d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529115, "uuid": "46bed3e7-4785-49f0-bdf3-a98aaefc026c", "value": "71355BF4FD59B8A9C10ED731B28098FDD7631DFA028A4BA906A7FECD5B437494B48481", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529115, "uuid": "02aa6aa6-256d-4269-8903-8e468758098b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529115, "uuid": "f65d2ec3-b1ba-4db3-b10a-f52005cc8363", "value": "24576:se5tUrKb+MC2T8HFEIfDVCsK4LE5REL6XCfLc:D5nTC9hCsK4w5GL6WLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529115, "uuid": "98201263-3faa-416a-b10f-dc68068de903", "value": 1064960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529115, "uuid": "be7c9cb4-034c-4717-9b31-1e321c019c36", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529115, "uuid": "15b6cc5b-f321-4377-adac-68bc4fc8682b", "value": "TEKL\u0130F \u0130STE\u011e\u0130 - EN AC\u0130L.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1264c84-c334-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622591691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591691, "uuid": "6fd79e99-a303-4dff-8670-7fd499c5bc6e", "comment": "Malware payload", "value": "2e3b4221697bc2a374cd6d313021b767", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591691, "uuid": "b14bd444-1341-4428-bf23-6c8902391471", "comment": "Malware payload", "value": "e41a7616a3919d883beb1527026281d66e7bcdaff99600e462d36a58f1bdc794", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591691, "uuid": "e5d7d535-b666-4813-8fe7-22949e3fc398", "comment": "Malware payload", "value": "2d17a7533da3d64f166d6f92e12a4fd73ff7e319", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591691, "uuid": "44496f9d-6683-43e2-8044-c16c769d18c4", "comment": "Malware payload", "value": "66ec6de6109978200bb0a7af307c15ea76ec9e1651c310c1d79438fd89aae9818cd2f8783a83dce7a851e444b4679c02", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591691, "uuid": "0a0d712a-0a46-43da-86a4-6bdd4bda6d34", "value": "25552315EF4EC7A5C0A90FB0F9FCAB09A2A4E1C2A402903F354C49FF5B57D68A85456F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591691, "uuid": "f1a427c1-3854-42c1-b329-0d4c1e34044f", "value": "12288:qvM7bJrzDRwlsJKv7bFi41tnXrpLFJY/gWBhFAts6d/0GUdQFtIzyu2LiSnw7yL5:qvM7ElsJKvnFjJLcnms00Gek+u/GkSy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622591691, "uuid": "438491e1-8b23-4b3a-8903-753d1ef2c167", "value": 1310720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622591691, "uuid": "015085ea-f20c-4cde-88b8-265bd4ff3989", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591691, "uuid": "a1934289-bb4e-4d16-9054-ae6ec17a0160", "value": "e41a7616a3919d883beb1527026281d66e7bcdaff99600e462d36a58f1bdc794.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6a45604-c2d5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622550951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622550951, "uuid": "7722c40b-137d-4d53-8fd8-23ad658403e0", "comment": "Malware payload", "value": "26bf83b818410e65948bdabc1633b258", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622550951, "uuid": "3a98dd66-8e26-412a-b3b3-efdf5ed7f8af", "comment": "Malware payload", "value": "e43180257a15c6d59f8ee3137ca3fe753603b3332292c1bd05ce0105127c94b7", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622550951, "uuid": "794bf401-b544-45cb-b68c-a637550de069", "comment": "Malware payload", "value": "94c75be8bb92c14eb91dcefb770ddb10dc126f74", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622550951, "uuid": "d6d6ca64-4054-4050-b427-a112b23674ef", "comment": "Malware payload", "value": "f6e78297725a6b7184bdf1b95a059ecffce3ece628bb2e30a82670d2e76eeaaed97d7886a9b9cb53f97ea14d4f2d7e92", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622550951, "uuid": "97cd3fdc-a0c2-4a2c-9967-7c31974b25c6", "value": "A9E4231CBFA537915BE7A685D3938136E412BED30AC48B87858E2339A6E54C18FD3D20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622550951, "uuid": "c4f12b5e-c52e-4bc2-b1ab-2a031919689d", "value": "12288:ofrlJ5JnB0gWNOMP1/wP4dkox6eyW7DFm7x8HWL9cmmJAsU5Ni61lH1hHyP7sA:ylJ5JnfWX9so6q78xYWSZJBH61lu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622550951, "uuid": "f084a825-152b-4dd7-baf2-565a5d93234a", "value": 707412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622550951, "uuid": "29c70928-e6a1-4594-84f1-d4aa65cf3a5f", "value": "application/x-xz", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622550951, "uuid": "342c15ee-5a0d-46e2-8f61-f660c2ec5110", "value": "SwiftRef_INV08899211.exe.xz.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2da37dce-c2d6-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622551070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622551070, "uuid": "029218e1-a71a-4cad-91c8-fbfabdcf1871", "comment": "Malware payload (AgentTesla)", "value": "476d535b4479f1909e187793eb29d6c9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622551070, "uuid": "a321e9c1-a9a4-4fff-bbf4-0b7b5a787d62", "comment": "Malware payload (AgentTesla)", "value": "e6d1139a7a618504fd44cde9395d723dc9763ff6269a9d658d0c5c5db07a6116", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622551070, "uuid": "9e6f4953-ad13-4520-91d5-0b5c61181dd8", "comment": "Malware payload (AgentTesla)", "value": "258eca5c580c7a5e1d9e6ba1791b80c587cbd541", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622551070, "uuid": "fc3423b5-d8be-41de-b148-5a9e89cbfbb1", "comment": "Malware payload (AgentTesla)", "value": "cb4471ad36dad52e1e9e9a1367b763808caa034ffc876bb19e7e7f21eca5a4108d5e98bf69e5f7d6bc1c21cb3b428296", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622551070, "uuid": "db35848d-b36e-41f4-8cb9-f7a83f063f92", "value": "3D44237939D18CA3D6A54970A272FE7FEA7B1B2716051E6327614FB77E4B2830706083", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622551070, "uuid": "5a89a702-0b82-4b56-876f-9836895a26a5", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622551070, "uuid": "3eb16636-3e8c-47b2-bea3-fccff59e517f", "value": "6144:8Qq+HX3NA4mB1DeJK/m7UcEj7ATUKtfevCsPHUUpLvfzQyrHLyJp:T33JmB1yJKrc6cTUKtfECU0OnzxCp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622551070, "uuid": "e808486e-114c-4507-a7fe-7f4aae503e0f", "value": 275693, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622551070, "uuid": "2c63b238-5ec2-4a4d-ba05-2cffc4ce3824", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622551070, "uuid": "4d663373-fb57-4de2-9ef8-d157e2f78cbd", "value": "Order04.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eebd80dc-c2ce-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622547958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547958, "uuid": "880ed840-cd2e-4732-8200-a5c946d3483d", "comment": "Malware payload", "value": "59efb1e609501877863f664acb991157", "object_relation": "md5", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547958, "uuid": "986a9857-a30e-49aa-baaa-a620fe41f15a", "comment": "Malware payload", "value": "e75b131008efc3f45bd8e5688b8b956e5aa649abddfc0f12d9d52d35e6343855", "object_relation": "sha256", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547958, "uuid": "31b10465-9594-4e48-bd3a-b7b2580814db", "comment": "Malware payload", "value": "0a8eedf91d735e80d1b19f1fdc3c7e99d6ef847e", "object_relation": "sha1", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547958, "uuid": "512ddf71-da05-4b23-91ac-58158f7addce", "comment": "Malware payload", "value": "cd23ac32cefd2f34ae9a56a2869ea27eb87ddf2a27560804370773570555644406b362ca4d0e3456d8737c4b7e24dfb1", "object_relation": "sha3-384", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547958, "uuid": "ec1c4ff2-2041-4290-9e34-d0a9c971c0e3", "value": "BAB10F5CDC31A089876C864B993C3A99A2F153B7E3467E70F46B7C41D6E5B85A010E3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547958, "uuid": "abb1e14c-3597-4ef2-a029-5d121c24ddb7", "value": "96:na+Qh77aqqBCY1Jl6c8ZTrfqYG9XTqB3xCu3dqJ9DFvKF:na+c77R/T0S3XexSF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622547958, "uuid": "40cebd68-e864-4e9a-9b79-7af59c50bee7", "value": 5167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622547958, "uuid": "460620b0-0d72-490c-9076-f53e1d97fb08", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547958, "uuid": "636c0794-ac38-40e5-baef-afc247ff7e61", "value": "e75b131008efc3f45bd8e5688b8b956e5aa649abddfc0f12d9d52d35e6343855", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d10e377a-c2ac-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622533306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622533306, "uuid": "2ba6fd16-6e19-49e6-88d0-598535f719b3", "comment": "Malware payload (RedLineStealer)", "value": "3a09a05ada813de6661be5739dc3c0c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622533306, "uuid": "ea157380-241a-48ae-ae81-772543afb609", "comment": "Malware payload (RedLineStealer)", "value": "e87c87c4a26902bc8bbd9993162a98bfb67bb20f9b06cfc0084f5301bec9b816", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622533306, "uuid": "6af1dd67-6051-4846-9d88-e01ec34b59bd", "comment": "Malware payload (RedLineStealer)", "value": "f8aebc44296ea072d5282ea6a59921ca2c9d9c5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622533306, "uuid": "3ad35e8e-86c6-45bb-9b8e-44764bebac98", "comment": "Malware payload (RedLineStealer)", "value": "e70b9c513e8613ca9c974962f1e1cc212a1444faf73604301e16faaac040e09bd780b16841cb6adccad8e6c2fc133d82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622533306, "uuid": "95477830-e5bc-402f-b406-a3fa4ce41251", "value": "A3849F10FA50D035F1F336B44AB792BD9629BDE1EB2450CF62C4AAEA56346E0EC31747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622533306, "uuid": "ba9f7616-6327-49e7-8435-c347572c28af", "value": "2f20facc3edc1d8ba24ede1f07abf090", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622533306, "uuid": "b5530e20-fc9d-4de9-921d-88cf7b93d2b4", "value": "6144:KekRbg1ueejPFYP/CqHaB0yAPzZVQfIqRPzc8eeFjPkMoa+IoyMZQ7OD+s2PzU0Q:Keg0ojdeKqHxyiZuhRiEPweODLb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622533306, "uuid": "6018ee9e-1682-4bc5-9ffe-4d50671db44d", "value": 397824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622533306, "uuid": "e2d137a4-b3b9-4c24-ba53-6f93f4bb2079", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622533306, "uuid": "8a75dcb7-775d-4ca3-98dc-a05902afbf50", "value": "3a09a05ada813de6661be5739dc3c0c9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04a10204-c2cf-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622547995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547995, "uuid": "0b7d4a83-40d1-4c59-a504-bf747771fe40", "comment": "Malware payload", "value": "2d289d7342507ca0255d639928295ad4", "object_relation": "md5", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547995, "uuid": "1ac695a2-3eb2-46d0-8b50-86c8f06d3d4b", "comment": "Malware payload", "value": "e9e720f29277ce7874c52205f127814e32123b2b901946982b2587b78b498b06", "object_relation": "sha256", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547995, "uuid": "9aec063b-66aa-4bba-a256-c6e382f57f31", "comment": "Malware payload", "value": "c4fbfed7535a87d97f7700fb916f3340d17ff9fa", "object_relation": "sha1", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547995, "uuid": "528ca8bd-89e7-47eb-9671-3d64e255e419", "comment": "Malware payload", "value": "33d5c9bdf989ca2fa2f0bc5c02e1fcff3ef30eada025ac570704c0135c1bcd3527bdaa6cadb6001c653f4313c96db9a3", "object_relation": "sha3-384", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547995, "uuid": "c7d9643f-0112-461c-a0ec-9bbeaf4f0f64", "value": "13E0ED347E3BC2320E3B6680DC8CB0A1887520AA434720B5B710C10BA60CF88823CA2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547995, "uuid": "4ffc057b-5748-4214-9346-72cea26d8768", "value": "6:YhHFEFmfgNiFcM25E3YRV3opedT1Xdv8SASdYDso1ZCv+L8O26XEhXoRa9YEIOQS:YYUoNiz25dTJxo1Q+L8O24+XorER", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622547995, "uuid": "51bf281c-21cb-485a-a7d4-1161c431040e", "value": 414, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622547995, "uuid": "999c40d1-0ad3-4502-aa8f-72a448f16695", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547995, "uuid": "559454dc-76d0-43b6-b046-1df385c41c4c", "value": "e9e720f29277ce7874c52205f127814e32123b2b901946982b2587b78b498b06", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53269b4b-c2ab-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622532665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622532665, "uuid": "e2fe2f71-aced-4c9b-b489-27f7213f75b7", "comment": "Malware payload (RedLineStealer)", "value": "988862f03157942de07bbdd9e40dd924", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622532665, "uuid": "018c0ec1-f3ac-4213-a0bb-a460c48e28ca", "comment": "Malware payload (RedLineStealer)", "value": "ea50cc254fa1cc865d19d13bbdf206dc69092d6f723cb56a3843d74ba83e64a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622532665, "uuid": "5c392e22-9da7-4152-8239-7f4a155060c8", "comment": "Malware payload (RedLineStealer)", "value": "552489add025a1acc1f4fb9277cb6d7b87c472db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622532665, "uuid": "5d2dbeff-a423-4a3b-bd8a-16c07d455394", "comment": "Malware payload (RedLineStealer)", "value": "4711e3d993f816570c5a3653c17988502208807e1d78a2bd1e572e4245840366a6aed38864ba847ddc83d79c541f85e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622532665, "uuid": "bff512a4-1c3d-42f8-82c3-3654d6c733bc", "value": "3FE52302BED15871C6B21D30457D9B21687EBC640B18CEAB93F41B9DEA355C0EB31FA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622532665, "uuid": "52da575b-99b1-4637-bd2c-ec5c848193e5", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622532665, "uuid": "f3c364b0-291b-40fb-9b0a-3f5f931f7ef1", "value": "49152:UbA301mWHSGE4SfYLZgCF37td/8s7DztKxOR3fueQDm5hUkMU/4Nun3zb3Njjaph:UbRrFSfQLzdDpKx0ADUUmqUZGD6hvy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622532665, "uuid": "3a78bce2-0be7-493f-a400-e909116354ac", "value": 3221953, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622532665, "uuid": "6b219d3c-9ac1-4847-8715-e88464756b02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622532665, "uuid": "f92f8be7-f9a7-4de9-90cb-e68fee09ce5f", "value": "988862F03157942DE07BBDD9E40DD924.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27947d85-c335-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622591862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591862, "uuid": "1190d714-0d6a-4ce4-9817-a8c7eb522191", "comment": "Malware payload", "value": "a7e1a2cc3c0a956488f65b4829b8799d", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591862, "uuid": "3a0a7211-b5a7-4946-93a8-91a5871b1d76", "comment": "Malware payload", "value": "eae312c5ec2028a2602c9654be679ecde099b2c0b148f8d71fca43706efe4c76", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591862, "uuid": "73859240-3698-4718-b1a0-2a2cb8beedf1", "comment": "Malware payload", "value": "10bfc411ed9c7290b2bed79b8c085dbfc3f933de", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591862, "uuid": "228fba3d-cb21-4610-a6a4-99a88ac038d8", "comment": "Malware payload", "value": "0f2f9dc004c29487dee0803147b69cdbb29ab473f2a5e61dddfbb3526e21688a79f509ab20432c671ae44a21338cd9be", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591862, "uuid": "f99372f5-31c7-48d8-868d-898a46fbf6fc", "value": "B521F3162ADA2B94C3B78F7300B7F220C733B941E993A75D454C91CC68E1614E839F23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591862, "uuid": "253e5fbf-4b93-4cec-bf7b-f0f9f55c1b0e", "value": "24:8IJz76kyAJ5J+/Ye04I0W4Rg8gOs76/qqgufm5:8WbnTerIGR+OJ/qbufe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622591862, "uuid": "a95a57c4-2308-4b00-b0c3-88c20d2385ce", "value": 1289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622591862, "uuid": "7bca5113-a677-40ec-ae4a-a40b5cf52149", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591862, "uuid": "8d39b0bb-d99e-4703-b146-9471620e6662", "value": "eae312c5ec2028a2602c9654be679ecde099b2c0b148f8d71fca43706efe4c76.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0876a3b4-c2ce-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1622547572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547572, "uuid": "241f608e-a066-4550-96b7-38787bba0454", "comment": "Malware payload (GuLoader)", "value": "541369bff43470b5cb1056745b7eec92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547572, "uuid": "29adface-d223-467c-99ef-5a9509d934ad", "comment": "Malware payload (GuLoader)", "value": "eb10ac373436166f7ca87d90b23d05247fcec78e9c791a454e68a17e29fdf54c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547572, "uuid": "d9bead7f-4d5a-4205-9e09-241814d7b3e5", "comment": "Malware payload (GuLoader)", "value": "6817936c5ba1f86bd8caf8769e9131a1b56c122c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547572, "uuid": "846562d3-cc7c-48fa-bf92-bcdbd6caea16", "comment": "Malware payload (GuLoader)", "value": "7549d270c7dd804a90857efff63ef176648663fc33e4e6ef404b6bdd942bed0eeaa04c61d4b334d7a5004b2abcfcfa69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547572, "uuid": "027ef5ec-7a86-4256-aec4-e63c0ad2ced4", "value": "AC648123B711A165E04AF470F225E1BEF2187CB2541A0D1BBA957F6F20749A3F9B4F06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547572, "uuid": "a6890725-1f40-4f1b-9685-0bf51c69e17c", "value": "1b3a9d51a40f5ca9cef0b8379f0622fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547572, "uuid": "d71d6b3c-8017-4a43-ab4d-5c8877ae80bc", "value": "6144:zYFh5QZY/sBI2/AVFPosKZGN36DIKRdkCVsS13o3EQxH41I+iIy2ttd0fjtKpsS1:cFPJkBTAVFPosKZGN36DIKRdkCVsS13T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622547572, "uuid": "64991fa8-8f19-4a36-a75b-7ab8ef5c440c", "value": 315392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622547572, "uuid": "6b336bc1-29b9-49df-8c09-254850bbe735", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547572, "uuid": "df294431-5f8d-4f11-826f-8324ab463c66", "value": "SecuriteInfo.com.__vbaHresultCheckObj.16723.23531", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da465561-c2c1-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622542341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622542341, "uuid": "062ce52e-f768-4a94-bd3c-6b0a04592ef4", "comment": "Malware payload (RedLineStealer)", "value": "5a88beb2f18d3d5af56d184a9862b788", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622542341, "uuid": "6ab494ee-7f11-4524-8394-e67387fe8a2e", "comment": "Malware payload (RedLineStealer)", "value": "ec835c15a9000e86553ebd1ec3a1cabee067cde9683b526e5dd09a276e1cd50a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622542341, "uuid": "f8d746cb-bd23-42f5-b290-a28a5bc277f6", "comment": "Malware payload (RedLineStealer)", "value": "c511b43a6caa02f4374c3219e024a3115465ae10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622542341, "uuid": "9d0e1792-0002-4cbb-bf81-0c7fc10828ea", "comment": "Malware payload (RedLineStealer)", "value": "f1f6cfd67ccddabda7d7afe6faf17de5e9d423f8c4148d02de958ce22d5a63f57bb1d0768b2ec642d0c4697a8ce4538b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622542341, "uuid": "9edf6fdf-ce0d-4960-b8d1-de2a453b935e", "value": "4A849E10F690D034F1F336F48ABB92BDA529BDA1E72450CF62D46AEA56346E1EC31707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622542341, "uuid": "5e8a3440-9fc1-43bf-9c81-3c9d35e7f8b0", "value": "84a7eb4192b6bf7f0b88f528d598a47f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622542341, "uuid": "7798affc-2a0e-484b-aea5-7ca7a95861d3", "value": "6144:2eJL82g8RUPrtYUn9i4SKlP8K8o1ViAFDprjvG8CiyfFPB/Lbb7CCiTa/j:2eJwgUDuUn9OKiKlEypjvaiyfFhT7q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622542341, "uuid": "d2de3a0c-f078-4b30-88b9-b6f75caed5d7", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622542341, "uuid": "c8b16cb3-88c0-4d0e-bcf3-bcf6dea507d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622542341, "uuid": "f349a7b9-6878-48e5-8ff9-46b4befd0c7d", "value": "5a88beb2f18d3d5af56d184a9862b788.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2ddcb90-c2a7-11eb-875b-42010a9c0053", "comment": "Malware payload (CrimsonRAT)", "timestamp": 1622531215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622531215, "uuid": "696442c2-7718-4e2f-b60b-e4a0550afeb3", "comment": "Malware payload (CrimsonRAT)", "value": "eae4474c646b0f3feecd690cfad0a46c", "object_relation": "md5", "Tag": [ { "name": "CrimsonRAT", "colour": "#D90F59", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622531215, "uuid": "66244c25-9dcb-4e68-bd8f-70fc4488a696", "comment": "Malware payload (CrimsonRAT)", "value": "ee0bdedcc1c0395fb52a3de9d7173ea0a662dd41bf8e41daf049d588041f8077", "object_relation": "sha256", "Tag": [ { "name": "CrimsonRAT", "colour": "#D90F59", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622531215, "uuid": "aab0dec4-1381-4fc4-9af9-c105f0ff245a", "comment": "Malware payload (CrimsonRAT)", "value": "3e8f4e99808e0761cc8f31c535492dc7c82661c2", "object_relation": "sha1", "Tag": [ { "name": "CrimsonRAT", "colour": "#D90F59", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622531215, "uuid": "c1d1b983-e6dd-480f-9b2d-d8c1e6b8e509", "comment": "Malware payload (CrimsonRAT)", "value": "eb7f38a288d00d88d0771471ea72996176bcc15b8a6153096bb979096919ca9fd37bd5601fc7a16c6342391e17fae1f3", "object_relation": "sha3-384", "Tag": [ { "name": "CrimsonRAT", "colour": "#D90F59", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622531215, "uuid": "da7bb02f-8df4-4fa4-aad6-4ad2bced1a80", "value": "FCA6F1C003ECC362E6BE47FEF46275E06775DA96E441EF0E4EE502FD1926351A8A0927", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622531215, "uuid": "7dbfe07c-50c8-48f8-82fb-a82de11dfb26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622531215, "uuid": "fe0c60ef-95a3-4098-bb79-453cced90e3f", "value": "3072:/PI2hpaJXkPDBJkrdCx1iJ65w+PjTN9sppbAmrhsiB7EdQ5E/Hs4Vo2I:3lhnDUrMxgc5w6NapXGQ5HT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622531215, "uuid": "4a7f5e9e-fb88-4ba4-a963-84a93b7822a0", "value": 9698816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622531215, "uuid": "86ee5ea1-7913-4553-a388-c31298072056", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622531215, "uuid": "67842957-1da2-462c-99a0-4f0ccf6b62f7", "value": "EAE4474C646B0F3FEECD690CFAD0A46C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29d97773-c2a3-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622529160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529160, "uuid": "a34ad01e-60f6-4f51-b93b-66c52ae3d24e", "comment": "Malware payload (AgentTesla)", "value": "8dfb4c52e800be284a118beaf833b559", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529160, "uuid": "c5fc0344-c7bc-434f-8a26-bd840eb7eb82", "comment": "Malware payload (AgentTesla)", "value": "ef60c6f882688ceb33102fceba7bef96a60b91c58b5b71d27681dd8247c76117", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529160, "uuid": "535cacd2-47cf-4c6e-82ce-e7a2215db01f", "comment": "Malware payload (AgentTesla)", "value": "a7d1a3333eaa4db1a5276f3bcdec06afe0827787", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529160, "uuid": "8e5f6008-453b-4f44-b5dd-bac09f6275ab", "comment": "Malware payload (AgentTesla)", "value": "28f305b44757f69cbb0007825a634315fbfe1a88248e3f59a91b289051beca334694154e51cb95e17022fa8147515bc1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529160, "uuid": "56c009f8-d847-4425-8478-dbc8b2708c80", "value": "D7455AF0F14898B1EC0ECB3186B68C6997237EFE6972041D1A6DF65C1B7338A5B59C06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529160, "uuid": "2a6d5242-7438-4ad6-9ff4-8f32766d5621", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529160, "uuid": "0fc1e5cf-e101-4926-851a-1e0ff3528cb8", "value": "12288:sf69bsKRG86vTDBHM9HlISo5YscTHFS9FrXkQDGTO+3gSNdaEFgEo4sN8+HMVN6:/UH+A+sc7FGFr0QmO+/PaEuEoFN7sy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529160, "uuid": "c3db2349-6c85-444e-9927-2a8e87807c02", "value": 1270272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529160, "uuid": "02ac4d2f-4485-4928-9299-241fcd9e0835", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529160, "uuid": "c59afbad-bf3f-4f15-8229-f676d669e6dd", "value": "revised Order 8954_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdd59107-c334-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622591712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591712, "uuid": "1367ed06-efd0-4469-b2d7-b30ae9f37843", "comment": "Malware payload", "value": "c689d925ea3b4ea6a5476e0c2af4d47d", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591712, "uuid": "04a4c810-b10c-4044-a91d-eda81409991d", "comment": "Malware payload", "value": "f006af714379fdd63923536d908f916f4c55480f3d07adadd53d5807e0c285ee", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591712, "uuid": "9d241efb-e496-47fa-a6ce-21e4acbda201", "comment": "Malware payload", "value": "01abab121bf50daa0efd6ed2791b6dbdf944232d", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591712, "uuid": "06c56e72-e864-4745-9105-1c9bfa90520e", "comment": "Malware payload", "value": "7f5cabd7795fab183a64ef72c20a9c1397b219565f36808ca8a78e7999b13d8d83dc5413a1064d80b3797423c19df6a2", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591712, "uuid": "84d57000-fc4a-47c0-b729-a8366e5932b7", "value": "9E45D14076A2F0E8E6FD913005EB85614B2DB93DDA6478E7BE4C518D2F646C00DFEAD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591712, "uuid": "197c996c-2523-4e7b-97ac-20d2a13dc2ef", "value": "6144:/S+SUvY2lH9F9hUVHbutYsATDaqeKOQe0d9:/S+XvY2ysAnaqepz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622591712, "uuid": "37c032df-9b8e-4a80-90db-c73923b415f0", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622591712, "uuid": "547f1dfc-aa6b-47a0-8828-7980b361fe10", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591712, "uuid": "a9fb0714-26a0-49c0-83c0-85640f3a21a3", "value": "f006af714379fdd63923536d908f916f4c55480f3d07adadd53d5807e0c285ee.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dec745e5-c26f-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1622507129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622507129, "uuid": "603367a2-98b4-49e0-adc3-37a2eeac890f", "comment": "Malware payload (ArkeiStealer)", "value": "aa2452c04d62dfd2e59ece008cb425ea", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622507129, "uuid": "ff57acee-b391-4004-bd84-f209a1610217", "comment": "Malware payload (ArkeiStealer)", "value": "f1eef3e9a10cda6ba7e4a9608579631d42b429bb49ff1f4f4f5c8ea2ef60eddf", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622507129, "uuid": "c2c4aca1-fd1c-48b1-a60f-51f78cefb306", "comment": "Malware payload (ArkeiStealer)", "value": "7aee8be36c53fa13ff66f7f6be171f3f9b8b34cf", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622507129, "uuid": "db1886d4-1f96-4b63-a96f-958c85475342", "comment": "Malware payload (ArkeiStealer)", "value": "13a9bca0671c9c783555680f9ff86f1b9d8f63f1f1049b9678d972aea7c0d3dfbe486812e81d21b4a326bcc33ca38572", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622507129, "uuid": "1f35ece3-8704-4863-a78a-901078d02473", "value": "0D16338AE2D801D3F7E191384198633F49AD8217207467E1E9F25B926B56B70FC7BD2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622507129, "uuid": "7d8a20c4-7d88-44a4-a55d-2d89978d7392", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622507129, "uuid": "ea2c7c75-64b7-48b7-ae77-f2ac0cb40374", "value": "98304:JbOi396Hjee7GxlVKoifraF1yWPYBVjZOTiFUC3XgaIF:Jbf9Gqe7ElVVF1HABVFL3X2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622507129, "uuid": "3019c68c-d78d-4d36-a98c-76d28fbb707b", "value": 4207121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622507129, "uuid": "8b57cf78-6665-418c-9f5f-edd15a03e584", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622507129, "uuid": "55218132-5fdf-4355-b7dc-88dc0bd25af6", "value": "AA2452C04D62DFD2E59ECE008CB425EA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d31ab22-c2a3-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622529165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529165, "uuid": "3686341d-187d-4440-a2e1-9c75c5906b94", "comment": "Malware payload (AgentTesla)", "value": "219def3531f8599d034d76167aba06f1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529165, "uuid": "50ee6ff1-ea8c-41cc-9178-d2fcde44a56c", "comment": "Malware payload (AgentTesla)", "value": "f26e3419bba9478ee9ffc8ef1f4691f4efe89837a96f377abefde64bb7ca6035", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529165, "uuid": "3841f6cc-d9cc-4f9e-a803-cac6d4f5672e", "comment": "Malware payload (AgentTesla)", "value": "39de191e10a7484b568f6a52a1e3a7d502afe061", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529165, "uuid": "1bd89471-a0c9-47ca-bf5e-6be4988956cb", "comment": "Malware payload (AgentTesla)", "value": "b580572f3d254d79331a35d8729fb7ac2668bdb8fba669d31c31b545d9e2fe429e5e9ea67b3a3d009084b8110c7b7083", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529165, "uuid": "3a1574e5-c11a-456c-a296-94b67259d2a7", "value": "8415E132129A9BD1E2AD87B8807498B303F175D7EB12CB3D5DA92099C0A574385D37BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529165, "uuid": "7e3393a7-a222-4eae-a426-939a81608fbb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529165, "uuid": "ea83e5c1-0cfe-484e-9ee4-59466914a765", "value": "12288:+BLykDVXb6N5mcKc+ISxj8oqtf4M9CqFFqVW3R1iX2TKX5HokDJFJDdVv6NYhvmB:A5WD+JtqD9CqFMk1EuKZokDddVvvFp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529165, "uuid": "5b198e2f-742d-471b-acf2-fa63dd75cb31", "value": 927744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529165, "uuid": "24c7edbe-9937-4afd-a926-db07a3891beb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529165, "uuid": "3210b7a4-fe53-4bd8-8b86-b94c5120b74d", "value": "Fastech PO #8507.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abf9d81f-c299-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622525083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622525083, "uuid": "382f9539-f833-4704-acef-cba219240fab", "comment": "Malware payload (AgentTesla)", "value": "e72d32b735ed68b72e6b1056f8a51e18", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622525083, "uuid": "5fc04b3c-b940-4709-b2d3-25eb5cc866b7", "comment": "Malware payload (AgentTesla)", "value": "f28b6b9ee5c9b9c48e9db394360f47e9b08004ce8ea97547cc52173aa5d554da", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622525083, "uuid": "387b47a6-8129-447b-b6b5-3e5cffdd6127", "comment": "Malware payload (AgentTesla)", "value": "25013e1856762e923bab6b425994d754b9481b99", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622525083, "uuid": "b7354a66-a342-48aa-b010-9f383167a96c", "comment": "Malware payload (AgentTesla)", "value": "987bf7f5b5f770d83834655183c1f1f062eb38298014049d7f2de0b472f05bbf8da62baca33cc57c458a7f938fbc1124", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622525083, "uuid": "c7ccf782-e19b-4301-b446-190f2f9e0717", "value": "D8D423D98594298C03073A65EE5D4DF2114F19E83A3EC7BF14DAE9F02B5DBEA096C20D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622525083, "uuid": "31ae3426-56db-4053-9dd8-54c1ea9e6431", "value": "12288:ztznDcRpL8oZEIp507W2K+XFXYBMcnCAQvFX3xFFMajqMhpYPA:JnI4oZEIpim+VoBMcvqFX3PysqKD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622525083, "uuid": "d7490d05-546e-435d-a986-06ba03a5fe83", "value": 647586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622525083, "uuid": "91b267a1-b070-4b3b-97b9-1680c33a0ec1", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622525083, "uuid": "7df67f8c-9259-4075-8d14-1502f5ef8388", "value": "RFQ_SMK01062020.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab5ad56d-c2a3-11eb-875b-42010a9c0053", "comment": "Malware payload (Adwind)", "timestamp": 1622529377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529377, "uuid": "25006258-d4b0-47d1-aad7-f00cb7f8da46", "comment": "Malware payload (Adwind)", "value": "cb1634b957054a35d56e0632b9468bde", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529377, "uuid": "c0820fa1-2d9b-41d0-a8b6-184dcf8d035c", "comment": "Malware payload (Adwind)", "value": "f2de92fc86de97d0de2a11e69ea30f022fb91129cb163a8e63d8ff2e7cff8e34", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529377, "uuid": "2cd567e9-d089-4cd8-bc43-6d255e579ff7", "comment": "Malware payload (Adwind)", "value": "92ae3d3adc787e37c247e23f2b0ac0b38c16ebf6", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529377, "uuid": "8dffe514-d4f3-4a4e-8ce0-f615345b82ec", "comment": "Malware payload (Adwind)", "value": "cf70b8606c780fb49ee7fa92841c5610000e877a34394f993a947846c8f10fe82e34007a486fe7c0131e0c0c22f3e70b", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529377, "uuid": "3bae0bf3-d7fc-4b4c-abbb-fe2b0e4681c1", "value": "1A642360C345CA649602C83DC777B6B80909627E74DB75F4E0EA260C67FB9F6758C0E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529377, "uuid": "e240cd38-801e-41d3-9389-c3158506f36f", "value": "6144:kFBYluJy5Ti59istmbkQbfj2pKd4ZSd3J4oeIhPXsTt4M3VEF25P9:kFBSYQimb3zj2Kd4Yd5njhkTtVEF2N9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529377, "uuid": "cb0002ef-5e46-48d6-8e0c-49e297a6bcc9", "value": 324361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529377, "uuid": "ddecc546-3f2c-4173-af08-9ea5f6ff53c3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529377, "uuid": "96e7f894-e618-46c1-ad75-ab5ba91d3238", "value": "4EgaBovIRFrlmkqYgpfewloe9hHF.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31546928-c292-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1622521871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622521871, "uuid": "f0ae9383-ccfb-49b9-90b9-45901e42892d", "comment": "Malware payload (RaccoonStealer)", "value": "80500b0ef96b3c18f961c276ed080767", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622521871, "uuid": "59269901-9287-4d50-916d-f7e075b6cf66", "comment": "Malware payload (RaccoonStealer)", "value": "f35e26234f43294da7313aaf3d6ea01a5e45bfba7b0026820a47bd6ee3c0698d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622521871, "uuid": "6836c2d2-ca54-4b27-9c97-ecd84cefdaac", "comment": "Malware payload (RaccoonStealer)", "value": "fa3419a287a05fb17ae1751897070fe4bd37faac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622521871, "uuid": "d0888730-db5c-4eaf-9fb5-291ff66d5b4d", "comment": "Malware payload (RaccoonStealer)", "value": "a42caed0a0173eedd55d49ad568f78d7a9fe0c2dd1903d635428af866bcf47ff663f1e3b114737026ad44dcc9c2affa8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622521871, "uuid": "4881bd90-21fd-4683-8056-459004f2e30c", "value": "DDC4D000B690D038F1F376F489BB926DA56A7EA1E72450CF62C46BEA56346F0BD30717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622521871, "uuid": "b9f67257-a23d-4893-8e6f-4e70311dffa0", "value": "24591330049b4c946140004b0755a204", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622521871, "uuid": "14efd8c9-ba22-40c4-af86-859d4d23cfe0", "value": "12288:v5feA4fbKjV+kpU2uXbPb/EgOorMcz3n1tO3WDf4MTTtX:v5fetKjV+vXbZrMcDn1tOmr42p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622521871, "uuid": "4703a15f-1065-457b-af6a-02618b3cfb60", "value": 596480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622521871, "uuid": "35df23ff-ffb5-4e45-88e5-b2ba8d1f8428", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622521871, "uuid": "0027e03d-6a69-482b-8607-e97fab6be17c", "value": "80500b0ef96b3c18f961c276ed080767.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c024f6b6-c2a7-11eb-875b-42010a9c0053", "comment": "Malware payload (TeamBot)", "timestamp": 1622531130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622531130, "uuid": "9d3b8474-19cd-4d40-b5df-bffa43746783", "comment": "Malware payload (TeamBot)", "value": "5f2ca480072e9c38e3ee217f029ade9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622531130, "uuid": "0968f0a2-5a4b-42c0-a09d-4b4b4ab51e11", "comment": "Malware payload (TeamBot)", "value": "f3bc66100debb5bbd82bbb690ff338a6f35f167697d28b07711bea62edcc0e02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622531130, "uuid": "0c89c399-803e-4779-9424-41022f63af87", "comment": "Malware payload (TeamBot)", "value": "fe4b02f93ff8cac62867cd86945e7a343aab7989", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622531130, "uuid": "330b5884-fe47-463d-bfe8-1c6a0031eb32", "comment": "Malware payload (TeamBot)", "value": "b161c648506c531167c0500d251f870331f466194419d49e0b0e22445340e023d543a7ff8a05e899aff095be065b5aae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622531130, "uuid": "eeee650d-9fbf-4421-85dd-e973bc8baa1f", "value": "BF05F1006790D034F5F336B549BB927C9A2D7DA2EB2850CF12C8AAEE67346D1AC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622531130, "uuid": "91222bac-d3d7-4470-afe5-359ec5d886e6", "value": "ddfa50a7d17fa7288028195442f05ca4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622531130, "uuid": "49b5034f-9747-4650-b5b6-00d4c8b7a57e", "value": "12288:nnkM68XBF9xpSVVrl4cgbqBGIcHdwrPYO81T7RNC333ACWmBRr0265J:nfXBbe42DPYB1T7RNC3nACHRr0265", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622531130, "uuid": "36af627f-5fbf-40ce-bb81-f0ec5a41792e", "value": 864768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622531130, "uuid": "0822aa50-6a3b-4615-89e1-2bcc1195a7f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622531130, "uuid": "91771f1c-d7a0-48eb-b01d-7bc9f1fe4afa", "value": "5f2ca480072e9c38e3ee217f029ade9e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "353a9aa6-c301-11eb-875b-42010a9c0053", "comment": "Malware payload (njrat)", "timestamp": 1622569552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622569552, "uuid": "8f8625fc-9065-4108-ac00-0185ca857210", "comment": "Malware payload (njrat)", "value": "3c0aae717448329bb947615ef4149634", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622569552, "uuid": "ac1defda-8bb6-4a48-bf1a-219bf470331b", "comment": "Malware payload (njrat)", "value": "f4e19ee47b081915a855cad65d4b573e39ca81ac27b163e2cc914e3445cfee4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622569552, "uuid": "9e4cccd9-6e16-4ea3-b7a2-6474c05fb485", "comment": "Malware payload (njrat)", "value": "773efa406c93ee52e6fa748e3abd491ba6dae350", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622569552, "uuid": "e83270e2-4aae-4ce0-b510-b26c0478027a", "comment": "Malware payload (njrat)", "value": "5c0c3792c8f0bcbf538b73f08ff1ebfc045836eed03382072d4ff762d53c66229e10628c21f8cf81f751f2a18a08ed9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622569552, "uuid": "a32f647d-f36e-467d-801a-9e0386573261", "value": "57E208067BE94215D6BC1AFC8CB313214772E3838532EB6F9CDC98CA4B676D00655EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622569552, "uuid": "841eccba-5657-4484-b93d-238d1ef9b34c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622569552, "uuid": "0eafca74-b248-428f-8061-ab53c413c191", "value": "384:i0bUe5XB4e0XcOfOLsw0Q0mS03AWTxtTUFQqzFJObbR:7T9Bujk555dnbR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622569552, "uuid": "2865049c-1220-48ec-9ee7-1bebb5e6ff62", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622569552, "uuid": "fcaf63a4-e239-47f5-bdb5-4d1794041a04", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622569552, "uuid": "1714c45f-52c3-4675-8b81-c00966ffe04d", "value": "GuDCxzqi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "434c0da6-c2ae-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1622533927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622533927, "uuid": "f6f357ef-cd3f-4696-8004-a50cf5869d2f", "comment": "Malware payload (Loki)", "value": "e2559d5426932b8b51b1e343a39328b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622533927, "uuid": "863c4cb7-0aae-4f69-bdc7-f373dc87c70f", "comment": "Malware payload (Loki)", "value": "f504c18377883cc49e072e7d49cf0fe6b0b70c56cc6daec41278e188664ca12c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622533927, "uuid": "862bff56-9921-44be-aca1-ece06a58e92c", "comment": "Malware payload (Loki)", "value": "23ec95c5e001954b4e0d6486a064fe5631f4b525", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622533927, "uuid": "bf24840b-326c-454b-84e2-9c00ac825b12", "comment": "Malware payload (Loki)", "value": "2bd96c3602977f784814e450824f63974af9204d76cfa4c2b2c72fb00f55a0aee4e3040deb93a698f17a9f30552ea40e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622533927, "uuid": "db7c8823-9dcb-4d6f-917f-225683b0a5a6", "value": "25453AF8B154B4EEC54BC632CA945CB8EB6129FE4307450A406766DCAF1FB9BCF184A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622533927, "uuid": "1d2caf1a-2e0b-4824-8f38-f9f190d6d0f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622533927, "uuid": "b211bcd9-924f-4135-a5a0-00f9c0fee65c", "value": "24576:IGRzXHjPZD3Ig2Igs1IB0Did3yvyOSdakvLe:IuXHjJ3I3Igs1IKGdCvyOSpvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622533927, "uuid": "9c38590a-a8ba-44c5-b7fc-d4cdd3868e58", "value": 1193472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622533927, "uuid": "25f0ca6e-a01a-48a9-8db2-94062313edea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622533927, "uuid": "4471ab02-3661-4f33-90e1-6cf1031d50c2", "value": "PO-20210601.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75089a9a-c2ab-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1622532722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622532722, "uuid": "a92ab8bf-a487-4f91-b36d-532f65cc46a5", "comment": "Malware payload (Loki)", "value": "8c8fcb6d9fb77e0f95cc81a1034d3b7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622532722, "uuid": "be9917de-f246-485a-abbc-556619825eeb", "comment": "Malware payload (Loki)", "value": "f528f1be2e42e3dc2742c8e90cae0f32528ba570a49ebf784043c3f5a9ae9ecc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622532722, "uuid": "dddc4bdd-bb1a-456e-8ffe-6dc46eb9f6b7", "comment": "Malware payload (Loki)", "value": "81eaab9da4c09ed4a6461619ce95fac93b3bf766", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622532722, "uuid": "35640133-6b53-441b-847c-e170c1931244", "comment": "Malware payload (Loki)", "value": "4ae3a1590d6b54d244fd6cdbb0998e3015424bce7b8032ba707d6fd4ec05e724587503d157029e889811c38d3d793566", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622532722, "uuid": "0b3b12d4-deb2-4e38-a757-6b2bc97864c0", "value": "2425AD7A32817ACFC92BCD72C9649C61FBA1B1B64707E3135063119C9A8D6ABDF141F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622532722, "uuid": "73497711-acaa-4a91-8326-fb7e060161ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622532722, "uuid": "050503a4-db62-45be-bac5-2e6715cec92b", "value": "24576:f5ny29C9HhrhBWAvL1vu7KKyC9wKHiJlS:f9y59HBhBPNuNXwaiM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622532722, "uuid": "3fecb05e-84f2-491e-9ce5-6b9c2b8bb273", "value": 989184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622532722, "uuid": "c7cdba5d-ffee-401f-ba06-a237198c391a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622532722, "uuid": "f51caa83-9913-46bc-9a40-a721f0ac22ff", "value": "Quote-20210601.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f08439c-c29d-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1622526699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622526699, "uuid": "043d2c75-3c99-4ac8-963b-c8e8c2a51b40", "comment": "Malware payload (Loki)", "value": "34f1a8ca17ea90126491784b6009721b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622526699, "uuid": "dfc335fa-d890-4d05-82fa-1d6b2ca93105", "comment": "Malware payload (Loki)", "value": "f5b7e7314da9df6c450a5a93e5d04b46499e5d1e4f4d0fa6cdfba1e08c4935ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622526699, "uuid": "a9708911-94d7-41a9-8e4c-2983b0472ac2", "comment": "Malware payload (Loki)", "value": "f87a11b1226c06711f23b26a6734f384a68265ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622526699, "uuid": "a1d5068b-822d-4c85-9812-6e1b4d973b90", "comment": "Malware payload (Loki)", "value": "3cd6e9b285eb1fb132b4da5a4b01c6753819ea3b106fb58eebcf2c7a5573a314a43881b459a4afe43af4c353c6f26797", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622526699, "uuid": "eba09cbd-e39a-4cf2-9b9b-122ad88b20e0", "value": "B525ADAE32817ACEC96BCD72C8649C71EA71A1B74707E3175063109C9E8D6ABDF141F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622526699, "uuid": "e9bcb455-3c87-4da1-a016-597618158f94", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622526699, "uuid": "a21f0ace-d73c-438f-83e5-520b720625a1", "value": "12288:AjJXaDFKEoy3H26N7hVOzNWdYfIXNo2rWw4LA7K0qOfVd87LMGZ8vgqP8DQvGyfv:AYHJ3HTczN2YfIXOhLHYs7RWPKQlBz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622526699, "uuid": "d3e8a70b-9daf-44d1-8d01-ae076c79809e", "value": 987136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622526699, "uuid": "ad9121e6-228a-4cf1-b51a-3ff7aa240d1a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622526699, "uuid": "cc4cf5de-cde1-4a22-a39e-a7b4861db967", "value": "Quote-210601.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ef5b1ba-c335-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622591875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591875, "uuid": "68e43ada-23c7-4b16-8e6c-c7a718ed6b20", "comment": "Malware payload", "value": "1d059c2645ebac4c823a96900c0f3534", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591875, "uuid": "3f426b54-e5f7-4c5b-9f38-fc066cb3f095", "comment": "Malware payload", "value": "f88530bc87cf2c133c0a50e434ce0428694901fe7860abb42737097fdea56b30", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591875, "uuid": "dd18c588-c5e9-4943-8f21-962172f516b7", "comment": "Malware payload", "value": "5c6ec94ef0c56f1ce12e724779c2082d615d4a93", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622591875, "uuid": "adda0ad4-912d-4f9d-9dd2-f36df0e154eb", "comment": "Malware payload", "value": "642cd4bc1b17db06de32882839db9857f39d4945bd0819ed16b19fc0435f4b551b0ebce95517e15a32dd9f7734e39bb4", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591875, "uuid": "47c833ef-d7dc-49e4-b328-0adbcba66789", "value": "B331AB08079D8318F3738A73787AE70587B5B85BD916CF6D09C562A46C68500B674F2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591875, "uuid": "0460035a-e79a-405c-bead-4e748a380c1b", "value": "24:8WVIkDwq5nSRVe6alTyA/eAh+/Cl1ga/E4I0aVArQ6YvmB:8WPZYVeDltmA7l1HISW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622591875, "uuid": "4f2be671-fdea-4038-9d5a-418d085d4ca6", "value": 1830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622591875, "uuid": "7cf56c5e-dc27-4957-b07e-d3ba49cb3b38", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622591875, "uuid": "afc97324-75c5-4b68-abd0-cc321e21fc58", "value": "f88530bc87cf2c133c0a50e434ce0428694901fe7860abb42737097fdea56b30.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "127dc919-c29e-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622526973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622526973, "uuid": "d42d9a9c-e400-4f05-bced-3341a2ce2e2c", "comment": "Malware payload (Formbook)", "value": "170e65521a5bbb392eaece875e582d7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622526973, "uuid": "fc8bd3a0-9c30-4ae9-87de-7bdca9d48034", "comment": "Malware payload (Formbook)", "value": "f8fe4e73472833179919f0a38080cb9a9567ce739ad669d4199748fc17613a9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622526973, "uuid": "14d44e34-1a70-49ae-8361-84bba82d2fe0", "comment": "Malware payload (Formbook)", "value": "47d2b0aebb16eb2e78401171405ed22dc095d0c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622526973, "uuid": "116ce2fc-c710-4302-a736-d89139c54cbe", "comment": "Malware payload (Formbook)", "value": "0282d36dd06c79739163fb21653502faf07fc5ba8aa70b890c9124328e37d9cecb4647e71c87aa120c949c40ecf28712", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622526973, "uuid": "e4fe4e70-9bad-4650-b9fd-35c877facf76", "value": "541517AFB21175DEC8D7CC32C9681CE4AA6064E6570BC20394DB11ADD9CDAF6DF201A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622526973, "uuid": "c76677f5-4e0c-405e-a835-1abe35d21661", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622526973, "uuid": "89b0db8b-885c-46c5-b450-d0f0ce44ab51", "value": "24576:S9rdQRZrjbMTLWHnkP5kaYk1bjnOBpgI33Z3:id2jbMNRkzuOBGIH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622526973, "uuid": "fd79eef9-25ab-4123-9f99-3b67314aa53f", "value": 949248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622526973, "uuid": "7e06da1d-e6c5-4a06-a617-29aa51d368e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622526973, "uuid": "1e68c0e9-c6f3-4f58-b766-6c4daaa75f64", "value": "RFxBAZARGANI 1.06.2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bdf0e8d-c29e-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1622526962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622526962, "uuid": "ff535232-418f-4adb-9a45-152d41605465", "comment": "Malware payload (RaccoonStealer)", "value": "d8954fc6e33b0b18053196ab315690c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622526962, "uuid": "68dcd969-c2c8-4fcd-b963-b71b545e3f22", "comment": "Malware payload (RaccoonStealer)", "value": "f908550bb9f5aa6c171c39230d6a7ecf869ed9619c53e629c646352fa340b249", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622526962, "uuid": "b6a87279-910b-43b8-ba71-fe8c47160f32", "comment": "Malware payload (RaccoonStealer)", "value": "419e456dd5b07ab35ccc63105a63b32063072e21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622526962, "uuid": "8b8fa0a7-309b-4aad-89a6-90e32f6c1328", "comment": "Malware payload (RaccoonStealer)", "value": "71afbb35a6f65fc30d18ff930ecc797a3188ace40c09fff8fe17726744adeffc256996cd0e8846c92d3723be2f8f8975", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622526962, "uuid": "5caecea2-f1db-48bb-9c02-1b13361fc78c", "value": "79C4DF107660D035F5F236F49ABF926DA969BCB1EB7450CB22C06AEE46346F0AD31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622526962, "uuid": "0c3b02ad-776b-4abd-a8dd-552d4fd7a1e6", "value": "ddfa50a7d17fa7288028195442f05ca4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622526962, "uuid": "a4ffbe18-e2cf-47e8-a412-cb48eeed1a7a", "value": "12288:gJ58K8TpB5iLYe7o4xNDyfA2S+26uLioeSoKjBSDyJdCzI6Gh4I:gJ5spBNqxyC+XudeSoKfcGhf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622526962, "uuid": "25ba7b41-6abb-4d40-8de7-9cff86892979", "value": 593408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622526962, "uuid": "28422678-fa16-4e19-a3e0-88af3613c584", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622526962, "uuid": "81e40d17-8455-4c28-952f-e0a2403b6ca8", "value": "d8954fc6e33b0b18053196ab315690c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3c83914-c2af-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622534626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622534626, "uuid": "89039ae8-9ca3-4be1-8104-bd88c5731f06", "comment": "Malware payload (AgentTesla)", "value": "88b578d96e632def7abaf678319325f3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "ra", "colour": "#1E0C4B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622534626, "uuid": "d14fca8b-5397-48bf-8f12-abe7b7afc8c4", "comment": "Malware payload (AgentTesla)", "value": "f933026edea7db865c7537790d7f8ac55474f83a6efc9182267d2523422b0049", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "ra", "colour": "#1E0C4B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622534626, "uuid": "661b790b-c300-4af2-a857-0392fc09d51d", "comment": "Malware payload (AgentTesla)", "value": "9b3fb378e916aa70ec777651113b304f90c262c4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "ra", "colour": "#1E0C4B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622534626, "uuid": "cca4e91c-b4e0-43b1-b478-b30e851ba172", "comment": "Malware payload (AgentTesla)", "value": "8a8922843ce9da0788de7e490e9bff7de294ac33339b4effbb927fa5d6cc7dc8f84b1110dffa73a0a255dfb2b3f763a9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "ra", "colour": "#1E0C4B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622534626, "uuid": "309735b9-a863-4b83-a342-0f38c86b6a31", "value": "0EA423C7258D8154A3AEB708493600BEF5D8BE5CD38532C9E6E0F39A762D53FB824391", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622534626, "uuid": "3c70bb17-74e4-47e1-8218-a8237168b5db", "value": "12288:d4G7+qiZv/J2GtRvchTDWAP6boWZOjMitjbzR9lyKRIghyH:ei+qiZJ9ttc5H6boRjTAKRjhyH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622534626, "uuid": "b503efbb-739e-46be-a5ba-fcbe748834b7", "value": 482843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622534626, "uuid": "1c171bf8-336b-4ddc-88b2-1441a446547c", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622534626, "uuid": "62c9aba9-3df0-433b-a283-ddd524f3c628", "value": "New Invoice.ra", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac25a9de-c2bd-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622540545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622540545, "uuid": "b71f5e7f-6ad1-4511-bf84-76a31059083e", "comment": "Malware payload (AgentTesla)", "value": "bdec7b0372bf9470e7db687ffe1656ae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622540545, "uuid": "004c4b86-abf8-46a1-9756-bb81d3e9fe25", "comment": "Malware payload (AgentTesla)", "value": "fa4619ebda77472e045b64ebc355777bdf509125e450ef35a59efd275610c9d3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622540545, "uuid": "b2810e20-d047-4872-b9ad-2fe779048b63", "comment": "Malware payload (AgentTesla)", "value": "24f63feededd1c9e88645bdea1a484edff93a020", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622540545, "uuid": "1b1e99d0-b0d6-4778-ae66-b1d3812df20b", "comment": "Malware payload (AgentTesla)", "value": "63cd1704527856b2c36d405836ae30f0df9bd36862b8dc8d4cd057d8213b125e31a5f24f669535810c78c042565aeded", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622540545, "uuid": "9460159a-9fa4-4fac-a47a-31e62c777919", "value": "D705E13613999BD0E67DC7F840A4A8B703F1B8D3EB12CB399E9C50991495B8486D237F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622540545, "uuid": "c33c3485-2794-4c49-9cf4-adeb84543927", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622540545, "uuid": "d5251684-1679-4ecc-9f0c-1f31c7605416", "value": "12288:0JqEIqjE+rb6N1kiXdLZJniZPlhBPtacNLQIEZbPNlrvXJdNdJzod3IBLWOUm1aN:cJjf+XJiZaikDlrvDN78d36KBm1a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622540545, "uuid": "fba02fbf-93fa-4b27-85ba-50d287b0c7e3", "value": 856064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622540545, "uuid": "de641ff1-b1f6-4b2e-a5f4-c4892decbaf1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622540545, "uuid": "0e406614-aa2a-4b42-825f-02a55565ee9e", "value": "SecuriteInfo.com.W32.MSIL_Kryptik.CYQ.genEldorado.3068.553", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8da1bc2-c298-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1622524675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622524675, "uuid": "60c151cf-290d-4abb-8405-5fdc63bd0061", "comment": "Malware payload (SnakeKeylogger)", "value": "e65afe26fb2ee00e4b6fb967c709e0de", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622524675, "uuid": "d98bd86c-1ac6-4a9c-b1bd-21c0f6708491", "comment": "Malware payload (SnakeKeylogger)", "value": "fa7c780baf5b0512450ed71bef12eaa58a08ccb00860943f00c07a5a5fb30449", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622524675, "uuid": "3b4eb34b-e589-45ee-8f58-4412805215c0", "comment": "Malware payload (SnakeKeylogger)", "value": "c2a1a3a74a81fc23ab79232cb3d48d1902e66a99", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622524675, "uuid": "bc4c8e0a-c742-4855-96c9-c8751c1a76fd", "comment": "Malware payload (SnakeKeylogger)", "value": "d2bc2cc59901cea72dd2120d4bfc139b32dadb828b8e84794f5542edaa06cc33f4d010e60e7b99164202f153bcef52be", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622524675, "uuid": "92b4eb35-f9c9-4be0-a250-349a1450a8ff", "value": "AEE42370C5CA7692845F9477630EE4AEAF4F32D382410A647D8B61E15648B8F3FAB137", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622524675, "uuid": "e94cb916-a715-4580-9111-1d71f629928e", "value": "12288:ZsaqD+QNwFpgto/VrYsdvGmTzd519vOOCU0A4t3Po:Z0qrFKO/VsoG0vvIJt3g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622524675, "uuid": "4e4a1c85-92a4-42d1-971a-1b0fdd56a48c", "value": 687560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622524675, "uuid": "5cbb246d-b0cf-41ea-a22d-7a01a3628c64", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622524675, "uuid": "6b4c56c0-0f65-4698-8bc8-d403d6652417", "value": "Sales Contract.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7572d8f1-c2d7-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622551620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622551620, "uuid": "56740461-db18-415e-b1a8-9a568f2b6d6d", "comment": "Malware payload (RedLineStealer)", "value": "e63eda6f6524d485c85dc472d194267f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622551620, "uuid": "47bf8ed8-6625-4e5e-be3d-8176f04f8863", "comment": "Malware payload (RedLineStealer)", "value": "fa7f1e6f6c3b9eefa2e5729e3273e28a7f9a4a1ccb30d81d5841dc814de9488a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622551620, "uuid": "fd65cd17-baeb-4b43-aa85-e180d56ddff3", "comment": "Malware payload (RedLineStealer)", "value": "2d90177c7313025f162a4cc2bbfff36d00348b81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622551620, "uuid": "ba1ef867-0c0c-49d6-82cf-6e09d6eaae5d", "comment": "Malware payload (RedLineStealer)", "value": "bc036e3b446c53be79acdff4933844a226718f6522eea0785dfb9cefb446cc453509933d2e615cb445ebdd0e61720986", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622551620, "uuid": "3040f78a-04da-4f4f-84d0-a6573e15f722", "value": "19849E10B690D034F5F336B45A7782BCA639BDE1EB6450CF62C4AAEA56346E0EC31707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622551620, "uuid": "21f83632-955d-4b71-a526-b83f7ca87b89", "value": "63c85c090ca4b46213d1d3501aebeb61", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622551620, "uuid": "079261a2-a9bd-411f-bbb8-19ad6670bbde", "value": "6144:glZLQW27u9bNhQNZgYZXzr+YO/mC4VfuXsYgiyCuoNKcATVCghTUGtI:glZc+FvQNZ3XzrTxPtI1wNfgW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622551620, "uuid": "694acf12-1a81-439c-a5ac-a9b0b5175d3b", "value": 398336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622551620, "uuid": "2c642d9e-d460-4e7c-a008-4b9ec9505ce4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622551620, "uuid": "49350bf3-d240-4c58-8f21-eb4cf9671c78", "value": "e63eda6f6524d485c85dc472d194267f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a539f01-c2ea-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622559601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622559601, "uuid": "0b4cd909-c5cc-4bd1-abe1-8c57d1273ed5", "comment": "Malware payload (Formbook)", "value": "a3a5a7cb010c1f5509c8d3109cfdf37b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622559601, "uuid": "e63eb04f-6e3a-4575-b86e-6b9ee7b73b1f", "comment": "Malware payload (Formbook)", "value": "fad6fcbe9a20cffcdc1764878a534aab7282c3735ae866204076ddeaa3d395da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622559601, "uuid": "3a6cb50c-f540-4c75-baed-a700d65a77f1", "comment": "Malware payload (Formbook)", "value": "5e201c494266c85b8abcab836ecba37dd0327ab7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622559601, "uuid": "81ba407e-121f-4a36-9013-99f0c5483fac", "comment": "Malware payload (Formbook)", "value": "57eb6f8d3382e700839708635ea6e3749a041030d6cb041480000a81c188a979bc343d9bd620a3ab8f2e1110cad19dc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622559601, "uuid": "23284756-075d-4725-a3c9-6600234eb3ad", "value": "09456C26A342D6C4F65E14B1CDA0FBF10466BD6BDF0A6D2706463E8270BBB57463B183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622559601, "uuid": "bd49dbe3-191b-4858-8efb-a7e31b2cd4dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622559601, "uuid": "c29ec237-2d13-48d3-bf1e-5b65971ba895", "value": "12288:p1iso/MWaMw16NbZdnxfoiBv264ta22Tsj99PUBwEKd65a7qs1jo8mOH3PBWvLx4:tokhbsdnxPt2671c9GBO6ANGP1yDMe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622559601, "uuid": "b6be5049-b501-45d3-b540-0cbab72a2fe2", "value": 1191936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622559601, "uuid": "f443c2f4-80b9-4bf3-9241-1300a9ddf302", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622559601, "uuid": "6dd1df63-a03e-4e6f-81d4-d95ede9c9df9", "value": "USD 187036 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97a7f353-c314-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622577877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622577877, "uuid": "2f583e2e-0eb5-4b0a-b5f2-3fddb7ecfb9b", "comment": "Malware payload", "value": "6943388010c1cc65365d6aadad6e681d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622577877, "uuid": "820c2243-4bfb-429d-976a-8d2a3a61106d", "comment": "Malware payload", "value": "fb069e0a93c41931992327c7eb8c1f845b85c764e4e75f2795629139f7a0ee18", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622577877, "uuid": "81aebc35-1898-4527-bdbc-3004ada69ff2", "comment": "Malware payload", "value": "732f1a0eed1b2ac4027bf0abb7a99325e7127029", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622577877, "uuid": "1cae1d62-3e68-4aab-ab19-fc1ae1398ac7", "comment": "Malware payload", "value": "4a50980bd7176323e0e76676783602d8c57030253c200f2af748d96646ab1ea30bd04e0e03a3745e3d88b69012091b4b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622577877, "uuid": "2b6811aa-7591-4385-89f9-f429a98fdf9b", "value": "60D31322D3130C4FC02579FA7A2BE62A39872E6A24CE449C45F5D66A2FB7084ED71753", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622577877, "uuid": "d49bcdcc-9e68-41af-87c1-29900e243d51", "value": "3072:biMYFJvw6Yh0b1gKobtCGCmCRlrishrYm:fYFJvwe1gKCYVl2sxN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622577877, "uuid": "8679ffbf-f5b0-4c1e-83e8-a42d604b8664", "value": 137480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622577877, "uuid": "dcb94b91-5a72-47dd-a37b-0c1db1c85f84", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622577877, "uuid": "5a92e307-97e7-4f3a-861a-b12cd0582f1a", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b27050a5-c2d6-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622551293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622551293, "uuid": "8eb6be2f-2f42-4813-8864-448fffab9303", "comment": "Malware payload (AgentTesla)", "value": "927296033be7f7ea6de573141e0677c0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622551293, "uuid": "cb0896e4-5652-49ff-935f-eeef22e6c670", "comment": "Malware payload (AgentTesla)", "value": "fb195db2638be4ed7473906443773cce442c8090ebbc142e012e70fe26ce3958", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622551293, "uuid": "f652710c-e98c-4249-abdc-a48140fca87c", "comment": "Malware payload (AgentTesla)", "value": "5748ffb1b22f9038eeda6a887134481388fc2d79", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622551293, "uuid": "0d96f1ab-8d5c-46d7-8ffa-f70fc571d75d", "comment": "Malware payload (AgentTesla)", "value": "5b0689c3f89f44035aa67e871b275bc18b5b914a923759205149b17a5753ff341dedd02a6879bdf86eb6228a904fdacf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622551293, "uuid": "450cda24-8410-4599-a156-7b302e2e73a4", "value": "CE255AAC321075EFC857CD7289681C64AAA57DBA570BC203A01735EC9A3DA9BCF151F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622551293, "uuid": "294906d3-d8ba-4d06-97aa-ff1fae69decd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622551293, "uuid": "fb501384-8e2c-47b7-a857-2428a033cf3e", "value": "12288:oxblffHbNZ8vAMO3KsqBElOetSow8BFTSRwD2e1BzjL4O9mr4TuRxs23D5jPj8Of:glff7HJHoygySCiGBzjL4O5uRym4L8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622551293, "uuid": "2e1718c2-0a75-4f2e-abb8-a93b3bcbc854", "value": 988160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622551293, "uuid": "833b39e3-d434-4887-ab60-77255a86eef7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622551293, "uuid": "e18bc62c-f17d-48c1-87a4-c3c0085d0e61", "value": "Payment Slip SP0235372.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4fe834f-c29c-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1622526387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622526387, "uuid": "5eb9861c-8756-440d-a04c-b74b8039d037", "comment": "Malware payload (NanoCore)", "value": "e5c8107bfd22775a217a725cf29b394c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622526387, "uuid": "9ab92812-a04b-41e2-91a4-4cda7880ec3a", "comment": "Malware payload (NanoCore)", "value": "fb30917609ba3a9aa1133926f73f5184679d31225f2070ae174f028936f2933d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622526387, "uuid": "62598fca-60a7-4750-8e49-1c0c13c22173", "comment": "Malware payload (NanoCore)", "value": "cf54c9fa552887396ca0fc28620e22f571a977d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622526387, "uuid": "c2626fa3-e20b-4ceb-99e3-7b1eb2470125", "comment": "Malware payload (NanoCore)", "value": "df25865854f39c6d23aaaeaff905c3b48ffd2d99873b203d315b2afef4034fc39196d12f13158bf33dd9a909eafd8dec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622526387, "uuid": "b40afe21-6590-4219-adba-518837317a23", "value": "6F15E0361259ABD4E67DC7B840A8A87303F4B9D3DB12CB3DAE9C109D1095B8486D277F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622526387, "uuid": "9fc5ce95-c91b-4424-b221-9d4a36e5fa08", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622526387, "uuid": "67f93ab0-a760-493b-b0af-d90abbebd3b7", "value": "12288:iEuTyBxVrgb6N2xDxR4rN3j7p3U1DqxlnkiE8KY0n4Tx2itZIhfW/ZLGAoKK0v5O:nG9V8Z3Yexlnk6gn4lttKhehL4Pi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622526387, "uuid": "281957a3-1aa2-40a9-a9f2-2182a3dee2f4", "value": 898560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622526387, "uuid": "06fbf27d-5522-4917-9cd9-03e1df7c0b84", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622526387, "uuid": "87ec7bf2-bc88-4b8a-8610-68fd9ee74ff3", "value": "Outward Remittancepdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29408ab3-c2b0-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622534742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622534742, "uuid": "2795d629-a862-4b11-950d-2db68a7b5c29", "comment": "Malware payload (AgentTesla)", "value": "a6da2c71e1aa89f7a2cdc7b57a9423d4", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622534742, "uuid": "e4332cbe-2ecb-41b4-a131-547ea56dd918", "comment": "Malware payload (AgentTesla)", "value": "fb40105a8b3b3f4d5d46bcc2f89baadc42b5ea605a3b156621d92a4ffdb3996c", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622534742, "uuid": "e68da90c-26d3-4f57-8df8-fb974a00bbb9", "comment": "Malware payload (AgentTesla)", "value": "5ad9f82f183ea2d74ab25fc0057ee140c59c746c", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622534742, "uuid": "4442e5ec-35e0-48a2-8a97-665c3e3f98c0", "comment": "Malware payload (AgentTesla)", "value": "d82145035e26d417f1f78d26865880a1f99d817c8d8f41ada5e2d324a334c2b6c55c6651b72f08b85566c41ad3a56b5c", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622534742, "uuid": "96dabe09-8a9e-4847-8e02-8b6132d72546", "value": "4EE433ACE74407821634C3B745DFA1FCE5F2119FF7291376A7AA304604E915BEAE3868", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622534742, "uuid": "685376e5-c51d-48f2-b552-15e6e0cad80d", "value": "12288:SlURpD9OVzuSX9skYLC3x+25+3kgrU7TNXRwEM4m1WfGtkGeIvmNvBD+Rzb:SmLBO9u+YL0+2ukgr6hUWfj+vSvBiRH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622534742, "uuid": "2bf90ee3-618e-460f-bc9f-f497e6ba6579", "value": 678510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622534742, "uuid": "c98781bf-6b67-434c-ac24-1824ae834f7d", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622534742, "uuid": "3056702a-994f-49ae-b9e2-eccf3eaf9071", "value": "Drawings-ESS316.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecb89bc9-c2ce-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622547955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547955, "uuid": "c635db51-52a2-4c5f-8f37-fa769e685d26", "comment": "Malware payload", "value": "9721599fc91a768eaa9943c6e15c50b5", "object_relation": "md5", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547955, "uuid": "6e74ed97-f3ff-4120-a389-5345ee9c0db8", "comment": "Malware payload", "value": "fb414689cf734ce73173b6d0717b23bc21642bb856a0f3d9fb309f7f06cebd32", "object_relation": "sha256", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547955, "uuid": "568d9cb6-3d7b-4d60-a6ae-cbdf11aef416", "comment": "Malware payload", "value": "95bce703a28b41d2d3628b3535deee298d64b7bb", "object_relation": "sha1", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622547955, "uuid": "cb5d931f-b6aa-46a7-bc9c-545c0c861560", "comment": "Malware payload", "value": "414825eb5da3985d7f4d9460ef657abd13bb9d224e09d43b5c76d82620afd78c9711dfb64941ded1947ad5653be29919", "object_relation": "sha3-384", "Tag": [ { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547955, "uuid": "43ccfac1-8f0f-4153-9919-96fd8dcaceb5", "value": "75F3E9CCB691B076837364B5043F110AB17A79ABF8449CA8F089E8E5BD749691277F3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547955, "uuid": "93ac1459-b7c8-4f72-acb0-12b9ddeace92", "value": "1536:BOwwXVqZCvnc3CWG9MdeW4dHUJAyekX5zwsfb7BGRsAim8TcVEljmComlE5AIfEa:BOwwXVPTUJnhx7Bf1wkTCL7JXx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622547955, "uuid": "6eb8ba8d-0d4f-4a19-8d9a-63ff2fb3a4cd", "value": 159386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622547955, "uuid": "6b45b3dd-513d-4b61-8ac5-7310304bf024", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622547955, "uuid": "0042607c-4d36-41d4-b189-87bfb9f05ba5", "value": "fb414689cf734ce73173b6d0717b23bc21642bb856a0f3d9fb309f7f06cebd32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d3adeb7-c2e0-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622555445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622555445, "uuid": "d91ddf97-0960-4ff7-b671-b3fcbe5c812c", "comment": "Malware payload (RedLineStealer)", "value": "acfbc1e462290e52d61e2306c7f5ed82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622555445, "uuid": "9a2b3f71-8219-49b1-b3eb-0e4f91e27eb6", "comment": "Malware payload (RedLineStealer)", "value": "fc459636a5f5def094afb0a4cdd5b8e51ffa5f879a114ff73ff22174f1c99709", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622555445, "uuid": "3ce1800a-ddd0-415d-8e40-f1b846c35804", "comment": "Malware payload (RedLineStealer)", "value": "ff481a9b3acf24b91b14112fb32d33e60a8dfc71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622555445, "uuid": "7d831010-5fe0-41b1-be0c-03c2ac373430", "comment": "Malware payload (RedLineStealer)", "value": "be91524a03c9349d2243f29234df7f339247d8e0bc00e8bfa3adae6965aa378215bd5f76c5da3e3304d31d9e75c29d19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622555445, "uuid": "fe5e0004-febb-470c-a104-9ed0fdec6de6", "value": "7B165BF17A0BE2DFC39698B0F402D507C42447F28759B501ED6A7878D742DAA25CBBAC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622555445, "uuid": "889c074c-4267-4b20-89b2-868e442342ea", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622555445, "uuid": "f1f4b71f-167f-41d0-8e06-120cff4e8292", "value": "49152:4d8/MXpMD+bU885CHVJ17NgJCdgtFk6axTpyixOY71pnw06TlZ95PsEhBV:+ZghYjOO4FETULabv6Tl5U4r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622555445, "uuid": "346a74e6-6515-47c7-80d5-0b078c37920f", "value": 4215808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622555445, "uuid": "6049a1fa-d550-42bd-a531-7f2704a0eca1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622555445, "uuid": "bf9adc84-9063-43d1-af14-cddc7ec76b59", "value": "Procon.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ded2bcf1-c29b-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1622526027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622526027, "uuid": "79f939f5-1c7f-4276-967a-64f379c80b88", "comment": "Malware payload (ArkeiStealer)", "value": "ab0b10097ffa30175acfe485609a8ab0", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622526027, "uuid": "24707922-c3a3-4e92-95cd-57f0335b9ea3", "comment": "Malware payload (ArkeiStealer)", "value": "fca7e429e6242b8d1fad50044984fc49f2ac9e3c8b64513334a78daffc5e7807", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622526027, "uuid": "2635631d-6c06-4121-8982-133956c6c5dd", "comment": "Malware payload (ArkeiStealer)", "value": "b3d6e4738410adf105597e77ef1421b83bd96ef2", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622526027, "uuid": "7b12a366-a90a-41c5-986a-b554149d4ca1", "comment": "Malware payload (ArkeiStealer)", "value": "02b2fc0c09a6af51b9e09bb69e4602f9aae8048bf2d51236e1919e7118993b122faccc688ca2c814a6af1cdb5cc7889f", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622526027, "uuid": "16187dbf-73dc-429b-b32d-4ed539dffce3", "value": "7DE4E100B291C035F5F736B45ABB927DA92ABDA1E77840CB53C56AEE57346E0AC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622526027, "uuid": "cc83b85d-c0b4-42b8-aa81-3c3978d7dd13", "value": "24591330049b4c946140004b0755a204", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622526027, "uuid": "72fdca70-9454-4bc0-a3c7-9a9fdc459f54", "value": "12288:ZuSnBRBw+pTmYUM+LFNOSrraly+JmaWTYoeADg8K6IzkHpERB777:ZuUa+pTKh6lzJmaWTYo5gF6Q2pEBX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622526027, "uuid": "48bf756c-ac92-4bad-8855-493826c78282", "value": 670208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622526027, "uuid": "5cdcfb2d-e3eb-4c49-9331-fe38ef6c6d42", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622526027, "uuid": "8a100ab0-47dd-423a-a56a-ce6f40ab9e96", "value": "fca7e429e6242b8d1fad50044984fc49f2ac9e3c8b645.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf6538a1-c2a2-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622529008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529008, "uuid": "b3b555e2-c90d-436d-b04d-f09e293eb6de", "comment": "Malware payload (AgentTesla)", "value": "b3c88165b701b194141aa9948004a402", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529008, "uuid": "03db2f3d-f910-493a-8dce-52415be909ac", "comment": "Malware payload (AgentTesla)", "value": "ff5843707b8c294ad421fd0095962d8117ea0c5c83b18e1825bf1bb1861f3820", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529008, "uuid": "ed922597-994d-4ab3-b64e-e3637d7e4d20", "comment": "Malware payload (AgentTesla)", "value": "d7a60c032f6eff7c4d5d8a7545125548c3f74261", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622529008, "uuid": "50cd14bc-5491-42e0-add9-935ea75a501d", "comment": "Malware payload (AgentTesla)", "value": "f2d643ff7da659116440b2199a4dcdb974bbcd444c9f96b73209de891a913ea39b3aa3e76a42767880ef28cbf83f2016", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529008, "uuid": "1e49fa04-13f4-4d57-b854-a2daaf51e84a", "value": "0F05E122129A5FE4E27DC7F850A4D87303F4B9D3EB11CB3DADA960981451B8486D27BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529008, "uuid": "d3b90ae1-94c5-4229-a956-b5f83ea527e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529008, "uuid": "2d300c3c-05c5-4172-82b3-21ae39f28be7", "value": "12288:5FyAHG0Hb6N+57TkRX6v2xGZ3NQ9n4TmN2eovL8x0AIK9JPK7rHxrgwWpL8+eZ4:PRdTipaK4Icj8EGJOrRr+eZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622529008, "uuid": "1d79f4fe-9a40-46aa-85a7-54c55ea30c9d", "value": 836096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622529008, "uuid": "a0a223fd-ef03-41d4-9aea-8b196d3fc911", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622529008, "uuid": "5e3b65e9-2d84-4dba-acae-60f9b547bacc", "value": "PAYMENT FOR MS FOB 4-25.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" } ] } }