{ "Event": { "published": true, "date": "2022-06-10", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-06-10", "timestamp": 1654905781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "ae69ac5a-45bd-4cb7-8205-d51dbf45187a", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7db90ee-e8ca-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654871790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654871790, "uuid": "8f5b318b-c979-4dcd-8afe-941e637a33ea", "comment": "Malware payload (AgentTesla)", "value": "1359c0238261b69351fd890bc5a032ab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654871790, "uuid": "1e5bfe67-7d17-4de3-af96-dc35a42ef0ab", "comment": "Malware payload (AgentTesla)", "value": "00356cd364cf0386db5481579ff1d155a2c3f8cfaa0ac2c2a762edbc68c0797f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654871790, "uuid": "c1f83ec1-7c6e-4f61-ace2-808dd0142683", "comment": "Malware payload (AgentTesla)", "value": "bbc97ae45579efd2bf8e1a3427ab3fa62eeb9e45", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654871790, "uuid": "2b44bd69-7f50-4475-8492-7a81df5f71fe", "comment": "Malware payload (AgentTesla)", "value": "ceadebe775a33fadf0a536539c8232f76bb3a29944fed21081a0d67ea935b8c1f494d31691fa2d01565490b8cf327b90", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654871790, "uuid": "d9bcd083-099b-4a0a-b9f7-c977014ee2a3", "value": "T151B4F11D368C0777D26EFF7188A4B089D376B61F7912FA454EC3A2C77432740A86662E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654871790, "uuid": "42b1b48d-1da9-433c-9638-e544dc31283e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654871790, "uuid": "6072c872-a031-4c5d-a263-d67baccef1fc", "value": "12288:ZtSLBgVN5jy9ED2hhD2YUVHM/uBaSP+4RuMBVDPoWXNyA+wu:Zsi332hwlVHM/uBa2+QB1oWI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654871790, "uuid": "a02b1a07-cbe7-4a93-8d9e-32b42c141d52", "value": 511488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654871790, "uuid": "1b5e09f9-2f49-43b9-b38f-b4933e35fcaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654871790, "uuid": "4c42da71-c149-4a35-abee-1076e8c9654d", "value": "Payment_100602022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41569b63-e911-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654902086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654902086, "uuid": "e1cd2f66-6836-4ca5-ad3e-64dc80a14bf0", "comment": "Malware payload", "value": "c42c0c8e4e3e1906725239df20628ff8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654902086, "uuid": "29a6e2eb-7237-4f2a-8e2d-86f6cd41eb99", "comment": "Malware payload", "value": "00a1ffaf92e3d49e687d46ced1359466ecb4489b36f9ef831ede9ca39f2de4c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654902086, "uuid": "f458fdd8-d912-47f8-9836-80079fc299db", "comment": "Malware payload", "value": "299bd426b29f5954388efaa41f366f31a0a16ddb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654902086, "uuid": "dc23778e-f433-453f-83cd-284d8578903b", "comment": "Malware payload", "value": "96161977f4b352326d4df39581afdf127790b6a4f496fb92262632cac40acf51abf1cbb5b712d37cff5de5cba1e4a4ae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654902086, "uuid": "1b69ded5-cf7d-47e5-b169-924592e62581", "value": "T19D64F111B792C832E4B3283148B1DF126BBF7861217464C767F827B92FA17815AF9397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654902086, "uuid": "8b071c0e-855a-474c-859a-600b394e9559", "value": "21c9610a394b1f74aa1da41925fae874", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654902086, "uuid": "69a18a66-5d10-40c8-b442-b28d3a4f167f", "value": "6144:szWUpJCIN/fsh+pq6UqwEVQi0vie21Qtz8:sSc5fsy3NVaieRt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654902086, "uuid": "586628cb-6af6-4146-acdd-d37383bc2d57", "value": 320000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654902086, "uuid": "4dab8567-68b6-4a92-a675-ef9b600e4b50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654902086, "uuid": "ac44f845-47d8-411c-9e89-280d3db653e5", "value": "c42c0c8e4e3e1906725239df20628ff8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0917ab2-e8f2-11ec-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1654888958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654888958, "uuid": "f10e9c99-82db-4a03-be90-fd660cbbcfc0", "comment": "Malware payload (NanoCore)", "value": "4fefee12b2bc843c8b06a1ac8ff1d28f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654888958, "uuid": "5f46d0a1-3252-469c-b614-81051a158826", "comment": "Malware payload (NanoCore)", "value": "00e1c1c9f132885b3d228909896b435aabe86844c79d20c4914631272248f7c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654888958, "uuid": "50f5761c-b9e6-4894-a68d-238f19226f16", "comment": "Malware payload (NanoCore)", "value": "79afc02b6acb71e9e293210a40425f30e3ed7016", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654888958, "uuid": "0cfd5378-eb5c-4843-9968-d2d15c6c1706", "comment": "Malware payload (NanoCore)", "value": "3969df6bb8bc28caaf8443f80daafb5576fa80ec6af8c9b306677b136e13d02217e024c9608cf43225fa01a8f6e126ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654888958, "uuid": "72afb7b4-64af-4b8d-9fd8-3100326e88e3", "value": "T1BEE412DF650CA297D0B45A34511AE4B613BEBD37AEB3B70D6CD5348B80AB3A201171E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654888958, "uuid": "5bceaf57-fbb8-4388-b135-ee016b7c719a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654888958, "uuid": "ded4f71f-1155-4712-841c-62faf6cfcd11", "value": "12288:eAacLwm7jkn+dAtsoFHrxk+tL0uzI3iAofX8:FFkmZdqr6+43iAofX8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654888958, "uuid": "76b5a38a-b9ce-43e8-b642-29fbad2f3397", "value": 688128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654888958, "uuid": "d5614871-e4ad-4a31-9a3f-e18fc93d5c02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654888958, "uuid": "96331e12-7295-4b83-bc68-d531926b6cc4", "value": "4fefee12b2bc843c8b06a1ac8ff1d28f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6eb65eb-e893-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654848274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654848274, "uuid": "81a79df9-8187-4719-a50a-0803123bdac0", "comment": "Malware payload (Heodo)", "value": "a3971087e91135545afa4760f9c9263f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654848274, "uuid": "e7eb9dd2-2bff-4b25-b450-1cf62997be71", "comment": "Malware payload (Heodo)", "value": "02bdc6f9aab0fd9e1d21c3dbd840c792c48dc1d0f22ca3f9c93d67f1ff71245a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654848274, "uuid": "5f247570-88b2-44fe-ad26-a3d516e36c35", "comment": "Malware payload (Heodo)", "value": "92992ebf7346e7e6c4a03f8abff1c7214970042f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654848274, "uuid": "acf523f8-89bf-480d-8203-17cac8548724", "comment": "Malware payload (Heodo)", "value": "c3541792f82d9e03db3a694b77c1327c65da3f0da949145ccac8dfac5a1da21e6582d7123a6f0bed8f6927b9ed1ec49c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654848274, "uuid": "e9d4dc36-4f6e-4c0c-a345-1fc1a9c10541", "value": "T15153295ABA5AD81DF915873548D74BAAA323FC314F9B0B832269F3116FFC8A0561710F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654848274, "uuid": "ab50aeeb-7dfa-4bd5-843c-f8b2d066c882", "value": "1536:tpKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgUDOJiA6Cv/UGLI36yOA3E4:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654848274, "uuid": "b06db992-917b-48df-aab4-e041477c5cf9", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654848274, "uuid": "d4b70545-f16f-4791-a506-62d122dd719e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654848274, "uuid": "6715ea1a-b86a-40d8-a119-6f9478cca4d2", "value": "DETAILS 92699696.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e333c11-e8b1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654860876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654860876, "uuid": "c14879e7-37c0-4b8c-aa89-eab3cb0d3ebb", "comment": "Malware payload (Formbook)", "value": "2fc2bd5f962370dbb5b1aeeb29a34275", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654860876, "uuid": "d336379b-6eae-44fd-8ef5-58fc97d5cf8f", "comment": "Malware payload (Formbook)", "value": "02e3248a95d735e440b9b578319762226ff006cb54f949cd33e1b5faf9c3114d", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654860876, "uuid": "89dc544c-9fac-4336-b96b-84b9b043ed8e", "comment": "Malware payload (Formbook)", "value": "2ca235182a2d111611c99554c72a513cb90d429a", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654860876, "uuid": "6230cc22-a1ea-4243-ba7e-b9ba50412a35", "comment": "Malware payload (Formbook)", "value": "dc2a36fd1c09e9c0f13f836892cfcbb09cba5b12bba71bb7578360e562115c52fedeb521aad91426834a3378b1f89f46", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654860876, "uuid": "2fe6d508-2cad-49b8-afaf-3ab4773e2f61", "value": "T1FEC4336A0D1F7D29796B2CAF094AE89C3E0C6B91245DD724678CFB1B1B7C930979C0D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654860876, "uuid": "8f056bd1-95e6-45c2-a767-0531d99b0d64", "value": "12288:tSYeh7GBII0nFVu5i+kqsoAGD7UVyxznmCXd4MFWVJJVPwR:MYC7GBII557sotPUUxlNjFWjJVPwR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654860876, "uuid": "dae08c8a-c6c3-485c-b01d-b02b37470373", "value": 592778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654860876, "uuid": "d73b7f1d-a3cb-4869-b8fb-51355c88acd3", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654860876, "uuid": "f6fc87e9-6505-4077-9574-7bad4cd99054", "value": "Payment Advice doc.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34cc1485-e873-11ec-93bb-42010a9c0043", "comment": "Malware payload (CoinMiner)", "timestamp": 1654834204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654834204, "uuid": "0071ed27-b3eb-4a94-99e3-eb43df41172c", "comment": "Malware payload (CoinMiner)", "value": "8bce61bb12b3015174c42216917dc45d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654834204, "uuid": "92bb4bc2-7296-4d0b-b46f-0500df4b38c7", "comment": "Malware payload (CoinMiner)", "value": "030be1ad6ebd45f230850be195da7ce21816e0ebf62f85a33ee777fa59c49a2b", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654834204, "uuid": "f39af915-3f89-49df-ba7f-9c61423f06ec", "comment": "Malware payload (CoinMiner)", "value": "7196385119253119a5c6caab5f8952160b873eca", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654834204, "uuid": "4ab3170b-3196-4214-9da0-6f89fa8f3c07", "comment": "Malware payload (CoinMiner)", "value": "a4b575eb5eb0b0e1bd3057e4a837a677310128091ac929d36f8b2692b7224b60a70db98d0f4faff73c0f66cfd6e1ecf8", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654834204, "uuid": "94f82010-f352-4a0a-8892-b8b106e3df50", "value": "T194D3E755FA02773CD9BE0DF0927C87144DB06EF4AB16D8F6279B724D8A322421A5F272", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654834204, "uuid": "0fa2cacc-02e5-4d74-90e1-eaab49138591", "value": "768:WO25Yt+QvusvV2GzXr3MkibI710DGlX+Uf2hR710DGlX+Uf2h/:W8tqKpTMkIWuUfiuUfE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654834204, "uuid": "b44df05f-4cc6-4e2d-9d32-869a2afcf1a9", "value": 139744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654834204, "uuid": "45df1c6b-b905-46fd-817c-56de2193f67f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654834204, "uuid": "5409409b-5eb6-4c70-9453-fda9a1cf119a", "value": "8bce61bb12b3015174c42216917dc45d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d067e7f4-e88e-11ec-93bb-42010a9c0043", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1654846062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846062, "uuid": "e3387093-4ff8-4de1-a4a4-bfe8fdc03da5", "comment": "Malware payload (ArkeiStealer)", "value": "64be2ec85776f9af2e3b08bb3556ca86", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846062, "uuid": "db85f10d-d908-4046-abc3-21918bd2e4b9", "comment": "Malware payload (ArkeiStealer)", "value": "050a72f71da53a81e6c4a30f1c693f05ef5ca60bae616ae3ef732fe8bed2b670", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846062, "uuid": "e5826c4a-15a3-4ccb-b27f-89bf0be1a5b2", "comment": "Malware payload (ArkeiStealer)", "value": "78bb72f72774ce9f643171817331d8f5f256e295", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846062, "uuid": "8cc089bc-0b71-4e06-a973-6ba62d08ad4b", "comment": "Malware payload (ArkeiStealer)", "value": "379733c63e49cf49f85955fa7bd0d8dc8cb5b35ee7761fedb4ad163582b429a4ca54ecde1e818c14baaf831979048674", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846062, "uuid": "6c9b50cd-4ec5-4292-a106-3a6cc3777db6", "value": "T19BE5334AC653D927D32D38BE681E27720E12E976E481E71F2286F63C5DE02357C2E1B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846062, "uuid": "870d8372-87b8-40eb-9fdf-19a44c23c487", "value": "79b3362178937bf9559741c46bb9e035", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846062, "uuid": "372c63cb-37f5-4b37-bf58-1442a706ecc1", "value": "98304:CQQyTfolQD04wK+lMsxaP3VToiYsamTvgN:CQQKf2wBw4sxuNYDCgN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654846062, "uuid": "d3f7b8b1-5f3a-4856-96ba-e450a78b178a", "value": 3159552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654846062, "uuid": "b66073ac-483c-4ccd-b6e2-10e903f5593e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846062, "uuid": "115a84fb-bece-458a-95c3-247aa56f8c88", "value": "050a72f71da53a81e6c4a30f1c693f05ef5ca60bae616ae3ef732fe8bed2b670", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28b6a6fd-e8ea-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654885294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654885294, "uuid": "b42faf99-3e1a-48f3-ada1-4a2e2e6e9678", "comment": "Malware payload (Heodo)", "value": "31112172f645bf8a3a207491f2e1d726", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654885294, "uuid": "fe3c9183-3465-46c4-ac84-72271c477403", "comment": "Malware payload (Heodo)", "value": "0530a160cd0081d7e938783d47d42856e5b9234726fa52feb29de3adde20ec39", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654885294, "uuid": "969ecb8e-efbe-435c-8d93-888d08be661e", "comment": "Malware payload (Heodo)", "value": "65e5df9b90846edeba0c534a2e29de89a3d55393", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654885294, "uuid": "c53906ec-e912-48f5-a9ba-ddf9c47a1410", "comment": "Malware payload (Heodo)", "value": "ad0695a951194588ab9e06aead5b49eac614714d0225799688893c145ba5c5d606aa19bcc77651d3e1a7a3dc5d6d7dec", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654885294, "uuid": "5087eff2-c078-4b48-ae89-4ec8a47719c2", "value": "T1D0B4154533F4306AD8678D7C849E0A0FD7E17A174FB1D28A135086AE3BB36527AB9F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654885294, "uuid": "80ef488c-158e-455f-94f6-bf8599e84cf8", "value": "b71031ac72c27db547b44e7ae017554b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654885294, "uuid": "601fcf2d-d48d-4fbc-bd74-d5ffdb260890", "value": "12288:fytPfASAuSvQnbKHorHDKGwC4ZTJxlGRS:fy9fASOvQ6oTDw3XC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654885294, "uuid": "9551b7d3-05c6-4dd8-9a8b-80c83524a9c4", "value": 508416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654885294, "uuid": "9e214df8-67f8-4ee3-96a5-fc6aa9993dd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654885294, "uuid": "580c1af3-0c21-4d22-977d-96d095270f76", "value": "31112172f645bf8a3a207491f2e1d726", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4fb5750-e8a0-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654853773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654853773, "uuid": "c5553338-b5cd-46f7-a24f-f9ec3cdc6297", "comment": "Malware payload (Mirai)", "value": "b451e66fe4ccc9ba268f4fee99f285f0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654853773, "uuid": "2ab36fa4-cbe1-49be-a871-30b08f2c74ca", "comment": "Malware payload (Mirai)", "value": "05924b142e92d47bb5b50b868d11ee115271cc4e4105d644e850cd6ea6687aa7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654853773, "uuid": "98754088-cba9-4003-bdaa-da3d6e355f5f", "comment": "Malware payload (Mirai)", "value": "4005e73e1406c57df5a5c3c97a5201f22d9ddb1a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654853773, "uuid": "cf967446-2768-4b48-916d-6e0fcdb031c1", "comment": "Malware payload (Mirai)", "value": "2ad88a3b6ab09782fcf40c8dcd3556eb795e4e2b9c8e9d5e9eb2b3c28c5d99575ef9efd8a15b9e0dcb30d8038aa70ea0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654853773, "uuid": "de4823bc-2579-4fc0-ab30-73e14df4e7fc", "value": "T101933CD294015E6CFD5BCA36D61BCA097C2191058FF20E27E762BD8B5C3A5B9ED0EC81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654853773, "uuid": "352fb565-96c8-4f21-a8b8-64b95f59b0c1", "value": "1536:UCoJ5PrbMo52g6Dj0PYL8cBwdnCY7Xds4YC:OH+L8Q9ZYzdZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654853773, "uuid": "1a91decb-6b72-4d83-a12c-4bacb025116c", "value": 93864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654853773, "uuid": "3c029a6a-30f3-4802-a616-407cd18f6d50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654853773, "uuid": "a0c17865-661f-4372-814f-37cada6677e7", "value": "b451e66fe4ccc9ba268f4fee99f285f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76887c2a-e905-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1654897021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654897021, "uuid": "92daeadd-8ca6-48c0-9a08-77778fcd4e22", "comment": "Malware payload (RedLineStealer)", "value": "a63d02c67f955ae44e80464acd6b77eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654897021, "uuid": "b3f09853-0486-4645-a43b-f982d619f261", "comment": "Malware payload (RedLineStealer)", "value": "067b49ac9efae080ad5e782fe13ea188797046745e71f6d1ad7150a4afb3e199", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654897021, "uuid": "a9a09965-3f7f-472b-8ad6-0cdaa08ccee4", "comment": "Malware payload (RedLineStealer)", "value": "977c1e28e6ae6909ac3a79467b559c99601e72c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654897021, "uuid": "237d8078-205e-4e9c-bee1-9326e0c99d50", "comment": "Malware payload (RedLineStealer)", "value": "220c88ee20bc5c767cd770f236cb6541b280e4f203dfe4360aff9b736b24bef0ed2515de500902a567a97aa4b86db167", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654897021, "uuid": "dd1d0460-0a86-41a9-ba47-1eca268cacec", "value": "T1DA4699D43385845BEC671A741E67B38A9328FE80AEF4B25B2720F34F4B39ED61964341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654897021, "uuid": "b4ec04fc-0297-433c-8939-7da2254d37a9", "value": "013c74198fc6e42dcf33737d6c40c012", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654897021, "uuid": "2906aa68-14a4-4c57-9876-70df8873d4fc", "value": "98304:h9eCUTzzphq1G/jxZIo0YYUOJimJJQYts5JcyTcvg6BtufkCy:PefTzVhqpP9JvgpTcvf7ufI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654897021, "uuid": "178bfe5d-3757-44e7-b97f-c23b1fb83fcc", "value": 5763680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654897021, "uuid": "2aaa31ff-308a-45fd-8d69-16577d78e92a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654897021, "uuid": "3bb5ee71-91c9-4eb7-b81e-9ec777075b86", "value": "a63d02c67f955ae44e80464acd6b77eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d14b40ae-e88e-11ec-93bb-42010a9c0043", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1654846063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846063, "uuid": "75275f41-be1b-4896-aea7-caca92ed57f8", "comment": "Malware payload (ArkeiStealer)", "value": "6a0b109c9d9bfb46e11f180584e0420d", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846063, "uuid": "d09d1874-094e-4e67-a493-15be6d6e1935", "comment": "Malware payload (ArkeiStealer)", "value": "070241a7aaf781229eeb62b15967928ee3497ddc935fe0081311fb37876f2505", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846063, "uuid": "6dd60584-4a6a-4962-85b9-20edd4619497", "comment": "Malware payload (ArkeiStealer)", "value": "55bb64fdfc80f24c83db1bf738098aca94c12be7", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846063, "uuid": "238f3632-53c4-417e-bdc6-1aec52e6ff39", "comment": "Malware payload (ArkeiStealer)", "value": "e03322d9511305c06a5784aead13fae145578e6b13e629cb5363e7f448abb4ce46ef6461693c231d5f189f44aa3e882e", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846063, "uuid": "cf05e954-768d-4129-a782-770c8819b249", "value": "T11D84BF10BB90C034F5B756F449B983ADB93EBAA15B3894CB62C51AEE16797D0DC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846063, "uuid": "585b1593-362b-41b7-bbfa-443bcb3c1d6b", "value": "28f9b27e782bb155192c1d4fb9991cf2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846063, "uuid": "6e8e0b29-dd03-4164-af2a-2e08b93a8300", "value": "6144:+J34lyc0ZCp1Q1SHkck+wFDsSSg8D8OuYGj3bu9Vftu3tcqZVTe0WVPKck:+JoN0QfQ8EcktDWga8O5Gu9RY3tcOVTx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654846063, "uuid": "33fe7115-4ccf-4854-82da-97403dc1c2c4", "value": 377256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654846063, "uuid": "6e7e322f-a21d-423a-906f-827496fec85a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846063, "uuid": "2799dc69-0a35-4602-9f46-7c613c5a2fa4", "value": "070241a7aaf781229eeb62b15967928ee3497ddc935fe0081311fb37876f2505", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eabba846-e918-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654905376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654905376, "uuid": "b3254e28-9dfa-4687-8107-2db47ef6daab", "comment": "Malware payload (Mirai)", "value": "fd473464781aae80d9819b538508b61d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654905376, "uuid": "43946d20-ac4a-4aea-97cf-12188b4ec586", "comment": "Malware payload (Mirai)", "value": "07efc636432e25a2889efe1a0ea26224fc0457af95162389a54a202cdc4a6560", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654905376, "uuid": "7b801084-d2e2-4120-95ae-29b401638ef0", "comment": "Malware payload (Mirai)", "value": "cf5e180fc630cb43bd14e83f4322d3ba38b3d006", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654905376, "uuid": "6d8c693f-48cc-4e56-a2f3-47a7ef2dd5c7", "comment": "Malware payload (Mirai)", "value": "633c800fed5e2c387073c4c2c1a1656120c358d208a5dbd9d19d6ad058c94c93f28dfcce8bc1c523d447c205f1c3d674", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654905376, "uuid": "43734539-f735-4cfb-928c-fe43b978173b", "value": "T1D8C3C506BF615FFBE85BCC374AA92B05248C581A22A97F75B534D918F20F25F09E3970", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654905376, "uuid": "af67d269-c3d0-4672-bdec-df2dbc02747d", "value": "1536:YlHbLz4K/T0jpPk3Ib/9CGinMHrnikVhrt7PPxibU3c6VJVE:Y110jpc3W9CMlt7PwkX+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654905376, "uuid": "408db289-02eb-4b6f-bb2b-346d99ad4dd0", "value": 122552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654905376, "uuid": "7c9cbf42-cbaf-4538-862c-fb55c7c3e5bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654905376, "uuid": "2ce441f4-e42e-4486-9643-5e532c61c17e", "value": "fd473464781aae80d9819b538508b61d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be945f8c-e895-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654849038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849038, "uuid": "cc1d96e0-67c6-4d48-8345-5ff5351f8387", "comment": "Malware payload (Heodo)", "value": "c4eae373cab64da3c4d5c978a86c6a96", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849038, "uuid": "e9983431-08a4-4fbc-b2df-6631e4238e68", "comment": "Malware payload (Heodo)", "value": "09f30d9314454baa96b94d6345cf6f88fa01bc61728b58093022a8cbab120829", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849038, "uuid": "0699e5c7-7e94-4d1d-9fcd-fb24984a6397", "comment": "Malware payload (Heodo)", "value": "2ca37f49bc293c224801ba654b105f35ddfa3e79", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849038, "uuid": "8e09643f-bc29-465a-bfb2-ea7aa7e738b4", "comment": "Malware payload (Heodo)", "value": "0f3e004eec0778ee3e3362b453269def8be1ace2743d75f5221e376baab42a62feb1d430be900a256f6ec2bd94ad56dd", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849038, "uuid": "9d76b604-c8d6-4a55-a708-c38b58c18b08", "value": "T14BF4D42FFF51E8E9F9439234814A9570B124BC1C8271797E3248FE60BD72698EB2DE15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849038, "uuid": "03d50ebb-7562-49a5-87bf-f2ce730d5a2b", "value": "98dfbb430035f9300f4be2418dab914b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849038, "uuid": "eb08d856-69c9-4b84-ba2c-b051dd4a6ab9", "value": "12288:LFbnmV9v3WtGWt4T/homzyMSoGG9muDqkRFuEEqp+V+kf80pG4:LFbO9v3WtVt4T/hoKyMJJ9BDqysY+0k1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654849038, "uuid": "0c1d6567-638c-4ffb-ba42-fe83be249c4a", "value": 747446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654849038, "uuid": "2f742fc9-b223-4ae2-b272-9e5e30ef4479", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849038, "uuid": "1b464a36-517b-4a6d-8449-a9e82f4c984d", "value": "RDP7yAbBHQgR9L2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9351eac4-e891-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654847248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847248, "uuid": "aaa9fa8f-9a75-4297-8fc5-0ac2f1d60838", "comment": "Malware payload (Heodo)", "value": "786f1883b79a95000098adc34be56253", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847248, "uuid": "ad2314d7-b3d5-4678-9ae1-25537a4e0881", "comment": "Malware payload (Heodo)", "value": "0a14cd07798ab8bc76527a0197071d61f44382d435f34277e7143b2da78bce02", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847248, "uuid": "b34db51a-ef1b-436f-b201-b8e3301f4580", "comment": "Malware payload (Heodo)", "value": "661aa4a6f292c139758f6fe521c34774998edd30", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847248, "uuid": "b32fd9e5-2f90-420d-862e-fd8c57e53c44", "comment": "Malware payload (Heodo)", "value": "6fd02a8e49ac907605bef895b45082341fa86866d018bcf745a7345f81b582085c8a07a0f85d642ca84589fe8d808ec6", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847248, "uuid": "256c66d2-e2fe-4e9c-8872-a7feaf83cddb", "value": "T13AF4D43EFF51E8E9F8439230814A9170B124BC2D8271797E3648FD64BD72698EB2DE15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847248, "uuid": "ffd58763-dae4-4d66-9715-59a49976a068", "value": "98dfbb430035f9300f4be2418dab914b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847248, "uuid": "3f7d6f92-b9ef-4c47-8d29-360383ee9601", "value": "12288:yFbnmV9v3WtGWt4T/humzyMSoGGrqh2tiDek/bPUkf80pG4:yFbO9v3WtVt4T/huKyMJJrq4Qb/Ikf84", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654847248, "uuid": "2858a4a6-89ef-426d-bce0-bbe8d809c4fb", "value": 743350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654847248, "uuid": "d2f8cf9a-e0a7-44cb-96bc-1f562901e4b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847248, "uuid": "c9c3478d-a558-40e2-8e7f-e200fa9e3ab0", "value": "YOQ48tX3XauFzNR.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f15a355-e8a0-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654853656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654853656, "uuid": "dc71fd90-7acb-43f8-870e-f1b9aaee8052", "comment": "Malware payload (Mirai)", "value": "9c66b03d72d730ba523fcf04380709a1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654853656, "uuid": "2fc6a95f-2230-4769-a149-b6769ffc793c", "comment": "Malware payload (Mirai)", "value": "0aa326df8b043ee6d2513ec5fabdaeb3f95ab74dbb019864b05e5f4c53bc542c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654853656, "uuid": "1c0b0448-8eda-4b70-b630-3cca0f257d44", "comment": "Malware payload (Mirai)", "value": "aefd65fcac5c209f6fd23585343d8429b688edfd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654853656, "uuid": "682ef40c-e4da-48e4-ba82-8f7c9bd7396d", "comment": "Malware payload (Mirai)", "value": "3836ddba3569595398856ae57d068bc9fe24adc1aa98ad0e3f7d1422bdb1650d4b989dfc613a1408084a71637e8c6cd0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654853656, "uuid": "4bc12dd5-3144-437e-836c-89145d7369b6", "value": "T199A3830C3E319FBCFBAD813447F78E25925823D636E2C585D19CE9015EB028D356EBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654853656, "uuid": "7071664a-4ec5-4419-873c-229504aa3bf0", "value": "3072:I/3Hash41mz8Fh4evkN/6kbgx42ZBfZzlBMU:aashWKiOZ6kbgx42ZBfNwU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654853656, "uuid": "55a51b84-b2b1-47a0-9345-2c908786c968", "value": 100660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654853656, "uuid": "d7729298-2a61-430f-9208-606f2d94a4ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654853656, "uuid": "ac7eac8a-4890-4439-9e6d-988617cb6fca", "value": "9c66b03d72d730ba523fcf04380709a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4a3ac0b-e8b3-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654861933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861933, "uuid": "38a9db8a-581f-4116-8ccc-b7bc34ff6b91", "comment": "Malware payload (Mirai)", "value": "73b96400037eff61054e9b66b41df8e0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861933, "uuid": "d64f5137-e87c-4331-baa1-19a10a0db20a", "comment": "Malware payload (Mirai)", "value": "0b32acb4df943cdc2a3d1beffcc6af458e17d01e4d8aad4dd6b8d569a0ec6341", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861933, "uuid": "0c987bc2-743d-4867-b085-9e79dfdba183", "comment": "Malware payload (Mirai)", "value": "6038cb20d959fc99ba16e544f42c78c1a0313105", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861933, "uuid": "1b73e998-f02a-4751-a821-4655f0a5871b", "comment": "Malware payload (Mirai)", "value": "4a8e18d4d289944a4e0472ac4764d78591d86fbbe7c951c75f9dffb4ad690167a152f30d70049fa51e560cd74d1de20a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654861933, "uuid": "52d0e741-10ba-4f4e-96a3-e43bea970160", "value": "T136C2E0608C57A8F0F939C435DF34C483A6CE1BB857FE316489482278D271691BBB965B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654861933, "uuid": "8240eaec-14af-49ed-803b-283168ce9026", "value": "768:eLBtBSHAWANYYjh/b0nYXcq4DbzKKs3Uozb:ejBzZYq0dbzKHzb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654861933, "uuid": "f08279aa-5afd-411d-9fc9-90ba95f672af", "value": 27476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654861933, "uuid": "427abef0-dd9c-4598-8eb7-0ac79e567b6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654861933, "uuid": "1605f9a6-6b64-4ad9-8f7e-6cc32748965d", "value": "vailon.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55e3a28e-e8cd-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654872914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654872914, "uuid": "c753040e-c2b9-490c-aeb7-8568de0282c2", "comment": "Malware payload", "value": "5843f80bcc7f0e612cb5d25800ec5f4d", "object_relation": "md5", "Tag": [ { "name": "obama188", "colour": "#E17D02", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654872914, "uuid": "c35cb8e0-1f3d-4789-87ff-6b709b860c10", "comment": "Malware payload", "value": "0bcc7eeab55d1ed3e4e9a1a2bb57b3aad7758e80ed1100d1922da9a300d8275b", "object_relation": "sha256", "Tag": [ { "name": "obama188", "colour": "#E17D02", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654872914, "uuid": "b016860c-c1ae-49a5-a86f-38e895291b96", "comment": "Malware payload", "value": "657b7d09bb22d8fa829da738470ca27b6cf92f39", "object_relation": "sha1", "Tag": [ { "name": "obama188", "colour": "#E17D02", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654872914, "uuid": "f35c2a3c-fdb0-475c-a018-88d692c5c87a", "comment": "Malware payload", "value": "ab77e58bbecba236cd76b2698f21b8a29157ae4ea5e29d60e762a4485d3a3c99915548fd278434cec670b74eaabfff44", "object_relation": "sha3-384", "Tag": [ { "name": "obama188", "colour": "#E17D02", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654872914, "uuid": "3f37955b-dd8f-4e3d-825d-bf53af418575", "value": "T1CF0144C49439CEA8CCB5D6B77C770B22E8B090062E37537E0CA13EC1A53D684490560D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654872914, "uuid": "5682e7b9-e4a3-4047-a872-acc27bcff701", "value": "12:5jV5SlmKC6ONu02OX0mlqofMSlaLJCiqgLhgOiPunj6jyR6G5ShNQ+k4kNtaB:9Ol52/2OEmYofMSsLJdAFGnpR6NhXB+a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654872914, "uuid": "89189573-5111-4db3-bbf4-aea9c5026163", "value": 703, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654872914, "uuid": "6b3c57b0-0eb7-40b4-9e8e-eb4bfc09b52d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654872914, "uuid": "ffd11c00-b06d-4ca9-a208-59183484d80a", "value": "2940353352_1175434622.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d29972bd-e88e-11ec-93bb-42010a9c0043", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1654846065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846065, "uuid": "0541ce51-129c-41c5-93d7-2a62fe61837f", "comment": "Malware payload (ArkeiStealer)", "value": "1ee0ded3181cdef31bdae6dbf660f8fb", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846065, "uuid": "5a01c4b2-ce13-4f4e-b6a0-fda79bf7a1c1", "comment": "Malware payload (ArkeiStealer)", "value": "0c34c255ac51bb3dab684b050f524ec5781b1edce9f9f05dab82400314842bb7", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846065, "uuid": "34143a1d-d2e1-4220-bb78-dfb59d22b359", "comment": "Malware payload (ArkeiStealer)", "value": "715a3a341ce5a2a545a617d96b5b1a6e5667cacf", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846065, "uuid": "e5e6a170-fb0a-40b7-a2dc-02b15b0468a4", "comment": "Malware payload (ArkeiStealer)", "value": "8dd662cfcfcf09ceb794a940fe593ee9d8b77ee9ddddae7bbba10fa9f87ec7fc0cfe5aac55800d427a4cb0ce4afbdc17", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846065, "uuid": "7d676b41-c69c-4deb-a36a-9e3985099eea", "value": "T1EDC52C135A8B0E75DDC27BB461CB533B9734EE30CA2A9B7FF608C53599632C4681A742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846065, "uuid": "e8125b2e-efcf-46d9-a5f8-f65bd7e79fb3", "value": "5dd6748a8bf8c3a3d51aac89447af978", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846065, "uuid": "24b2ce84-1dad-429f-8458-b1f02b3561e8", "value": "24576:YLASDPMr3zA/vamWzluCkZsK9Whi6My4tIXYm5/9gAfVdI8sOKmdhimuQ5p3h31t:YLASDPMr3w/8Gui6l4tIXYyV+UQE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654846065, "uuid": "67f9d7b6-52dd-43b9-b3d4-121901014cd8", "value": 2509999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654846065, "uuid": "ccb65ed8-4e01-4c61-8fee-f97f437f1313", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846065, "uuid": "bd5931b6-11f8-428b-b676-e9ddec92329e", "value": "0c34c255ac51bb3dab684b050f524ec5781b1edce9f9f05dab82400314842bb7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23889fc9-e8ba-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1654864669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654864669, "uuid": "df3d0029-40c4-4a02-afb6-349baae0865e", "comment": "Malware payload (Loki)", "value": "ac5e3736b82453e15bcef4b331c51a89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654864669, "uuid": "0b573586-7e2d-4e9f-99ec-ace6548b95c0", "comment": "Malware payload (Loki)", "value": "0d070538c3136d9de6b20146d81bf9636092b06c3b0fbcf394d52faed2883d5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654864669, "uuid": "f1cabf4e-7fdb-40db-8266-763476fd8752", "comment": "Malware payload (Loki)", "value": "476a97f097db2d09278432ce90239d46fb3c6ba4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654864669, "uuid": "272d7b0b-4a26-4622-95dc-49e42cc2a3ad", "comment": "Malware payload (Loki)", "value": "cb0ec853fd8bb452bbc14dac4c4cada599689b9ade7abac2f205acf8716eda486755a1f419ceaf8b46cf981c4fe7cc3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654864669, "uuid": "27e60e94-f86c-47a8-aa55-9f3ab155d787", "value": "T1D1D4E069761AA54EC01A4637C5CB0D1043A29E571B2BE70B6487339E9D1F3EFCE0A2D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654864669, "uuid": "0906f97a-990b-40b7-9ab3-95f0a349c407", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654864669, "uuid": "d489ff36-49b8-4d2e-ba60-5a92f061ef31", "value": "12288:JGnSA4M+K9qP/3ADg+T1684JAKVTCUjxEP7cX/oyuG:sS//+TkVTnFEb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654864669, "uuid": "5cbaf65a-e170-4d80-93a8-ee9d034b1cb8", "value": 605696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654864669, "uuid": "aa981ffd-46b2-4eac-a10e-a73195b6a223", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654864669, "uuid": "2f84b485-5965-4194-8b4d-98c8636f66bf", "value": "Price List.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e4d1e11-e8c9-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654871210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654871210, "uuid": "fca8f169-fcea-4ed6-b3b2-a153fd0258f8", "comment": "Malware payload", "value": "8eb245bcc6ac3fb0cc90005e85ee48f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654871210, "uuid": "bc5257c0-8c02-4c12-8424-a566c6ba5f4f", "comment": "Malware payload", "value": "0d36da3b7cb3f21997103e31ad4deb2a6114529b53839503b4a4480019f253ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654871210, "uuid": "9cca43d9-c766-4f86-ba30-4d930e1947fa", "comment": "Malware payload", "value": "bde7af69162cdb321bdd3632d826102a0b66b0e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654871210, "uuid": "e50933d5-e6ad-48d1-9bc1-0bc1b5b78ba2", "comment": "Malware payload", "value": "f6cc28a05e1f6f6280de87be026b3b1fcf6c85eacf1c41940dc6381f12c7ca4bf9525be518b1e6eb17478f01faf73663", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654871210, "uuid": "589213b1-56fc-4b0f-864a-f5e52a378685", "value": "T1C614FCD02B5ADCBBFB88F474660199B13E8EBAE3F5D641DE21DD624E1A235B144F0C18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654871210, "uuid": "de718dc7-b097-4fa3-b398-0940023730c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654871210, "uuid": "fe52e068-8582-4ba8-8dae-0b6ccd884731", "value": "192:FrvzqE9avpeCL7Lbn9u3cGkhCT5pIpGMVKX93JH0QHVzj84QVxqHSubQXN5J9hdm:t7vav5Lb83cGkhUfrM8rHlHJIjl/B5Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654871210, "uuid": "6a040f53-f9ef-4bfb-b641-991e86b5393e", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654871210, "uuid": "16cf06e5-6fcb-49d8-8b27-502d3856777c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654871210, "uuid": "82a33023-6ade-422f-9830-e1f079599b31", "value": "ScanDocument01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54e11dfe-e886-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654842418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654842418, "uuid": "755b943b-1959-422f-868a-44758bf6484e", "comment": "Malware payload", "value": "7a1dfcf4aa56f01d7ecd7218c0ae1d6e", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "xslx", "colour": "#7C20C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654842418, "uuid": "930c7829-dce9-4da7-b762-da45eb808539", "comment": "Malware payload", "value": "0d627584b2e8d8da075e7159e4304353716d037d2a074e613a4244f86a69ed28", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "xslx", "colour": "#7C20C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654842418, "uuid": "8287c253-db28-4ddc-99c0-5f257ca0bfbf", "comment": "Malware payload", "value": "1b0f0fff48e88bcc54011b67171811f88de875e6", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "xslx", "colour": "#7C20C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654842418, "uuid": "75d94443-3f32-4f70-8624-ec072421d9ce", "comment": "Malware payload", "value": "36309a02ec5cb9c02c1e522ed0b9980353418002c97d4e87182d407c45a7079ec0575c801f678797d69431dadd765bbb", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "xslx", "colour": "#7C20C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654842418, "uuid": "c9a90a12-4c50-4e36-a6df-de5eb6b64b68", "value": "T18F8423AE32DCC763FADF227C154717F6165DEE038BAA0417252AB7045178680BC63ABD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654842418, "uuid": "0fd86bbe-a7aa-4c6a-90e6-d099ae0cef1d", "value": "6144:vYGUHS8aq9I96ttKr+7G4j2ryS9XEJykgKSYneXKJi4KX3YN12CLGrE5rxxRxjLr:Hn8T9Q6tGHw1ZC+1NN12C55Ij6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654842418, "uuid": "835d73c6-ba7d-4177-a064-80ef85824ecf", "value": 388808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654842418, "uuid": "744b0e25-994c-4582-9813-c132364375b4", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654842418, "uuid": "60e9679c-281b-4803-8a36-70e93214a061", "value": "DHL CUSTOM RELEASE FORM.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c98b5c4-e8b6-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654862993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654862993, "uuid": "b28d5452-9c85-475d-afaa-54e6fbfcead2", "comment": "Malware payload (Formbook)", "value": "e4f564c8463291fdc43cb09defc377e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654862993, "uuid": "f3292819-5022-4569-a15f-5a9568036952", "comment": "Malware payload (Formbook)", "value": "0ed579b3296417591124ca80085725ab5d105e610133da707c4948cc58bfa975", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654862993, "uuid": "94652051-0725-4776-b017-ba0637721508", "comment": "Malware payload (Formbook)", "value": "91d8bf7a2b1afd8e62163d1d76968e5c5151edc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654862993, "uuid": "187b3657-6c01-447b-ae99-3c5d6f7f61d7", "comment": "Malware payload (Formbook)", "value": "5e80628a1a234bb1cbed3e2e9734b3fdec2397a5216b2a29d6441cd2033ee59d2fc53b1e09aaeb81a5b5baf9956929ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654862993, "uuid": "1c26051f-2e86-4da6-8ea4-a8bd0cb31e01", "value": "T14864F2A2D2D00CEEFDA653B449769D1BA2E3BE6D7870A90F132D75746B331C30126993", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654862993, "uuid": "65b5038a-adbf-444f-806a-9d0afb3116d3", "value": "dd1742eadfc6df18ded3c26ae64ad610", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654862993, "uuid": "5bc45eb2-a636-4864-a1c1-dbf3c86eed3a", "value": "6144:QbnEoPm6LWgWLIXck/9Ct59b5zyG9IxFXSk8pXum59Mdo:UPmGfWcXcRNb5zJIxFXSHZuwMa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654862993, "uuid": "ffc93cac-0fe2-485c-ae1b-8e9835f1f2ad", "value": 335196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654862993, "uuid": "e621134f-153a-4f07-bf7b-30ae7024a960", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654862993, "uuid": "690218c2-8fa1-4545-bdea-686a2e872d95", "value": "price_list_pdf_098.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "009c6e20-e868-11ec-93bb-42010a9c0043", "comment": "Malware payload (njrat)", "timestamp": 1654829392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654829392, "uuid": "d53a5e9f-a036-47c6-bbac-726c3bcf318f", "comment": "Malware payload (njrat)", "value": "51730f16d17a389bab463db282eb48b9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654829392, "uuid": "6ea74d30-e73e-4a58-bcc6-677c9fb624fb", "comment": "Malware payload (njrat)", "value": "0eeac4bf4551eeae83b6458ab2c976b82e84d46ce45f2dd6954df70ba85c7266", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654829392, "uuid": "e7fd67c1-51de-4276-b1da-b16464acd40e", "comment": "Malware payload (njrat)", "value": "fb527ade8d7fa331b4dc13e826c54ea350c56acf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654829392, "uuid": "678c33de-d6e6-4912-891d-1fa7179ff903", "comment": "Malware payload (njrat)", "value": "cf2b318641554cf6977a9a3fc5fbd652e8c249c9947c9cb14a7f65485904d4cbe45e4e07041c45f6d431db5d4e7365c9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654829392, "uuid": "89c86fa2-20bf-4ced-9ab5-bfbcd612b966", "value": "T179A312117BED6145DF918E384B4B11466FB6E3933623EA96089C121BDF02F43CEC5279", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654829392, "uuid": "08937e71-a1d3-4d45-ac89-79fe1ac8c9de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654829392, "uuid": "c54d6d89-74fe-4da4-ada4-93973d987cdd", "value": "1536:VoNz9kG6BXqxqzd3LAWjuaGUb8JWURxjK2XnQumbMke0LF7d7BUkElnNP/nhpUOH:VAqZyw/6aGUbubxjJ3QHbMkLZ7d7B2Ph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654829392, "uuid": "866fe31c-ca1c-4cfb-8948-22df670da3ef", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654829392, "uuid": "e73416b2-6f1f-4d05-b302-35de12f652bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654829392, "uuid": "ce6c7f4d-47ab-4e79-a00d-0fe255c44231", "value": "51730f16d17a389bab463db282eb48b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54129b07-e8cc-11ec-93bb-42010a9c0043", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1654872482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654872482, "uuid": "a7018cca-6a29-4607-96e7-6518166d0ff6", "comment": "Malware payload (ArkeiStealer)", "value": "8761df0ddd35eddbd71afa911f4acb57", "object_relation": "md5", "Tag": [ { "name": "ccleaner-crack", "colour": "#72696B", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654872482, "uuid": "5375d2ec-16fb-4442-ace9-8a81d633b370", "comment": "Malware payload (ArkeiStealer)", "value": "0f27aaa32a59b7a5625e57d143953d287efb798414b286c795395c925c9083d6", "object_relation": "sha256", "Tag": [ { "name": "ccleaner-crack", "colour": "#72696B", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654872482, "uuid": "4286f1c0-730a-4728-a8a7-275a4bbad710", "comment": "Malware payload (ArkeiStealer)", "value": "e290b15ba31606d59816ecee77a5cab39412c604", "object_relation": "sha1", "Tag": [ { "name": "ccleaner-crack", "colour": "#72696B", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654872482, "uuid": "ae6c2bb8-29ef-40cc-9ac5-12b7b7ef81e7", "comment": "Malware payload (ArkeiStealer)", "value": "84f9cb3ad7e4148ad777aa1f3c6246c2ca685ec9c0e7679460c4eeb348d6f709c89ef1b379e7896b3872786207c3da5a", "object_relation": "sha3-384", "Tag": [ { "name": "ccleaner-crack", "colour": "#72696B", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654872482, "uuid": "722ccbb1-1c95-4d4e-87af-42dd5cbcadc2", "value": "T1524633C746F9A897F499672E03D50A67B41C44EE13ABF780E006361E29796322D7FB13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654872482, "uuid": "14957851-f121-41e0-a6dc-3ece694cc104", "value": "98304:rrsf1KNVOVz7d7B7bCiDCt13wkg2vwYp8sw5h3JwHY54K6hkYVQ5lFf/5WRMkrOP:rof1KIzp7B72Pt13QOlwBwHPBCYVQ7FV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654872482, "uuid": "58fecf39-fb0d-4587-b09b-092203eee0f5", "value": 5831341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654872482, "uuid": "649e3015-44b0-48fc-9d65-fb719c084e04", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654872482, "uuid": "f7787269-18c3-44c8-add4-fa67148d5dd7", "value": "wBJBAEA4HIxMgoA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0b2d051-e8b1-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654861014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861014, "uuid": "489ec13b-e9d0-4d6a-8e95-6ab8a445f468", "comment": "Malware payload", "value": "5c71885c45fdf7f381cf980462a0232c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861014, "uuid": "9c370925-59c4-43e7-8b82-d35188ae738a", "comment": "Malware payload", "value": "103bf9051d78f6163539d630b5685e78ff428d8cf8a71c0ffbbe084dd5cfc568", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861014, "uuid": "f2cab0a3-0f51-4b23-b6b5-8e89556cab03", "comment": "Malware payload", "value": "faff449c2db3933b088b2f67efe1829b452893fd", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861014, "uuid": "e320f7b4-94ff-4e01-b468-fe3807de05d6", "comment": "Malware payload", "value": "9bcc8ddbcf35e97c8b6df8e63cb4d3b578111f22ec0dd8beff2a37a2e0dbd4d6d88b2ff0d5c21cd42b7cb621a0fca6ac", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654861014, "uuid": "1163a650-737d-433d-8ddc-60802416e050", "value": "T1F41523F6E927F06ACECF4A3D45856FA773028E9ACC5415328936A66FDC35E04261CCE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654861014, "uuid": "8b9b9592-9cd4-42e6-afbe-bd06b7911d82", "value": "24576:bBQItHj+G6jKCPL3D3A3i04nFwleG+PbJFHlXLqIIAAqs0o:VQcHjh6jBD3A3/4nFm+/FXtAT0o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654861014, "uuid": "ec2ca54a-11cf-4b85-a301-2a4a89989314", "value": 900137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654861014, "uuid": "1e3e2abb-a959-4515-aaa0-37324c0cc85e", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654861014, "uuid": "9daa91b4-ada4-40c4-b98f-1cc7c82a076a", "value": "vn.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0965801a-e8e8-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654884382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654884382, "uuid": "b9344296-a325-47dc-a763-698b08821f71", "comment": "Malware payload (Heodo)", "value": "396c7aa13044814aeaac7326ba2788e9", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654884382, "uuid": "64a942ad-ae4b-4681-b39a-106646df2054", "comment": "Malware payload (Heodo)", "value": "10624af4ddcbf0e45dd759af601adcb0e37871443e241e683169e7d193bf23a6", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654884382, "uuid": "8d9d06c3-8980-474b-b5d4-319907edce30", "comment": "Malware payload (Heodo)", "value": "af4c64cf14ff1ca8b4c43a4510e40563b6ea5a60", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654884382, "uuid": "26980020-3cd4-4af0-a655-005269dacbfb", "comment": "Malware payload (Heodo)", "value": "81028f8122fb3a3d44c21e1889e1ecb601c68d30004f6e8405014caa9cdbb9074cbb36cd60de0ea6adada4d3fb8f4535", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654884382, "uuid": "ed97efd3-3553-4069-8135-0bf8c68279da", "value": "T117B4154533F4306AD8678D7C849E0A0FD7E17A174FB1D28A135086AE3BB36527AB9F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654884382, "uuid": "6b56d7d4-5f20-49fc-be22-fd3240bab9af", "value": "b71031ac72c27db547b44e7ae017554b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654884382, "uuid": "447c6ae0-9703-4e28-b8b8-4b579adfce85", "value": "12288:fytPfASAuSvQnbMHorHDKGwC4ZTJxlGRS:fy9fASOvQ0oTDw3XC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654884382, "uuid": "fd850ce9-5c44-410b-939b-cd38c63c9160", "value": 508416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654884382, "uuid": "3a0c4d10-f3c4-4e43-b427-ea89095cc2cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654884382, "uuid": "dc02a750-0b29-4622-950f-4c759af62c2f", "value": "396c7aa13044814aeaac7326ba2788e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ae9ab86-e875-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1654835047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654835047, "uuid": "a3dcf775-2731-42d5-97ed-1f11214eb71a", "comment": "Malware payload (SnakeKeylogger)", "value": "e3a8dff29a219031a262afe2c2d71131", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654835047, "uuid": "4ebf0a18-ddbd-4f95-862a-de7599b5d090", "comment": "Malware payload (SnakeKeylogger)", "value": "10cc3f1dc131c28e2739e1d8033978860b22ed0575cefde472a9cbedd95a198f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654835047, "uuid": "08229f6c-84f3-41f6-aa9d-bcfcdaaab90d", "comment": "Malware payload (SnakeKeylogger)", "value": "0a075e57d5a4340d6ef5a98885fe5f07ad659b77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654835047, "uuid": "6ab6b5f3-1c62-4a3a-8a66-a54a68c6073b", "comment": "Malware payload (SnakeKeylogger)", "value": "1c648258bc980d71d090a2bc8f68a5b314863eec217fd77ae897e0bdc7064b6c7686fcc0af6e8c427b403d7baed637fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654835047, "uuid": "cba22820-76cd-4107-b7c6-7f565f61bcad", "value": "T11CA370CA76783E83E555B17E8472F538CE658C77F7D2878969C23AA337733849A02604", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654835047, "uuid": "0bbaabf7-f1fd-4240-8f17-f70951a98308", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654835047, "uuid": "652c24e7-7b0e-4d10-b471-5b40e56b2221", "value": "384:7EA1Uq43YzwFVjwLsjhCR7CR8F0Jns32RLHk6HJLhnajOtyqPf9mYBtEttRWr29P:Y3q4oEyAjhCR2FRHyUp4RWrST0pRI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654835047, "uuid": "bf11fb68-03e2-458c-8c06-56ea2577d45c", "value": 99840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654835047, "uuid": "c8da3b28-730c-4544-88da-dff6092a98db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654835047, "uuid": "0f1622c1-f325-4bf5-a81a-8b9b73c7265a", "value": "P#108871980.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb3f59a7-e8be-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654866749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654866749, "uuid": "3d5237e3-65ba-4bed-ab2c-b37b32559075", "comment": "Malware payload", "value": "eed49c88dba5f2aa10cbd3acf66d899d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654866749, "uuid": "c0680f4d-c713-4347-9622-fc2e6b40aae1", "comment": "Malware payload", "value": "124edd0f1a21ff9c888d0a5335658449a7edf4fa94e15467d891517701d40c15", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654866749, "uuid": "955ecd35-cd1c-425e-8936-144e1600ea17", "comment": "Malware payload", "value": "9da59c2b24d16540c4cb6230d6e67fb3590688b3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654866749, "uuid": "99aac487-2bf6-4320-9fad-9e363679e700", "comment": "Malware payload", "value": "62a089687d75f91ddc819737b5958470e86cfff47a24de871d831ad01c114b253686ac5ed23ec72e71e799e21f7024e8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654866749, "uuid": "e23bdb56-2956-4101-88f3-47c809dab2e0", "value": "T1EDB46D27F2E18477D1332A7CAC1B77AC982ABE112D2864466BE45D4C9F3DB81341B2D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654866749, "uuid": "c0960c92-06d7-4bf4-9ad5-bab1904a4659", "value": "de39e9bccd748838a01b9b5e60a7eba3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654866749, "uuid": "0ac85032-6870-4981-a6b3-46490e764cb8", "value": "12288:6x9S0AmIr2iuW9Q8bnn+JHB0XitCZuZ7r:X0qrMEQ8bn+JCW7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654866749, "uuid": "3bd2d276-0bc4-4a04-868e-b5fc25070f6d", "value": 499712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654866749, "uuid": "8301df68-7c41-4bc5-996e-3c08c94bb779", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654866749, "uuid": "d04888f9-c3c3-43d6-b363-ab7a6105a329", "value": "124edd0f1a21ff9c888d0a5335658449a7edf4fa94e15467d891517701d40c15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "370bb19c-e8b6-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654862984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654862984, "uuid": "08b46ed1-8349-4ba8-911b-a05e3505a8e4", "comment": "Malware payload", "value": "f4c9fef754cbaad03e559be394bfd25b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654862984, "uuid": "68caf289-e493-4f65-b7a6-2c6e51a31a78", "comment": "Malware payload", "value": "12e8033159bd3cff5bce3aadf9e42351281fd269cfb3ee6222fc3254946f9ea2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654862984, "uuid": "458c22f0-d3a4-44d6-9e7c-0baf04289615", "comment": "Malware payload", "value": "a880267fbfc2cc00968f335c9e3877025530fd48", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654862984, "uuid": "46d66f3f-d03b-494d-969f-1025d5094188", "comment": "Malware payload", "value": "5c8364ca2caa8e76bf49a2ff6837ff311e8d03d020f70092f512af67941521c3f5a5afc2d5f9daaedba9142e01b6b20e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654862984, "uuid": "f8161e2f-e26b-4438-b612-2919ab51c686", "value": "T15AD3D0553DC5AA2DCA2E1208B4BB97C473D603DF14EDB646F94CA9884B4365CE03ACBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654862984, "uuid": "ca758843-b931-4f8d-8216-2ae25c3e5c9a", "value": "3072:LkOzf4AOb13Yp0RargrqiWBpzupXAQETlPjZwAIJLVltqgQ:Ltf4Ap0w0rqiWeWTYLVjjQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654862984, "uuid": "c69b26c9-73e8-46f3-a7e8-5d7d01dd083c", "value": 136121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654862984, "uuid": "0b896d83-d4b3-4f06-9b50-60ed24002159", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654862984, "uuid": "099a0d4f-8b61-487d-a185-f4fad9bc4ae8", "value": "shipping docs.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d3a3934-e878-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654836527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654836527, "uuid": "01ed3a61-1281-488d-9733-dcd643760247", "comment": "Malware payload (Heodo)", "value": "160724081dcd26d064eebca3371704df", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654836527, "uuid": "34da9650-f9f1-462f-9144-27905b09d180", "comment": "Malware payload (Heodo)", "value": "12f2953640a0172d7ac53939b0b0050362466055532da7e8a70567e33e58ed43", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654836527, "uuid": "0f62cef2-05b9-48d3-8d90-0f57a33c995a", "comment": "Malware payload (Heodo)", "value": "190f0e9ae61496aac2bc115b33a47a3611f4a30c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654836527, "uuid": "43be6143-8aaa-4e6b-941b-9ed226568ce8", "comment": "Malware payload (Heodo)", "value": "1fa63c2d42046e27f0085f9814390f78e0c69fe51d585536017ec682722484ec01c608be2584a9d3072b5abbf8a7d0da", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654836527, "uuid": "2a915581-b026-49d1-94f4-531fbabfe5a4", "value": "T1F3E4A29DFF02C5C0E53761B2989C98D844683D1E5140AEB53489BE763B76BA2CE87C37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654836527, "uuid": "47dad874-d62d-4c39-9364-db91887cb982", "value": "3107f7451b0e16fdcd17c5b464d06e23", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654836527, "uuid": "845577f3-e69c-414d-ba0c-f18afbe002ec", "value": "6144:HiwEnJyVLryVLryVLryVLryVLryVLryVLGLO8yMZodxz51dPRHh+u392986Ugn:CoYYYYYY6a8S91d5Yu3w+6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654836527, "uuid": "101657e7-50f1-4fad-851c-9c38e1ac643c", "value": 661504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654836527, "uuid": "5a10e896-fd0c-4f78-9274-141e4e1e7a13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654836527, "uuid": "3ce2634f-0a9f-4e17-b287-d5261b7ba0c5", "value": "160724081dcd26d064eebca3371704df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96407d29-e8f3-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654889343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654889343, "uuid": "9b51aefd-e1a1-47b5-814e-76ab20814030", "comment": "Malware payload", "value": "79dcdcb71122861b45027e992a8b256b", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654889343, "uuid": "ef272fc9-2b7d-4054-9242-1f71fa2fd7cf", "comment": "Malware payload", "value": "138d6b7c14089c460dac2f723c91acb6436fdcc1b9dd9f03e711e035d4bd6620", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654889343, "uuid": "57aed5c2-c54e-453f-b95a-6ffe700548d6", "comment": "Malware payload", "value": "088e491b907fde82d39d4208d1edf6ddb43cb65e", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654889343, "uuid": "5ac7fb10-67a7-4f31-a2a7-a7a6e64b502b", "comment": "Malware payload", "value": "4c86d38f6053c7fb81b2261ac68aacd68cc12b61efd8f1004f2663344f9b80405f32dcc27e50b5fb69a1f41e52635fac", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654889343, "uuid": "21180cc2-6723-421a-b7b2-70da20ccb103", "value": "T180C423A6B1FECA5EC61B4DF0DA38F247DADD5DF0A391C1F661098D517C42CC686A08B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654889343, "uuid": "c0ee6c4a-b8dd-4891-a618-e7bf1ff0324b", "value": "12288:JcPl9JcM2c10wJuQLPymZs6Y7/0s4ieWsee0N3J:OPlLXl10YZvkrdeWsee0N3J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654889343, "uuid": "9712ba93-5374-4343-92cd-de54c28bb8ac", "value": 549375, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654889343, "uuid": "9454e992-59ca-4675-8121-825e136d9f4a", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654889343, "uuid": "22124330-5f9a-4ea2-9453-8bcc69346609", "value": "Invoice-Transfer Details 13052022.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48d17092-e891-11ec-93bb-42010a9c0043", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1654847123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847123, "uuid": "f4b77b15-9c6f-456c-a054-8c09921ab5e3", "comment": "Malware payload (ArkeiStealer)", "value": "3f63d5bda9c3055623b9a27a8bfb0ac7", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847123, "uuid": "d45ed560-310f-40ee-afaf-7a1f3e207f64", "comment": "Malware payload (ArkeiStealer)", "value": "13c9d21ff036ca44a565c00af37d1b80b1acb8858a6a149bb701121429e88ec4", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847123, "uuid": "2b3cf390-5654-4aba-a0bf-39d27458d1f4", "comment": "Malware payload (ArkeiStealer)", "value": "345d8c93ece9c3fbb9c620f05f1e36507a76e0c8", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847123, "uuid": "381fbf16-f6a6-4082-ab18-85469d374cab", "comment": "Malware payload (ArkeiStealer)", "value": "c52885259776bb169dbe9f06208fb5039c55b97a197cd9f1ff2d386e27927754cf2ce7a75f0d4e1f7613558da1fe4199", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847123, "uuid": "a7e7e70e-caf6-4b4f-8bc8-554a5727e41e", "value": "T120B53329C78CADFBC96520762C571E1E0740F4AAD6473972F5F8A25AFDBA3D80106378", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847123, "uuid": "a4187a46-cb09-472a-8cdd-ed9202ba8468", "value": "bee6b6031caef490ea53179b1f7393a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847123, "uuid": "c849727c-d64f-40dc-ac0a-051dd12f99b4", "value": "49152:YpAWSYo7s4h5dt315U9ahUC5PFF56ur/0gjxZnQ:6AttsN9ahUoPnXj7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654847123, "uuid": "7f626d91-0584-4aaf-a7d7-56d8cd315c74", "value": 2430976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654847123, "uuid": "7eea099e-152b-4f91-a30f-cfea94d6c893", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847123, "uuid": "8bb270ee-f54e-41c4-9ba7-f1e957b69a36", "value": "13c9d21ff036ca44a565c00af37d1b80b1acb8858a6a149bb701121429e88ec4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3108cfd0-e917-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654904635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654904635, "uuid": "925a17e3-3f08-4a7f-9db3-438893c6092b", "comment": "Malware payload", "value": "54dceb0243034d3406419368494c5aeb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654904635, "uuid": "e275f044-43bf-4f0e-acfb-300df9085d96", "comment": "Malware payload", "value": "147acbbf007be667ae676b798af1cc0c6ef598d510e2223044ca241225d081f9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654904635, "uuid": "77150c42-5c55-44a0-82b0-be7aff147bc2", "comment": "Malware payload", "value": "27e8c584ee1a73da17ea388f3907bd2e14d11d3a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654904635, "uuid": "44ae98b4-3549-4841-94ef-b9c6fe0a298e", "comment": "Malware payload", "value": "b30e89a9b2df449d3c81b96919b95232fb1e5cc08b3ced08495559fea8f3219deb64fcb224e20f6b8a8898bca86cadfd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654904635, "uuid": "07ad8ce4-fa79-474f-9af9-76296c0477ae", "value": "T1CB438D403799C136F6BD4B74A9F2928087B9D2273903DA5D6DC814EA2F13BC596036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654904635, "uuid": "ae0413ed-a834-41e1-95b2-f8a621e1cdb2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654904635, "uuid": "45e69e83-213a-4ff8-9afa-592cb13d32b4", "value": "768:RjMEIL+Cyq+DiktelDSN+iV08Ybygea1Xb3MvEgK/J/DYMdcQeVc6KN:RjLektKDs4zb1X1XQnkJb/peVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654904635, "uuid": "77ea6fdf-9801-4fcd-95b3-ef5a912f7e49", "value": 58368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654904635, "uuid": "7f054c97-6654-4fbb-8caf-4a5969148614", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654904635, "uuid": "e2a3ae2c-0860-4fd1-908e-6b2beb656134", "value": "54dceb0243034d3406419368494c5aeb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3d90c8e-e912-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654902761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654902761, "uuid": "58498ce6-a762-482f-a1a4-5ff00e20439b", "comment": "Malware payload", "value": "fa592190652b7d0bcdf277d3f0b8ab2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654902761, "uuid": "7962fb2e-7d0a-4dbb-9d0f-92d8bc95b2ab", "comment": "Malware payload", "value": "14a46ec087e9e643c2ecc8f5273d81c3bf43dc2327bda8608f107d0dad6a54f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654902761, "uuid": "42e4a43c-b21b-40c2-90a2-64c14dfcefab", "comment": "Malware payload", "value": "dc414603c97445dad01e7c1ccc962d0513eee3cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654902761, "uuid": "a52d7214-59f0-45d6-bb5e-2c623a8404ff", "comment": "Malware payload", "value": "1cfe9c4ed54565c3c1c3adb537c1f31d46a85dbe23c0034cc143ff753a0333493f75b1ff6f278df970cedee92442636e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654902761, "uuid": "f9d171fe-0c7e-4972-a55d-44fbeb54274d", "value": "T1B0B4140573F43066D46B4D3C859E1A0FE7E67A074BB5D1CA239082AE3BB364279B9F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654902761, "uuid": "de6232f7-ea95-4b74-ba8f-7bd8d5815b14", "value": "b71031ac72c27db547b44e7ae017554b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654902761, "uuid": "1e37dcb6-9c21-4f34-b25a-7896382545f8", "value": "6144:TkzytaJpnASmmaNGQ7DYMT1atZNtpTKIEHzfLAcKhIepZn6kdRphRUQP7LwW1:oytafAS/aNPwHbHcKeep5h/uQgW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654902761, "uuid": "e82b7a10-6634-48df-826c-6e38ad353f5b", "value": 504320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654902761, "uuid": "e02fc8e8-fe30-4462-8060-c82f0cf221a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654902761, "uuid": "dab91717-04fc-4b83-bfa9-3ac841a6056d", "value": "fa592190652b7d0bcdf277d3f0b8ab2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64e3a65b-e88d-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654845452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654845452, "uuid": "ce199f83-2f0a-4b8b-ac95-f1bb31b898da", "comment": "Malware payload (AgentTesla)", "value": "d994684eead688817a1277bc3af0a509", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654845452, "uuid": "9e5eb784-b9cc-4f82-ad84-913291ad43c8", "comment": "Malware payload (AgentTesla)", "value": "17427671c68d5e4353e806c600331496161517bcca39fe012c26feefad962f48", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654845452, "uuid": "8daf2036-cb5c-4f17-b086-22d64b6f5aba", "comment": "Malware payload (AgentTesla)", "value": "7d2f6bab63675ce579f4c90adb6feb94d6b9a9c3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654845452, "uuid": "1454a458-42a6-4f25-9f95-7c6c32e3b7eb", "comment": "Malware payload (AgentTesla)", "value": "d41bf6d34ad60d1701fba67d3f67ac10eb8132d1df8b34e69e0146d731df46318cd7ddaaf77d7249e4960010dfccfe87", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654845452, "uuid": "fe60d271-846f-4199-8a1a-7063ed4adae8", "value": "T15DB4021533AC134BF33EAB350560614ED3A9358BA902FF4F4A8696DF7871B419923A1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654845452, "uuid": "4c180168-18bd-4064-9ef4-9d8130f6723e", "value": "12288:w71BYqakZVM3u/C1X5GAeZGFX8rPv0PVJ3vB3AfNyco:u+kZVAqIdeZGFX8rPOVVv94To", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654845452, "uuid": "85131518-b904-4847-9df4-26cf36a227fb", "value": 501760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654845452, "uuid": "6e40df6d-fa0a-46a3-a10d-438f9de08a9e", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654845452, "uuid": "c4971b89-f2fb-4f92-982f-e1a97f3c86bb", "value": "PI#CMZBD-220057 400KB.pdf.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d93943f5-e8e1-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654881725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654881725, "uuid": "132e32db-e691-4995-8c8d-6a1e8cafed59", "comment": "Malware payload (AgentTesla)", "value": "9f1e511177ab54a5ab17c9b817e9748c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654881725, "uuid": "755c6243-b22d-43cf-abd3-ac4624c08895", "comment": "Malware payload (AgentTesla)", "value": "17c2ba4b393bd84fcc56ea6c17898f1252e8df142ddd3db0bd35d729f9bfde7f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654881725, "uuid": "f595f7a0-6032-4ac3-bbf1-5f9b2b1bd47a", "comment": "Malware payload (AgentTesla)", "value": "69629d389b387a5f12e5118e84cffda5a3dc2db5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654881725, "uuid": "c5c6b280-0e6a-4da9-992c-54c4b5cc4d79", "comment": "Malware payload (AgentTesla)", "value": "e8cc62334ef85d97ce57f1c50a3ff5dcf905d53040133fcf9c7da1eb58f3faf6d255d9daee09b05759f2cbfedc33cb6a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654881725, "uuid": "f130e47e-dd55-44b2-859d-5b5b542e9819", "value": "T145C48E36362CBF91E57EC77C50A1851183F09A4FFB12E54A7EE720CF6871B414362AA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654881725, "uuid": "1dd712a8-b75b-47be-8ef3-c428b04dd90b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654881725, "uuid": "65a34913-07ca-486d-b73d-4b50def863fb", "value": "12288:wJ/dBkfhLuyAHF5fIx5IiEvr0hdyYB2ILzZHAWZz:IihLuyyFJIxpEz0PF/ga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654881725, "uuid": "edf87712-2d46-4e12-acf0-bc699132be13", "value": 569856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654881725, "uuid": "8fd54df3-60aa-4d49-a111-29257bac67f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654881725, "uuid": "bad2737c-96dd-4da5-b332-e75191a62725", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b81a30ae-e895-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654849027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849027, "uuid": "3c62c2c0-31da-48a9-a925-b14f6b8d8c78", "comment": "Malware payload (Heodo)", "value": "482e1917baae9cfa7c19b777b8f5cf11", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849027, "uuid": "2d87c19c-7085-4ab2-9a0b-6f98cb522de7", "comment": "Malware payload (Heodo)", "value": "188444eb2f62df3dcfeffb0fee6c3f386b5a36ec591764ea9d02c98078ad7832", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849027, "uuid": "68fd793a-2fd5-42c8-9bde-e31fb73a830e", "comment": "Malware payload (Heodo)", "value": "5430abf23357f7521f6f21d4383d3b8143fe3fee", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849027, "uuid": "7dac1b15-3cc1-432c-a719-734fe326c8b7", "comment": "Malware payload (Heodo)", "value": "2fb20e32e99ab247ef05abad198a929b498f3b75870d45248ad0dc19f5e706f8b77aeb9e27d359f728beaab22f54182b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849027, "uuid": "c874866e-4e35-44fd-9070-91fb4765c241", "value": "T115F4D42FFF51E8E9F9439234814A9570B124BC1C8271797E3248FE60BD72698EB2DE15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849027, "uuid": "bd21e285-ea27-4b2a-99ca-bf6bd7e811d0", "value": "98dfbb430035f9300f4be2418dab914b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849027, "uuid": "dce2dd3a-7af1-447c-af5c-e146cf1608e2", "value": "12288:LFbnmV9v3WtGWt4T/homzyMSoGGymuDqkRFuEEqp+V+kf80pG4:LFbO9v3WtVt4T/hoKyMJJyBDqysY+0k1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654849027, "uuid": "96468468-5afc-4ac7-98a3-ed4914ae568d", "value": 747446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654849027, "uuid": "f28e198f-fcff-4c9b-bf15-b9921dce01e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849027, "uuid": "a263d4d0-49fe-4a10-874d-c6be65b1a33e", "value": "Iq4srNmTUUIgdNz.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "824ca024-e8bc-11ec-93bb-42010a9c0043", "comment": "Malware payload (XFilesStealer)", "timestamp": 1654865687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654865687, "uuid": "38257977-d872-4a41-9389-044f199b86e5", "comment": "Malware payload (XFilesStealer)", "value": "69d71cf9af28c732b1cf0f53a141b774", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654865687, "uuid": "b8e4cb10-c1f4-4444-82d5-e1be18f67e53", "comment": "Malware payload (XFilesStealer)", "value": "1887989d168e18606bf175ddb1a83e6ca5af7eb2bcbd60be37e729ecd0ab8bb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654865687, "uuid": "1a8cbcf2-6581-4bf5-978b-274f8bbc515e", "comment": "Malware payload (XFilesStealer)", "value": "67551bc2cd84ddca9426816b7f334e8ab72b7113", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654865687, "uuid": "d65db8f3-6259-4890-99b9-9d4c0c8bdb26", "comment": "Malware payload (XFilesStealer)", "value": "28e00becb9cccf1176f32f1bd64e2f64daf13fdd5984eb8c830e6ef694e9cdfd564d99f4041222c83074f77fec388d8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654865687, "uuid": "76e3e7b7-83b7-4afb-8251-2f4a69bc77d8", "value": "T1C7B32B82312F4D6AD3D2933620D73227D9467DE1E291EED4A46815F70BF329DE8C6362", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654865687, "uuid": "3912526e-02c0-4e5d-8e28-222fe4d48185", "value": "1536:HwBb7zBzfJ82ZXCZvau97Dd3UYsDyoSX4x5zd9TkMdE5a0uCtUdCG+0z6kFC1QA:Sb3BfC2ZXCvau8YCyczd9BSLG+09jA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654865687, "uuid": "9907bafa-fbc0-4814-a4f8-6af7e3e6e65d", "value": 108032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654865687, "uuid": "38e316d6-9746-4480-8a64-b559466fb3e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654865687, "uuid": "2ece3ead-735b-4dc0-b619-b0f789730520", "value": "69d71cf9af28c732b1cf0f53a141b774", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f30a401-e8c2-11ec-93bb-42010a9c0043", "comment": "Malware payload (RecordBreaker)", "timestamp": 1654868259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654868259, "uuid": "c06d13e0-c98e-4696-8d19-7a553e948d21", "comment": "Malware payload (RecordBreaker)", "value": "54f8227f9ee06d4362e4447a7c94a688", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654868259, "uuid": "85348c3f-2250-479e-8a42-3d145e9ecf1d", "comment": "Malware payload (RecordBreaker)", "value": "1a826e480203a4fc717d5ce5df1e7c6cb87b43406216d79d43af18d5262f84e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654868259, "uuid": "a2cf1b86-caa9-43af-a095-a98dc503cc60", "comment": "Malware payload (RecordBreaker)", "value": "5adde4cf0d529fc9f36f857da118b4a431ed625a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654868259, "uuid": "e4cf948d-b5c4-4282-bdcf-7d087290e3a3", "comment": "Malware payload (RecordBreaker)", "value": "a92bd5ceba2bd3a64edfc446bc1e936b419e103a04c4e2e7861849069f8a232f724af4f9655bf54aa5cae990013cf804", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654868259, "uuid": "4a4847df-72be-4c77-9df8-b8d46890c700", "value": "T150263354AC9833A3DD1586753F204B12F1FB305CA6660E0BD7C47B86E53E1A1B70E6B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654868259, "uuid": "0ac110b4-17dd-49fa-935d-fb72a4554f7b", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654868259, "uuid": "992b791a-4294-49b3-a2a6-bc44b604d253", "value": "98304:JcK4bgWdeBVpteRXC4a3+xG4eVs0YORVLgo60fLBa0zIgh/9Jm1:JcKIgW6boRXB4p1YJo60f80TnJo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654868259, "uuid": "4dcf9a2e-2f62-465b-89c3-01bb8ebeee57", "value": 4779351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654868259, "uuid": "69bb3e6b-05c6-43fb-9a18-0b1e45787677", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654868259, "uuid": "2c5eae8e-1bb3-4dd4-968d-83412ab93330", "value": "1A826E480203A4FC717D5CE5DF1E7C6CB87B43406216D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d473fc55-e88e-11ec-93bb-42010a9c0043", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1654846068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846068, "uuid": "8e78b132-07b2-4936-beec-d34bfa663774", "comment": "Malware payload (ArkeiStealer)", "value": "c68be1d16f3773396d545bbb34e9790b", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846068, "uuid": "0004a33d-617f-43fc-9465-51fe5a1e50d3", "comment": "Malware payload (ArkeiStealer)", "value": "1ab53a9a4f0dd99fce8b0d80dccc9dfa6ea6d4a5665fbd830a100034fc199209", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846068, "uuid": "8747aaf1-07a9-4224-8910-2c2d47e8fb75", "comment": "Malware payload (ArkeiStealer)", "value": "1a1dea08644e862bfd2f0b3271c4432bb87de20f", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846068, "uuid": "24cee23a-9c1c-4fa1-b695-43a3f626c0f4", "comment": "Malware payload (ArkeiStealer)", "value": "564c75bbae4311b957e3901d4823f652fe0a874c70ace547c10aa6b6b06f0693868899b5d0377ecf1631a0566a61a08d", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846068, "uuid": "51592174-1d54-4495-9204-37c98ca7cf63", "value": "T172C52B135A8B0E75DDC23BB461CB633B9738ED30CA2A9B7FF609C53599532C5681A702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846068, "uuid": "6ee88322-7c1a-4d70-9039-6b574b7cc891", "value": "5dd6748a8bf8c3a3d51aac89447af978", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846068, "uuid": "64829d0c-9430-455e-bd9e-aede8a0c5cc7", "value": "24576:qrASjvMY28+/vQ8IklXkh2s19LGPthTrEC4Eh8LeQZM/LCuHzk/Y+uQ5p3h3VGzE:qrASjvMY23/ToKth/f4rLeNuuHucE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654846068, "uuid": "e4278691-6e31-4bc5-ac6b-179142181f60", "value": 2511023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654846068, "uuid": "425aae3d-c112-4196-82d1-174a073cccc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846068, "uuid": "bf4a97ae-d8c0-4313-af5b-025aada97ffb", "value": "1ab53a9a4f0dd99fce8b0d80dccc9dfa6ea6d4a5665fbd830a100034fc199209", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "882c3427-e8f2-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654888890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654888890, "uuid": "8c0d1ea3-8663-42f8-92f0-4d9c4c849830", "comment": "Malware payload", "value": "70d440a4502c8571eb9ba72232123b73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654888890, "uuid": "f26ea192-72ba-4c87-b6cb-ae253b4cafad", "comment": "Malware payload", "value": "1adecc47dd50f23aff0f1ff3c56f471f6968d28a82777d4f5f3eb7caab4ebc82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654888890, "uuid": "8f30eb7b-f1f4-443a-8283-59f9cf608ed2", "comment": "Malware payload", "value": "0c340798efcc61e2e5b317dddf306eb279bf3864", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654888890, "uuid": "6cdb015d-e364-4fcc-9032-23437ccd72ad", "comment": "Malware payload", "value": "486365e26b498c8a9c391b2e610c5b3738dcbf3722ec37e468febc6d1bfd86011fcc24af68391709339cb1c574f46d66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654888890, "uuid": "26c10321-7271-4e01-87dc-ab062d49e6a3", "value": "T103B4140573F43066D46B4D3C859E190FE7E67A074BB5D1CA239082AE3BB364279B9F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654888890, "uuid": "cd628641-b2ec-4dce-9b7b-0b9ce2567631", "value": "b71031ac72c27db547b44e7ae017554b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654888890, "uuid": "1ec3e2a9-838e-4a18-bc74-9db4432ce879", "value": "6144:TkzytaJpnASmmaNGQ7DYMT1atZNtpTKIEHzlLAcKhIepZn6kdRphRUQP7LwW1:oytafAS/aNPwHbdcKeep5h/uQgW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654888890, "uuid": "c30e2374-bc07-435b-85f6-1479c356c9fe", "value": 504320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654888890, "uuid": "924651ab-3364-4399-95bd-e45db16acffe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654888890, "uuid": "740b622b-3d67-49a8-a3db-3d5f5bd731f4", "value": "70d440a4502c8571eb9ba72232123b73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50071c49-e894-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1654848423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654848423, "uuid": "d0f3b5df-e27d-4ee2-b51d-e82e5bc4c408", "comment": "Malware payload (Loki)", "value": "dd269be86e225c1f76277e947e8a85af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654848423, "uuid": "e6849c3f-765e-445d-be2c-6cfba6c462ba", "comment": "Malware payload (Loki)", "value": "1b697cbd61c08be53e1cdb6b94379423ff4b0056d19f7646f6da6a21111e30df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654848423, "uuid": "402f6ec7-0554-4db1-af45-84582e3394d2", "comment": "Malware payload (Loki)", "value": "34147f4e48bcdee342b30bec5a9d324e0ab9205e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654848423, "uuid": "6494e13a-e115-4eac-8258-12edbc61d688", "comment": "Malware payload (Loki)", "value": "8d3851c6a8878938d907d3a5659b6f54999004df5d16f036f1683a8a061ef7929533545be234ca40f41ecc692e9b34b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654848423, "uuid": "2fba1ae3-68ed-49e6-ba5f-132409662c40", "value": "T10814BF20B6F1C532E1B3593318749262D77BBC12FA74898F3764027D2F70691A6BA367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654848423, "uuid": "2b6e3124-25db-48b2-b72a-bc13bfa472ce", "value": "78d26c9d6f2c9d23af6542e6624e3f43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654848423, "uuid": "1f25893e-8845-4d7d-8d0d-dc6bb053eb80", "value": "3072:7+EfBtR5w8Fw7aU1KIYT4Fo5GvGXYPqJSc5:KEfwnnKrHyGXYPwSu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654848423, "uuid": "affa30fa-b83f-4079-8d68-5b48633f9497", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654848423, "uuid": "a56704bd-de34-4d7c-b2ed-eb5580a64088", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654848423, "uuid": "33977d49-e37e-4431-b470-b9cd48c02f67", "value": "dd269be86e225c1f76277e947e8a85af.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9d8e156-e918-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654905267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654905267, "uuid": "586f4887-b6b4-4afa-9995-45dec8bd11a6", "comment": "Malware payload", "value": "742332a2addc080eb386d8e9d9c7a15f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654905267, "uuid": "cacd6b92-7be1-43d1-bb06-0579c0f708dd", "comment": "Malware payload", "value": "1be5904bf668d685066e82c147d27cbd41d46acd13ff7a3b3e225e6cc4bec29d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654905267, "uuid": "bc8ca8b7-ab18-459e-9641-2194e2ac64fa", "comment": "Malware payload", "value": "4a9963da4fed5ef0841bf9b4e227fedcec0ad22a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654905267, "uuid": "2221bcdf-f450-4ed5-8a61-456fd0fc2e62", "comment": "Malware payload", "value": "bc9d1fb23c1a6790530db9410cb61fd3ebcba6080f7c1172b0180e1113a239f0074dce371e77232d757c1de211a9c03f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654905267, "uuid": "3c10dd87-c579-4395-be74-0f7474ba0714", "value": "T1A01302942F13498BD93228BBB54BDC567DC61B1A341F885810B9C1789AF3218E6FD329", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654905267, "uuid": "b88cb1c3-dd71-4391-8695-3b66f65aa65b", "value": "768:TDoQtBTX941eYFDgNbl5PatCbYUmQAvv/wY24kDpg4AubAvQ3k2:XtBTX941eYF8NblpuvnwanQ3H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654905267, "uuid": "6c912dc0-d935-4e29-8acd-7774df71cd5a", "value": 44484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654905267, "uuid": "d9420ccf-e880-402b-b5cb-9b26dfaac801", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654905267, "uuid": "60b198da-7802-4785-8b3f-204aebc1e897", "value": "SecuriteInfo.com.Trojan.Linux.GenericKD.50331933.28475.6286", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5489177-e88e-11ec-93bb-42010a9c0043", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1654846070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846070, "uuid": "4807ebcd-cd73-42e4-bb13-5cbd8c2cb33c", "comment": "Malware payload (ArkeiStealer)", "value": "93bbe978e05144a5417cde21d6766019", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846070, "uuid": "400d0b67-ca8d-45f1-95a8-0c9906b02770", "comment": "Malware payload (ArkeiStealer)", "value": "1c1ce03425793be83b9d250c92531863e1896b40dc2061fe6adbac7fb328c921", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846070, "uuid": "0d4381b7-d1b8-45ef-8398-444d7015302b", "comment": "Malware payload (ArkeiStealer)", "value": "65714ea26b5cf58e7ddd36610198ed23a94c5883", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846070, "uuid": "c4c7ff93-b167-4936-be8d-5d8c0591490e", "comment": "Malware payload (ArkeiStealer)", "value": "f988339c508fe7651ef5de6a2887b62fcdbc53d33cb30c38a1f11d3ae37f980700a733b1f6d4d6907d88458ce4b0d0d7", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846070, "uuid": "22968462-d54a-4659-85cd-81fc3b0b086b", "value": "T11384BF10BB90C035F1B756F059B983A8B93EBAA16B3494CB62C51AEE47357E5EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846070, "uuid": "a0e5a774-bb06-4c54-9431-9958f4516f0c", "value": "1dd05aad8ce2a14fd9b3b972a5a8dca9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846070, "uuid": "2bab217e-b352-4120-91e3-d31df36b6f2c", "value": "6144:wfRFkJvx0FmAAKTFQkvtqS1+H6B8YJ2fR8VLL+I8TkqvyhlsddPmUSBVwOo:wfRij0fAuakvtf1lBBJARjPkEyhlsdwQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654846070, "uuid": "1306fc82-6160-453f-9592-1e49f7009579", "value": 376744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654846070, "uuid": "ccff9ddc-488d-4f13-ac08-b781e308b154", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846070, "uuid": "4c53ad78-8544-48a6-b2b4-18057c5ff30d", "value": "1c1ce03425793be83b9d250c92531863e1896b40dc2061fe6adbac7fb328c921", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ff90b8b-e8b1-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1654860959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654860959, "uuid": "a875d330-73a0-4337-afba-0bfd35fed85b", "comment": "Malware payload (GuLoader)", "value": "500b0e8745af2736b070600bf47062a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654860959, "uuid": "c0bc2e93-b81c-4613-9c41-1cf5022ed120", "comment": "Malware payload (GuLoader)", "value": "1c1e9fe35524c3bcd831dc225b3feedfbd1f7b83e522aa85977647aac4a55298", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654860959, "uuid": "129fe236-4cce-46e0-9f6e-4843dad790fc", "comment": "Malware payload (GuLoader)", "value": "fb297c5947ba68785db0d3498430a265b61151bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654860959, "uuid": "8f097c71-42bc-4b30-bde1-24b607f3e945", "comment": "Malware payload (GuLoader)", "value": "be1e2a556f1038a3aa964011dd8406d2d1ee2aa176be3e107562031e484fab5f870286e8226d22034ce98819b085f52f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654860959, "uuid": "54cc1932-24e5-4c01-8c6e-3976f3d41ce1", "value": "T1CF2402103B71D623E8924731997A6EFA8EB6BE2564602E4B07603F8D7E332D1D61F315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654860959, "uuid": "f9849822-7709-4fdc-afa5-665105ed4200", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654860959, "uuid": "d906d8c8-3ee2-41ba-9b33-03723b10bde5", "value": "3072:RbG7N2kDTHUpouE6/84VuYrQGbSP0gbv9yU2A8nf6eNGphnHY8rD/u7pIzw70p0v:RbE/HUc48U7rnSh4Nx8rD/YIz+0WdKAV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654860959, "uuid": "70a7c4a0-0c5e-46d4-964d-8fd386e84cdf", "value": 210816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654860959, "uuid": "e901a0cc-621f-4e35-9952-bf6b824f8e65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654860959, "uuid": "753b2c9a-d8db-4684-b1db-9c2081303534", "value": "NEW RFQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80074f3a-e8e1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654881575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654881575, "uuid": "2be53120-f322-4693-a23a-3463b76a1e3f", "comment": "Malware payload (Mirai)", "value": "9ae77730f1765cf479312392f447ad4d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654881575, "uuid": "db1c2efd-ef85-4b66-80a1-272d24afcc56", "comment": "Malware payload (Mirai)", "value": "1d0158e5c40abb5b02513833c462a4af3af6c36b862d7b272942d18af05270c0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654881575, "uuid": "bcbb5ccd-ad2b-4856-9aa5-6735aa6aef7a", "comment": "Malware payload (Mirai)", "value": "68d21889fa89ba529600ee1c9cd8df27ea793d37", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654881575, "uuid": "4f53efd5-fccd-486f-a1a4-8b54c26f51a6", "comment": "Malware payload (Mirai)", "value": "6defb6b1bc2faa50751e3856a36680b6563de6a83ad470a237fe0667ea8a297acd53f45d139b4178bdda1309caf441e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654881575, "uuid": "966a1d61-0c55-4ef5-bde5-efe9a2d22bd0", "value": "T144D2D081C66F1D1DDB738F7155E4A1C137A11DAC6B318AC186C0DF103A6BD73A998D8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654881575, "uuid": "4c54ff8f-255b-4b9f-8078-861378407fd2", "value": "768:/c68d8ZxsdezAebrg9/7+l9Z3qfZJT4uVcqgw0+0:v8SZWEVwqlX3qfZV4u+qgw0+0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654881575, "uuid": "0fbce0a6-a444-41ad-8a09-ed80926a5f72", "value": 30516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654881575, "uuid": "a606f274-b64f-463a-9454-da5c1906665f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654881575, "uuid": "13d1473b-c5c7-4fb0-a71a-ba19c26f75f2", "value": "9ae77730f1765cf479312392f447ad4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbd8d075-e8f3-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654889406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654889406, "uuid": "c29ce7d8-a5fe-474e-b5cd-b0ff814978f6", "comment": "Malware payload", "value": "b6a380f3e92b2554bd4f8e36b826bdef", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654889406, "uuid": "3185371f-773c-40d7-abb9-90da34eae14d", "comment": "Malware payload", "value": "1dfa15c8c7b00f93c4c2a52b7a403fda61dca06d6669d941d6fa831ac206af95", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654889406, "uuid": "695b0e10-5233-4ce4-90fb-cd57a412fd60", "comment": "Malware payload", "value": "c3111540bd503274fff36d34c10df68732b1962e", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654889406, "uuid": "b0070735-60f7-43cd-91c8-57c750557d51", "comment": "Malware payload", "value": "7a2888f9d3ce84928c61244534166e44529cf10c26e8467d814e4627b00670d6d3c15e92338dd96923f3a11c8cfaebce", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654889406, "uuid": "fb523639-57fc-4fc7-b40b-f0da185cbf09", "value": "T13BC423CE5778F74DE52BDA79EE3F278B265988F0DE108437B50DE536390848092E4972", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654889406, "uuid": "895d3e60-f716-4357-8b2b-fd8c3416589c", "value": "12288:GcPl9JcMNc90uJuL8syKfSoVU40YbQ82kBgPJlRvhu5QBkXD:9PlTX+90JA0CffPJjs5QkD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654889406, "uuid": "f1a9ae49-9468-4efe-a812-e14ad66a2ccd", "value": 552319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654889406, "uuid": "8e35f6a0-326c-4354-ab5b-c41100d322fd", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654889406, "uuid": "50521b94-a233-4d51-9d71-8a0d5047dc3e", "value": "INVOICE_SKM_C450i22051816020.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d624a42a-e88e-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1654846071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846071, "uuid": "6a7f9a9d-55e6-4363-ac3a-0b59b8a8e0f0", "comment": "Malware payload (RedLineStealer)", "value": "94e2a422a168c73f0cd201e21d105e61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846071, "uuid": "ada3c3f3-35c6-4633-add4-0bdf42acf525", "comment": "Malware payload (RedLineStealer)", "value": "1f2712dc2745ca854db58eabf9b166edcffafa50db4667750e2ba34b5d6b8aea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846071, "uuid": "407357cd-5585-46ad-ac89-f1a32fdc2499", "comment": "Malware payload (RedLineStealer)", "value": "bc623846617a74f3ab49db3fd4533c478d154b7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846071, "uuid": "2b47ee8c-7cbc-4af8-849b-aa93d119f38e", "comment": "Malware payload (RedLineStealer)", "value": "d0f2dde4435684a815000f3e8895c6fec6a63adb96c71538f3f38cfd65e251a8bebd2bea819404aadeb0ef524912423d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846071, "uuid": "e7f8077c-ea38-4b2a-b609-5e6a7659f02f", "value": "T1D5549D26B751C032E76280369A5A9BB1CABEFC3166257417E7D40A7D9EB03D1DB3430B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846071, "uuid": "2fe4c45b-aa0b-44a7-be35-1f42076e6b9b", "value": "d93897b578aa5cc6453a8404cf181339", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846071, "uuid": "d1459259-fd84-46d0-bded-fbeb9db709cc", "value": "3072:6kLeYxvJvLCOLaFU9swL5T0UE/vNNdRs4VrdQWEWBhmAyArCKY5ALO8jQsoWED1q:bRL0a9swF4UyvPEsphDOKYXsoWEjG1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654846071, "uuid": "1bc91012-d2b6-4f18-a631-2be59acfa31f", "value": 292352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654846071, "uuid": "1d0305d3-4b82-424e-a695-4e0c40290898", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846071, "uuid": "7c847e7f-9e73-42ea-8dc8-423ee6775fbf", "value": "1f2712dc2745ca854db58eabf9b166edcffafa50db4667750e2ba34b5d6b8aea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c54932e3-e898-11ec-93bb-42010a9c0043", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1654850338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654850338, "uuid": "ea31cfba-fe86-42f8-9f35-84472849d2ac", "comment": "Malware payload (Gh0stRAT)", "value": "87445680318229b91ae15789c3481550", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654850338, "uuid": "25666f66-d083-44ca-8b8e-2d4eb1f59fdd", "comment": "Malware payload (Gh0stRAT)", "value": "1f5b290101320e19f628080f287860c7295e99a08e1047a991c749f3043674b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654850338, "uuid": "47281c33-9e9f-4b37-987d-5dedcd773dde", "comment": "Malware payload (Gh0stRAT)", "value": "1ad11aa0cd95ceb6ab8db2a53b54dd6d663653d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654850338, "uuid": "69392493-d9d1-4d24-aea1-3cdda9105543", "comment": "Malware payload (Gh0stRAT)", "value": "2475cde8ee1f7bfed7af6efc3d0107ef36addd1ebd476c5805ca782052b5f1f4f736abedfb851bac93e83221fd2cfe4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654850338, "uuid": "3b7227f7-8b9b-4b77-bc68-8799da66edc8", "value": "T14A85E0017BF4E076E26125B248F6D33979A6BC215B345BCB7BD02E3D9E316C1A938325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654850338, "uuid": "317cabc2-4724-4dc0-9b10-64a65d4eff6b", "value": "a0ec29d680d3c9521a9e350b6233d3cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654850338, "uuid": "553f9532-9cff-4cc9-bcd5-b57df828689e", "value": "24576:N6mcqqpMUGU04EepcTmkA92ZeemXdTDnCzwEdQY1RRdvinfTfYvBn5z23o:N9QMUEjxqHTPCznV19cTy5z24", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654850338, "uuid": "b56f6565-6019-468e-bc5c-e363236a9239", "value": 1708544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654850338, "uuid": "e33388fe-0c9c-4312-9053-00ef8e381a49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654850338, "uuid": "0aa4fdc5-5eb0-4edd-978e-bfb30030e24c", "value": "1F5B290101320E19F628080F287860C7295E99A08E1047A991C749F3043674B6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e27afc0-e8b1-11ec-93bb-42010a9c0043", "comment": "Malware payload (XFilesStealer)", "timestamp": 1654860956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654860956, "uuid": "4ee9d168-af79-4b35-a943-4b7fc74b2ef2", "comment": "Malware payload (XFilesStealer)", "value": "8e028581d617ff6bd43371df0d6e4cf8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654860956, "uuid": "2cc586c3-87e9-4a53-8e88-14b8013af068", "comment": "Malware payload (XFilesStealer)", "value": "206fa1d8aaf5cb1b560c5a3ff8bf39f11b8054507c6f21df3bc5d290ef519c58", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654860956, "uuid": "4935fe73-a92a-4afd-8b13-a838b9295042", "comment": "Malware payload (XFilesStealer)", "value": "0126aa1c0e26e5323cb17e67413bf7424cb27eab", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654860956, "uuid": "e9060be1-a0f8-4723-a4a2-c21266b6ff19", "comment": "Malware payload (XFilesStealer)", "value": "ccc9600ffd4254eec0e3e3bba5d510a5e58a3c811f6c7f624adf237baaa5a582c16f3148b22838931ab41bd439148e18", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654860956, "uuid": "f0f08276-ce72-4490-8148-49f1e7c824bc", "value": "T19855395A6512188EE82872B1D972B36846058FF90C7BD74AFD49B21FC273B931D39783", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654860956, "uuid": "6e6c94db-bb69-43d8-a295-76762be27808", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654860956, "uuid": "ab85bd0b-a6f4-4094-ab93-cf39507b2563", "value": "12288:iSZ++L+dUfcAzF4ehwUH22qla5w/yXbxGelixrny1xK76TpB9CpVh+AC:jZ+IWAzFdHH0MW/IbxGsipOXB8pPC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654860956, "uuid": "fc39bbdd-b23e-4605-8672-791afa3021ef", "value": 1383592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654860956, "uuid": "ef1bbdcc-a902-43d7-9b52-d8b3416bbf0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654860956, "uuid": "a231ecfa-701f-4d2a-ad52-b736e4453a14", "value": "PO_IN00043INBOM_Specifications Sheet^^^^^dwg.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a7a1df5-e8c2-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654868144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654868144, "uuid": "6480213c-ac22-44f9-8ab4-bb1ed682621d", "comment": "Malware payload (Mirai)", "value": "254d6581c66aabccc49fe9e0e8ca7d03", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654868144, "uuid": "9c108023-f683-4401-9f03-529b9920bdfb", "comment": "Malware payload (Mirai)", "value": "20efae7a7268bac79b7d5086291c59d13c8fb0895a3d75e9aac8e821a3e09423", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654868144, "uuid": "3310957f-53a5-4ff9-ba8d-f33452fa5fb9", "comment": "Malware payload (Mirai)", "value": "28a6774f1c3484cf079c159ed781e2df21e2b091", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654868144, "uuid": "619a7dcd-3477-4964-a921-927e61b6e067", "comment": "Malware payload (Mirai)", "value": "2b5f8f5bb129d165e39b6fb594375e87cac4ae504fdedef77347c41a45b9cbebdfc9c4b1c22eca0e437baaafd387d871", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654868144, "uuid": "d1483292-bfa4-4eeb-bb15-735bddd33c90", "value": "T1DD930845B8818A16C5D813FAFA2E11CE332267F8E2DE7212DD105F2477CA92F0D77A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654868144, "uuid": "50c94ddf-64ef-4801-9c33-2e2b1515f8d8", "value": "1536:3tnePBE6jkkeQ1fXoDCUgxfygLvRjgbAkVwqtstAWHcFiAB0gcMIIi6mFXuETnnc:oP66QzQ1gD74nvRsbAvtAWHcPBfmFXub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654868144, "uuid": "1b986e88-6185-44c7-b32b-af008423ec86", "value": 95536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654868144, "uuid": "40714ee6-b055-4e39-a7a5-76a11db67efd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654868144, "uuid": "647c6fc5-c40f-46f1-aeb2-9aa8c22453a3", "value": "254d6581c66aabccc49fe9e0e8ca7d03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d425b157-e8af-11ec-93bb-42010a9c0043", "comment": "Malware payload (QuasarRAT)", "timestamp": 1654860241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654860241, "uuid": "c7699c45-e98e-4e39-88a9-f2850c8311b9", "comment": "Malware payload (QuasarRAT)", "value": "f1da6d3b864123b5d821eeede9c418d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654860241, "uuid": "c6c00c49-0b5c-49ad-8bbd-8953572ca053", "comment": "Malware payload (QuasarRAT)", "value": "2180fd32d8edf4e03bbef29e05b6cf0c1c18d9c43450ac0393aeddd84ea4d4c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654860241, "uuid": "02b008e3-a603-40a1-b8a6-7f3121be0025", "comment": "Malware payload (QuasarRAT)", "value": "67911739d2580942ce811a26da6be6eb842c7118", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654860241, "uuid": "6c2f60ce-0aa8-467e-b54e-7361e2ffd5ce", "comment": "Malware payload (QuasarRAT)", "value": "39b076925f0415a84c15f4827cbc11aa3013be3ab23785ee8b9b24cdce03af10ad9bf94b05bce2250d9c3d894f594c6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654860241, "uuid": "5407b3aa-16c4-4dbe-9881-9daa5aa376cb", "value": "T191A56A2C7B655E72FF1FD8B445018B29BBA2FF5332418A9397DB25CA8B5E1262D10CC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654860241, "uuid": "56067b4a-a508-44f4-b32a-524021795adf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654860241, "uuid": "8575bec8-ef50-4ca1-be2a-506dcf37b9ec", "value": "24576:F9RRjxoYQGbr2v2RjRYB55LQJ6eVTgSJvHGLNcV:FlvQ8Xc5Lg/V88HO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654860241, "uuid": "7bce9e28-400f-489f-a1bf-279878bd6608", "value": 2097152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654860241, "uuid": "4343d4a0-c3a0-4114-93bb-35753008ba2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654860241, "uuid": "099529e6-5786-4b5e-ac7f-60296704677f", "value": "MV.FAST FREIGHT_ TBN_VESSEL PARTICULAR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f1334de-e8c3-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654868742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654868742, "uuid": "6055c430-0dc1-4a17-ba74-a4861c7f92d2", "comment": "Malware payload", "value": "91edd347f033b3c551ab4083dad5269b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654868742, "uuid": "94997d14-c5ca-45a5-b90a-b29892af4f8b", "comment": "Malware payload", "value": "223c1c3483af1486c51fe88f8bcebd063ebd3318036060acbbabaf1ab3d280a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654868742, "uuid": "e0a7d039-9480-47f2-a4c6-762d978829f2", "comment": "Malware payload", "value": "a36f6689f7c9da388ccf3311c0c461fe174eabcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654868742, "uuid": "07376994-a029-4b50-a3eb-a5fb18ae0b4f", "comment": "Malware payload", "value": "bb0993008e66c66964b1eb6d08e8cc6d838264411f044887465bc19e4a105052aff7465a354a5a372c0cb8329e39a317", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654868742, "uuid": "7183dd7a-3637-43a2-9392-8e5d86c5e8af", "value": "T17814E802338981E9D42B077AA6CE4AB5E1294C173C75FC1F71353EA767B0AC845E6DAC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654868742, "uuid": "ffb207f4-dd5d-49e8-b9e3-5b16f82f1491", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654868742, "uuid": "28b8a766-f1f7-4f4e-9a0d-35e318c9e0b5", "value": "3072:qfbysSALppRZwFiyc594RWDZ7E0e4Oum0aW:sbysSg/isyc594RWDZZbOum0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654868742, "uuid": "e0e57cf3-599d-4b1f-be66-4388222e737c", "value": 193536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654868742, "uuid": "bf893d32-953d-4cbc-96d9-3e2f587152f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654868742, "uuid": "4de8b6d2-7e2b-4b9d-83b5-fe6e5c4ad2df", "value": "MT00109317.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe6dd646-e8b2-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654861601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861601, "uuid": "311df221-6bfd-4929-8435-4de28b85105e", "comment": "Malware payload", "value": "035a6472f62decb1ae99d72aee431c45", "object_relation": "md5", "Tag": [ { "name": "Encoded", "colour": "#B4A098", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861601, "uuid": "944639a0-8327-4a43-820f-20d8855e5812", "comment": "Malware payload", "value": "226133b37579101264dd5b3fde9fa30956cb038d6008b056e618331e63d910c9", "object_relation": "sha256", "Tag": [ { "name": "Encoded", "colour": "#B4A098", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861601, "uuid": "e0371c3e-0e47-4a11-8f0f-3244ace1acf0", "comment": "Malware payload", "value": "e92c62537c3001b81f94cff9ea5abc557efd3974", "object_relation": "sha1", "Tag": [ { "name": "Encoded", "colour": "#B4A098", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861601, "uuid": "5f1f85c5-1a61-4e59-b58b-a02b0116e7f8", "comment": "Malware payload", "value": "959dab88c476e00607d60f7b55fae1e7c3f311c4b259730fe6b7ba06b2406f0656797e3033fd25340493189e21b2d6bc", "object_relation": "sha3-384", "Tag": [ { "name": "Encoded", "colour": "#B4A098", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654861601, "uuid": "f138d0e6-587a-41e3-9894-1b6bba066ed9", "value": "T1E2D48E8D97C18EA5E855E775DFB723A45789DEB10CAF63275368322EC07B3A46E00702", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654861601, "uuid": "34bfd011-327e-4b98-8db8-441b554d3627", "value": "12288:5GKwC5p0EBH22qla5w/yXbxmIRRPQjzX5:j50kH0MW/IbxfnQ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654861601, "uuid": "91f903b0-ae4c-4bc1-9172-70dd39381e0f", "value": 647168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654861601, "uuid": "55cba9d9-1724-49c5-9fe0-372fb8222e94", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654861601, "uuid": "60cad9b1-722e-409a-8f57-930b84f91c38", "value": "Bndwm_Vfobaoef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dd229f0-e8d4-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654875800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654875800, "uuid": "1818a662-cb8f-4f84-bc39-c2c65b3381a8", "comment": "Malware payload", "value": "565a322f5910e76491646a0f7847f65c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654875800, "uuid": "a7eab49a-31d8-4ef0-a6d6-5c434e528a32", "comment": "Malware payload", "value": "233a666fce4179d561dbcd31f35624fd3bc21068ae08995316eb9e5f7debf6f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654875800, "uuid": "859aff8a-6144-4096-87ca-6dd75edd9660", "comment": "Malware payload", "value": "7b37633c5438c202e95ded27c87629bde35e7dcc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654875800, "uuid": "6f6fd2ad-3326-413e-a729-047b9d597adb", "comment": "Malware payload", "value": "60464cd2aaaf931d79bce80746ac13ea6d989a0532c0e1fee9a69cf01adae6fe0546310ed2a2f4227dd3c93eebe4e110", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654875800, "uuid": "3cf40e11-2b3c-46db-bd93-1bc87aed79a0", "value": "T1A155170063E91A05F6FB5F79A976A5404BB77DDA683AD34E18DC60CE0FA3B408951B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654875800, "uuid": "f76f094e-8b13-45d4-b66e-c5f903160527", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654875800, "uuid": "552429cf-249b-4dc0-a764-19754c8979d4", "value": "24576:l97Erv0YzjPkX9bAuTAHthGos+eHe1YQV+p+Zq121:l974DXkXTqXMfcJV+p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654875800, "uuid": "00116187-9f97-4b7c-a508-2aafee4e91ff", "value": 1398784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654875800, "uuid": "49e0265e-befa-43a0-8b9e-56dd27245cb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654875800, "uuid": "b9caf622-23d8-4f96-90ce-b225ff10665e", "value": "565a322f5910e76491646a0f7847f65c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c78ce1c1-e8d1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654874823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654874823, "uuid": "d3805365-c6f5-4ace-a28e-13ac135d84bb", "comment": "Malware payload (Heodo)", "value": "40c0e66d0dd53d9ba0e81ecef6e545a5", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654874823, "uuid": "fe83e763-194f-42a3-a2dc-9d5b05de2560", "comment": "Malware payload (Heodo)", "value": "23bc0c4a15a588594c1b3c56aeb9efaddcdc9bf856f509b6cbb39d91f38d89e4", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654874823, "uuid": "795e7f53-5ee0-46a3-a918-3c9f5c1c2e08", "comment": "Malware payload (Heodo)", "value": "d382025eb48652247e26c4c2bfa020258724a05d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654874823, "uuid": "07d23a9d-c80a-43ac-a2f8-6c726c8992ca", "comment": "Malware payload (Heodo)", "value": "7ce18c294473487ba8a62d1d04e3ba033944e918bbfb852b1cdc380633709e4600cf53943ff7caa012f469ce3931b72c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654874823, "uuid": "7b7afbdd-660e-4da5-b2c8-9d4a0a6b3e0c", "value": "T1AEB4140573F43066E46B4D3C859E190FE7E67A074BB5D1CA239082AE3BB364279B9F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654874823, "uuid": "c44209ef-01fd-4627-b4a6-286fde4f3b3d", "value": "b71031ac72c27db547b44e7ae017554b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654874823, "uuid": "142824b3-caf2-42b1-aa41-95172a506559", "value": "6144:TkzytaJpnASmmaNGQ7DYMT1atZNtpTKIEHzWLAcKhIepZn6kdRphRUQP7LwW1:oytafAS/aNPwHbacKeep5h/uQgW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654874823, "uuid": "d92bd3de-8e74-4b31-a81d-ba44cf0d32c0", "value": 504320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654874823, "uuid": "68737329-e2a4-44a9-bf1d-295cf4f0d0e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654874823, "uuid": "12112866-41b3-4296-9137-7de966ea47fb", "value": "40c0e66d0dd53d9ba0e81ecef6e545a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2628ef4-e8b3-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654861929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861929, "uuid": "33564aa7-5637-4d8a-8e16-20b57656e4c4", "comment": "Malware payload (Mirai)", "value": "7add66c86602c5e46fb9213d9c1bec13", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861929, "uuid": "4e7fae37-21c0-4d3a-8bc0-85acdb53a53c", "comment": "Malware payload (Mirai)", "value": "23d3a970f37b38e9e0d21090a6d7aac3c576ce00258443ee168fa7a83857a437", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861929, "uuid": "a39bd0a6-1505-4862-9594-34f4e1fc26e9", "comment": "Malware payload (Mirai)", "value": "38174f09a500f7139c226a223eaab4c23d3b783d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861929, "uuid": "a9b1f938-f1ca-4045-b212-6488aa032707", "comment": "Malware payload (Mirai)", "value": "3ce674026be700bfd6df67607582fe909c3c4e340f90d7088d8333533381f1ae1b31c065cc87ed966b9fcc31a44c718a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654861929, "uuid": "6f4007e7-6f84-4d1e-8924-99b5ae30ccbd", "value": "T1BED2D0BDF4983DDAC99D4CBCA0DE1E854DB975C830DA4B2C23148C5D166A263F98E0BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654861929, "uuid": "3c8a330e-4a24-4118-92c4-0e738ebbce8d", "value": "768:M0h7kPj4Br2G6QrGvIK2hHgrdS4MQpJxDOxWX:bZkPjQqvI6s4xP3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654861929, "uuid": "f9eb94d7-0446-4b5a-a3ea-d54ec410df45", "value": 30696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654861929, "uuid": "c3251e60-7e4e-46d0-be5d-20f27183631a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654861929, "uuid": "5e697f1c-8945-45c7-8041-d42d64677353", "value": "vailon.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f38beb52-e85c-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654824646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654824646, "uuid": "bc41c35e-159b-4219-85f2-b20b997e0ea6", "comment": "Malware payload", "value": "654247b85169929869f46dd5e7df130b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654824646, "uuid": "3878ff5a-1376-47fd-897a-965c3525f708", "comment": "Malware payload", "value": "268741ec1735e10573dee9e1d0488faeaee1f2c6f30b0be02b5695ce0684b1a7", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654824646, "uuid": "9395df6d-0363-44ea-ad93-286f22f70228", "comment": "Malware payload", "value": "696f42527fe7996e5c7ba394f467d3d6e8d15869", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654824646, "uuid": "db9f36f4-d259-4d88-9293-705b8afe5b02", "comment": "Malware payload", "value": "ede716acd99066a10d27962aaf8ecd87923e87e21a9036cfcb3f09039927af50df30dc3ed5c2a43b4404a3d2ce867c07", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654824646, "uuid": "306f9537-ef56-4084-a6fe-6049b80902c5", "value": "T1ED95337029085AC7AD6BD73A242C870FB32C7E3C635B8F1E297709BC2045CD5AD9599B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654824646, "uuid": "8839fb25-0795-49fe-98c8-9a8ac87ef775", "value": "49152:ALjhcCFWZLk+ty04y3QahmZCRkQO3BGuCtF8rIXJue3TB:ALjhcuxy7wzRGuClue3TB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654824646, "uuid": "bc2575e8-f33b-4153-8ec0-55dc0cb3a4d2", "value": 1986716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654824646, "uuid": "f9f1e4a6-afd1-4fca-ae78-796767055675", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654824646, "uuid": "06185891-4b81-4329-aaa5-27c13a2b1472", "value": "ireplace-file-08.06.22.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbd939f6-e8a5-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1654855932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654855932, "uuid": "4ede0a9b-eab3-40a8-a49d-f10876d1f50d", "comment": "Malware payload (RedLineStealer)", "value": "00b886de0de6d58ad12c3ac87fde6f1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654855932, "uuid": "b3397c42-7068-4bdd-8bd4-2244af4bf93b", "comment": "Malware payload (RedLineStealer)", "value": "26d516094a2683872e29fbbfae81101c9d2508777240cf002e92e9cde54409cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654855932, "uuid": "dff2078d-2f0d-4f53-9ab8-ceb54d65bdfc", "comment": "Malware payload (RedLineStealer)", "value": "ddbc78fcb2afec039882352691fd36a28fb2cd28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654855932, "uuid": "e2369e63-23e9-4862-bbd9-296f7b566924", "comment": "Malware payload (RedLineStealer)", "value": "340302c905d33f4d3b066fd9b4b7190862379b3677533c0630dd33aac4a9ab4314abb2010ebab1fee6da380fd445a4d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654855932, "uuid": "2fcdfee0-8e87-49d7-b452-f3b61336818f", "value": "T124B5F9039A8B0E75DDC27BB461CB633B9734EE30CA269B7FF608C53559532C5681AB42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654855932, "uuid": "d6ae51ad-04d1-4fed-909d-8524d42bfb95", "value": "4abe00f9bb2c9be2a818a94bb7c50882", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654855932, "uuid": "c5a4e152-26bb-4f80-a5f0-70062f8b6584", "value": "24576:SPZVU2Ra8uS3+K3ulD73D2mfeY2fm2VTFQJyAp56jNHiD0acWwfwuQ5p3h31U:SPZVU2Ra8uS3+K3uBT9aYJyxNHCM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654855932, "uuid": "d6c62fca-0634-498e-a0c6-566ee6dc4aa7", "value": 2377192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654855932, "uuid": "b9c99319-7cdf-4c58-9739-1b1c5ed2add7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654855932, "uuid": "86180490-9200-4eee-9ac1-7a4d178d4e95", "value": "00b886de0de6d58ad12c3ac87fde6f1d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c304ad9e-e8b3-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654861931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861931, "uuid": "1ac9c50f-4e14-4fbc-bcbf-de867557fb82", "comment": "Malware payload (Mirai)", "value": "a0ac5f7ed0f94ca0a005d09804edecf7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861931, "uuid": "0dcf78b8-e23b-43f0-9dd0-3091456ce6e2", "comment": "Malware payload (Mirai)", "value": "273fcc52f63aa844c503d98aaac2093950fe248c86d0604077c893da4992a40a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861931, "uuid": "8eead027-44ae-4076-a750-47cbd0d3f9c4", "comment": "Malware payload (Mirai)", "value": "d7805fcb9937f44d3908f8b05e85d42305b9c3a6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861931, "uuid": "74c41222-1b44-434e-a60d-84d204d194bb", "comment": "Malware payload (Mirai)", "value": "29dc2e3ee4a004dcd1a20c8b6b2ddad63b7f6eb55e8340ac444c6dc6425cecd0f5bdd53893bdc225f820f702a49a8c9a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654861931, "uuid": "65f4641a-4103-46b8-aeb3-91afa021a3ba", "value": "T1F7E2E0ED3605EAF1CDF04570ADBD9E8357088FB862FA30723AA487519DC05027B963CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654861931, "uuid": "1d961c82-0fda-4faa-a3f9-4f9710aa6d78", "value": "768:m+iPdt4DhFLLaCKSpCQTK4tABg0jl8/G5bqV8CxNj35LD9q3UELre:ZiPdtkhwCKOCQTK4tAP58/YY3QLC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654861931, "uuid": "07ee55ef-e858-4e12-b34c-0d941606750c", "value": 33332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654861931, "uuid": "26d85546-3b9f-4ab0-bb80-305a81b28446", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654861931, "uuid": "3fb6fd9b-f129-470d-b5db-cf1b003e3045", "value": "vailon.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49da7cea-e891-11ec-93bb-42010a9c0043", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1654847124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847124, "uuid": "be4d682a-cf88-4200-bf9b-b858e63df413", "comment": "Malware payload (ArkeiStealer)", "value": "0f35e84f37c1de86015b115c6a0b24cb", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847124, "uuid": "72e55e0f-71d5-41ff-9ceb-f4e1d42c1c3a", "comment": "Malware payload (ArkeiStealer)", "value": "285ec49f3d5dcb11970ffb08fdd41188576e220b74385147a72ce2dcec034632", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847124, "uuid": "255a9456-be84-42ee-935a-a75ce64c3bc3", "comment": "Malware payload (ArkeiStealer)", "value": "bcbcb91990ee212502d811f6c60e2523f73572c1", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847124, "uuid": "cebec3e6-3893-4678-92a3-5f27bbb7c673", "comment": "Malware payload (ArkeiStealer)", "value": "36b6e74066449e3c30fb04a1800da534f91d77360b34a2f1130b662f449624e9a4b4d95161d637a6d6d1400829f7e43e", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847124, "uuid": "36ed56d4-a67a-4de0-b69e-f924d8778c3f", "value": "T1B6D533ABABD0BDC0E523C372C843435632D735B1A15DCF5B22BD264CA53E5196E428AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847124, "uuid": "36a318e1-b34a-4170-8399-a0a39ccdc56b", "value": "79b3362178937bf9559741c46bb9e035", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847124, "uuid": "8f7853de-10c2-434c-abd1-9c4304e8b0b2", "value": "49152:HdOroqVnl137NBljI+7TS5dOvI1oUUbJXYVYTPbK1qgo8WPAeB:8RR7HljD2acdUleYvsI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654847124, "uuid": "b8f40dfe-f7a0-41c2-9780-c5b9a0db28b0", "value": 2763960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654847124, "uuid": "38847345-d580-45ed-b0a3-c86f1e15c6cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847124, "uuid": "d745c250-28a1-42e2-8e0a-2676af21ea32", "value": "285ec49f3d5dcb11970ffb08fdd41188576e220b74385147a72ce2dcec034632", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "622fcfad-e897-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654849742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849742, "uuid": "7d7c27b5-8e13-408d-a253-20686c69a9cf", "comment": "Malware payload", "value": "6c15dce9d9b6a55349adb18eabf8ab11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849742, "uuid": "c9b232a4-32b0-4b2c-9567-a5e076f90d15", "comment": "Malware payload", "value": "28a0f79c1c18a9cf6beb8d93ac9cb523ee83c92aeb2bc83e69e87a1d6e3df748", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849742, "uuid": "26390f8d-2cd5-456d-81ee-432424683536", "comment": "Malware payload", "value": "6ee90bc6db1982367e4c7f563e8de2030c69d62f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849742, "uuid": "88f16bbd-428f-4e94-9b45-a4f1c17b8c31", "comment": "Malware payload", "value": "28281e6c51196d014ddbac7cfc719cb511e179a177d0ba295f3295a0486a22a2ca65488f59babe0fbe0d24039de80ca0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849742, "uuid": "de6e6090-54aa-4901-be50-ad21cedc30a6", "value": "T17747B3420B35B8AAF0B5E539D553C53BE9E832BE9BFC2DF70049A1046212B65637F643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849742, "uuid": "2453ffad-3551-4104-9da6-9be2670c9c0c", "value": "07f25454186948ad33bf5de66d24724c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849742, "uuid": "07bab136-bf30-4b19-889d-84e756c20fac", "value": "393216:6/voOVjbJsVVLkuT3tz47B1B8d+0GJpBvhShw7A4ZijYnKqHARbHz48:+FsV3T3tzABL8d+KGXMYK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654849742, "uuid": "8b2a0f8e-d5af-4f4a-8d6b-8c43e6856a7b", "value": 25803776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654849742, "uuid": "91903afc-c815-4ed8-8527-a405dee06510", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849742, "uuid": "67cdbb8a-3852-440f-bc3a-57892e561f5a", "value": "\u5458\u5de5\u674e\u4f69\u541b\u79bb\u804c\u4ea4\u63a5\u4fe1\u606f\u8865\u5145.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f07fdc09-e8b4-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1654862436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654862436, "uuid": "618ec152-3fc2-4dae-bf3c-5a08c727538b", "comment": "Malware payload (SnakeKeylogger)", "value": "2189bd6f4d41656999fb7cad89f53c8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654862436, "uuid": "a45dbf2b-b5ba-495b-9cf6-6b22e311106a", "comment": "Malware payload (SnakeKeylogger)", "value": "294f6b652cfd746318ef6ca206551f94a91882d8563a6a71a398e481e4d7c6e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654862436, "uuid": "b276bdf0-dacc-4ad6-a741-037b62dd7458", "comment": "Malware payload (SnakeKeylogger)", "value": "1e49023b48a20fa17ed769bb0da3c90c41b7bbb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654862436, "uuid": "0139d729-0f05-4a6e-a785-0444a1e4a604", "comment": "Malware payload (SnakeKeylogger)", "value": "ef83549afedcbc95d655ffff0b8f698eb7d25454eaddbdd82177da6dee9daa5e120605b2e717e84947def7027d2b91c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654862436, "uuid": "3e8659a5-d032-46d8-95e8-f45ce0a828ea", "value": "T1C4D4F11A7605E54EC0164737C9DB681043A25EA7672BE70B7187339D9E0F3DBCE0A2E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654862436, "uuid": "26543710-a110-49fd-a714-68c825035647", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654862436, "uuid": "feb53db1-2f66-4ec5-8ef4-cf406265bc70", "value": "12288:gp8OF6wP28yTg9qAByfB+e7DVJzL5bHIwUNKUpnJ3:utmf/fRIplZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654862436, "uuid": "ceef4869-d05a-4f52-ad05-069667a1a884", "value": 646656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654862436, "uuid": "d3c485df-03d5-4be2-8703-80ecf23d7404", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654862436, "uuid": "c89e0038-500e-4166-b0c0-8820ac137621", "value": "doc2019291888001990.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "667cb5d3-e8d5-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654876378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654876378, "uuid": "c39114a9-15bb-4e32-a04c-3ed9ce5c5d92", "comment": "Malware payload (AgentTesla)", "value": "35cd900a8a9939ed73dca23f454aff12", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654876378, "uuid": "57334e88-6b8c-4a59-a105-fd276cdd1cee", "comment": "Malware payload (AgentTesla)", "value": "2973364844c940ede5b65bf2ee262608f5ed914af6675946a5739a6a82c4d90e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654876378, "uuid": "65be1044-28ba-494f-91c4-c335e8b3b18d", "comment": "Malware payload (AgentTesla)", "value": "feb0009cbc22ddadd27a4ec1dbc905097d62a402", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654876378, "uuid": "b66ed849-9f4e-40a4-9d53-b66ac51230fb", "comment": "Malware payload (AgentTesla)", "value": "54255d05ca73f521b2d05df15d734735ee74849218334f81248683d58d2a11c1bb8a4562dd35727e0d141334cfcde271", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654876378, "uuid": "aba8e87a-5939-4a76-8800-bb9aa8d22294", "value": "T1CBB4F15D27DD5706E5B9FFF948A0B14AD77ABA4B6512FB0A0ECB92CF1430B00A46211F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654876378, "uuid": "81987317-17b9-4110-8026-470a0ae0e70a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654876378, "uuid": "39d58fb6-f182-40b9-ade2-b96f804efb14", "value": "12288:WNEKZXgRu2cnfmcr0XFpB0jn1tMLP0Ct4Hc9wJ:oEKEsuJ0Mjl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654876378, "uuid": "1d737efd-2fc7-4685-b2ec-6e086ad1db3b", "value": 498688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654876378, "uuid": "6ce8679e-5fed-4154-9e96-d9ce896055db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654876378, "uuid": "6f61f581-03a7-458d-b26e-ddde70432966", "value": "SecuriteInfo.com.Variant.Tedy.135288.2253.22652", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2ddd047-e8ce-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654873473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654873473, "uuid": "aa1e930a-19f4-4eab-bf01-ba54d65383fa", "comment": "Malware payload (Formbook)", "value": "70ce6f33f1dbb6487f90c6ec5884989d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654873473, "uuid": "4eeae9bc-2bdc-438d-bd1f-c2a680cd5b78", "comment": "Malware payload (Formbook)", "value": "2a1a8ac3a730d44608f6f52728bf9cf98fa4501086b2a02d0fe0f667e61da3cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654873473, "uuid": "076c8de7-99aa-45e9-acd6-2be6d768273b", "comment": "Malware payload (Formbook)", "value": "a09a3a57a7e754af3278ed3ea60df5705190b947", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654873473, "uuid": "f6f8d958-9a22-4b51-80a5-9d0e044e4211", "comment": "Malware payload (Formbook)", "value": "62dac4c54cf688eb71e4260b42ac45364fb5214cb23aa40b4f8730c20883634277d64f710d9f63c1cbd0bce2504b175e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654873473, "uuid": "b9f80b6c-938a-4364-b594-b2240bb45e3b", "value": "T100E4E00A7511E59EC10A5A33C5DA0D1043B39EA7672BE70BA487329E5D1F3EFCE091D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654873473, "uuid": "dc4b9b25-a033-4a47-ad82-e29658fb1b0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654873473, "uuid": "e8783313-c02a-4f45-b28f-a5867dfec1df", "value": "12288:8yGPj9Wow89qLnL79fsKSKJGDsgWlTmhRs38HBfRVHZV:APbCnL79fsYcZWIhykBjb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654873473, "uuid": "49175db0-6ff5-425f-b441-c0c8e24fd704", "value": 679424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654873473, "uuid": "7bd9aded-9580-461c-8797-a628c223b6ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654873473, "uuid": "d8bfefe5-de82-4778-b3cb-c25b07492f50", "value": "SecuriteInfo.com.W32.AIDetectNet.01.26845.10778", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afcbbcd5-e8dd-11ec-93bb-42010a9c0043", "comment": "Malware payload (DCRat)", "timestamp": 1654879937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654879937, "uuid": "093463cf-113b-4b80-9a4c-aaa0dcec85a2", "comment": "Malware payload (DCRat)", "value": "a6c5db5e8d25cabd0407f0677a252a1c", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654879937, "uuid": "fb31065b-8970-4313-b04b-6a315ecf3f6d", "comment": "Malware payload (DCRat)", "value": "2a4d4cea8c3fe6cf1c104391538d0fbc0efcbd2ec4e493e4f3dfe97d3f9b5e7d", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654879937, "uuid": "77ef6b65-2b4f-4ab0-9aa0-c09e9c3d17a7", "comment": "Malware payload (DCRat)", "value": "ea519d9726abcb7c478bccd4d3f3e8a68f9f00bd", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654879937, "uuid": "a1e8707b-d1f8-4225-955e-8325664d8dc1", "comment": "Malware payload (DCRat)", "value": "6248b8ebd23c5073adf03b0dbfc087597eeb95d050543557ed3b6de8995fc2f9edc6ca4cf51881122b33c4aca3d5b581", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654879937, "uuid": "d20fb95c-3921-41d3-8053-24cf4e8b46af", "value": "T105953313CDA152BECEC36DBED5F994551D8C80DB207F8E2C1AB61B57E8D9823422342B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654879937, "uuid": "76f15502-fb68-49b2-9014-bf888eede138", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654879937, "uuid": "417498f0-3d22-474b-8aeb-e42b813ea6a0", "value": "49152:dzDu42GX47yRgrYzbz73ZLT8QcCSIzeG3BVf24euPw:tDulYDbz735T8rLIzbBZ24t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654879937, "uuid": "7c754d3c-aa64-4ea6-a708-9082ccc35f56", "value": 2046976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654879937, "uuid": "f0f9d070-d39e-48cf-95cf-ca136e11bb82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654879937, "uuid": "9132728f-b3de-4c58-94cc-bee9c036abde", "value": "a6c5db5e8d25cabd0407f0677a252a1c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afdb883c-e8e4-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654882944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654882944, "uuid": "8a7e4dce-e70d-4350-b2b9-1445dbd7698f", "comment": "Malware payload", "value": "d422739ed0a4205c44354cfaa6390687", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654882944, "uuid": "74ef166d-c677-4f3c-8df2-bea4de4cf725", "comment": "Malware payload", "value": "2ab0042eb9f9571fb341a67093fc948321b01bb4bf62fdf53e831e25249e3779", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654882944, "uuid": "d97c84e2-0aee-4963-b8ab-db0b046f510a", "comment": "Malware payload", "value": "b2e56e645232004f6a098492cdd57478d8c0992d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654882944, "uuid": "3bb23a55-ccdd-427e-aba4-6ab251c571d4", "comment": "Malware payload", "value": "4be4edf21f98eacf5d74222e6b71d65ff5f379e704217fa90addff1eed6857a0c1ac926a2d6eaaca5f271571e5786a47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654882944, "uuid": "96ce29e3-b060-4bbc-b02c-88d5bd670fe6", "value": "T18E946C3FC8516878FD46A274C606D571B629FC6582B1386E339CC260BDB2958FF6CE24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654882944, "uuid": "247f8f7c-5658-4bf7-aa19-5d60943e98bf", "value": "6144:yFb8KmV9eQ8+9gQdCBjieXt4jP/h47AFE0yFSJ2vEOtRyGUl0r2QOrhSALqDlWJQ:yFbnmV9v3WtGWt4T/humzyMSoGGa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654882944, "uuid": "a4dba210-e9e5-4845-8bec-0239d51470b0", "value": 419881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654882944, "uuid": "9cd205b2-6aa9-4ece-ac69-79cfef061fe8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654882944, "uuid": "34f2f16a-47b1-4bc1-b4a7-fa22e4695767", "value": "d422739ed0a4205c44354cfaa6390687", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c310db37-e8fa-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654892425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654892425, "uuid": "20eb74ab-16fa-4031-8fab-3d2d219f2b67", "comment": "Malware payload", "value": "a8efa6536d6f44759d251512a5b65684", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654892425, "uuid": "3121e1b5-d59c-4c8a-a025-5a4f1659449d", "comment": "Malware payload", "value": "2af046b6fa86630cce26522adc94d3b2c0d99b044f44fcb05b278dba9ba045f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654892425, "uuid": "54d7afd4-d84c-4e44-bfcd-5f48e5436941", "comment": "Malware payload", "value": "c647f82e8dd5f81f370452dbe603d08e88c1910a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654892425, "uuid": "32c27624-a38d-4d3a-ad75-bcd15c49c91e", "comment": "Malware payload", "value": "86485525b7cea2072f91042ff81f651bddd6574a31f56c47f30357556bf188acc258e3d01aedd3d433997771ac80fa47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654892425, "uuid": "1290897b-1218-46ae-a8a3-002260055e94", "value": "T183B4140573F43066D46B4D3C859E190FE7E67A074BB5D1CA239082AE3BB364279B9F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654892425, "uuid": "00fdf697-a81b-472e-be7d-ceb325e04a3f", "value": "b71031ac72c27db547b44e7ae017554b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654892425, "uuid": "bb5d338e-f14b-44f0-b198-f1f9634d1dca", "value": "6144:TkzytaJpnASmmaNGQ7DYMT1atZNtpTKIEHzuLAcKhIepZn6kdRphRUQP7LwW1:oytafAS/aNPwHbqcKeep5h/uQgW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654892425, "uuid": "8cf28d72-ac02-40d7-9268-9b0a7de7c54c", "value": 504320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654892425, "uuid": "6f41a06e-0983-48c0-abc3-2a0bf41f224a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654892425, "uuid": "64ebb577-b66a-4694-8225-4cec7457f8f8", "value": "a8efa6536d6f44759d251512a5b65684", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "831905e3-e897-11ec-93bb-42010a9c0043", "comment": "Malware payload (CoinMiner)", "timestamp": 1654849797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849797, "uuid": "99426027-fe58-4884-9ab5-fbb421832077", "comment": "Malware payload (CoinMiner)", "value": "09610d47f3239b2371ad6e82e9a60e6b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849797, "uuid": "576cca14-9269-4572-8bdd-32ded69520cf", "comment": "Malware payload (CoinMiner)", "value": "2c049deedbc83923abdd41580faa07c98037f09b5fabe98f97a9239a0b6e3542", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849797, "uuid": "1e72f5c5-e857-4273-889f-bd88d885d61b", "comment": "Malware payload (CoinMiner)", "value": "3c6c45b4669086d4477aff8ec771a7340cd989fe", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849797, "uuid": "c59720d5-d311-4abf-9ef4-97002fc5640a", "comment": "Malware payload (CoinMiner)", "value": "7c2c9e1ce1aa04864c245de29895b929c9068b64964eb02452aaea6a4139a0eda7009588a09a854f6c09751cc38f54a6", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849797, "uuid": "ff2986e1-97b9-478f-b026-6605f0122263", "value": "T11B463315099763BCCD23EB39F2A64F1A5A3035D89ED3688FF54453E62DB4288E5E043B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849797, "uuid": "38fc0b23-03ea-4db5-b509-678a8b9b64ad", "value": "0dc6c5e06e22bd9f0c79c55ec1c09b01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849797, "uuid": "b8a21c3d-cc86-41b3-96b3-22fde1d97eb9", "value": "98304:FiShUNKAsTGQrErbI4UZ4LoyOSe9tSgvdUr4zQkLvr4hnLsyPJV5kpv8Cvgroq1i:MnpsTGrbIyFlgvI4MWMhLs6UkCmr1x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654849797, "uuid": "45be5baf-5642-4298-b934-01fc77873ffe", "value": 5688320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654849797, "uuid": "464e3595-5fc6-4996-8c94-c9a101eac3be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849797, "uuid": "1029c0ba-f983-423d-ab18-53bf7c533242", "value": "BTG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfa3a39e-e884-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1654841739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654841739, "uuid": "99c439cc-6177-4d25-b1c7-74006177d009", "comment": "Malware payload (Loki)", "value": "1abd4801d683fe375b415bc8e0cba8da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654841739, "uuid": "c8c3c9ce-6e6d-4d73-b26d-9a59b62e979e", "comment": "Malware payload (Loki)", "value": "2c1ad7493279718dfc88f2a456272ffd34e90361fb44f7d7570aba730248a608", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654841739, "uuid": "08374451-53de-4c6a-b894-d5f7a8c83857", "comment": "Malware payload (Loki)", "value": "42e939f44900fc3db050301046755b3595a3b49f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654841739, "uuid": "28211306-2204-40b5-bd0d-4d60eac6cda7", "comment": "Malware payload (Loki)", "value": "ecae3e26c06115d232e9641642cf7792672c19be7e82d9e79c7bac692afd0775993dd643bc2cb40a764181df78f79019", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654841739, "uuid": "18ed17ae-3af1-44f6-958d-1d8caad52ed8", "value": "T100B41201376C40B3DB584AFA6CAB574153F9D23F4BA6D38A6C44129EBC873CA4E165CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654841739, "uuid": "ded4937b-2996-4b80-9fa3-aa5e0103ec9e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654841739, "uuid": "0a8567cd-8720-43b3-9dba-ef525c70bce8", "value": "12288:+99qQII9M5V/K6PXyxipAsFPz3bbCKjrr9RR/F:cbZ+KpyDFbLbCAr9n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654841739, "uuid": "22eaba9a-1b02-41b6-8db6-1963e6e4ffbe", "value": 502784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654841739, "uuid": "5dae628b-87a8-4517-885e-428062a7ce37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654841739, "uuid": "2f0eb16e-17e8-4b88-a190-06744054daaa", "value": "1abd4801d683fe375b415bc8e0cba8da.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c3906e0-e8de-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654880334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654880334, "uuid": "ba941acb-c7eb-4057-808e-0fc50f47c622", "comment": "Malware payload (Mirai)", "value": "479f02ba1f462df434db6a63248d0591", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654880334, "uuid": "79356bef-1e88-4385-bbaf-fd107f23e79f", "comment": "Malware payload (Mirai)", "value": "2cb2a81182b618ab37e0991aaa119fcedb71457f6392d26f8a255f0939a40a19", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654880334, "uuid": "34659772-e043-4b35-8781-ee84dce7d4a2", "comment": "Malware payload (Mirai)", "value": "668aa228afb02c2aca8c90f9267595320ba6dc43", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654880334, "uuid": "ed4b01f8-c1cb-440f-ba6a-cae77b009e61", "comment": "Malware payload (Mirai)", "value": "3b43ca8b4d025901d39ea6e4aa848e3228864386c268b4ba3cafa0d2def0b27f6c1050b312163f8db6ba33c69ffb82d7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654880334, "uuid": "243f2d92-b267-4324-90a4-3a69a2e6614a", "value": "T1BEE2F2AE28900BEFF74756F608D90F780DF508B1A403AD4A6639E5377D885F1A443EC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654880334, "uuid": "bf852a82-0e14-48d1-ba29-4de4e0049a18", "value": "768:atmj0yzIh3uY5TVAZjGxWnTLertgUps+KtQBXgXgEt3kYGyR+JgGlzDpbuR1Jy:nJ0ONnverBs5tQSXL3kTyRqVJuI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654880334, "uuid": "43bdc032-b28b-4b29-98cf-77346ccf158b", "value": 33356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654880334, "uuid": "2b149abe-b5d9-40cf-9f2d-39b8c53ac526", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654880334, "uuid": "acc23ed7-3153-471b-a615-44649c1b4b64", "value": "479f02ba1f462df434db6a63248d0591", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8fa38af-e8b1-11ec-93bb-42010a9c0043", "comment": "Malware payload (MassLogger)", "timestamp": 1654861055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861055, "uuid": "503d203c-d462-46f4-bff7-3eb68533f63b", "comment": "Malware payload (MassLogger)", "value": "540ac2f309de16c54000e529e0327632", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861055, "uuid": "ef5ba492-0a57-45c9-bbd1-1df1c6e8c94f", "comment": "Malware payload (MassLogger)", "value": "2e4a62b85a1f30e4c4584d724961e0d0a67a3d55006154eb6f55efdff54050ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861055, "uuid": "ee6b4ef4-a83d-44c2-844a-e5601cd9e8a9", "comment": "Malware payload (MassLogger)", "value": "3275d1d19deed57196fa7bd424afde6c5ec51673", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861055, "uuid": "04c2c6bf-a540-4f56-816d-8ff2d9b1712e", "comment": "Malware payload (MassLogger)", "value": "15693ece55bc1aefe5bebde4f9ea4f0126b5ad609d59bfe7cc2232de7e0c99fbdf31c5076dce6ab071b49e6d665e478a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654861055, "uuid": "c882af91-9402-47de-b44a-fbcccc05d251", "value": "T1BE94BEC2F11085EEED6A177224271D9259932CBDD6B9D10C71F936323BF72A3402E99B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654861055, "uuid": "57d20ae1-bbf6-4f31-ac99-8e0ddb7e2210", "value": "dd1742eadfc6df18ded3c26ae64ad610", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654861055, "uuid": "3fa9c0c6-aa43-4551-abfd-2d6be2de06e5", "value": "6144:zb2WVqB0NzuQ9NMH9CinMy5FTkf8xVbCtyY5xX/l1:7W0N6QcdC8My5+GVCF/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654861055, "uuid": "e7f323df-0fa6-46f2-afe2-7dd3174d73c7", "value": 427045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654861055, "uuid": "5c9933c9-c6de-488e-877e-ea0aaf8d0d11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654861055, "uuid": "c64db361-8b3e-452e-9725-693947192237", "value": "00987654567098765434567.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73727791-e8ac-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654858791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654858791, "uuid": "87301820-6c83-457d-96e5-6574f6f2d3bf", "comment": "Malware payload (Formbook)", "value": "040dd2a1f0d0c0294fb76985ecca362a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654858791, "uuid": "817fc1e2-191b-4515-bf49-981ce5f7ddfc", "comment": "Malware payload (Formbook)", "value": "2edf75a7e40c006b93315b9482428021b5643abbedbb0ec3d49d88124906022e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654858791, "uuid": "4ff0b1c2-957c-49c4-909c-4ed57b8b70ff", "comment": "Malware payload (Formbook)", "value": "ca8b029d27baaf53ccf2fb2977437ce7a401d591", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654858791, "uuid": "4ff6f487-7b22-4ad3-a2be-2250ca6ca54b", "comment": "Malware payload (Formbook)", "value": "ec52d021ab7b243a1c15590ba84c1a2ffb5958d1adaef63099b8c45acdeb3891c20cba910efd26315773b72c1896547e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654858791, "uuid": "2bf44d34-d08e-4cc3-b353-fcf492ec9d3e", "value": "T11935AE12B6404036C5621E305D167A5D6A66BF50E93BAC4B6AF83ECCFFF63816D39072", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654858791, "uuid": "3c04ccf8-9f19-4a6d-9d80-78ae50d3d90f", "value": "89080780c4b7d92c01cae7daa58f85c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654858791, "uuid": "2248b8a3-d0fe-4ff8-a6d5-787181b5e26b", "value": "24576:dbX6YQLIszpHNVDbs8NqmyGhwWUvkMsTWe:VXopHHPvUvBe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654858791, "uuid": "9e5c569b-c403-4bc9-af3a-c83a63692491", "value": 1064448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654858791, "uuid": "db174199-dcf1-4995-90aa-90733359a649", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654858791, "uuid": "fb2b3c64-fb99-4fe7-bdef-7e4929837385", "value": "SecuriteInfo.com.Win32.Injector.ERTG.16726.23465", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87ee5d6e-e8ab-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654858395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654858395, "uuid": "85acc2bd-df0d-4288-b04a-c0a28347505c", "comment": "Malware payload", "value": "80afeac260177cd049e2cce1ca47d238", "object_relation": "md5", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654858395, "uuid": "b7f78613-af68-4816-8b19-2e1c90491898", "comment": "Malware payload", "value": "2f845b41636a5a00efb7c873cdfa3f1e378ab2de4e39cbab8fed60735b49c3ea", "object_relation": "sha256", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654858395, "uuid": "434949a8-e237-4037-a5a6-c766247d3c94", "comment": "Malware payload", "value": "5da69394ce7ca8f161f00b9ef094e49da8105c5d", "object_relation": "sha1", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654858395, "uuid": "ce86179c-2084-447a-9dc8-664afe7f14da", "comment": "Malware payload", "value": "1f8594a3761fdbf6622303fc787a15481f33cba0158b0f020e0aff6d711e936a734a6db16fdb456784aacf1e54889874", "object_relation": "sha3-384", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654858395, "uuid": "ee4f34b9-efa9-4cbd-abdc-57f76224c93e", "value": "T17EF2F2031C1A7A2AC1DB88A4F0B17261F52567DDAE348C1FCFE31C25AB47575E16F584", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654858395, "uuid": "181acc54-7118-4d5d-ac2b-37f809522590", "value": "768:XknweuXgU4jXU/lABTCpb+n8IywW5RNJFj0yQFiy/CQ/Ryf/GJ36hQqa+9otH:QU4jXU/lkTmBwONjgyQcy/N/RC/lla7H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654858395, "uuid": "cf101a34-aa1d-4783-ad9a-f71e84ea4df5", "value": 35866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654858395, "uuid": "701edfe4-9c44-479d-9876-d229a212ea7e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654858395, "uuid": "c1173426-9be0-4f44-be2d-a842b779b683", "value": "Liste-864.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5ecb369-e8da-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1654878739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654878739, "uuid": "f6949b80-8dfe-4305-b64f-eb9a05fc31eb", "comment": "Malware payload (RedLineStealer)", "value": "a46648b2dd6e96562b144ae36956f123", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654878739, "uuid": "5be25cda-10e1-4f3a-95d1-2f8d20a681f1", "comment": "Malware payload (RedLineStealer)", "value": "308fcf160e8a3e3956eae1a8a2285d06813dd879104601e884b5af4c960ca82a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654878739, "uuid": "e5ce000f-9a4d-4536-a2ab-f3d8b5461112", "comment": "Malware payload (RedLineStealer)", "value": "caa5d0f31b1dcc21e2267a2b240d35e1c7ce769a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654878739, "uuid": "230a09fa-26d0-498a-aa3b-ddd4ef50ff4c", "comment": "Malware payload (RedLineStealer)", "value": "94a1e2ff7ee2b34609a809cdf2f9869b3767b24eb5e75ce57ec619b9bc7515ed2cc6460a2fd32e265b7699bfe7c6a7ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654878739, "uuid": "43925677-bc64-4bcc-8f28-c317673f2abf", "value": "T174B33B6877DC5614F5FF8EB468B111D157F0E5A36C12DB9F4EC4B09A0A22B80EA12BF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654878739, "uuid": "1caabf83-261e-4240-a0f5-59a07e1626e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654878739, "uuid": "48cc9e1b-4098-4f59-934d-a1e740815ec4", "value": "1536:ARxakCrHQ2IxAvcGFZySXt18x08JENf8HYbpuPFbuZNoxH/EgP0wuei6jLB:QCrHQIpjN8JYf8HYbpuN98gPhhl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654878739, "uuid": "fb21b9d7-fea8-4652-b1bf-19de2d23a21d", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654878739, "uuid": "570d7246-f33a-4a4a-aed0-5f80e0f54d31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654878739, "uuid": "ae6bc470-631e-4167-b69e-c2499f9707e2", "value": "308FCF160E8A3E3956EAE1A8A2285D06813DD87910460.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e203e2d-e90a-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654899127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654899127, "uuid": "92c9d22d-15a8-4c5b-aa82-1b60f2b18685", "comment": "Malware payload", "value": "4137bbc5d5e63196b87577390108e155", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654899127, "uuid": "daeb1b58-0169-460e-ba62-56b3a084c77f", "comment": "Malware payload", "value": "32c13122b55a0627f66b955a6c23af6d3dffbe5f1f3f07fd1563e4535a8b5060", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654899127, "uuid": "0643acf0-2860-4804-a907-049c5ce73b8e", "comment": "Malware payload", "value": "e83e13c1ac36c5a67d4c18eeaa31043ba5ded755", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654899127, "uuid": "f701c570-fc28-49f3-8d91-122c6ed1845c", "comment": "Malware payload", "value": "41163abb97e4cd576ef615b662decc1ead7c8523349455d6bb6822970e811a84c33d6f0786603a8c350f9b1bf4148328", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654899127, "uuid": "e9e46864-6704-41fc-8604-662a0929474a", "value": "T14735DF6CA3F9C627F06E9B3290154016A5F8B41BE28EF7072DC628F918D73639D095DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654899127, "uuid": "e3599707-35d2-4bba-b78e-853f9bca1bbd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654899127, "uuid": "ebc150e3-2f01-460a-acd7-b2b0d70a5fdc", "value": "24576:xIyoOEXVL2XD6Ys7AZrUR4pRaACqyJmG:azOa2XDDuAuRKah", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654899127, "uuid": "9a216976-6cea-47a8-844b-5ee5dc1ad94c", "value": 1149440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654899127, "uuid": "65d64e9e-100c-4248-a53a-693c8b89bf82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654899127, "uuid": "71b9011f-075e-4123-b12d-18cc2d0eab60", "value": "4137bbc5d5e63196b87577390108e155", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "757e133c-e897-11ec-93bb-42010a9c0043", "comment": "Malware payload (YoungLotus)", "timestamp": 1654849775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849775, "uuid": "002bb705-9696-44f3-b152-d9b514391cf0", "comment": "Malware payload (YoungLotus)", "value": "7fa81506e2397640ac4571ed3eee9c1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849775, "uuid": "ea5396b1-8ca0-4b9b-bb31-988b054a8515", "comment": "Malware payload (YoungLotus)", "value": "32ed59ce4299490ce95d293f6304b1932873091fc0a3ec4db3052a89214245a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849775, "uuid": "06116181-f0e0-40e2-b75a-00b3eddc8d4d", "comment": "Malware payload (YoungLotus)", "value": "2a6e134d34a25d1c7c7cf340068fb996817e0c40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849775, "uuid": "0c83bc46-7240-46f0-a21e-5afebecbc074", "comment": "Malware payload (YoungLotus)", "value": "884a571583dfb601389bf0a8b8d4ded22f676ba40e3cc90fb6c97827d5977526b2fc5252e28b6d82f090d2cbf6dcc85e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849775, "uuid": "43435f67-df07-49b3-9b20-beb854b015a7", "value": "T108C54B11E106801FDAB715BA4EBF721D661CBF500311A2C7A2CC7E1D5FBA9E2793A44E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849775, "uuid": "23919c8d-66b9-4ab9-bd4a-e283628984a4", "value": "e7a44f92ec960fd78c1f2a98d67fb7a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849775, "uuid": "923ba5ff-fa62-4e56-889d-d663bf2ac278", "value": "49152:lUC3y045e6n7oBEjztDYWGEY91psnZYKWSrh:lUC3y0mrn8BFmY91psnZYKWi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654849775, "uuid": "5c51a5e8-c1b6-42f6-9001-660cb486c13e", "value": 2736220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654849775, "uuid": "636ff545-c83f-446a-b50b-1ba0db207df0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849775, "uuid": "954f1cd4-a36a-4ce1-8c4e-6e224fcfa816", "value": "\u70b9\u51fb\u6b64\u5904\u5b89\u88c5\u7b80\u4f53\u4e2d\u6587\u8bed\u8a00\u7ffb\u8bd1\u6c49\u5316\u5305690.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5a98009-e87f-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654839601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654839601, "uuid": "73dae2e1-1844-4343-b6c7-00aba6f4800b", "comment": "Malware payload (AgentTesla)", "value": "9e270927ff9890c0fde5faf46f161d1e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654839601, "uuid": "4426d459-7b2e-479f-9453-fb94a3200141", "comment": "Malware payload (AgentTesla)", "value": "34cdcc5de945d36929f78aca7bbccbc25537a68240da25db0a892a121a7eb87b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654839601, "uuid": "a2313aa0-b4cd-4dbb-b77b-cfa760c05c37", "comment": "Malware payload (AgentTesla)", "value": "dbf0b3d860845d3d7937db1e6b2611b655343e78", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654839601, "uuid": "a4ca4e26-9e17-4042-a33d-675a5ac8e0a8", "comment": "Malware payload (AgentTesla)", "value": "0b288f1b68e533c5fb7502cae9b1d2b59d456d60200af77867688f63a6ca1ae4a2fd899633c7017e902188ee9d6a4dd4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654839601, "uuid": "babb2e44-1063-41b6-9397-88fcaa570110", "value": "T1E6C4F125336C871FE97FB6B884A4604ADBB56207C613FF4E4DC5A29E14327C09D2662F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654839601, "uuid": "4f276419-739c-422d-a1a9-453efb5184fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654839601, "uuid": "23d1285e-08ba-4fc5-b2a1-49c5221ba2d9", "value": "12288:+yz1MMWMW3pts160O9p7BbIiKk2AP0VB7p7zCCoOwP:+yqMkjsqBbIiKk2APSB7p5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654839601, "uuid": "2843826c-c41a-4e00-b122-f2ba05800d67", "value": 570776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654839601, "uuid": "5c94d61b-73e4-479e-9ce3-1b599632bbc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654839601, "uuid": "b10e0ea0-1007-460b-8e90-45389b4a8856", "value": "00182773-20220610.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab0a9a44-e864-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654827960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654827960, "uuid": "95057a90-9e89-47fc-9a9a-b6ff0fcba22e", "comment": "Malware payload (Mirai)", "value": "2dae35ae35a1434b10316115b23df393", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654827960, "uuid": "23eefbf7-73ce-4355-a50a-f836d3b48087", "comment": "Malware payload (Mirai)", "value": "3587bfb6be5418482cb00b7a627f25066caf9c092f6f1b233275832edbeaba7d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654827960, "uuid": "64e7708b-f493-4513-9405-efe42529bb4b", "comment": "Malware payload (Mirai)", "value": "1eea5b9d1be8a7242bf616d19dab52e4785ad1a4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654827960, "uuid": "8f735e5e-3758-4ad2-80f4-e9de57ab68bc", "comment": "Malware payload (Mirai)", "value": "23fbf0a5e566fc57c9aacbfb7224b140ab09ebda5e6d7890b1d0407cf746f75f9c066c94086e88e6972759d9a68db87b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654827960, "uuid": "c0b6aeae-f090-47f4-9550-defdb22959fe", "value": "T11483D70A6E259F7CFFAD523547B38F25964C33A627A1C544D19CEA012E7064E342FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654827960, "uuid": "99c731c9-4a31-4875-b42a-5f2a60b5b399", "value": "1536:kOUHTwXGm9jPr87mv4yQMoP9RCc3H330Jx9n/mkdROwmAmVLV5GaSa10vi:dgT7m9jj8KSbCcX0nnPROZAmVLV5znIi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654827960, "uuid": "b479f456-5444-49d8-8ffb-9488d09f8e74", "value": 88188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654827960, "uuid": "0006849e-3ff4-4987-9f58-c8aa58f7dd35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654827960, "uuid": "800353e7-8d41-4693-a8d4-76377160be7b", "value": "2dae35ae35a1434b10316115b23df393", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6159a48b-e863-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654827407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654827407, "uuid": "1dc49678-d7fa-4b2c-a074-9942751a0fa8", "comment": "Malware payload (Mirai)", "value": "9d9df620bbba5e7bc6cccb4dc7c7f161", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654827407, "uuid": "0f429909-8fe3-480a-9494-00334b17f525", "comment": "Malware payload (Mirai)", "value": "35a783a9a914ef9f98cb5f5719bb28991b0b9f502d66818a42dc06760c2179e2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654827407, "uuid": "f64eebc8-8ba1-48a5-ad9e-d4cbb8e35220", "comment": "Malware payload (Mirai)", "value": "1f8d882243646f5b5258de9cdf67ecd69067b1fa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654827407, "uuid": "6ad54f9c-d5e6-46f8-ac4f-2d4a5d29542c", "comment": "Malware payload (Mirai)", "value": "15be893efddaef54cb9ac452a505c37c0ac32041754ae3e852fdab028a2dd0f5efb5b06913a62d8099a861a8347c721f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654827407, "uuid": "52e101da-beec-4ce9-9e4b-f009ecbafc52", "value": "T149632B85FD4B81F5C91B8D3040A7F23FDB31D97901748AADDF9AAF36DE27641620218A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654827407, "uuid": "bf494db4-9295-4ea5-9459-2f790bf2b1c3", "value": "1536:1+KhJXpF0xQG9G9ZIcyXz/zcO/oi7uLNwLAsycGL:1+KhEQ0G9ZMjvB7uJwLAs9I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654827407, "uuid": "d1555152-6b12-46ab-9f79-ee1340d63ee2", "value": 70448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654827407, "uuid": "b0190d99-80f4-4a51-b9cf-f752e2f4d94a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654827407, "uuid": "6df76b1c-bc84-4b26-bea9-854e3985c862", "value": "9d9df620bbba5e7bc6cccb4dc7c7f161", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcdd0f4a-e88f-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654846458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846458, "uuid": "6787937f-d361-40b4-9a8e-9369ffa699ad", "comment": "Malware payload", "value": "c8ab95a40ba648c8e2265bb5b76070a2", "object_relation": "md5", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "E98346", "colour": "#6FDB7E", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846458, "uuid": "e6fc37f7-b3a0-4f5f-a3d8-a75fc256298c", "comment": "Malware payload", "value": "35daac20102fc39160f38318fe83ed84fba1dfb742956e63b2cabc1f630ab7d1", "object_relation": "sha256", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "E98346", "colour": "#6FDB7E", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846458, "uuid": "5863d823-c8d8-48b0-8796-d96292b7e8e5", "comment": "Malware payload", "value": "e4dae121507556215340844f4ae1db5c84f803dc", "object_relation": "sha1", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "E98346", "colour": "#6FDB7E", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846458, "uuid": "c3634bec-af26-4747-8dd6-ab6208b18555", "comment": "Malware payload", "value": "b5b0b044ef80f2e10fc6710c2cb0277a5432fa5d4e4537a22b7ee48e89048d343dd480d23d53d3ed7e64960ef68a9c9e", "object_relation": "sha3-384", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "E98346", "colour": "#6FDB7E", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846458, "uuid": "93cc5f3f-32e4-4047-8209-b9ec86ec6153", "value": "T1B321B52783643CE0F8AF933336E81182B16B0A0E0DD4434B9F40A9793D4EA4CC035B6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846458, "uuid": "6537b91b-0c6e-408d-b0e9-b9f15f11f522", "value": "24:ticEVrCgR9R7qNYYA/RhLYJmmJQ+4kTyt/EbQsYS43Iym8LHKel:4cE17qNYYAjYZJl4kTmCSrYYTVl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654846458, "uuid": "2a7d9d23-ce31-4575-8ae5-f58d05ddfde6", "value": 1112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654846458, "uuid": "7939c3b4-b909-4aab-a424-f4a258ef3287", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846458, "uuid": "0ce86b37-2637-4e17-88e9-8bff1b723a58", "value": "F2110872171.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cde7cec2-e893-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654848205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654848205, "uuid": "0cb51cb5-172b-4895-9eae-ebb1f2ab713c", "comment": "Malware payload", "value": "062af6bbcb73287c1d0746415cc64fcf", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654848205, "uuid": "40764b19-d1c2-4eb7-92a8-7aeb69cb1b15", "comment": "Malware payload", "value": "370f2ad9ef6d2637af4ed836a497970b459a2c40bfd6acb860442db6fa59f9fc", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654848205, "uuid": "711dae77-21e7-4fd2-9cbb-ec2630783672", "comment": "Malware payload", "value": "1ff33b5d09f408b474f3255d8287e6561864e4a5", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654848205, "uuid": "094ed18f-767e-477f-afc5-2afd2b59c0b6", "comment": "Malware payload", "value": "5e0bcbfea6b8d79297f9bfe4de46d8b383dc01452e9df29124978656b62be2ca818042719bd654d26ae71e676b4841bd", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654848205, "uuid": "93c61723-8030-44b8-bd39-919941e16e03", "value": "T13784239DFF020F27F92FAD302E4165AC7828EE409B564D05E3747E8B62BA791514E63C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654848205, "uuid": "886e6390-8589-4727-a588-834cf521b9e7", "value": "6144:CYT1QpeaVvudruMDsLZ55YKTXufNS1dSHq/hH4RsEogDdSgWea6BhhGV7CWR:7RQpeaVvudiMDsF5VYNS1czflDF/9vhg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654848205, "uuid": "f6c9471c-bf89-4530-b806-3a92b1c478cd", "value": 388760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654848205, "uuid": "0362d9fe-83ad-4cb5-9387-105216685799", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654848205, "uuid": "373e905e-100a-4ea3-bdd3-08c64003bf64", "value": "LUX_SCMTON24549599456453564545545342676 .xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19373452-e8c8-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654870665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654870665, "uuid": "01535a4a-f90c-4f5c-9d09-90efed312f3f", "comment": "Malware payload", "value": "1a79d44b6ea79decefeb5a0611b0b0b9", "object_relation": "md5", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654870665, "uuid": "ad28224a-aa8b-4439-8fb7-f86c45907978", "comment": "Malware payload", "value": "374d959e0d6faf717ed4528e7b52c1193d5f645e82eb32e6b32b8d142906b231", "object_relation": "sha256", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654870665, "uuid": "1cc0360e-a3b8-4e5a-b3c7-dd1ac1181c62", "comment": "Malware payload", "value": "70697ac7ad57eb689ed9d3e79a3105ea9d2e077a", "object_relation": "sha1", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654870665, "uuid": "00d2014e-6e43-4708-b2f7-21d8ea3047cc", "comment": "Malware payload", "value": "0bd121f88513521dcc15a742bb1856c5c5c0862e19a1571d48c92cc80db80785d6781eefb06c7cbbf6c91319e5640990", "object_relation": "sha3-384", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654870665, "uuid": "93f2be50-e1d6-43b1-8e65-41808e9f4d15", "value": "T171F2F14375EA6826739BE81FA066277B52D6587C7246FCE40B00D9F3F0001567BF22AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654870665, "uuid": "09d2a1ce-feb0-4869-bb90-5db600b7acfa", "value": "768:RNBKEMPn/DVPo3b0/M6OE1vVwuVljCK0OGWgWmX8:rsn/F35OUweljwJMM8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654870665, "uuid": "e0472bcb-eaec-4473-823f-96bd51947ec0", "value": 35870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654870665, "uuid": "1bac0100-0d79-4a99-80b7-d6e4acb75a79", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654870665, "uuid": "e362fa07-ec6d-47b6-86fb-626e26c8cfbc", "value": "01704-24658.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d69ffcc-e8a9-11ec-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1654857438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857438, "uuid": "5743d665-2d53-4e98-bab8-2a34a76c2ce0", "comment": "Malware payload (NanoCore)", "value": "c5ff1231a5ecec6ea602f13f37cd0676", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857438, "uuid": "86aaad74-44e7-43ee-b326-578ce5deaf0d", "comment": "Malware payload (NanoCore)", "value": "37f06a03ca9d8ac7c86ee2b3d7e6ee399aa56b9356caf00f802021f9247ac70f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857438, "uuid": "2ddf7a6c-6d2d-46f4-88f3-56007bd7ec5e", "comment": "Malware payload (NanoCore)", "value": "afb4c7ca0e836bdddf3a31c36e9a95da41f76c15", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857438, "uuid": "74ee24ef-740d-4df4-84c8-00bf29c29a05", "comment": "Malware payload (NanoCore)", "value": "45b556300a78c95fb245883fede0d5da691ee2be3766fd686274f252a2f632aa273f25271f265a2385004296603d49f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857438, "uuid": "64b6c9a0-23eb-4b31-adbd-a41cd8787c75", "value": "T10515CF2C5BF4C623F11D7B37B0190156EAF82507A28EF7062DC6A9F518B7353AE0929D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857438, "uuid": "2ff141e4-a703-486a-8aa6-7d97391e2c60", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857438, "uuid": "742ece7c-d9b3-4c76-907e-f51a63e2b99f", "value": "12288:RipOfjdr5tP85sdd2kqVO6RYj9RzduQiDqaMzHo61jWedzuXzRhjIYT0gW:RPrHP8RvYAYBVdLkqJzH28ulhsYw5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654857438, "uuid": "e198c010-9c5f-4ae9-8132-6ab0341d9eb6", "value": 895488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654857438, "uuid": "c1cef36b-2f47-4bc2-8656-bed85c71a137", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857438, "uuid": "005d8043-37df-4a1b-86f5-fbfaeb6e2629", "value": "c5ff1231a5ecec6ea602f13f37cd0676", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be3147bc-e8d1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654874807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654874807, "uuid": "4ede7e54-e872-4a14-95c2-c42a32eb3a72", "comment": "Malware payload (Heodo)", "value": "c14e8c02d1ce444db89a074e65b85558", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654874807, "uuid": "29499a58-89e7-4ac7-b909-5eaab351235b", "comment": "Malware payload (Heodo)", "value": "37f20536564b46efc68bc1271d8062881416c6502022917318844e360ce54f0f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654874807, "uuid": "73733a73-bfd3-4dbc-8910-2d6e50c57a3a", "comment": "Malware payload (Heodo)", "value": "1253943f5efd31596a738bc49acbacdf69e6cb50", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654874807, "uuid": "abb5e6a5-7142-44b8-b9e5-53443e999eab", "comment": "Malware payload (Heodo)", "value": "d2600d60902328f1352621d2dfede4c8d172b4552562c5eb19ff7285d090ccd1dfc7c73d1ba1c130e4e8a0dc96f69ffe", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654874807, "uuid": "f5409741-a2d2-4dbc-b4d8-84533b5e37d0", "value": "T1A7B4140573F43066D46B4D3C859E1A0FE7E67A074BB5D1CA239082AE3BB364279B9F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654874807, "uuid": "6b4e5186-208e-4615-b0c4-8fb80aa23087", "value": "b71031ac72c27db547b44e7ae017554b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654874807, "uuid": "a6dc523f-76a9-43bb-9f82-e3864536916b", "value": "6144:TkzytaJpnASmmaNGQ7DYMT1atZNtpTKIEHz7LAcKhIepZn6kdRphRUQP7LwW1:oytafAS/aNPwHbTcKeep5h/uQgW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654874807, "uuid": "b2c81d11-b61e-4d20-b4fb-0c155bfd3b20", "value": 504320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654874807, "uuid": "00e98226-f754-44e1-a1ba-619b4bdd454f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654874807, "uuid": "7cdecd9b-d55f-48a1-91d0-0b142ae27e44", "value": "c14e8c02d1ce444db89a074e65b85558", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d460fa18-e86c-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1654831465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654831465, "uuid": "b29dfc3c-4eb4-4955-97bd-b7b806621d0a", "comment": "Malware payload (RedLineStealer)", "value": "d51e686dad822b88ad933c8a4617b1b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654831465, "uuid": "9ff3093a-f8ed-4c8d-8b6b-66f23372cff9", "comment": "Malware payload (RedLineStealer)", "value": "380f198e2d2818ca64f32e37c83958a6b8e4e451010874dacf6d040433b829fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654831465, "uuid": "c660db69-ef4e-4613-9baf-dfc484ead499", "comment": "Malware payload (RedLineStealer)", "value": "1a25b2349b8b71c1962451c4c19655ecefe49431", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654831465, "uuid": "8453c961-badc-4142-aa6d-79e060887209", "comment": "Malware payload (RedLineStealer)", "value": "545bac76dffdb7b4ad237b9cc5ee427d426c04fafd2ea51a62470da11a303b6becb5d125e80c8e86d1fbd355bf33f43d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654831465, "uuid": "ffafe9e1-4815-4157-8e04-a9d87e90fa39", "value": "T13BB52386F359EA62C09D40329A1733B6472BFB5018A8072B7718725E8DF7787FA21275", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654831465, "uuid": "2ed1bf16-24ea-4931-9f65-94e22ce1351d", "value": "7617119cde5afea121182e7cd8e56744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654831465, "uuid": "c1435b7a-4f94-46f4-b405-69de52a5944c", "value": "49152:d71kdgnbOGTOXM+UEjVRYtoO8G6dPyFU2x/DsWBIIhRkoDyB:dJkKOXBKb8G22lbkSyB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654831465, "uuid": "0d569c30-484a-40b0-a91d-3144dfb848a1", "value": 2385408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654831465, "uuid": "2305c5d5-d129-48f9-9636-403692af894d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654831465, "uuid": "b618c075-cedf-4ed9-ba20-32a401b6ae9f", "value": "d51e686dad822b88ad933c8a4617b1b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e564f9f-e8c0-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654867372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654867372, "uuid": "c8ad8e18-56ef-4b9c-b589-dc85b299cfa9", "comment": "Malware payload", "value": "43c843ff5bebb406de09e05d953749ed", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654867372, "uuid": "0327ef26-cd83-4503-b1e9-356958731c7c", "comment": "Malware payload", "value": "384b53b95d242c4fa72c3133e51f895c1a7091e76933fa64a8cde9a3d7b4c3b8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654867372, "uuid": "6164e23d-f2ed-40ec-8c7c-bb0f52006813", "comment": "Malware payload", "value": "13f2d48b9117d8b67bbd470005f9c12ebf28b785", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654867372, "uuid": "90d7b8ec-718a-463c-8611-1b3279eca315", "comment": "Malware payload", "value": "4990f53e3f16d2552ead20b5681b88293273c823151f620d07945ac2cf5a75841765ea0f57ad591ac0f23ddae47d54f8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654867372, "uuid": "d7a95c0d-bcbd-476b-a234-f1d75f22d152", "value": "T1E0759E25F1818437D0372E7C8D0BA2D8A429BA747D38A84776F42F4C9B79F917A252C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654867372, "uuid": "1f937830-9df9-47e4-9269-bc687b973ec5", "value": "1c2dbc3f8a965dc37fc6ca77373dc4d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654867372, "uuid": "cb504028-7423-432a-8bd4-ff07cfad3637", "value": "24576:phVEOY8iSQOmlHQvm/lzr7eC7MrbAMPmoTNwpcYcTqd+iUTup34phDa5/zZ:pHE4hOwu7H83tTNwkTrZTa34plM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654867372, "uuid": "ad019ea8-9b83-4e92-b266-87e52ac194d5", "value": 1563648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654867372, "uuid": "53df36a6-a708-4479-85ff-84b70b61da3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654867372, "uuid": "3a9c9091-d4bd-478a-97ed-4a038550fa9f", "value": "384b53b95d242c4fa72c3133e51f895c1a7091e76933fa64a8cde9a3d7b4c3b8.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93f7e348-e8de-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654880320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654880320, "uuid": "752b3cf0-f695-4335-8ccc-5facc3469fba", "comment": "Malware payload (Mirai)", "value": "c17f0f3df3038c1acdf40da3153bff89", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654880320, "uuid": "86cb10e7-6e13-43b5-8e21-2c84648580de", "comment": "Malware payload (Mirai)", "value": "39cf7512bb4a49f7e6840c20f445a0c94ef4511cfb42fdcd791e72b6432395f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654880320, "uuid": "ea0410f0-bfa3-4512-ad2f-03c36e329f75", "comment": "Malware payload (Mirai)", "value": "9a3e47649f09b7dd2664fd3764252defe65c05df", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654880320, "uuid": "c4055818-e617-4ba0-9c35-df9201a0bd05", "comment": "Malware payload (Mirai)", "value": "0f22152ce903cebab92a75aa495680937e4b2e0b173ee36bcc6f7817278296762aceba47220c8ffb700b9a39a8812dd4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654880320, "uuid": "0e1871e0-bdb8-44e5-8402-950dc335b839", "value": "T13A032A5AD113C9F1E90B81B02157EB79E736ED3260A1CC1EE7C57972EC31A82D60A35E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654880320, "uuid": "725d4fe1-c72c-41f7-8879-818a5889b193", "value": "768:gJzqYuyAGqXOzQVcbhrGE/2rBA4dWWu+fLuEUNF5lx2oC++:gJzq0JGxBA4UWu5N2F+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654880320, "uuid": "4f3e053c-cc93-487f-8b24-6a192cfe8de3", "value": 38652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654880320, "uuid": "face035b-70cc-4de6-a33f-2da1b8e22fa5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654880320, "uuid": "1b07c10b-da17-423e-a240-5aa94ff902d1", "value": "c17f0f3df3038c1acdf40da3153bff89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97b08a47-e905-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654897077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654897077, "uuid": "9dcd8fb6-a1c3-4815-b8b1-1926a60cde17", "comment": "Malware payload", "value": "a7adb05e8dbcb9469ab08003725d0988", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654897077, "uuid": "cb51c3c1-c980-4b10-8994-40e5358ee54b", "comment": "Malware payload", "value": "3a64c86b54f124af888876b5b8bd372e82334f31664917b3e9c754c9af3a4d69", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654897077, "uuid": "7cccb417-48ef-4e48-8e53-86d49c7b488f", "comment": "Malware payload", "value": "351e644d6ae2724ba933706e6003a1d9609b2f25", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654897077, "uuid": "2539e692-51d4-4821-9b7b-3c75a9a6c1c6", "comment": "Malware payload", "value": "a3ad4990badc4872bfc88d69ab597a9eca0f0a1fbc3c15130c5c41c12f77cf7e72ef9800e2b9a05cb942defc5a56e4d2", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654897077, "uuid": "46afad5d-d859-48f0-b0eb-af7c33463461", "value": "T17195337A094244AEC39F992B3B8C5D1F146A23DCB58CBC16CE219DF92C813A6FCD1725", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654897077, "uuid": "c449471b-aaef-40be-8a2f-e1f43f7de112", "value": "49152:wIJaC1o2LPPInSYLNs7yKn9D6RvllZZyUOJuJwNt:TG2L3IEnhUvlxOuJwNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654897077, "uuid": "5b991369-060d-4a0d-b4a9-6fe19e0fdf35", "value": 1986825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654897077, "uuid": "77a10a57-ff65-4c2d-be10-2a7ebc081260", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654897077, "uuid": "5e7aeb07-cf1c-4967-904d-19eaa4004d2c", "value": "pastagentile,file,08.06.22.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2750fc16-e911-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654902042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654902042, "uuid": "865a13aa-cc00-4eba-94b0-33bf1d468a69", "comment": "Malware payload", "value": "310107176f7c8142ea983fe84a129cf7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654902042, "uuid": "4432a241-81e9-4431-8c69-4218a42571f9", "comment": "Malware payload", "value": "3abd701cb64b3f75dda3fa43f4fe697ab535ad37d77293439b946949a3f3af08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654902042, "uuid": "513e2393-bb4d-4765-b64e-985f27fb1b3b", "comment": "Malware payload", "value": "e0050f1e86a9cfe50e474ace2af07a486f1abe38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654902042, "uuid": "c2405e2b-4012-4266-a345-31c624cd492f", "comment": "Malware payload", "value": "fb37faa7afe0633bfe41bba7ba4ed2f781c2a4eec3d33519e3eac6694123c4ee1cbbfb3f649cb632426bdefcb3e5e55c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654902042, "uuid": "8fd17d3e-3ca1-440a-82aa-5215eb88b559", "value": "T17DB4140573F43066D46B4D3C859E1A0FE7E67A074BB5D1CA239082AE3BB364279B9F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654902042, "uuid": "0420d5a2-1d38-4721-9e29-5f92f94e922d", "value": "b71031ac72c27db547b44e7ae017554b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654902042, "uuid": "f2e9863d-29d0-458e-aa73-f248bd1c0100", "value": "6144:TkzytaJpnASmmaNGQ7DYMT1atZNtpTKIEHzFLAcKhIepZn6kdRphRUQP7LwW1:oytafAS/aNPwHbxcKeep5h/uQgW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654902042, "uuid": "edcd66fe-7d4c-415e-8a04-db1546bdb5c5", "value": 504320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654902042, "uuid": "dd4b6771-2831-4e8a-ae61-6839d024b97e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654902042, "uuid": "f09f61d5-67b3-4415-a614-4fcef5a73257", "value": "310107176f7c8142ea983fe84a129cf7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10395c8d-e8be-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654866355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654866355, "uuid": "eaddf52d-a216-4255-884c-5e63b1e6b977", "comment": "Malware payload (Mirai)", "value": "d783a1ed0e6421d7f294c36697fe8682", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654866355, "uuid": "6ee8a35d-f603-4d7e-be87-b8a248576837", "comment": "Malware payload (Mirai)", "value": "3b08bbd9cd81b5aa3df764a9ac7dac8e5dd449ba5e99f946a217227ceca0c94c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654866355, "uuid": "65557bcf-7ad3-4cfe-b34b-d999c7022dbc", "comment": "Malware payload (Mirai)", "value": "254f8ba0cc6e6fc2b93a1bcca6dae3342c58874e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654866355, "uuid": "b92e66a4-96ab-4a77-82f1-01b988b39934", "comment": "Malware payload (Mirai)", "value": "73fe6b7c838de12d5d1f5fd5f5e0ed2b02e290ee27e91571d9182e2e8787bcbe344ca96eb4c1d9d7029be13bc010fb0d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654866355, "uuid": "d1a5a0d4-6d86-49d5-a496-b8c73b9ae0e6", "value": "T114733925BD7A2D17C0D5AA3B12F74754B2F2634B35E4C60E7D620E4EBF20940A2636F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654866355, "uuid": "2ad0edf9-b4bc-435a-8571-32b9099ec962", "value": "1536:dKQ40gc+VN/veP54uHEf1HpQIg2/Lx6UOSYmHYi:oQsxVqDEVqIhFX1Yi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654866355, "uuid": "2a62f65a-fd9b-4f1a-bf31-81d275ed0547", "value": 75236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654866355, "uuid": "6b514a06-e7b5-42c4-bd59-cf62e273f15e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654866355, "uuid": "2fceea06-06db-425e-a37c-2ef838e5f4f9", "value": "d783a1ed0e6421d7f294c36697fe8682", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd51b2f9-e907-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654897999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654897999, "uuid": "50cea175-f082-43c2-88c2-36d99448301f", "comment": "Malware payload", "value": "a5fb2d5af29dfab036fab2d213755f2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654897999, "uuid": "40f82b68-26ee-4ca5-b112-be525def4afa", "comment": "Malware payload", "value": "3e33d882e1456f1463302241f621def5665d12c65ae8cefcf175c3b3340b9d70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654897999, "uuid": "a527f805-9c7f-4105-9d80-95944995e39a", "comment": "Malware payload", "value": "ed757931ba362c8db6016033876bfa8051a71183", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654897999, "uuid": "7d12a6b1-f8da-4729-9c7c-7cd983fb90ac", "comment": "Malware payload", "value": "eef86f42c23c16504fe6494de108e67a359fbf7a741630fda672f3ba4f77227b7a9f8d16c9d41b105c1f24de2d3bec6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654897999, "uuid": "3f6b27d5-4063-490a-903c-f26fd0575de5", "value": "T1E0B4154533F4306AD8678D7C849E0A0FD7E17A174FB1D28A135086AE3BB36527AB9F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654897999, "uuid": "cd613bd9-d0ba-46f3-93e7-825997443ad3", "value": "b71031ac72c27db547b44e7ae017554b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654897999, "uuid": "bffbf2eb-c66a-4ff3-ab65-63bc5d167dc1", "value": "12288:fytPfASAuSvQnbfHorHDKGwC4ZTJxlGRS:fy9fASOvQjoTDw3XC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654897999, "uuid": "77105e7b-7e16-4f14-853b-5020706fba42", "value": 508416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654897999, "uuid": "706f1fdc-0886-4da3-ae81-e1dd96d16ab8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654897999, "uuid": "7958940b-9c3b-4e51-8cc2-f67c938a3a37", "value": "a5fb2d5af29dfab036fab2d213755f2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a330e0e-e8a5-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1654855608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654855608, "uuid": "3b64422c-f01e-4e5f-b026-9629bb968758", "comment": "Malware payload (RedLineStealer)", "value": "7b6cb8f97a9a8dc9d43b1a95a9b91352", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654855608, "uuid": "0a90be79-1b15-4135-9d20-0a23644d8fa5", "comment": "Malware payload (RedLineStealer)", "value": "3e3cd5951635f21acb757dbe35eb86d5dc07aa373f19e63a66aa7408e7be36ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654855608, "uuid": "2350eaae-8290-45bc-9736-80668ff3464c", "comment": "Malware payload (RedLineStealer)", "value": "8b3a7c5158eba71a0db7e381f72fc2d5a103e060", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654855608, "uuid": "33384daf-24e6-4da2-92b7-48ca851277bc", "comment": "Malware payload (RedLineStealer)", "value": "6d5565cfe37ad1112e8a9b9fffba41be4666f3d69d3ee3c00ef5621ec2536a2a1b9eacee2763d1ccd12a0696beba2638", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654855608, "uuid": "1fc32ddc-efc0-43ae-a933-fc404ace3b30", "value": "T19E14BF1073E2C4B1F0A2183048B0DB61DBBB74B152355A9B37B81B3E1FB63915BB9396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654855608, "uuid": "46d3e691-108c-47db-a72d-adbcd2d89e91", "value": "485e95e552d1f7ecd08990de492f0040", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654855608, "uuid": "e760ce58-4a00-4587-9dd8-b6151f14efa1", "value": "3072:ZtbDX4BezcJySvBNNPUo5zSmE0MWIlWD3PtiIu9:z34sQlzN5ZRDIlWD3VRu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654855608, "uuid": "1386fcb7-62b1-4dae-bf19-604d37bf9514", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654855608, "uuid": "d76cc453-fa4d-41c6-9d8a-e09ff53fd865", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654855608, "uuid": "5400d80a-65b9-450d-9235-b34033526aac", "value": "7b6cb8f97a9a8dc9d43b1a95a9b91352.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "445d9634-e901-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654895219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654895219, "uuid": "b2581bda-704d-4c41-b589-67fae66d5b47", "comment": "Malware payload (Mirai)", "value": "e37ad00e41fa64510fcacccdb9193b89", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654895219, "uuid": "2c5bb8a5-31a2-4f32-9f00-0b07ce8b34c1", "comment": "Malware payload (Mirai)", "value": "3ef3f385b6852d2f517fce9f626e59bae4c418ffe9dd915773279aebedd3b10c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654895219, "uuid": "1a279cf4-e7fe-47cd-b2d6-bac6d61014ab", "comment": "Malware payload (Mirai)", "value": "564a01d9b92bdaa8c22574637a757dd9dbad279a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654895219, "uuid": "16362b1a-9a67-4a5a-a2b8-b8d05026d7dd", "comment": "Malware payload (Mirai)", "value": "f09dfecf8c8c66280a2a47468441a2248439aa63e3add9d295b1cd627decf40ac1f32d76117a113f8c1f53a710080852", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654895219, "uuid": "ee39a830-2b7e-4896-995a-37a419080d0d", "value": "T195632A967401AD7DFD9BF2BAC0260E09BC2072A065632B27A767FD937D721E5DC05D02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654895219, "uuid": "1997641e-77c0-43bf-97f3-96acad104db5", "value": "768:oehcFvxpr1WffBZTGr702OS4+f1pruHewNlQtcnQ81PR0iL11RPP3ieEFyGvJyeR:o7B709/g1pSHewfa4Q81PZ11RPvieKRZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654895219, "uuid": "dae76af3-f045-4912-b2b0-ab4d601fad2f", "value": 68320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654895219, "uuid": "d44e7489-7c26-4980-bb77-1178fdde2997", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654895219, "uuid": "e83e1181-50f3-44c4-9451-f1d68a205ae2", "value": "e37ad00e41fa64510fcacccdb9193b89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3d10dbf-e8e1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654881662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654881662, "uuid": "c75f8a31-d1bd-4d1c-b437-c4af7d57ea98", "comment": "Malware payload (Mirai)", "value": "46f9dc97baafa797a8fb849ab7c6b3d2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654881662, "uuid": "65a93668-e741-479b-bd91-5fde04b4baf8", "comment": "Malware payload (Mirai)", "value": "3f57076ae00854fb3c2c3e78479b1863b80bf7546a8ff7bea03a0963535482d4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654881662, "uuid": "ea47fbcb-49d1-4c18-8a0f-48483e33643a", "comment": "Malware payload (Mirai)", "value": "747ad88f0cd7bade20ac6ef7f15f8ccdc3ef1361", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654881662, "uuid": "04fe95fd-0c2b-475c-ad28-7dd9355b996d", "comment": "Malware payload (Mirai)", "value": "77679df076a5c787eec30f6464dee23e125493d1df9cb8dbdb43f713414cca07166f6a824aca715e13d0926df6f007ef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654881662, "uuid": "d2f93b2e-2b6f-4ab0-b5d8-906dd2bc2a6d", "value": "T131D2E124201E59B4E2607CB29BECC58652934F7CE2E8F8372859233C94CA95E5CFDED5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654881662, "uuid": "5dd1c0f1-80d8-4efe-bf4c-92b3c13fc5b6", "value": "768:aYzbhTnlIm0SUIbPWYpnX2f0nuE5s3UozTq:zzbhTniwnGf0nu/zO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654881662, "uuid": "367b05b4-fc50-43a9-9564-7081721e68a2", "value": 28408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654881662, "uuid": "5f702768-eecf-4dd1-b82a-feadb520cf8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654881662, "uuid": "181064cf-0275-4f68-81e1-47ad17608c9a", "value": "46f9dc97baafa797a8fb849ab7c6b3d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ad2cfc7-e891-11ec-93bb-42010a9c0043", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1654847126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847126, "uuid": "a808ecef-fa86-4cfc-a24d-d46d4f8019ac", "comment": "Malware payload (ArkeiStealer)", "value": "ac229ca9b15901ecc49eb4ba18f49898", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847126, "uuid": "0d2b3a64-1ee0-4fe8-9b4b-ce83cac93e57", "comment": "Malware payload (ArkeiStealer)", "value": "40044510039d6edd419bc8831bf81c6be40b81bce9851fb0790ad208b602c93c", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847126, "uuid": "36b24904-0113-46cb-b6e3-1fbda310c1d9", "comment": "Malware payload (ArkeiStealer)", "value": "aaa86a6678c43a977530b5d6b40c40cfa54fb419", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847126, "uuid": "949fbd27-fd5b-4e7c-81fb-cc06ebcf8d7e", "comment": "Malware payload (ArkeiStealer)", "value": "5ccd11cc26ca79d0ab1da9388f450c3678e4be79fbf84df6c39c787ac4289d568925dac94f2babd84b844d4363614840", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847126, "uuid": "d143e38d-575d-4b36-bc01-25d9f66ed3ea", "value": "T14D063363B341D2B4FE1E54F790281A7BB78AA12C758893D612EE331B5BE0730ED6554C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847126, "uuid": "9c082446-6f9c-4fd0-87b7-aca62d3e44a0", "value": "79b3362178937bf9559741c46bb9e035", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847126, "uuid": "5a68fe04-2362-4254-b935-9a72e4f2717b", "value": "49152:zfzv4Mvu6jM4WYzWPob8G+ky3K9hi1lL62Nikuze4bd8M/0kVJU3US/SMLaZN3Lk:zc0u6HWYz9b8GinX14BDUkS8m9gm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654847126, "uuid": "adc2909d-e88f-4922-bb6c-dc4d43d8c660", "value": 3944448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654847126, "uuid": "616ea564-8f81-4074-ac88-47a15a01ce11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847126, "uuid": "91c94650-304a-4052-af26-b444d0360885", "value": "40044510039d6edd419bc8831bf81c6be40b81bce9851fb0790ad208b602c93c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "541db620-e891-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654847142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847142, "uuid": "7816aa69-351b-497c-87df-a3b763b84858", "comment": "Malware payload", "value": "b05e8fe9d27fd26a18f77ff91669f6bc", "object_relation": "md5", "Tag": [ { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847142, "uuid": "f60a993d-44bc-4509-9cb1-e63489ec7890", "comment": "Malware payload", "value": "407bafad1aebe07abd775d8c6ed49761fd22065238631518136da07640f113e8", "object_relation": "sha256", "Tag": [ { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847142, "uuid": "c8ead069-4661-4dea-813c-970e130479fb", "comment": "Malware payload", "value": "7585054f623eb6fa7e2ee9d95caa4017b4e4ff80", "object_relation": "sha1", "Tag": [ { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847142, "uuid": "3a0216b9-3b41-422b-833a-d4580d29eb4c", "comment": "Malware payload", "value": "6a5ddc3c5e6d690888622943fe1bbe9c18a8b840578048651b26f289d79385fda5033e218a1e3ae4ac0f0da058bbc887", "object_relation": "sha3-384", "Tag": [ { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847142, "uuid": "43987b29-935b-44a1-9331-436bfa1073bd", "value": "T15231297F08486B7E1117B103ECDC9C29A3F3A236365C338C1918E8FD296678A3D36001", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847142, "uuid": "1c1bcb70-3da7-4edf-8ce1-ea5e91b57e44", "value": "24:xXr28Kw4EmykmD2C5uoSdD05iAIId6P2v3SnhtIQpbJ/RuUEt7aeiPRGIRCK/1vj:128KkmE5UD0QAIY6P2PSMQpbJ/kmo81L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654847142, "uuid": "9faca832-6343-4392-beca-17feeba6da14", "value": 1529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654847142, "uuid": "05945ccd-5a39-4221-82bf-8ef97951c170", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847142, "uuid": "244a4577-91b5-403c-941f-87c6c25576f3", "value": "endofline.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce4f85cb-e86c-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654831455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654831455, "uuid": "2d037b4a-8df6-4371-960b-b186b8306882", "comment": "Malware payload", "value": "654cdcbcb0eb566c0871dc39ee7ef6c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654831455, "uuid": "fe89bbe8-2831-4680-b09a-8181e0b6b3d5", "comment": "Malware payload", "value": "4159e2b4279685b57b9e13d3a58a2dbc933261fcf8116d5ac3b76485e843b411", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654831455, "uuid": "4c7c9996-7817-40a9-bb74-6a56633bdaa7", "comment": "Malware payload", "value": "53f5f2340f3c621a03ecf2910af7db59a943682c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654831455, "uuid": "b49f8230-7573-4e11-bf99-6ab66aff1318", "comment": "Malware payload", "value": "1800219f6ad8c596e423be87ea69112dca4217a89c5d3a345998b0d1a29a645a39f2c6e841b4191c9f179679e060ada6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654831455, "uuid": "238de695-e06e-457c-8310-51e1e99cbf77", "value": "T1694612BD104C3758C41A8C345123FC75A2BA6D1D1BFC8A9AB5EEBAC07BFB450A605F52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654831455, "uuid": "990b9f2b-5ea5-45a6-8cc4-82e71abcbc5a", "value": "c746d534ad9ccd55c1e8619db5329a06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654831455, "uuid": "d1669a3c-57c7-4955-876d-735b027465d6", "value": "98304:nJj7A+tl0ohAmiaTTD/efixvuIeBW47cQC08OxDjK+yvaouD:J3AA0ohlNPKfqvaBtZC088jT5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654831455, "uuid": "83d4bfb1-1da3-4307-a92f-b371ad22eb86", "value": 5553776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654831455, "uuid": "5b3a6186-ba4c-4426-b37c-c5303efd91fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654831455, "uuid": "7ef043a5-85b8-4c6d-94b1-4207e62a817b", "value": "654cdcbcb0eb566c0871dc39ee7ef6c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b935e833-e8cb-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654872222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654872222, "uuid": "4362f630-2457-4664-a2d4-34e7d383c7fb", "comment": "Malware payload (Heodo)", "value": "28954777b3352a49c0de90df01541c01", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654872222, "uuid": "d2fd83a6-492f-4704-a2e0-6c2ff35398f2", "comment": "Malware payload (Heodo)", "value": "41eda5c1bc224afab921220c1d73a11bc5cb6120c43f01b7db4660bf19137435", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654872222, "uuid": "0413fbab-6ec5-4b3a-bf22-bfa693af9bf5", "comment": "Malware payload (Heodo)", "value": "a5c717af41566d597b562ce92fb2035bf10a0ddc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654872222, "uuid": "b2e9be7c-5384-47d7-a86e-53d1e92002ef", "comment": "Malware payload (Heodo)", "value": "83c2c25010e41aea7664623258c0a21b728c44304f5276b5b4755ad1d057a45967afc324e1025b46bd87d85a54b6335b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654872222, "uuid": "4ec7ab5f-25b9-4533-8054-297ce676ef66", "value": "T103B4140573F43066D46B4D3C859E1A0FE7E67A074BB5D1CA239082AE3BB364279B9F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654872222, "uuid": "dfe12afb-c53b-4a8c-a56a-989ff6d1b297", "value": "b71031ac72c27db547b44e7ae017554b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654872222, "uuid": "3bccfcde-5d03-448c-9c1f-6d875ac62a46", "value": "6144:TkzytaJpnASmmaNGQ7DYMT1atZNtpTKIEHzKLAcKhIepZn6kdRphRUQP7LwW1:oytafAS/aNPwHbucKeep5h/uQgW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654872222, "uuid": "a0f8bde7-b24c-4941-bc4f-7bc21f9200cc", "value": 504320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654872222, "uuid": "cbb3db49-6a7b-413a-8fc2-f7ccb6ced8d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654872222, "uuid": "2ef0a00d-acc4-4e31-99e8-961662be585d", "value": "emotetpacked.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e02fd61d-e8a7-11ec-93bb-42010a9c0043", "comment": "Malware payload (XFilesStealer)", "timestamp": 1654856826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654856826, "uuid": "cddc065e-3d82-4d94-b0bb-c3b512753511", "comment": "Malware payload (XFilesStealer)", "value": "3fb026129d425126ea7558f0e6be6e3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654856826, "uuid": "b8a2b88e-3fe4-4366-bd86-43251a443056", "comment": "Malware payload (XFilesStealer)", "value": "41fd0e6b9ec7720f147319b5b3b92108cb96923608dde51224925e0133e71d6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654856826, "uuid": "99deb59f-7d99-4710-b374-3c0ac8debeb6", "comment": "Malware payload (XFilesStealer)", "value": "6a98f3e150e1d02de98dd794bc76dc1cd6a3b7d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654856826, "uuid": "cc3550cb-4396-4552-b4c9-92ca8db2885b", "comment": "Malware payload (XFilesStealer)", "value": "2d7509cca9b19bdd23ca08047131f75a82865a71ef519703852553fb0e0631705ad98b2926f166869c806a2275706ea1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654856826, "uuid": "873c838e-b42d-4bb1-9265-445fa61dd12e", "value": "T12993DAC49604F275E83A9733FC01ABF01D152D8FEA061347AABABF7535B950E29094F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654856826, "uuid": "91f4a017-0051-4733-9b61-1a913dea3b31", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654856826, "uuid": "2ff599b2-6742-45d8-9dcf-5839d63128ca", "value": "384:Y7BkBxrt10i/QHKQdKLMHgCsedTufKcD8XObCi9/dtFpJYzM4is5+DrrhijqvVx6:Y7BkDt1nqrACfdTnqrKqNx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654856826, "uuid": "03049cd0-8606-4261-bd54-fd75fa7c19bb", "value": 95312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654856826, "uuid": "13488129-601f-41d1-84e6-881df93000ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654856826, "uuid": "d6aff260-6ec3-470d-a643-3559b1e467cf", "value": "ChimLacUpdate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fdd78b1-e8b1-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1654860932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654860932, "uuid": "fb58296f-3c0a-4e40-a345-778a223d1bf9", "comment": "Malware payload (SnakeKeylogger)", "value": "ada1eb8ad365bed0eccd652cb175c800", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654860932, "uuid": "65a07ad5-5f89-4172-8d2e-1e009e19eb19", "comment": "Malware payload (SnakeKeylogger)", "value": "423b683ed8208298d93ae5e27a9b0c016ccee6ab81dbbcbe3ea83a157da03d7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654860932, "uuid": "65fb7241-542b-49de-ba51-f9537d7bb665", "comment": "Malware payload (SnakeKeylogger)", "value": "cdb5f07ec18bedc9fdf1d66c7dcdb570070116c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654860932, "uuid": "08a5635b-5774-4b05-97c3-2d5156d09663", "comment": "Malware payload (SnakeKeylogger)", "value": "b15c65bb5e82da3def50e7514eb09692e62fe94ccc4c4e57b64695c382717930b55191caf121d971c398f847d5f0a405", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654860932, "uuid": "c762406d-9e70-4a76-b019-18b39c0c8b77", "value": "T10BC26C6DD2E8861CE0A103F2C8B7437446291B196C93F2AF6ED464273B753F5CB25EA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654860932, "uuid": "654954e2-fe68-4c5f-8384-d6b0a2101936", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654860932, "uuid": "01027126-2aba-49aa-b8f5-81cd18479368", "value": "384:MXOWvhIkA8HyKdMZzfZeEBiGeksNs0RkMOOOOOOO4x+87qQq777778yXAtyP:huW4wZzBeFGeko/RJOOOOOOOGGwtI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654860932, "uuid": "01c87de3-d703-4fd9-b087-cbabba4fdc4b", "value": 27648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654860932, "uuid": "2666e8c9-f4ca-4708-94df-b34b3912a015", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654860932, "uuid": "817087f7-330b-4d6d-adc9-ae8c7559183e", "value": "854F1E97-5DBB-4A87-A566-33D9012B05E2.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc7f104f-e8a3-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654855074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654855074, "uuid": "cb90b231-d66a-4cd5-9e2a-4786ac454783", "comment": "Malware payload", "value": "202f3ef0fcef079d13128b558fbe832c", "object_relation": "md5", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654855074, "uuid": "357e18bd-fdf2-48f4-aaf7-31d7332f6114", "comment": "Malware payload", "value": "44579571fdb3e5063047a4c54cacdb24c2c0b54e1216bc6893cc918218bf06d1", "object_relation": "sha256", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654855074, "uuid": "7607335f-85b3-444c-98f0-5a8dd937ae51", "comment": "Malware payload", "value": "c8d0d2404a83b5e8009b4c70ba2823f344e6b087", "object_relation": "sha1", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654855074, "uuid": "867a930b-d943-4ba7-a35a-9a82689d64e8", "comment": "Malware payload", "value": "69555056499c69de113654cd34bac4d900d50a70c1056c53d6ace341d665565aa1d05fc23d2ed76542990a1dfbdf97dd", "object_relation": "sha3-384", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654855074, "uuid": "01d4e8f5-0d48-4eeb-b0c0-f2cb28fa3101", "value": "T1A9F20279D27B5B99AF884530723E7BD88F44E41778E3ACF4A1C486678D6E2212D131F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654855074, "uuid": "7513d8a7-531c-491b-9d27-be04fecd0076", "value": "768:tetbhTjLbvIpg4DEZ9qBnQ2bpKkYuBLeXQoUkErHw:kRLDIpg4DEZmnpKkYpF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654855074, "uuid": "0964a806-2ee1-47af-b484-27e6e534ddc4", "value": 35874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654855074, "uuid": "57863625-b33a-463c-80b0-76f4202c0bb6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654855074, "uuid": "b75cca3e-f556-4d10-8d2b-91487342e829", "value": "0111 10062022.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a04b04e-e8e1-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654881458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654881458, "uuid": "08237433-1c67-4596-b902-fd3c69de19a1", "comment": "Malware payload (AgentTesla)", "value": "a7388866c604fef00f22fc11ee8ad67f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654881458, "uuid": "06528e00-643c-41b0-9a82-5814f7b7bf3f", "comment": "Malware payload (AgentTesla)", "value": "44bdc4600a8e090f0cebe74116e4261bb074011e3f3c9a12bbc4eedb55a71a66", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654881458, "uuid": "dee5b568-a8e8-40f4-aba4-5311c1d1141b", "comment": "Malware payload (AgentTesla)", "value": "c5ee59b6f2e7e9bd434b1357c4c859fca4e9dffd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654881458, "uuid": "fd6d2e9f-ef7c-4eb4-8146-b95568f3e0cb", "comment": "Malware payload (AgentTesla)", "value": "9f1bdf830b8bcfe9116e1fcff947ab37f0ded9d912225c621133e3c2dc413fc896ee3dcff244bf10173376fa62db89d4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654881458, "uuid": "f55169ca-e30f-4d21-8d3a-9843075a71da", "value": "T186C48D36366CBFA1E53ED77C90A1441183F0990FF712E54A7DEB24CF6835B4143A2A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654881458, "uuid": "f0e4f738-802d-47c6-a81f-95d2e89a82f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654881458, "uuid": "7e2009d3-94c3-460f-9863-949c565e8419", "value": "12288:SWcmWMkKhLuyAH8iTOEjK7b61c6P1cT0Az48J:SeWIhLuyyVTzjKLz/J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654881458, "uuid": "8945ba01-fd7d-49e4-ab6d-7e07621493e6", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654881458, "uuid": "16a332f3-be0d-48ca-915a-8d377f0b054c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654881458, "uuid": "dabc0837-ae88-47b9-817e-1b805bb83ab2", "value": "Shipping Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44fad5d7-e874-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654834661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654834661, "uuid": "3f9b1781-2bc2-4f43-88f7-b2b41e7b0a7e", "comment": "Malware payload (AgentTesla)", "value": "69d4b073917681f6b2296490ce2e47b1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654834661, "uuid": "01415882-2c21-4b65-aaee-c6e159de0472", "comment": "Malware payload (AgentTesla)", "value": "452d2e5f7a65fcc801b79ed05c99196b7ddb345e19145d0b035c806ee0504c95", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654834661, "uuid": "de04692d-5aa1-48db-b1df-ddf7e1364749", "comment": "Malware payload (AgentTesla)", "value": "9f2ac04e58582120d34d9b51a0a8db6b852b7650", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654834661, "uuid": "b9a6316a-ab8c-45ec-9a78-5c6730be9ea4", "comment": "Malware payload (AgentTesla)", "value": "8ac29d3940d04e71574ab3cd01ac5723b679316438c2f90e1fddd9711f466ac4d401d6a85ed198a53ad88a9e69d06a2f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654834661, "uuid": "dafd9152-3f70-4b3e-96a5-ff12acdb6b15", "value": "T1C0A49C2127AC6FA2D67ADBB801A1810007F1945FFB63E52A7EF708DE5445F0146B3B7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654834661, "uuid": "a79eddaf-b2c3-45b7-80ec-d669d7d98637", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654834661, "uuid": "a9176e4b-396a-4b03-8d91-16e28b1476e9", "value": "6144:dC9mW2Wi1VX0+eugpozlzWbSHHwL7yevO2eI+6pysh4oog2dAU2M:c9m11hDzl8SHHwdvO2eeh4oo9AUX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654834661, "uuid": "7eaa0b32-2f2b-4279-ad71-cb16d9761213", "value": 464384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654834661, "uuid": "3657d909-9b4c-4bea-815d-861f8b689733", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654834661, "uuid": "e735fd2a-41d1-4e9d-b982-28a86cb5f83d", "value": "QUOTE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a168ada3-e8b3-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654861874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861874, "uuid": "eda48367-2722-462d-8925-6d14aa8b9a65", "comment": "Malware payload (Formbook)", "value": "0fee9201baf24e3591dec5658e622fa7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861874, "uuid": "87f6a2f3-2cb1-49c3-b095-91faa37ac7c4", "comment": "Malware payload (Formbook)", "value": "45a4bc647e6470eff9500761231b09f037f326d5495b1261bf28f6fdb8bf6249", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861874, "uuid": "f45e88f5-6f89-4a52-961a-4a42271cded8", "comment": "Malware payload (Formbook)", "value": "eef524c46a7dc1f6446706a5e0d4e1ec1c206eca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861874, "uuid": "8702934a-1f27-4e9d-a8d1-4b3e57bd5b93", "comment": "Malware payload (Formbook)", "value": "5f9f8939939d199aba16ea32d3dd4fce298b09104f0308966d30a15fa18c9009e3869f3e2ae2aaff2068b348c3d004ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654861874, "uuid": "29ca82ae-9990-45fc-994e-0d6c2a259788", "value": "T1A1E4F02A3502E54EC05A4A33C9DA6D1453A2AE57172BD74B70C7338E9D1F3EF8E0A1D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654861874, "uuid": "a5fe1dfa-3630-4363-839c-9be6885d8b33", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654861874, "uuid": "2b57a7bb-6a78-402c-8f6f-86db7a819b29", "value": "12288:okMzVN6z9qaemEW16BZrVjdbXXJ4I4sRl8iVzuKYiDaP5:okM4pe+0BZpjRxRlR0sQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654861874, "uuid": "c6a5037d-89b6-4e5a-99e3-eddc8a1a2eb0", "value": 698880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654861874, "uuid": "1250af5f-af8f-42e5-bbdf-20722818adcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654861874, "uuid": "1fa0b131-8c33-4a15-b838-4ec00dbdb9a3", "value": "Arrival Notice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0398682-e918-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654905386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654905386, "uuid": "e45dbc38-fccd-4c58-b90b-d9cb456ab74a", "comment": "Malware payload", "value": "b3ef79ccf4dc96c563f4b5254d3e19f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654905386, "uuid": "c0743e46-6b1a-4c24-8e0e-c693e6e84365", "comment": "Malware payload", "value": "45b64db6c0771a978cefa3a3daf18b8ad777a2084773f027a1cd33abc4d6d918", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654905386, "uuid": "003f063e-7dae-4827-b7de-90482372688f", "comment": "Malware payload", "value": "e33b199e1cb4e26773232cc18ef35fc1a37766af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654905386, "uuid": "eb752a64-0d22-4802-9a3e-a8bba193899a", "comment": "Malware payload", "value": "91a85571240435c3a315bc7695e1eb7ab55463b4210a5f1d6e6207773e207408ff873dd91e55a3a9d091d88892942f87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654905386, "uuid": "285955b8-6f6a-46a9-a5f4-279a1719679a", "value": "T1BEB4140573F43066D46B4D3C849E1A0FE7E67A074BB5D1CA239082AE3BB364279B9F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654905386, "uuid": "16494c76-968b-4aa0-8b2b-ca139430056b", "value": "b71031ac72c27db547b44e7ae017554b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654905386, "uuid": "ca5f518c-9843-4e41-b86a-c81eaf7e1433", "value": "6144:TkzytaJpnASmmaNGQ7DYMT1atZNtpTKIEHzbLAcKhIepZn6kdRphRUQP7LwW1:oytafAS/aNPwHbfcKeep5h/uQgW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654905386, "uuid": "12600599-5840-46bc-9c60-9cf746c0a1d2", "value": 504320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654905386, "uuid": "7b822121-47c7-4ac9-a9f9-a6e09f499405", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654905386, "uuid": "5ef0206e-e3b3-4d5c-b963-bf357ab07d73", "value": "b3ef79ccf4dc96c563f4b5254d3e19f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d420b4c9-e8fa-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654892454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654892454, "uuid": "6e5446ca-1fcd-4160-91f4-01642ad96891", "comment": "Malware payload", "value": "83cd31338c8a12883decc96063f09bcf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654892454, "uuid": "3436d04a-efba-4be5-8987-708f619e91b3", "comment": "Malware payload", "value": "474e66f716066a239b8762c6102ed41c869af0bd48a754c4482c850063376e9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654892454, "uuid": "e09900e1-6442-455d-9660-c01bbe848768", "comment": "Malware payload", "value": "00892d264fc1fbac6be077ed13d3dedf3167bc26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654892454, "uuid": "aca5e020-b4b3-4066-8d18-33c9dced9b50", "comment": "Malware payload", "value": "f104285be340fba3d880660830be82a2855f4ad1c86c8adb91f86b39f6734a1f3843b0ee79f5ab49ec871a66fb019e46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654892454, "uuid": "f0bac92a-dad8-414d-a729-01eacd3e80e4", "value": "T116B4140573F43066D46B4D3C859E1A0FE7E67A074BB5D1CA239082AE3BB364279B9F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654892454, "uuid": "3f0815c8-613d-4398-a55d-07229218ce53", "value": "b71031ac72c27db547b44e7ae017554b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654892454, "uuid": "20ba99e5-45ea-4fb1-919b-0114affbab23", "value": "6144:TkzytaJpnASmmaNGQ7DYMT1atZNtpTKIEHzHLAcKhIepZn6kdRphRUQP7LwW1:oytafAS/aNPwHbPcKeep5h/uQgW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654892454, "uuid": "8e288a27-c7ea-4b15-9a77-f4cce56d1e9f", "value": 504320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654892454, "uuid": "09d6ab8b-2274-4299-926e-a6bbc58c9d15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654892454, "uuid": "d4382519-23e8-4425-b333-068287032c08", "value": "83cd31338c8a12883decc96063f09bcf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bcbfa6c-e891-11ec-93bb-42010a9c0043", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1654847128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847128, "uuid": "bfffafe5-91fc-4009-a4ea-7da2cac2a23b", "comment": "Malware payload (ArkeiStealer)", "value": "d8aaeb2e34408f43b3c69046fd253b27", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847128, "uuid": "c87501ed-1987-47c4-8249-e11f640e15ca", "comment": "Malware payload (ArkeiStealer)", "value": "478095690b73f317b9ff209fd4c8a80aba031dfddf84e9ff95fb5168dc8d7453", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847128, "uuid": "f848487b-c592-4a75-beb1-53edb846721a", "comment": "Malware payload (ArkeiStealer)", "value": "73cb9bed5d9a44a4adf44e18153a9666f5f1981f", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847128, "uuid": "b0f8c0ae-42a1-4c83-86a2-bfe8d81f4878", "comment": "Malware payload (ArkeiStealer)", "value": "856019e7e00ed967dbf9e5638b944f68144410a5f8dac8c021235ebe0f8fe89d86e2b57c8af59121f012156e1c01901b", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847128, "uuid": "a9063163-5e95-48a8-aada-d23f3c274018", "value": "T1B9C533766304F607C99E557169FD0E47BF2D3194B4422B2FB2D84F5B2DA3682AE408B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847128, "uuid": "ba8dcff9-0966-4e42-9472-0ab68f17fd75", "value": "79b3362178937bf9559741c46bb9e035", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847128, "uuid": "77b31e83-86e1-4cfd-8bc7-ab8a66bede90", "value": "49152:G//Ps6auADGuowxTTq/0P/wWenXoc4GrTc/JxZVjFcsuhi5H5vFZbceMv7tfCIi4:G6CzwxbGXocLM/jKi5H5tZbchoIi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654847128, "uuid": "78784f59-fbba-4015-b138-136691c45101", "value": 2705408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654847128, "uuid": "a905212a-1283-44d4-94d7-8d842e28096d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847128, "uuid": "963d469f-6b0e-475f-9688-e632c5a743cf", "value": "478095690b73f317b9ff209fd4c8a80aba031dfddf84e9ff95fb5168dc8d7453", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9ab8b6f-e8f7-11ec-93bb-42010a9c0043", "comment": "Malware payload (RecordBreaker)", "timestamp": 1654891147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654891147, "uuid": "5015ba3f-44c3-4b73-ae1c-0b0e0fd550eb", "comment": "Malware payload (RecordBreaker)", "value": "b35cde0ed02bf71f1a87721d09746f7b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654891147, "uuid": "df617fa6-8ff8-40b5-83d0-cd455a8169e7", "comment": "Malware payload (RecordBreaker)", "value": "47f3c8bf3329c2ef862cf12567849555b17b930c8d7c0d571f4e112dae1453b1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654891147, "uuid": "b71b63ec-1097-4cad-95be-26f4e00a2437", "comment": "Malware payload (RecordBreaker)", "value": "0cf266265f77e387a9d396888651240f2b458e0a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654891147, "uuid": "397b0143-8bc6-43e9-b895-dc49d0fad9d9", "comment": "Malware payload (RecordBreaker)", "value": "e858ca7178cd5cbc80d08954baf807e2273a5f224081d66d94a68f30af99790ef7d45a89f2a274426bf17e92e6d74836", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654891147, "uuid": "a23a631c-1e27-43af-90cc-c6ae267f2e6b", "value": "T1CA4307814885EC73C15248B4278D752FDBDEDC022A20F5CBB736F7D746E618249AA39B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654891147, "uuid": "db2465b9-b7f8-4b2d-b05f-7a37cc4f34d5", "value": "4ec5227a81c3e90d891321c143c67557", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654891147, "uuid": "d4d73b89-1c40-4a7c-8847-81003706ee34", "value": "1536:qzwshK8pUMGxo0xwwW9VemFMGfpbbVDjoANyCa:wwshK8yMexbW9vJVD8ANs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654891147, "uuid": "4daeff96-8ede-4c9f-bf9f-251afb374b67", "value": 56832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654891147, "uuid": "12c23425-fe61-4798-994d-65853773e483", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654891147, "uuid": "d771a0a8-3535-4cd9-bc93-079a47891a91", "value": "b35cde0ed02bf71f1a87721d09746f7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dd0b219-e901-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654895261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654895261, "uuid": "416859d1-aacb-4304-8997-30dc68807501", "comment": "Malware payload (Mirai)", "value": "f48f908691671cf521b86f084071e07b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654895261, "uuid": "96ffdfbd-3d72-4643-ad5f-a344d787ba7b", "comment": "Malware payload (Mirai)", "value": "4832b20376fcd3c7ac950128cb069d315c6ef618cb89826956381204d88749e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654895261, "uuid": "2dd46a52-eb0e-447d-9289-a83d079d24f0", "comment": "Malware payload (Mirai)", "value": "f4afac157df8d7b24bc24acec3120f44d5d2d4f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654895261, "uuid": "268d1320-3ef1-4d51-ac2d-1832c55d6f93", "comment": "Malware payload (Mirai)", "value": "f4a4e77608238eba1b7e118d8d360c968f7c342006287eabfa69dd87b91a206c4a03e3d4db51d827ec7e9987f57fb89b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654895261, "uuid": "c143f8ac-c48f-4b70-94b3-8ce0574cfff2", "value": "T1DA835D25FD665D27C0D4617B61F38321F1F6534A20B88B1E7DB20E8EBF24A50361B7A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654895261, "uuid": "6134a4e1-2f42-4cba-a5ef-89356bcc05be", "value": "768:u6fm+qZQwiQq+Q/1LNMoMlqEtzpynKO+NQDsm6HGxQOtHscFrl5E57CE1tWOIe:uKsQw4H/1BMXlqEeYN3HGttH155AtHN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654895261, "uuid": "5ef07bfc-f062-4f8e-9b39-bc2446e0673c", "value": 83328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654895261, "uuid": "7d41adfb-4838-4645-a15e-27e5d0c87789", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654895261, "uuid": "49c6e54f-2e59-4016-8511-d5593248d9e4", "value": "f48f908691671cf521b86f084071e07b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dddd4c13-e918-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654905355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654905355, "uuid": "323d7a2b-9901-4398-b14d-381afc6d592f", "comment": "Malware payload", "value": "0a52c2094e769b5e795634cadfea3024", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654905355, "uuid": "2621e917-a6ec-4c97-8854-27c5cfe3a8bf", "comment": "Malware payload", "value": "4885ac9292d5bc63b9f7f7649560a32f2a5411bbf3f40baf5313b142bc6ddede", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654905355, "uuid": "adfea4d3-a49d-4c91-8bd1-ed2133a94bcc", "comment": "Malware payload", "value": "7de6cc8415129128d665faad67c0d278102aa791", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654905355, "uuid": "79486b05-9f1e-4d77-bbec-e066064a0cbd", "comment": "Malware payload", "value": "ff728325301bee93709d93cb8dcfa2589bd254a85b72a8654f94ba6da3a37a0487277354e4ba4dcbf56c3b0d59d9ba5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654905355, "uuid": "294743be-46a4-4b81-907e-d8921abfc065", "value": "T18BB4140573F43066D46B4D3C859E190FE7E67A074BB5D1CA239082AE3BB364279B9F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654905355, "uuid": "6489dd4d-5f44-4af9-bc64-e89b9cc18f50", "value": "b71031ac72c27db547b44e7ae017554b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654905355, "uuid": "a6f1f560-ee78-4080-817c-b673db988b3a", "value": "6144:TkzytaJpnASmmaNGQ7DYMT1atZNtpTKIEHz5LAcKhIepZn6kdRphRUQP7LwW1:oytafAS/aNPwHbhcKeep5h/uQgW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654905355, "uuid": "7291044c-3acb-48d1-ad23-92dfda0cb0a9", "value": 504320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654905355, "uuid": "5bda6f28-f1b9-4713-b027-b412c900af49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654905355, "uuid": "13d405a4-bb99-477d-bc5d-c46449b386d1", "value": "0a52c2094e769b5e795634cadfea3024", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8384c3f-e8fe-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654894205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654894205, "uuid": "3b36cf46-0398-43e9-a3bf-081eed3df9f4", "comment": "Malware payload (Mirai)", "value": "d76ba9e55148f0fdd51d675fdf6732e8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654894205, "uuid": "5d629b31-2cc3-4fcb-a450-8b1b65058b7a", "comment": "Malware payload (Mirai)", "value": "498413e1f132aae7841dd31e1bad357385e74708dcb3c625e8ecd8b9b4e8d765", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654894205, "uuid": "7f6b7580-e227-49c3-8993-e87e840117bc", "comment": "Malware payload (Mirai)", "value": "e5c8c3699e6b883e312dfe293d07980b08d1010e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654894205, "uuid": "248386c6-22f0-4d5b-a3f6-8a3b5fb363d5", "comment": "Malware payload (Mirai)", "value": "70a3f478132f68b17aa439a5fdbcaeeb691e1798bfd196ca21fd6e8a557c5eb11e9fa5670dc8adc6a08294e130bc545f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654894205, "uuid": "dc43f522-96f0-492e-b7d4-1081b2521be0", "value": "T1CC432959B8D28B12C5D091BBF91E86CD3B2613E8E2DB32039D326F6536C681B1D67E50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654894205, "uuid": "c0d0fd11-daf3-44ba-b647-ba4bc006bdc4", "value": "768:002Sus8+Aub7UDeiAVExkDkUnf6r2kytP3f4pS3FK6/kHXdinMmWFkp+ShfVi/1:GSI+AY7Uiib2Jl3wpUZxd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654894205, "uuid": "15338aa9-eeff-4c58-ae65-6cf12fec7ca0", "value": 56824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654894205, "uuid": "3e9afd0e-8975-42f4-9ab9-8d0596639a41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654894205, "uuid": "736694db-2e86-4d6f-a8aa-a5cb0d269e2f", "value": "PnBarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a55c4888-e8b8-11ec-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1654864028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654864028, "uuid": "fea82ea9-df15-45ab-8534-0c39ed6fde0a", "comment": "Malware payload (AveMariaRAT)", "value": "49e7118731b5aab328d5be8e6dfa3562", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654864028, "uuid": "5545e037-87f0-4b8c-a565-741529e91bfa", "comment": "Malware payload (AveMariaRAT)", "value": "49cdfc76b7a32f4fbbb5044efe58054b8f4eb85c4e7ed6f9cd4a154e08367b19", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654864028, "uuid": "f3fa8018-7d70-4f74-9ce1-975939e5abf3", "comment": "Malware payload (AveMariaRAT)", "value": "e53478529f88ad398df18e3ec855dcc976367702", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654864028, "uuid": "0f4ee549-7472-43c8-bbbf-22f0318fd9dc", "comment": "Malware payload (AveMariaRAT)", "value": "d9cc12b50322b2ad4c5619065b3624e5422a2b1c8967c607e339a3070036e6d11bf21bfa565fc15978f9aee40f34171b", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654864028, "uuid": "2f3e38bc-9dd1-4c1a-afe1-68dc331bb6cd", "value": "T17114FDD06B5ADCBBFB88F474660199B13E8EBAE3F5D641DE20DD624E1A235B144F0C18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654864028, "uuid": "d15fec6b-59cf-4942-b101-ca647cca6141", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654864028, "uuid": "1e995c99-7ff0-4367-8e99-0541c6efbf88", "value": "384:xRCA7IcqLwrSgyKd9zNvT8h5l0OIH6/TbX:57CLwlzV0sOIH6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654864028, "uuid": "80b2b7ce-85e3-4329-b16b-5ab82f71fcd8", "value": 200192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654864028, "uuid": "78a042ec-b968-4f1d-a38f-75aa9007b2b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654864028, "uuid": "7b34f7b3-34c1-461e-9c30-1445f2aa7ab1", "value": "SCANDOCUMENTS-PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b857623-e8c1-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654867743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654867743, "uuid": "3bb8344a-20f4-46fb-8336-117a994c248b", "comment": "Malware payload", "value": "8098932a617c4ac03d4b6c774f9d7a12", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654867743, "uuid": "7dca1597-6101-464e-8341-88e09bc7168a", "comment": "Malware payload", "value": "49dc6436c708fd0b5fd6c9384fae9ff71d11d7059d31e990c99460750acc837d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654867743, "uuid": "e93ce0de-7ec7-4de8-a313-4de9e2fa9270", "comment": "Malware payload", "value": "1d20f3d9bdc092facfaf77deced7b50fabee33a0", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654867743, "uuid": "487b25ad-0cb3-4321-b810-cce4dd693c3a", "comment": "Malware payload", "value": "0660472c8ddaa325ff44b88272b9773a323da700a56e988b2eaa94f0dd45060f59d827f7fa710cb5f8d0e35255643cff", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654867743, "uuid": "4e1e9a3b-0868-4b98-9417-c533c86d6df0", "value": "T12396334E8DA60EFC23FF4191B7B06522A80B6A62D77D62C95036405FF3268BE7587D13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654867743, "uuid": "a1c3666e-7d05-450d-8813-2627d71b3cdf", "value": "196608:XSZk2TJM4Lq+JYixmOb8gFGgrw31sDL5Wh2dycVKa980TNEGJXZL:iRT32oYiQg8g031ILC2dlEJ0fXZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654867743, "uuid": "28405cb0-5178-48ba-86d0-61991e890eed", "value": 8820724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654867743, "uuid": "74bcc143-4b5e-45b6-aa07-04c15b712bd7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654867743, "uuid": "f5727aa5-4c19-4ec3-b728-d440493e00c5", "value": "Unconfirmed 517737.crdownload.0.dr.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2562d2f1-e8b6-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654862955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654862955, "uuid": "21ddaabc-75e2-4e62-8d8e-a292d0bae86a", "comment": "Malware payload (AgentTesla)", "value": "700d6e0ec3986f08fb68cda6ac414d10", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654862955, "uuid": "855a36c0-616a-4cf6-bc11-7bfbe6dd3fee", "comment": "Malware payload (AgentTesla)", "value": "4a65790e4dc264d0d397ba2b6733c5db13a920aac0ff521c632ce2248d89a0ad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654862955, "uuid": "b5e42a11-2e4b-41cc-b651-611ad5fbc87e", "comment": "Malware payload (AgentTesla)", "value": "710ab80fece47285afb37cfc141a60384cea3978", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654862955, "uuid": "1dddbfa9-5a6a-435d-b067-d2a8f202eb9c", "comment": "Malware payload (AgentTesla)", "value": "5320d3b0aa45a944e0cd26d16a31504072da95776d761385c1c9d62db1b6c18348dc6c497527deb50f73c2c4266914cb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654862955, "uuid": "79b2cd09-7d75-4ff5-9c78-dc872ddd80d3", "value": "T178F4F15A7645A54EC00A8A37C6D60D148362AE9B5B27E70F658333AD8D1F3DFCF062D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654862955, "uuid": "2faf8df0-74ce-43fc-bc7b-b6a0932f1f26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654862955, "uuid": "86b75417-add8-4939-bd0c-cbb09a5483f8", "value": "12288:atMY5j87s9q7B6NkAnA/Ef2kScLm9pMAWj0ieDN62gDeX384Rz3sF+CVUIhhl+f3:KPyB6NbA/g9LwVw8s6s4Rz36dYm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654862955, "uuid": "7338ae09-281d-44ae-a394-6c41ee11e96a", "value": 730624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654862955, "uuid": "0977bcc9-2f07-4720-945a-f73648f78e5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654862955, "uuid": "4f72fe76-2889-40f9-bd42-dcd467d3fa87", "value": "SecuriteInfo.com.W32.AIDetectNet.01.19527.13519", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a42bb1b8-e8ce-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1654873475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654873475, "uuid": "447f8535-aa16-474a-ad07-26d7dbd16747", "comment": "Malware payload (Loki)", "value": "772615e7112d075445089c3aa0d09d00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654873475, "uuid": "2ea93b63-5871-49bd-9587-59c0e7a0cad2", "comment": "Malware payload (Loki)", "value": "4b89267832125c432812fa3f7bc1953ccdf0f23d1f9dcaea37a5a53ea3169e67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654873475, "uuid": "80feddca-1a3d-4ff8-8dde-5d0581792be7", "comment": "Malware payload (Loki)", "value": "ad1e283f1538d8c148dce3bf89e2f97ffc50ba82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654873475, "uuid": "1f214320-3c88-4473-8ccb-174fec4cb5a9", "comment": "Malware payload (Loki)", "value": "e0bf5c6a456c785275d3cc100588a6498608224a5fa7b31cc6183e1303cbbed3449b1badc62345e2d85a038c0c0f0ba4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654873475, "uuid": "92fe98e4-46fc-4967-a6db-6ac619facb69", "value": "T13CE4E10523FC452AE2FBAFB9D86A10689A39BF079892F70E14CE35CD54A3702955137F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654873475, "uuid": "0ab3f4bb-f037-465e-a2b3-bc328d3bb09d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654873475, "uuid": "0bc9b595-602d-42c6-abdc-9c2b1aec9128", "value": "12288:6AiFaAYUnzUG+kQJg88rXhtBANjTPQOGSvgBSSM6crrMEgZVCsSd:atYUnIpDAGNPIOjmSSwaVCZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654873475, "uuid": "104bb800-3b27-4f1f-a7fe-47653ae77c21", "value": 698776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654873475, "uuid": "a1486982-defb-4028-843c-30cc2f96d7ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654873475, "uuid": "22f8678b-d912-49da-a816-12bb86af4d5f", "value": "SecuriteInfo.com.MSIL.Kryptik.AFJJ.25174.14726", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2490db3-e8e5-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654883404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654883404, "uuid": "653ac7d3-4817-4a18-97b5-c54812c3cdd7", "comment": "Malware payload (Mirai)", "value": "1fdc356a5d58df75919086ee215f1578", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654883404, "uuid": "8bd85886-6c72-4d63-8255-862cb2b6a9b4", "comment": "Malware payload (Mirai)", "value": "4ba653be855d8f259f76e462a66e2419e16e8639ba4fa8ca3edc268c093e9102", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654883404, "uuid": "42ed94d6-3b2d-43f3-8b07-735b567d5c02", "comment": "Malware payload (Mirai)", "value": "96830c129c22b296678ad97e76222ad03dc9f10a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654883404, "uuid": "d2d4562b-2bdd-4e78-ae41-c6e37d05895a", "comment": "Malware payload (Mirai)", "value": "889bd3e8c677b26967eda18456f31d18d89856a3e0022af8ebb566064b55a80052c4a7bad85c34e5b1ff46ac41937f46", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654883404, "uuid": "0579f059-e46c-486f-8ec8-c7c06e0dfa80", "value": "T1E5D2E15352CB719BF04D65B70C2B6C1E8002961D9189A335BE6CB9F71A97F0ABE4D302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654883404, "uuid": "21477a75-8f03-4e59-afd7-5af964309596", "value": "768:DoBsztK30G0+wvuRDe58V4n4iwBKSKJZuTxf6luynbcuyD7Uryqa:UaBKl0+OeDPSnDwwUQluynouy8mqa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654883404, "uuid": "1d3aa550-6383-44d1-ae4f-31dd9931d798", "value": 29784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654883404, "uuid": "4616dd17-010f-4454-87f7-da7619141e02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654883404, "uuid": "3533ba9a-3ff6-4dc2-aecd-8c23db390de4", "value": "x86-20220610-1750", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75f69d6d-e901-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654895302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654895302, "uuid": "d776fd49-c228-4866-bed3-b735759ecbdf", "comment": "Malware payload", "value": "8e86c15b5d2c1b4acdf55763ebcd8827", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654895302, "uuid": "74996186-303c-475f-936a-6a2811f6a007", "comment": "Malware payload", "value": "4bb5263891baeb26089f1bd2d6b2a225cca6c04cb490faf5ca1ce928c7560d18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654895302, "uuid": "ad01b4b3-073a-49a4-98eb-9f044e2385fe", "comment": "Malware payload", "value": "1ecf2dbcb2a5dcf6a627f6474bca53cb892b15da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654895302, "uuid": "90769b66-a56c-495e-84ac-25fa96b5b8ee", "comment": "Malware payload", "value": "957107f04738a3fd17b1b239e325991cbbcbd19201aed1c8add9f81907c0ba9fda27c6d5588f357c63d2a10182e393e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654895302, "uuid": "b2760b5b-a957-485a-91fa-6094263d1bbf", "value": "T10BB4140573F47066D46B4D3C849E1A0FE7E67A074BB5D1CA239082AE3BB364279B9F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654895302, "uuid": "2940050f-a07c-428e-bc01-9b5b8134d38a", "value": "b71031ac72c27db547b44e7ae017554b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654895302, "uuid": "8206ccc7-b20a-4810-ace9-0f689480b7b1", "value": "6144:TkzytaJpnASmmaNGQ7DYMT1atZNtpTKIEHzFLAcKhIepZn6kdRphRUQP7LwW1:oytafAS/aNPwHbdcKeep5h/uQgW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654895302, "uuid": "40d98313-bb0f-456d-b2a7-9053cc00f390", "value": 504320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654895302, "uuid": "6e2f67eb-2cd0-4630-8ae6-c4f3aea24ee1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654895302, "uuid": "fb3a087b-77af-4eb5-8a0e-d9349a9d5f23", "value": "8e86c15b5d2c1b4acdf55763ebcd8827", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "245a2aa7-e877-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654835895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654835895, "uuid": "fc82701e-eedc-42ae-99b5-188a8927fe67", "comment": "Malware payload (Formbook)", "value": "4f2a18c8b9119c8b0cc610d7db79280a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654835895, "uuid": "9756296f-f15c-4a05-8530-0b52752e6e43", "comment": "Malware payload (Formbook)", "value": "4c12bf99e0536d0e0085073ecbf8cea16145ce3c65dad2ea16b9eddb7e8faec1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654835895, "uuid": "3307a1ff-a670-48a5-8b9e-ef39a196b0ce", "comment": "Malware payload (Formbook)", "value": "84ef77febe34d732257fe459856986eb28823342", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654835895, "uuid": "4e3d8f78-1222-4d9b-bd5d-468a92861b97", "comment": "Malware payload (Formbook)", "value": "c54c273c6309cd22ce685f27a22c8598705cf75e846ae60af2efeb99a00b5634a311947352969b7b376a7831b7f89ca7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654835895, "uuid": "548ff62f-dd9b-4e2e-9c93-4ff5455ebb67", "value": "T1D3259E43728A9EE7C46A61F3D459991023F6FECB0120C64F3D96B69954F37C3235AA0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654835895, "uuid": "4f657ec4-94c4-4bb3-b37e-04cfc04ec677", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654835895, "uuid": "77e938d7-ab20-470e-8be9-3984924c7e0b", "value": "12288:ppHAmIY3VscmUsCgYlq2iWl6wap1q7F8FqnBQdxj/WtyqU:Nqgsb2/l6t1dDHqI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654835895, "uuid": "529d6c18-4177-43a7-89b7-fbcb09797d45", "value": 998400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654835895, "uuid": "7dce9850-fb4e-4b75-ab2a-887ac3aa5f4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654835895, "uuid": "7f3906cf-48a2-4daf-a63f-fd397b8aa4cf", "value": "SecuriteInfo.com.Variant.Lazy.195509.3765.20408", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a53a855-e8aa-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654857916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857916, "uuid": "116fd881-7d55-4815-a562-32ec30e47e06", "comment": "Malware payload (Formbook)", "value": "557e92d3d24f2b05241969d0f825d1cd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857916, "uuid": "9def7a35-02fa-47f6-a99c-3a7c765bf73e", "comment": "Malware payload (Formbook)", "value": "4d10d656d4b9e79a589ac051b09b7c3dbd14149f051c1087fa91ae0b28eda731", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857916, "uuid": "9d469c25-2404-468c-96ef-fd3e9f05cdbb", "comment": "Malware payload (Formbook)", "value": "37ee0505d2640b0fc4ebe57ca10867632f6844f2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857916, "uuid": "d459b8b2-14ea-47f0-bdac-3fc9d689f53d", "comment": "Malware payload (Formbook)", "value": "2300a232f5c48961338ab12d891371f8102288cda04f41332b272b6c1a920177d7625bc1f2df74286a3fc3f6d2079335", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857916, "uuid": "58cfc2a6-df1a-407a-8997-00a3782ae239", "value": "T1AC05DF1E63E44F26E15F97B7D4A245A9A7722207E482EF0D8D8CE4EC2C5A7C19E03357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857916, "uuid": "d64cf494-eaf9-45eb-80eb-58a4fdd5ce87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857916, "uuid": "6d69c02a-079e-4b51-96b3-a9e052988d3f", "value": "12288:xuTVXPkytLLxLF+3zVwL81SGPTJX3ChoMo7xvWO7is40NEuUxdGnFmaz/J:0T5cyhd03zQYPTJH6sH7is4C6GEi/J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654857916, "uuid": "15740da2-391e-4fbf-8f31-e1dcf25a245a", "value": 872960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654857916, "uuid": "51f26243-dbc7-4f5e-9422-969e0593dfd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857916, "uuid": "ae00e316-72c0-4853-a954-8446954402ac", "value": "557e92d3d24f2b05241969d0f825d1cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "985673fa-e860-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1654826211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654826211, "uuid": "2fccc782-d961-4d70-ab23-e6e6568e242c", "comment": "Malware payload (SnakeKeylogger)", "value": "681bd63e86b46e26138f9131399c4702", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654826211, "uuid": "241dc13c-05c6-4b06-a154-dcbf5727a13d", "comment": "Malware payload (SnakeKeylogger)", "value": "4d1b9e837d0fb87707b64e50328c39e99f6d8804ff52ec69fef842aa21d153eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654826211, "uuid": "059291e0-f0a8-4b86-bfee-4778f3793513", "comment": "Malware payload (SnakeKeylogger)", "value": "7b2b94003321f36c3ee397bf51fab8e547de2254", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654826211, "uuid": "8e72267b-8f9d-408e-af79-cbfd0965b8bd", "comment": "Malware payload (SnakeKeylogger)", "value": "895027724df37732ab5e93c5fd8b0974fbbddf8958a90b436d52fc26c8b3465c1afada111e5de9fa6c0d4bd27b1f4c60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654826211, "uuid": "628ebb4a-1ddc-4241-b355-b3b59762a52f", "value": "T1ED14E902338881E9D42B077AA6CE4AB5E1294C173C75FC1F75353EA767B0AC845E6DAC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654826211, "uuid": "c1654c35-0933-4194-ad30-f77bff988473", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654826211, "uuid": "77a61ca3-04a0-4a57-b32e-cdab7eaf8836", "value": "3072:tsSALppRZwFiyc594RWDZ7E0e4Oum0an:tsSg/isyc594RWDZZbOum0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654826211, "uuid": "82c662d3-a001-4dc8-96b0-3977395fd1c2", "value": 194048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654826211, "uuid": "688d737a-8b16-4e8d-9d02-095a2ba70f9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654826211, "uuid": "53ecb171-a86f-4c47-a042-8d4175a9e3b4", "value": "Booking7850.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b4d4104-e8aa-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654857891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857891, "uuid": "881343e9-ec3f-404f-8faa-ace6838886b0", "comment": "Malware payload (Mirai)", "value": "0792198615b3d197f911f2abb7f7a281", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857891, "uuid": "883c20c8-4ce5-4c3b-a80d-85922007034a", "comment": "Malware payload (Mirai)", "value": "4d1d49f9308167d58ff9fdecd1ceed24ac5d6d89f0ab3dc50b6c35bb71bb42c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857891, "uuid": "a82a3e6c-e063-467c-9776-2b09c79192fd", "comment": "Malware payload (Mirai)", "value": "060b83839c9b6de755694a1a437f6f44f66f2545", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857891, "uuid": "fc0b6af3-081e-4fac-a2db-e25186156079", "comment": "Malware payload (Mirai)", "value": "fb77b877b461e3d9fa7c65fb7d9f6ec1894420737650a785863f616112da63fbd7f505d4f204e170ccb0eb587fd5d92d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857891, "uuid": "6f8a6e0c-ca9f-4ee9-aa4c-2cb5c5bfc176", "value": "T108E2E15340B287C8E6FF203294877AAF00A5BD5C7C7C6296D499A63B4088E1C7D6D6E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857891, "uuid": "dcae0f66-cfa3-4437-9161-f72a3599c996", "value": "768:bUhpUibgzIP7i0TlBNMHy0EHuofnbcuyD7UtQRj3:UUHq7dUHy0EPnouy8tyz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654857891, "uuid": "d78649c0-49fe-41ea-922c-d5b0f70a6c98", "value": 33968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654857891, "uuid": "b7c3a1f0-88f5-443e-baad-27e754a6d0d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857891, "uuid": "d86099ef-6572-4143-99c1-840f7af6b0a0", "value": "0792198615b3d197f911f2abb7f7a281", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1efcf450-e8b6-11ec-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1654862944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654862944, "uuid": "48479478-b387-4b7c-8304-8b9ca9d6f5b6", "comment": "Malware payload (NanoCore)", "value": "338eed26cab0a9ed976c75b21b381599", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654862944, "uuid": "de124ad7-4411-470c-ab62-ab507b69072f", "comment": "Malware payload (NanoCore)", "value": "4d350de340e89f32b37f92cc6ec7e905075ff390af1cd5287f0e191062e8aff3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654862944, "uuid": "1e9d4f6f-865d-4124-8795-d017cb89f03f", "comment": "Malware payload (NanoCore)", "value": "61f0ffb26b99762246a6c2e3190f7cec5e56000d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654862944, "uuid": "e91e78a3-2cb5-417d-bb2a-8d78d8baa6ee", "comment": "Malware payload (NanoCore)", "value": "cc521a919ed0008d8cdccdf1a38f4bf9c8c1d706450503e77704655a62eea5c9e552844a45cb03ab70886e17c6092d24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654862944, "uuid": "2314a6b8-5c21-4050-8683-136671836e04", "value": "T12D73C004B2458D6EFB51B63A2E9091ACD1EE9C3D2D67FD86E5217F8836391E01DF412C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654862944, "uuid": "69a57d88-fc4d-4eb7-97dc-afa3b6c47b27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654862944, "uuid": "f7f264b1-e50e-45ad-93c8-f217439eb4d6", "value": "192:i4F3CmeD799tWCyEzmYoiBMP4hYgazf6VFQl+YU:i4F3x679WCyKd24hYgjFZY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654862944, "uuid": "d03b0fe2-3722-4e2e-b67c-2e941ef5774b", "value": 76288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654862944, "uuid": "0ee96aec-5c77-4950-bc5b-f08f1b1eae57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654862944, "uuid": "2eccf8e8-5971-439e-b760-9e6231efbe6b", "value": "SecuriteInfo.com.W32.AIDetectNet.01.27602.7428", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e72ba5fc-e8d2-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654875306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654875306, "uuid": "d8e71108-e3d7-4b68-9e85-0fabf3be9e62", "comment": "Malware payload (Formbook)", "value": "df913892cfafc34891e2f9d16ffcc69e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654875306, "uuid": "396f06fe-39e1-463d-8635-2a70549b6a78", "comment": "Malware payload (Formbook)", "value": "4e7ff374bf5f0989e5d1e4ae395c9229a0d786ec1669dd0cf0fadf2a3f898554", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654875306, "uuid": "3f9acf02-b949-4479-bbbf-a36a53da216a", "comment": "Malware payload (Formbook)", "value": "ebdc1a236d2d518dc65e04d9a8fb96514f072b7b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654875306, "uuid": "9ea960af-0d45-4d9d-96fa-f9ca4d4a71ba", "comment": "Malware payload (Formbook)", "value": "ce98c686854fb06ec46e9372003af7190b39f4efc23479b9c5d9db12b063ba44bcedb3863dd0fc171dd6cb40140add94", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654875306, "uuid": "e1f51114-ebdd-4d14-a3dd-2744754d7799", "value": "T124E412202DAC8673C87F4BF99065D152A3798219B603F32EDDD5909D39A37C19A1B3E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654875306, "uuid": "c51d8baf-2721-4645-a9f8-8b547c966ee4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654875306, "uuid": "34c5ae0d-88e5-4c9f-a997-81d114db3dd1", "value": "12288:wrXpUSlB61512v5AaJsCGgYEoZ8qxlmfQWnLzVLvmDV1mbkc6:eXpUSlB61512vuJgunAQMHufF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654875306, "uuid": "f07d2fd4-696f-4f3e-bd9e-1c98d225d8e5", "value": 674816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654875306, "uuid": "2d10d7e2-c06d-4376-92cf-557839f015eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654875306, "uuid": "51f843aa-bde5-42fc-871b-40c694a98e96", "value": "df913892cfafc34891e2f9d16ffcc69e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "401491f5-e8c5-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654869442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654869442, "uuid": "0a9dfaba-1508-4a95-a82d-dc6a92abcdd5", "comment": "Malware payload", "value": "3cef3aea22ac3369da5363974bd810a6", "object_relation": "md5", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654869442, "uuid": "a9be1b8d-5bbe-4379-8220-b6e11957d062", "comment": "Malware payload", "value": "4ea569c7d307041aa7dd469949af5e92e681603835b3357fef58ed1fcfb3b912", "object_relation": "sha256", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654869442, "uuid": "48c29361-81ac-4a8e-b3f8-34981ca6b8e8", "comment": "Malware payload", "value": "152892be65767857c4afe3bc9c76fb7cd108716d", "object_relation": "sha1", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654869442, "uuid": "f1c598a8-b2b6-4c7c-8a75-ab069dce80a6", "comment": "Malware payload", "value": "dfcdc4233fc14896c1412cbae0f2d06d095075f1e1811f531588195d42ccba3aa1aa6e2ee839bc690066009e78096d4a", "object_relation": "sha3-384", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654869442, "uuid": "933d433d-093d-413f-9efd-348325028540", "value": "T16CF2F1EE51A2D585CDC7FE9B0CB408E70DEE1539AAA527415DB039348EC91A5EF80073", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654869442, "uuid": "864d0851-adeb-40f1-bf3b-6521faae5c5b", "value": "768:XPkaIyDU+5tbrrHV1uUU8oNjhm0w0FTSz7WEZRrKCN7BmYiZ3dHJz:fkaRUc1I8iIYJSXZR+a74z5Jz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654869442, "uuid": "b2c813e7-f459-416f-b165-6bf0178183dc", "value": 35868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654869442, "uuid": "5a3aac20-337a-445b-8e05-8d1d387c783e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654869442, "uuid": "4fd503b0-d57e-4808-a126-cfc0688c6efe", "value": "4322_56607.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf74345b-e8a0-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654853764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654853764, "uuid": "23978a35-33e3-4c81-8e63-e8aa82a65c87", "comment": "Malware payload (Formbook)", "value": "fefb775d496875e34c7ccc0eb4772972", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654853764, "uuid": "8053d47e-bd8b-496f-8ece-7c18d13659f7", "comment": "Malware payload (Formbook)", "value": "516d04036325a5b8d02a92bc54f879454adb95f10c5782ad29caf17fcb1d47e4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654853764, "uuid": "67607d15-9548-4ce4-8cfc-b720dc92a665", "comment": "Malware payload (Formbook)", "value": "c4b273d16278c0be00e140fd92640cf21371ebd1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654853764, "uuid": "916d3ad0-81e5-4aca-9e6c-f776659de3d8", "comment": "Malware payload (Formbook)", "value": "913135043d60ce3c808727c93ca7bebe6bda94d52e2b7cdfd866fb72ac42018eec5017b522835966f46ef96fcb54fe4b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654853764, "uuid": "87ebcfa5-d22a-42d3-be32-e5f6999aa7a0", "value": "T162D422103BF90216EBA543F90A254311E2B8F51A7B76DB072A8110DF9CDBBC68B136D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654853764, "uuid": "5b258993-d600-4d0d-aa13-7e9e5c241f77", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654853764, "uuid": "5db7433e-5e7d-4b6f-9084-c3039d00d5e2", "value": "12288:R9qqPSih8Cf7OdD9AQIr4cQ64QigsIn7yOR8O6nIufs:RTK88IO4xPQ6NiJcyObSfs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654853764, "uuid": "72f84c93-4a8a-4e71-81fd-9eb227347567", "value": 605696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654853764, "uuid": "7ddba1dd-d736-42ee-9638-55d2b636ec6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654853764, "uuid": "269637a7-9234-435c-95b7-46a2b1bd89f0", "value": "fefb775d496875e34c7ccc0eb4772972", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a5840ce-e8b0-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1654860332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654860332, "uuid": "cc2f0bbf-3bf4-4904-a61b-bcf62c51cfbf", "comment": "Malware payload (Loki)", "value": "26a95f4d1b0ae7b4784573ae3aa18fa3", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654860332, "uuid": "de38628c-222a-4ad5-b52d-fef000921992", "comment": "Malware payload (Loki)", "value": "51c7be86a8e2fc9d475ae5400eddec53fe9ce63bc89859299ad645d6ebac85fc", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654860332, "uuid": "862f821c-4069-40ae-b4b2-463f32277d67", "comment": "Malware payload (Loki)", "value": "56a966ef25e03776a4fb642458c1e8eb4d169841", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654860332, "uuid": "8c747b04-992d-4ae5-acbe-f57a202ff115", "comment": "Malware payload (Loki)", "value": "82748beb347ff6f17d723b3b9d13b2a46f2793f4423a88907f59002535af0f31ce8f871cc561f7859a093c59207b1456", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654860332, "uuid": "30354b7a-5fb6-4978-af17-f59350dc314c", "value": "T1EEB4239F2EE4272370103DBA03456D8B53D6874B83DA53792D77FCCE2942648E68E68D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654860332, "uuid": "7107688b-7601-4e2c-ad07-e49fce422f2b", "value": "12288:ksOFC7WekVdEM25T0zf3UqowLgo17kLX5eJpmLTUmF64w+p+6x:kg7kZdgZLX5eJULTU+6Kp5x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654860332, "uuid": "404f3114-29f2-4e32-b719-1d94f1030ab5", "value": 521313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654860332, "uuid": "b0799a69-0478-4da8-b13c-74b5cf70872d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654860332, "uuid": "e632b071-c5ef-4e90-933b-f15e015059f9", "value": "Payment Slip copy.r01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64c8bed6-e8ab-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654858336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654858336, "uuid": "9b5306fb-f53a-449c-84e2-29309093dd11", "comment": "Malware payload", "value": "2ddbc785cd696041c5b0c3bd1a8af552", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Locker", "colour": "#0F83CA", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654858336, "uuid": "c8720406-9dcd-492d-a5c3-69018ee705b9", "comment": "Malware payload", "value": "5251a356421340a45c8dc6d431ef8a8cbca4078a0305a87f4fbd552e9fc0793e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Locker", "colour": "#0F83CA", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654858336, "uuid": "571313d2-bc40-4ca7-bec7-fe7f4924e421", "comment": "Malware payload", "value": "1269636a5197ee7a1402e406c91177bf6a149652", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Locker", "colour": "#0F83CA", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654858336, "uuid": "d87aedfa-3dab-4e3f-8b65-9a18d6b46fd2", "comment": "Malware payload", "value": "90f235f09f0cf556e6d8e64cd09ecd9543e647d4a91f1dd46c23ed4c95cce502a4e5002b3836ffcdb792107303cb65f8", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Locker", "colour": "#0F83CA", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654858336, "uuid": "e4231da2-b1ee-4260-8058-dd38f92363d6", "value": "T18CD51215CA63FCD0DD4A8171B8EF4FDD6A9104E28AF162374672712D7CA35381AEB70A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654858336, "uuid": "ef192efa-62f0-4064-a8b3-78c899776851", "value": "49152:VPctdtUtD6iJjM2M7xZkQPctdtUtD6yJjM2M7xZkpPctdtUtD62JjM2M7xZknJjj:VP04D6ojkxlP04D64jkx4P04D6sjkxin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654858336, "uuid": "d0920892-a923-40a3-9bb3-633da78459c5", "value": 2823672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654858336, "uuid": "d7168226-2e30-4e36-a5d8-f87da5ebea33", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654858336, "uuid": "45c5dbe1-9a66-4055-8fb9-00d6404b3460", "value": "freefollowers.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14c6be6b-e8f8-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654891273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654891273, "uuid": "d56ff92d-4486-4195-ac2d-82cb4e56fc0a", "comment": "Malware payload", "value": "19dc7ca88349aa7cbc8b0e6cdf1f3d47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654891273, "uuid": "301aeadc-64b2-4ee0-8121-583b7aec188a", "comment": "Malware payload", "value": "52876d1726bf1657b61f1a2e7bf932ee15ca41ff84874fc769755ea233ea10ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654891273, "uuid": "ce6fb10a-b1c9-4d81-be6f-5d5474fd1873", "comment": "Malware payload", "value": "539776804588ca4f456a72241c5541502b98acca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654891273, "uuid": "d28bef81-1211-49ab-b147-4c06d0ed2556", "comment": "Malware payload", "value": "966352c9e74b5c1116d62b04c71ba8b05520674382e33ae92f7a8fda398f1f37aee30682d0b2e95ceab50dcf30dea45a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654891273, "uuid": "15d1576f-157b-427b-97a1-f6bb2c2320de", "value": "T1F445DF2C17F5C627F06D6BB390218016D5F8205BA2CEF7062DC768F819A73A39E495DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654891273, "uuid": "6983f38a-5403-43a5-9236-ef3158aacf9b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654891273, "uuid": "46a70f5e-dfd2-4261-a10d-6cb931aa4bd8", "value": "24576:TwOYRQYAy8elLe4RJ+TvOLMJ+Vb5P2gf6p:9YrflxMJ+VbZ2F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654891273, "uuid": "188f7604-bf07-43a7-849f-dd08c132141e", "value": 1167872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654891273, "uuid": "7ff07f36-3912-4e15-a15d-6481e5e91403", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654891273, "uuid": "4af3aeb5-5133-48a6-9498-e7cc2ffa4379", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00089256-e8d5-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654876206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654876206, "uuid": "2eac6a80-0c67-47f9-8a5d-a88f9fa525c1", "comment": "Malware payload", "value": "4da671ccc779f0e4d71dea89627871a2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654876206, "uuid": "cc942f95-2182-49d7-a9ed-7d3b912020ef", "comment": "Malware payload", "value": "5357344e405b42b4da5a63905b547f82c34130a93b66bb1642324799e9ffd66b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654876206, "uuid": "a53493df-5f59-4337-8919-f92264ba5f44", "comment": "Malware payload", "value": "336f29150b6ef4e07af391ccb7110d42c7ed10b6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654876206, "uuid": "860f8156-ca41-4de5-92f0-9f52cf7e3e4e", "comment": "Malware payload", "value": "7077b6917495db167f12cfa863685d5477c3753b8dce771c22fb788a91027f9730abd70cd684fb1dd871a263c742db6f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654876206, "uuid": "6b05cd12-a7ee-4450-af59-fd955c8ba3e0", "value": "T12B333982F881A662D5C4127BFA0E029D33366BA9A5EF7203DF147F713BE711A0E76411", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654876206, "uuid": "a46d429f-4467-4063-aa32-c11fdc6d9bcb", "value": "768:xtdWGa8G2yz27KaGcjkAxcEf4Vt/rQb9cj3ojWfwVpdPaUjhgbAZeFG1pMKolsqG:fm8GHyy/Ebyj4qfcpVVFgeeFspMlL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654876206, "uuid": "2552ae6c-330a-468b-877a-ab45d4c3cb60", "value": 54480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654876206, "uuid": "f89d090b-9c8a-48dc-a0c1-6c5763fde031", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654876206, "uuid": "4fb793ad-2ae8-4cfb-a199-4032b6033715", "value": "bot.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9b65505-e8de-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654880383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654880383, "uuid": "603d4c62-e818-432e-88ad-c7ef84c5a12d", "comment": "Malware payload", "value": "c1b008b905ed7c99276ef90f6f7085a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654880383, "uuid": "a8be9f71-e60f-4363-9537-1fcd6b35151c", "comment": "Malware payload", "value": "538d5d6693e9804b06e2b8f134e40718726ce00ddfbb90fc9ca3199653befefc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654880383, "uuid": "ac73ba00-201e-44bf-9b06-9790b2ebda8d", "comment": "Malware payload", "value": "928e6941c1382dad17261443da0b66f1310d3b01", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654880383, "uuid": "dc1c131c-e1ef-4eb3-9c33-e4f521785924", "comment": "Malware payload", "value": "8874b4c5081943cd7e0202f47c4f6822903ad3aa4c00e7fafd60e7b39e8366e8cddbe891f2bc1b95156c0fcf3bd2595d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654880383, "uuid": "846189f8-f6fd-45e1-8bb9-35448c1cd342", "value": "T139A3406B6E209B28F75C973406FB6D34834A23E726E6D64AD19FD6001E3131D5C0FAB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654880383, "uuid": "9d4a8e31-84b7-49ac-a345-dea228273eb1", "value": "3072:rvZFFm4q8PAms2EHgrUHxiVcb0qFb1lGWx:13Ams2EHgrUR+eFb1lGWx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654880383, "uuid": "00f5f971-6eb8-440d-a22c-f2e4988258b3", "value": 99772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654880383, "uuid": "71c0571c-be0d-4754-afb8-6e32bf42dac0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654880383, "uuid": "c3b277f5-1524-4bde-ad9e-ff04a4413331", "value": "c1b008b905ed7c99276ef90f6f7085a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9728bc4-e8ef-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654887711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654887711, "uuid": "ab56c071-96ef-486e-aa4a-7750d8094857", "comment": "Malware payload", "value": "06bbd02409376709e01380e5d4afb876", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654887711, "uuid": "59f878a1-cb7f-4ed5-b968-227801b20009", "comment": "Malware payload", "value": "54db52efe70986c12609bc41de92b6c649d442b3e6fc99978ef4ecf200f0fd49", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654887711, "uuid": "ba386222-bd5b-42bf-a2dd-ee72601184c1", "comment": "Malware payload", "value": "935a85ed46316971f77de422e9d4119a973f7357", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654887711, "uuid": "fd78e77d-0bc0-43c9-94e0-24c5b3867933", "comment": "Malware payload", "value": "4240c171aa1d79401b3096d046a71dc27076d67e365f152afdd79c4aaade17520767cc0e9cc175114b9587a34a1a9cdc", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654887711, "uuid": "88fd5047-37e4-45fc-a580-e300c6d5a69d", "value": "T1B1764C8987F5F2B882CA9D85EEC5CE876C1420ED564C23180778EF64AF4A01D577E39E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654887711, "uuid": "2ab3f971-065f-4ee7-8703-237a23f5efe6", "value": "98304:9hLoNCEHr4wt0Mu65PdikZsmjdlvQkiozxMJbaYHISshrneHFdn3Z:9sDtSkXplvPzoaYU5nup", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654887711, "uuid": "0cfa5916-f55d-4286-845e-6936705a35ab", "value": 7446413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654887711, "uuid": "0ee1c5c5-7f00-4a6f-b24d-df795c9a3869", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654887711, "uuid": "244abe66-b5ba-4556-8c4b-4945c5821078", "value": "launchctl.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c139645f-e8a2-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654854626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654854626, "uuid": "6ca6fa5f-0f05-4e41-a3fd-bbbf102152ca", "comment": "Malware payload", "value": "55db284c80732594f8569cc83c8ac3ca", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654854626, "uuid": "d3fb230d-4922-4997-90c1-aa21f9fc5be3", "comment": "Malware payload", "value": "54f6c4c3c26e607d32b405f79043fa5bf33dadda9e0e2ec3650aecdcc4df1d03", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654854626, "uuid": "daec11e5-1584-4b44-bb83-9bece6d4ebd4", "comment": "Malware payload", "value": "1b6977386575cd49899ec908bf5f4e19ca7b1a19", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654854626, "uuid": "fc15a3f7-3cb9-428a-a400-2976747b9d52", "comment": "Malware payload", "value": "1a26becbd37e4b0676107f21788e0c5fb80e051128d0fb67d4ff29ce7f19d3521fe8e9a622b2fd0760f0abc122603d6b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654854626, "uuid": "e3f3f208-ccd1-445c-a6c1-2ffe5c828173", "value": "T10FD3126E3B984B67D4E5B9798FC489ACCCF3CE92A89440B771003094DCF869229C51FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654854626, "uuid": "a8eb5190-7d8e-425b-8ba9-09a2c746965b", "value": "3072:my1vimR32l0UoGmWG2SEUrwxpFl7mP48zv0meKmymPDM4CswEgbN:V1KmR32l0RW35Urwx+zmy2CT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654854626, "uuid": "a097339e-fb16-4b79-9ed3-1ea06d4de5ff", "value": 130560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654854626, "uuid": "52cdc99b-1a2b-4083-8209-2cd73491d90e", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654854626, "uuid": "c521e1ac-7e5f-480c-b1cd-3f2f22e26dbd", "value": "SecuriteInfo.com.Heur.26743.30333", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dcb8245-e8fa-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654892255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654892255, "uuid": "fe9ac280-87cc-44c4-8729-2127f8d61f20", "comment": "Malware payload (AgentTesla)", "value": "7f768c165aa34df037cedb1ce59254bb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654892255, "uuid": "99c66ebc-3ca9-470d-bef4-d463573014ea", "comment": "Malware payload (AgentTesla)", "value": "56b706b0ca7e0e987af4d30146c57ecb93c05ee2549871e50b4a788c269c37af", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654892255, "uuid": "b150ad2d-093b-4964-8c64-4749114297d4", "comment": "Malware payload (AgentTesla)", "value": "1ab11918c355a500ac2c9ab79813163dbd2bfa2b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654892255, "uuid": "b7c530b8-a5d5-4727-bca8-d489ae27e3ae", "comment": "Malware payload (AgentTesla)", "value": "c36c687bcb8d392d45ba4b7b54df6d53782dd97c632c7ecc51f2b8f62bacd6fb9bc1532477d234ba34004ecacf04d067", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654892255, "uuid": "5154903d-9359-4026-9079-08052d7296ac", "value": "T19AD49D36362CAFA1E63EC77C90A1841193F0994FFB12E5497EF724CF2871B5047629A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654892255, "uuid": "70c80b86-daf7-45de-93c3-b0e492307b58", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654892255, "uuid": "65998a4b-718e-4e3f-9085-c85125aca1ba", "value": "12288:ybpakghLuyAHmKV7uhac27Ir7rTAEi8SrOXgSqo+C3I:SYhLuyy6hacCiHiyXgc+C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654892255, "uuid": "22079031-9eb2-43f2-8d0b-969036aefdd4", "value": 627200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654892255, "uuid": "753d047b-0248-4b4a-aa31-497ae95c6aeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654892255, "uuid": "a8cb86a7-59cf-4cff-9d24-3ae485938ac1", "value": "Quotation Request.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "516c1e8a-e901-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654895241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654895241, "uuid": "ac01dcac-3cc9-4d1e-a5ba-360fb43025a9", "comment": "Malware payload (Mirai)", "value": "87d9889487d16a7b4540aa22f88ebd81", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654895241, "uuid": "7b261add-e475-45aa-bd35-093e343731c9", "comment": "Malware payload (Mirai)", "value": "5850d800a6b19d010552f5c5a2b4f2cdebb437a5ff5be1c09f3e014c3087e80f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654895241, "uuid": "3a1b53d5-558f-4f0f-a844-f4dce5cb427c", "comment": "Malware payload (Mirai)", "value": "057694607e2f8042a52af8f1412a908c216ccb84", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654895241, "uuid": "73253a17-e0e0-4f9d-9fd9-cf7776db4e20", "comment": "Malware payload (Mirai)", "value": "3d665bcb744d54359b2da4a6cdc49596073585a67eede1c92302ccbd5808b92212cab40891c9fb73bcfed03d4a083d6a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654895241, "uuid": "a02ddf59-4133-4099-a37d-31c520e179b7", "value": "T13CD2E16A8CE62B0BE50C117474CE2D05CC72510E3189C847FA955C7BDC69F7B7A28347", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654895241, "uuid": "bbd5f2b6-cfcd-4399-8953-6ceaaa89fb2d", "value": "768:FNPv4DvmpNQEI1A9xQCJeX10tw49zBTROnbcuyD7UHQRjDh:FJv6q0KxFeX1099VTROnouy8Hynh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654895241, "uuid": "ca635365-1c60-4291-b3a5-97f402cf0978", "value": 29992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654895241, "uuid": "aa089c11-04c1-4ea8-b40f-fa4cb448b935", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654895241, "uuid": "99a9fd03-75b9-47cb-ab28-3722f921b920", "value": "87d9889487d16a7b4540aa22f88ebd81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2aa2178-e864-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654827973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654827973, "uuid": "83493983-7e40-44db-a3fd-317484e0ef79", "comment": "Malware payload (Mirai)", "value": "792275d06d7f792b879f7d3623756c4b", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654827973, "uuid": "25434876-d39d-4435-b52b-89e0fa720b28", "comment": "Malware payload (Mirai)", "value": "58b6bcc66bd827797e7f2dd2b9c5cc41b65edf71e082e0704d3de88c47fafac4", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654827973, "uuid": "661e4a4c-3127-4bcb-98af-946e1dd9dccc", "comment": "Malware payload (Mirai)", "value": "111221fce7bc55cba7edb81e94ceab0243af0d08", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654827973, "uuid": "df906c94-6504-4fa7-900a-59eb78cace0c", "comment": "Malware payload (Mirai)", "value": "b274e6cc386dc57f22c3734b9ec4bd784b94a7298ffe826b4abd4de008588c6ffa9d8a7de20e6daa0f85f42d51493e2c", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654827973, "uuid": "b0a2f07f-a13c-4652-adf7-064da373c725", "value": "T1E6632847B48181FCC549C134437BB63EC866717E023EB2EA37D8BF166D46E605E1D98A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654827973, "uuid": "332de22b-c871-43a2-ad72-628c92e85f98", "value": "1536:HiPvSy7Dqk8BuHtGuBEYHvatmMzx1zGDGL:CPvzDqk8BuHtGiEYHvagMLzGM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654827973, "uuid": "1267da6f-21e1-41a1-a891-c7dc59236665", "value": 66816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654827973, "uuid": "70f61e1b-ed86-4abc-b1fc-2e8abec2e3f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654827973, "uuid": "4ea718d6-edf7-4f62-b265-2c0a0dcab2ce", "value": "792275d06d7f792b879f7d3623756c4b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66329374-e901-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654895276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654895276, "uuid": "0146082e-437d-40e0-bc13-99fc32907637", "comment": "Malware payload (Mirai)", "value": "b32034a35c260204e9f0edebf94c1c3d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654895276, "uuid": "1b5522de-756f-47d2-b699-c1425493e846", "comment": "Malware payload (Mirai)", "value": "58e3c75bfb8676e486ef278ecd6efcb4ab22a5f0db4cc502d4c3c12d89e4a5b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654895276, "uuid": "61f417d1-783d-4b03-93ce-449428bd4ba9", "comment": "Malware payload (Mirai)", "value": "1b6f46fe075484d72a891e9567c2eca98159822e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654895276, "uuid": "61f9c394-2c5c-4945-9ce1-6e11c09d7069", "comment": "Malware payload (Mirai)", "value": "4a21e3920a861c62f1af253cb2c715495d9af6ebb910bbb25c91d829e60c5b99fec7e3c9981ac91c134d964eec215617", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654895276, "uuid": "a0bfecc7-84d0-44fb-aa82-a5eb6fb4607c", "value": "T1CA639415FF610FB7D8AFDD774AA91B06288D614B32A43B767930D428B25B14F09E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654895276, "uuid": "5a377805-f655-47a9-8981-d37e30ad138e", "value": "1536:bfwR0LHMMYEWpvO1yxzKz+24lsWpC+mtZ2fysgJ:bA0LHMiyhKFFt/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654895276, "uuid": "02ae22fd-a767-4c33-abd4-4b6b1082b061", "value": 73184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654895276, "uuid": "937af7d1-d0ad-465b-9229-9893fe369b76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654895276, "uuid": "ae18dfa6-d01e-43b9-bcd2-15683c1b135b", "value": "b32034a35c260204e9f0edebf94c1c3d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ace20568-e8e1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654881650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654881650, "uuid": "faa84f2b-c1bb-4127-abb7-f341787430ed", "comment": "Malware payload (Mirai)", "value": "94edfe692be39cd943c1aa98540cacca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654881650, "uuid": "906cc403-04bf-4f57-9156-a1e1b0b86269", "comment": "Malware payload (Mirai)", "value": "5a7b3a32182543d15513da519a7bcd7f2fbccb987ecc5a06b75ece2ac9dc7406", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654881650, "uuid": "b89887bd-1973-4498-b84d-7707ee51f87f", "comment": "Malware payload (Mirai)", "value": "1981fc77a0c9da1c9e5459c0aca5c8393955a5b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654881650, "uuid": "d9cfa881-b395-4bb6-ac39-0c57ce6a2f16", "comment": "Malware payload (Mirai)", "value": "59e32a17729bc81121f406b0fe82dfb4d5d085035fc070c440a82f0fd21d803baeb4674b6ca4c12a94af66869eb5c739", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654881650, "uuid": "b60cc92b-5496-4a0e-b486-8c28b0a8bb60", "value": "T17AF2F196D53B7CF1D8200F31DCB844909024ABEB61DA325319BE53B557EA0C528BFD9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654881650, "uuid": "eb46a295-d031-44d5-8a7c-74dab7574320", "value": "768:QoqZPyrxigG5wydmDR2CKLuHCZu4+TiqgZEqI+lCzpCx6S4BulXgO9q3UELQT:QpyrdnUC6BhZEqClFB7zL2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654881650, "uuid": "be9a680a-7d9a-4cbc-a02f-7c1ff58917f9", "value": 36424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654881650, "uuid": "6278f142-e97b-495b-9e3a-ba707940972d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654881650, "uuid": "22b6469f-6a8e-4afb-a4a5-1f4da8ca7264", "value": "94edfe692be39cd943c1aa98540cacca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5ffd7ec-e8af-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654860164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654860164, "uuid": "7d2b3312-198e-4d32-9d16-965dfd647e9f", "comment": "Malware payload (Formbook)", "value": "7959b12b513cf9abfc6f58cbf0ff1ad9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654860164, "uuid": "2051108f-4d05-4231-9b5c-e77768351adf", "comment": "Malware payload (Formbook)", "value": "5ad68e0938866ceb07515ecee72f0677459db9ac6c3286e7f435d0b26d1afc51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654860164, "uuid": "fd7a17b5-c859-4c03-b8ed-1e6a8fb180e7", "comment": "Malware payload (Formbook)", "value": "aa03c7d6b2a387f02d4f538eebc4890a8b0edf3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654860164, "uuid": "33f7a6a4-ae2a-4bb5-af0c-65bba5c2e5b9", "comment": "Malware payload (Formbook)", "value": "39916cedb78e860bc28876aec48102c1ce474cfdb53ed82287416f01bb67c03a8947e79e2dde11f8380da27491472ea7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654860164, "uuid": "57ee0c78-2b86-4072-8666-3e06a2349cf7", "value": "T145E4F15A7516E58EC0064A33C9DB1C1483A29E97572BE74B7487339E9E0F3EFCE09186", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654860164, "uuid": "7d16ece0-e783-46ce-b4be-2a62a6ae61e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654860164, "uuid": "d68d3fbc-aee4-4a6d-ba54-ffd332d4ba06", "value": "12288:u6Y72x9qk+JYWS+dD3Z+MbxLaZeo9RguQ9Q+e:uQmYWSm+GJaZjIIX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654860164, "uuid": "6b8d7891-0a1c-4de5-b8da-348f3422ebf4", "value": 692224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654860164, "uuid": "97d5c213-9ea2-486f-927a-4937d2bb5ff9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654860164, "uuid": "fd85cbea-1c0b-4676-a0a2-6e5806d7dfb8", "value": "BL-DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c343c7dd-e852-11ec-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1654820270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654820270, "uuid": "386e77f9-9222-4f90-b8ce-9fe78a5303f1", "comment": "Malware payload (AsyncRAT)", "value": "80cc6fac1cd9e027a2f5d2d3a608e3a2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654820270, "uuid": "8073cef5-6d6a-4c0b-8c30-433fd39d5a66", "comment": "Malware payload (AsyncRAT)", "value": "5b682f3038aea6c3db35ba85a82712a1920adddd5587777742ca711dcd729757", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654820270, "uuid": "0b456601-4155-44df-9505-fae9404926f3", "comment": "Malware payload (AsyncRAT)", "value": "46a8ceaa6a254912b853c62d7e363be87604b744", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654820270, "uuid": "3e16d026-52af-470c-a0f0-2cf00c7b11a3", "comment": "Malware payload (AsyncRAT)", "value": "8d40e5b45c52d273fc1193d80fac6e85950846dc804711a82e3833ea9f74281780858317493d0a3ac13aca480fdae68a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654820270, "uuid": "9d6bb34b-b535-46a2-9d3c-a06d3a9e2db3", "value": "T15CA4120077ED03C2CAB687BD1C5213125779D50A3A3AE70E4D8562DE2EE77428B677A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654820270, "uuid": "9094db6f-4045-4d59-a968-20984c8143f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654820270, "uuid": "ac6d3660-0983-4cfd-a2f1-8b8e7b4ecc88", "value": "6144:a/9qhasTwxXnOHQedrZIyt82uMXj1yTTh0L+SJ+f2C5j32WzC8Sbflc:G9qxQwKytiKyRmPJpDWBSb6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654820270, "uuid": "3251ce75-637a-4236-9c6e-17cfd4f416f5", "value": 450560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654820270, "uuid": "8e21784a-583a-4c2d-b027-fe7327193495", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654820270, "uuid": "99b381c4-7356-47d7-8c8b-c68043c6d5ba", "value": "New Order.xlxs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed7d4245-e86d-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654831937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654831937, "uuid": "f8e9e93d-4e37-4bd8-b8d6-f1ad1a34af6c", "comment": "Malware payload (AgentTesla)", "value": "7961a731a04cf2f42e4d13a3ff8b78c9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654831937, "uuid": "ddaca1b6-c66b-47f0-bbd6-2037d9b9fcdc", "comment": "Malware payload (AgentTesla)", "value": "5bd46059d7476009319aa894c589bf08015e8fe30c5b92805c9dab585b3a88dc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654831937, "uuid": "02784bc3-3281-4ea7-b121-9b8646a01003", "comment": "Malware payload (AgentTesla)", "value": "9c847be03bfc0b7f0e3dd51d0719541779b92e25", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654831937, "uuid": "f5eb4e72-298f-416a-a0fa-eb0a499f0851", "comment": "Malware payload (AgentTesla)", "value": "f0e9a01aaae11423f649a8b88dbcc33ec647740624da4a693c9bb7e0a6ff91109fbe28db67089cbdb11cab2dccd65b66", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654831937, "uuid": "34824fdb-b339-4d30-92dd-c234f5eac1c6", "value": "T1EBB40129339C131BF76BDAB514A0604E87ECB5571923FF4A4D84A3CE2932701A9A357F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654831937, "uuid": "4c7192c3-b299-4c06-9724-9e5f3de4bc41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654831937, "uuid": "4864fe54-d1b7-417a-84bb-baab2bcb2581", "value": "12288:a1u0PO5J3A9J4KCHzAukiC5pECnT2hYgxdQJpyhhsx27kMRkg:Sz9J4ZHsFiCErhXayhg27Og", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654831937, "uuid": "6273eada-f3b3-45db-946f-6f10dadb1623", "value": 524696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654831937, "uuid": "10b559a5-9f61-43d6-9485-d537437fe8ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654831937, "uuid": "78d15cdc-993c-4a4c-a93b-1af082a64efc", "value": "SecuriteInfo.com.TrojanSpy.MSIL.AgentTesla.AQ.MTB.20745.8578", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d79e4a24-e87e-11ec-93bb-42010a9c0043", "comment": "Malware payload (njrat)", "timestamp": 1654839202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654839202, "uuid": "cfed49ce-b614-4d39-ae18-3b0cfcfc16b3", "comment": "Malware payload (njrat)", "value": "612174fd6305bfa675dc49c57b37967e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654839202, "uuid": "035363f5-639b-44c9-ae79-ee43adcfea69", "comment": "Malware payload (njrat)", "value": "5c018e8495aec8ed5d96476a4d137904a2a7bb30861158cd0eae1df8d8ae4b26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654839202, "uuid": "e808ad57-de9e-4a8e-a57b-09cc4e66bab6", "comment": "Malware payload (njrat)", "value": "000ebc40e3663bdb722c38d7db866a1c97842d5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654839202, "uuid": "0ad4814a-27bd-4f26-82c5-b50c86cfecfa", "comment": "Malware payload (njrat)", "value": "67d588acae5330ba0248264b8893d9f12c363e6e704166f8da9561e7c8b9e1e93ad96720514647a5a7b65f573ba76b8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654839202, "uuid": "fc65809b-b976-48e3-a733-1eb645696bb1", "value": "T18E25F19AAD419E03C3F322F2AF8085B331581E717765547595B93F3B72B8C839B9A720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654839202, "uuid": "416792f7-140e-49fd-8e48-0ec18b2c5c21", "value": "890e522b31701e079a367b89393329e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654839202, "uuid": "1dcd4145-c70b-493a-a5d6-3c04358210e1", "value": "24576:1thEVaPqL1ecod96VdQ+IhGGkMlDK3gf0:dEVUczVdQ+2kN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654839202, "uuid": "40c0c5ed-55fa-4689-ac8a-dacfba1f5ade", "value": 1031796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654839202, "uuid": "79c867fd-984e-4d94-907c-85fa8d77c396", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654839202, "uuid": "41012c40-7da2-479b-90d6-26559f1ad301", "value": "order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ecbc607-e859-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654823054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654823054, "uuid": "82795c9d-0a91-444c-9b57-833036c93f87", "comment": "Malware payload", "value": "10ebda388e6c16469d68724bd8333501", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654823054, "uuid": "c384668d-d719-420e-b9c8-131b945b292f", "comment": "Malware payload", "value": "5d09a1aef3c09a876fdc07307465302900360b286c2574aa7bfd0d51f10a8d86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654823054, "uuid": "1768bfd4-1a6d-429e-ae24-3d9e2734f3b2", "comment": "Malware payload", "value": "e1206fcefab5d7642c0cc786e99a4749cd94039d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654823054, "uuid": "af0a854d-e557-43dd-8542-e4105609ad6d", "comment": "Malware payload", "value": "23977c2df67222bde8fb71c1d9035eaf618f0828ab7d964b95baf19653fb6663e429d9b3b0f6d2703521763ca2d29242", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654823054, "uuid": "64df6abe-d3cf-47e1-a224-c515f47a4834", "value": "T130635B9BAB1601E8D027913CCA975A42F371F85913118BCF1BE163162F27AE56E7F320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654823054, "uuid": "c88cd483-ec7e-4d51-8631-4146e7cee3d7", "value": "9a2e2b5bb4dde8d000dabe1f74191362", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654823054, "uuid": "cfe99894-e6d8-4ef1-84a4-a298b791c349", "value": "1536:dfnXesKLHYfXaHxz00KdXMtbHlnStKBQ:dfnXesKmO0Dd8PnStKBQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654823054, "uuid": "bb744667-c12c-4ec1-b4dd-230149e003cf", "value": 70144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654823054, "uuid": "a29c4c18-2d39-48c9-b3ea-fcc506192232", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654823054, "uuid": "108cd0e7-403f-4c8f-8fa0-41b81cc96916", "value": "10ebda388e6c16469d68724bd8333501", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4832cf92-e8a9-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1654857430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857430, "uuid": "429e1ca5-faae-4bf3-833e-2b13a9251c4b", "comment": "Malware payload (RedLineStealer)", "value": "86eaf8864f2b75c0112b8f55b2606e11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857430, "uuid": "7cd764f2-9593-4904-a3a6-8a9496fed90d", "comment": "Malware payload (RedLineStealer)", "value": "5d33e19c8d5157ae072d9ea8c310bd1158c8def035d1a64a5dd9eba2bc5c6c45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857430, "uuid": "c18122f8-fb5b-48b4-8d2e-b210b9bf8fcf", "comment": "Malware payload (RedLineStealer)", "value": "4737b673d7787a6397fe2711a66c75405a12abfa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857430, "uuid": "82c41416-7daf-4105-bdd1-4451a88f4eb0", "comment": "Malware payload (RedLineStealer)", "value": "b7a71cd12cf666f0170ddbda1eb14e392d19a1a3583e5bfff15b0d30960afd66c81dc729f8d8c702c52aa87547a24d05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857430, "uuid": "4f799855-a16e-4bda-8946-49473770d2cb", "value": "T14314EBD0AB5ADC3BF488B474A6818060BE9EBFE5F8D355CE244DF64A493279144F0C2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857430, "uuid": "eb7dd709-e579-4028-bf66-9dad92573d08", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857430, "uuid": "15706e70-33fe-42da-9ffc-7338ebd66213", "value": "768:8Uiw3WnhObkAApSu3oiIDNzeJku9vx/SF5Mbd0oC3d4OoxnrKcSnYR8:oRnkbX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654857430, "uuid": "3e680556-6e49-4a87-ad55-37c7990e65e5", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654857430, "uuid": "4057a0f3-f945-439f-86fb-385e1e28eedf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857430, "uuid": "e088ce9d-167b-4577-bc8b-32c9d6dfe0e9", "value": "Order Samples.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e79a6d24-e8fe-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654894204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654894204, "uuid": "90eaad1d-c947-48a1-afd3-80563363ba8b", "comment": "Malware payload (Mirai)", "value": "5517f2c135daf23c3eb8bf3214beff69", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654894204, "uuid": "e329780b-d046-4d29-84c1-2505a8af6c1e", "comment": "Malware payload (Mirai)", "value": "5d8fb0482046447eb71476026c5c71933aa7b6f51a140c30383362be027425d1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654894204, "uuid": "e744b8e0-e664-4772-9017-8be40370967a", "comment": "Malware payload (Mirai)", "value": "00dd032d78bb9e185709ad5456d7441f6f5906a5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654894204, "uuid": "8b8d96e2-75e2-40cd-99b2-67cda79ca4de", "comment": "Malware payload (Mirai)", "value": "cdaa105232b5d528fd43580f38956dd7805b5a5c43259e0d3af46313c6ec1bf4088b9f1fd604c256f4de3687ccf078c0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654894204, "uuid": "cdf430e8-17c0-44ca-a4f0-cbf2cd9067a7", "value": "T1B1334DC5A643D9FDC8160971206BEF315E77F1FA2154E987E7A8D632AC43702A60BB4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654894204, "uuid": "33365b7e-fd53-453e-bdfd-0f98d99665e4", "value": "1536:x7tpPzZ2DMIYxv1hvYVZU4Rl7h7SpG/Yb+eP:x7tproDY51hvYVZdRlV7SpMYSs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654894204, "uuid": "0fb6ff45-133e-4926-a3cc-1a07cc61a097", "value": 50192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654894204, "uuid": "98db9fb7-8458-4b74-99c6-fc12f51eb90e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654894204, "uuid": "1b2d0592-61cc-4765-8ab0-4d5151bf4e94", "value": "PnBx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d5e87eb-e8cd-11ec-93bb-42010a9c0043", "comment": "Malware payload (Quakbot)", "timestamp": 1654872927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654872927, "uuid": "4aeebcd2-0772-44f9-906e-6d28b46847d1", "comment": "Malware payload (Quakbot)", "value": "d9e15cda8e81e66020e0a501a5b1d541", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama188", "colour": "#E17D02", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654872927, "uuid": "4eafb197-3e6a-424d-b670-b11a7ad5b9e8", "comment": "Malware payload (Quakbot)", "value": "5e973f186b248b880c192d951165fcdc7ddb2c7a00f011e397c0504706714274", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama188", "colour": "#E17D02", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654872927, "uuid": "6ee0156f-0f03-4f9a-8369-fcae4c4b4a7f", "comment": "Malware payload (Quakbot)", "value": "7683c33cd8d8d2d7eadde39e0a3a4dced47fe96d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama188", "colour": "#E17D02", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654872927, "uuid": "99517a1b-1b6f-4eb4-9ed4-31a16900c058", "comment": "Malware payload (Quakbot)", "value": "7ed96e54f68eeba2ce93bb4d388b7d40362d309b105f261bed4042b1779d3c73f4347dca283b9fe101b3ea6175bc0c6a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama188", "colour": "#E17D02", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654872927, "uuid": "76699216-7197-4fc4-9e8e-b5e32679d300", "value": "T10925B062B3905C37C1632A3D9C2B7764A92ABE112E3459C72BF81F4C4F357917B252A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654872927, "uuid": "349c5399-c149-41a3-83f6-857c0480bfda", "value": "20989e3840429c9a803f6f380c7c63b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654872927, "uuid": "ec43e813-26f6-41a3-9d04-4cdccc173d14", "value": "24576:UFsIvAexp4zV2Kk546oeKg/E9gKZy5Iy5:2tGM8L0555", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654872927, "uuid": "dd336fcf-d142-4f29-ba12-e3b03a517197", "value": 992256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654872927, "uuid": "9ae66937-8c43-48d6-9483-655c716ef5c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654872927, "uuid": "1cb56482-e41e-42bd-b532-9e24484d2ef0", "value": "crackbot.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "513547bd-e8cb-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654872048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654872048, "uuid": "171f104f-b786-42af-a99b-2e9c87325a22", "comment": "Malware payload (Heodo)", "value": "fc9f9e28b1d0d4c7f96a884dbab3bb67", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654872048, "uuid": "9d0ddee6-6ea0-4e92-8722-7f448f6e01e9", "comment": "Malware payload (Heodo)", "value": "5f711a737008058f610b0a3a613cc502c0bd26de8a1379b59801a7cbb436fe4e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654872048, "uuid": "ef127e5e-12ad-481c-aa9d-a3eb1643aeda", "comment": "Malware payload (Heodo)", "value": "560b87efeefda0fc1d6f1209b75b8baa131abfe7", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654872048, "uuid": "0721c17c-aa4d-40fc-9623-193e601ec014", "comment": "Malware payload (Heodo)", "value": "8b7211899ad109ec29c9fe95a3e2d4cdf3d6cdf17284437ca804216ac38e807c197863cca6b6e9ab7b9574b2d2efe4a7", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654872048, "uuid": "3d7d4917-e88c-4202-a6b6-570d15d366ff", "value": "T1F3B4140573F43066D46B4D3C859E1A0FE7E67A074BB5D1CA239082AE3BB364279B9F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654872048, "uuid": "520493c8-8e7a-4104-9c16-7c01552a0c7b", "value": "b71031ac72c27db547b44e7ae017554b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654872048, "uuid": "6f36acfd-5120-4c54-ba9b-d858018e0421", "value": "6144:TkzytaJpnASmmaNGQ7DYMT1atZNtpTKIEHzdLAcKhIepZn6kdRphRUQP7LwW1:oytafAS/aNPwHbdcKeep5h/uQgW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654872048, "uuid": "880aaa90-2c1c-46e5-b7c7-2c6088342776", "value": 504320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654872048, "uuid": "c92469cf-5087-4a8b-8a3e-dcdda00a21bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654872048, "uuid": "1feda985-a627-4cd9-b3d0-6ef6ba14bebf", "value": "fc9f9e28b1d0d4c7f96a884dbab3bb67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5383d6f-e8b3-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654861934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861934, "uuid": "960e5028-d73c-4265-badd-f20e52bcc3ea", "comment": "Malware payload (Mirai)", "value": "9f4bae09ef21f4f3b2dbf20cbae3074d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861934, "uuid": "419db901-344d-414a-b573-3104fcb5c524", "comment": "Malware payload (Mirai)", "value": "60a121d437b9b019f541454274b9d82b844b0af41d2261288ce77cef4860c13f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861934, "uuid": "259d9975-0476-4761-bf77-52ef8f507ca1", "comment": "Malware payload (Mirai)", "value": "51689bc15e7ae15a11f548523bba5e01eb6b3efb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861934, "uuid": "ef1a8a9e-514e-4125-aea6-98cd448034e4", "comment": "Malware payload (Mirai)", "value": "638f87d2c1be59dc2c89aaf9bf153614f7f01468f3a6937935db42751e6507fda9edebaea55e57b5b9b5351ff5961540", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654861934, "uuid": "f4b421cc-169c-40fb-8e3f-ce09aaa947ff", "value": "T1B6C2E1E23B89C865EEB118FAE77447467AA60DB9B7EC62730C4496305B8040EB1724B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654861934, "uuid": "20132ec9-93cf-4306-89ea-1c2432190276", "value": "768:/iLWkEhvg3lj7jgjTakay2ych0DVJ+34s3UozE:gvEh4ljy1t2H0DVJuzE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654861934, "uuid": "d1da2f90-1315-40d0-b9f7-f5ee59738162", "value": 28152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654861934, "uuid": "de70f219-0172-4f35-96ad-611abf9972c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654861934, "uuid": "6df69e37-85ff-44f0-b13b-12e06a646409", "value": "vailon.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c08df91b-e902-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654895857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654895857, "uuid": "9692f1e7-37ea-4788-bc10-213f27a39f96", "comment": "Malware payload", "value": "cd79a50203d54c9332f13b1ca518483d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654895857, "uuid": "363fffeb-2a50-4bb4-af0d-3d99b1964c16", "comment": "Malware payload", "value": "60d501c0c89689500b8b9cd4f1c0c37576325cb406a98996a3498039b170fb01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654895857, "uuid": "7e77c0f1-3e9a-47a6-9828-af36489c2586", "comment": "Malware payload", "value": "185b3b927641f51dc25b4ed6393c5cd67df56a15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654895857, "uuid": "0949604e-1b86-4671-8213-ac3a445d793f", "comment": "Malware payload", "value": "a852e031b74ece7b9fb1490ad2f0c6774e54501d14c19f1aef36d6a811dffb8ccae492186e81092c58baa5a068f19d58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654895857, "uuid": "ef54f43f-629f-428c-b641-9c340ebf7f2c", "value": "T144F4E026F669968BCAF947F58820D3303FB06C5E5829D3CA3AC53E8F7536B49411871B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654895857, "uuid": "8516ae10-cc3e-4105-9428-e5fdb07fe9e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654895857, "uuid": "a5c1e8f7-8b0f-4a31-8139-791f65ba0096", "value": "12288:s+dk9q1GdETNXt2fy0wRr63lnbE8luVlXcQF4OD4P/KR:sHZih02mn4dSODQs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654895857, "uuid": "f1581c99-2e1f-4b23-bfc2-f28c6c9e25e2", "value": 725504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654895857, "uuid": "f7254be5-864a-4c12-bb71-e9f78be67dad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654895857, "uuid": "267b27d8-a2c0-4774-befd-fb7fbaa79e21", "value": "swift copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65385680-e8aa-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654857908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857908, "uuid": "0dfab429-7587-431d-bddf-890304293815", "comment": "Malware payload", "value": "7c783fba8ae20da59f30b8c84e7ef64c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857908, "uuid": "a7159f49-30d5-4ba7-b3b4-d641a2f0f8cd", "comment": "Malware payload", "value": "60f0359eba674e7f697ee9d555463cb1bd40bbfef83338af25cc8cbb1cb0d5a7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857908, "uuid": "6aa14584-8f6a-4b16-aa7e-034e3905f1a3", "comment": "Malware payload", "value": "bbec01389a7f24309285a6065261b37e41a66647", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857908, "uuid": "26e4bc08-cda1-49cb-8e59-e007fb05b494", "comment": "Malware payload", "value": "7429a477387f4994290155ece4b00dfe11ed7855236497d57e433095737b21c291eb93af5393f7d6cad2d87fd113f22d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857908, "uuid": "74d254db-679e-47c3-83fb-03357801276f", "value": "T1CD83F1275F04C461D7D20F384AF15FAC86B8DEC1AD63EA4EA86E734F35B9A041E0B615", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857908, "uuid": "0338d221-d619-4de6-954a-c61dbc3d901e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857908, "uuid": "8d07124e-7d37-4835-84e0-1ecb63b158b7", "value": "1536:CxJDvabrK0uBgrdB7Kgql2UlsrfMdmvorGrl/bfkBfdfgZU8UlF1lV/OxQi4ttJ:6JouBgquU2rfnGGrlzvO8Ul/lV/1tn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654857908, "uuid": "804b2b90-90ab-4f6a-97e4-8be1fe4ded92", "value": 86016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654857908, "uuid": "a12af0a7-5491-4cb8-9a3d-86118f43a8a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857908, "uuid": "7bdce51d-7534-4cbd-8a44-6809f0aa55f4", "value": "7c783fba8ae20da59f30b8c84e7ef64c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "076a9d02-e899-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1654850449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654850449, "uuid": "dfe7b99e-5e29-46f8-ad4a-fee1bd58c4d6", "comment": "Malware payload (RedLineStealer)", "value": "034f039728084f16eedd6acbc71254b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654850449, "uuid": "d24c7fdc-a441-4246-81ed-7dd2b5a92573", "comment": "Malware payload (RedLineStealer)", "value": "619f5a3ef5b1bb8acb34dc7d6a02c0a1acb3a1f6672b77304ab3e2527f47f1b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654850449, "uuid": "9d05ce98-1f71-47e4-b294-eb46e43bae11", "comment": "Malware payload (RedLineStealer)", "value": "7aa1c7ec82fc1dc79d046ee38b1e25a6140ce431", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654850449, "uuid": "d50b55a4-55c6-4f82-afca-4e2cffacff90", "comment": "Malware payload (RedLineStealer)", "value": "c76ba33eb2811b096360ce91c2cb58ef54485614a253a2cf04eb9a3885fea4798ea8157867dc2762dac9908a21e85108", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654850449, "uuid": "6a83e64c-9da4-4228-a287-72a80b3d1063", "value": "T1C7B519039A8B0E75DDC23BB461CB533B9734EE30CA2A9B7FF609C53599532C5681A742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654850449, "uuid": "ac162aa3-9474-40f8-841b-56d53234a9ba", "value": "5dd6748a8bf8c3a3d51aac89447af978", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654850449, "uuid": "57f38d56-f76a-4f55-9b28-416f56e3e154", "value": "24576:IrASjvMY6Qj/vykjucdD8zFVSCDN3rrG7tKC4MOTJuQ5p3h3GGzE:IrASjvMY6sK9ZdN3kKCevE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654850449, "uuid": "98ba8eeb-6f3f-4987-badb-43b280a3021e", "value": 2327727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654850449, "uuid": "9015b587-93a3-41e6-bb67-9a922b0f5483", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654850449, "uuid": "450a0bd1-2844-4125-a980-f7dcc91573b2", "value": "034f039728084f16eedd6acbc71254b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df905bf8-e912-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654902781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654902781, "uuid": "45f9b56b-ebd4-424c-aeab-19b51e3af681", "comment": "Malware payload", "value": "2f3ec506514d5721f6709aaff06413c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654902781, "uuid": "9fa6f1a8-c52f-40b8-b00d-82be3b6a740c", "comment": "Malware payload", "value": "62f5870376119c966b7a8c8f4a0ed4f4ea6fd62f92d2a0dddb089e0c374220c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654902781, "uuid": "97217c50-eade-4a4f-8347-196ca2b27407", "comment": "Malware payload", "value": "8d0a080aaf0b06a3953857881751aaf6641dde45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654902781, "uuid": "6f6709ef-2178-4999-8ab4-f0b50f2824a4", "comment": "Malware payload", "value": "4dfa20b4a51a04f586e567c3b00b2521e391ab2873163f8b10fa30effc6f08a3d68c3a978d914d6e0698953c420032c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654902781, "uuid": "ca796869-cef5-4a9d-ad6a-25ef1040592b", "value": "T1EFB4140573F43066D46B4D3C849E190FE7E67A074BB5D1CA239082AE3BB364279B9F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654902781, "uuid": "eac83494-f491-44d3-addc-d984320d7f58", "value": "b71031ac72c27db547b44e7ae017554b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654902781, "uuid": "5755d5ef-cd25-46da-88dd-c4db6a218bed", "value": "6144:TkzytaJpnASmmaNGQ7DYMT1atZNtpTKIEHzrLAcKhIepZn6kdRphRUQP7LwW1:oytafAS/aNPwHbjcKeep5h/uQgW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654902781, "uuid": "571accf8-6b1c-48ac-9a68-0d7e61c481d0", "value": 504320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654902781, "uuid": "b3b06793-1df5-4cc1-850e-c4252540f90c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654902781, "uuid": "12690202-eecc-48c9-b297-05d823176a8d", "value": "2f3ec506514d5721f6709aaff06413c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28f30e70-e890-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654846640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846640, "uuid": "921eb995-cf5a-4fde-b6a8-ecc06fafe307", "comment": "Malware payload", "value": "f3f66e19772f33cac82d8cf88b0257a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846640, "uuid": "e6a7b615-7ecb-4895-9163-bc835f05569f", "comment": "Malware payload", "value": "63499ea2f5bb554931547eb8cda06ce7e862a0c81ab68ba42b71a722fa2fc853", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846640, "uuid": "c2221f84-0be1-4b00-879f-5d595270057c", "comment": "Malware payload", "value": "a24ad0f5adbe90308b0d178c37f70263bb139fd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846640, "uuid": "8b378f02-dde3-43a1-8d84-0414204ec765", "comment": "Malware payload", "value": "4e494bc5b028e1519b9ba1bd25aac694da228f41b996b91ae6226912f6f08b8c95f7d9302901afb641457d94679953a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846640, "uuid": "4bbb3d49-02e0-4d76-9b58-97fa15f50f20", "value": "T18586331027F015A0DD77C57AE8A6863BC6D2B42A6329E31F43A0C76B1F175E11E7B392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846640, "uuid": "87635611-af85-4a02-95f9-5c9aee878d18", "value": "1e92fd54d65284238a0e3b74b2715062", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846640, "uuid": "e481f2f7-ebce-496f-928f-991427e8f52c", "value": "196608:/+H0vW0bF7FoRE2nOL2VsTNfwZHYY8TFDhk:2U1FeREWOL2VsBkET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654846640, "uuid": "7c91868b-037f-45d3-99e0-f24b46126e8d", "value": 8013939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654846640, "uuid": "7180978e-fe24-4462-afd3-0176d2fedc42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846640, "uuid": "ae7eabc9-a689-4112-916c-e774a25c5506", "value": "document.docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74ced6a6-e90f-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654901313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654901313, "uuid": "6c6f3510-1348-4123-92a6-08e4ac3a8d82", "comment": "Malware payload", "value": "bdacbd663f585ce59e37511b498e103d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654901313, "uuid": "6b28aec6-9ba6-4ae8-988b-ede855225be4", "comment": "Malware payload", "value": "6410cb96c680540438b642756fa9cd68c03ba1685660e25b5122b0612af5ddf0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654901313, "uuid": "b20fe4d8-b1d3-4fb4-b7ab-8adc65c242b8", "comment": "Malware payload", "value": "f5aeef8dd06a9253c94d50472b487fe61c8fb37e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654901313, "uuid": "50f96f21-a7f7-4510-a633-64b0e7676d50", "comment": "Malware payload", "value": "09868b2b5d940f7a3a31514ddfdc2f2d91ff262f0cce3df590826b2550bd2be8a153adb918f10574bb2a7d0a54a3f229", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654901313, "uuid": "0e90465c-f4da-4803-902d-dc9a16991f51", "value": "T190B4154533F4306AD8678D7C849E0A0FD7E17A174FB1D28A135086AE3BB36527AB9F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654901313, "uuid": "6f2fa4bc-ec7a-43cc-bbe7-8ec8cc3f7b82", "value": "b71031ac72c27db547b44e7ae017554b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654901313, "uuid": "28d28e06-13ff-4cc0-a71a-8116d57bcb02", "value": "12288:fytPfASAuSvQnbGHorHDKGwC4ZTJxlGRS:fy9fASOvQWoTDw3XC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654901313, "uuid": "6fb792b0-a355-4b90-942a-cf865eeb5dd8", "value": 508416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654901313, "uuid": "39ae316c-9889-4575-a2fe-c1054c27ebe4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654901313, "uuid": "bf3d0a94-7278-4101-8a5a-c8f815b4e20a", "value": "bdacbd663f585ce59e37511b498e103d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f559fd4-e8b8-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654863777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654863777, "uuid": "d9c0160c-3c07-483c-bf34-835c1684da14", "comment": "Malware payload (AgentTesla)", "value": "c12821a350021bcbff3045370da650f0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654863777, "uuid": "ba6e0340-e143-48de-92f1-2dde27d1ee8c", "comment": "Malware payload (AgentTesla)", "value": "660f823208f8966ae493dbe6c064ed7b38b93701205ff6ca2ee035433412c388", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654863777, "uuid": "47a5490f-bd1d-40e6-9ca7-9b430dafa17e", "comment": "Malware payload (AgentTesla)", "value": "c0bdbd01eb48646d16f738c7c1d8bf45f37bbd29", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654863777, "uuid": "3a885a64-159e-4628-8b66-5d8ed2e0050b", "comment": "Malware payload (AgentTesla)", "value": "00804906b1598f41d7c61cf95fa412f1e32fd9a7ea8f519bf57b2ba700dc939faaef4eb42900dea3a8d4c4e9831faf64", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654863777, "uuid": "084cfc9b-b2c3-4981-bd7a-e12c6d1678eb", "value": "T1EDB26102F684C3B0E3A6567778EDB10CF39A9C2C061BAA92F4987D5D1A722D11DF653C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654863777, "uuid": "139ffac7-31d9-4843-b519-1773cef0bfd9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654863777, "uuid": "a731ce92-1cc1-4d33-ab9a-6ff852d45f21", "value": "192:63MOreV06wlj52yhA2tG3OCZ5nL1EvNesGPj8WiCWfD:68FdwlgyS2tG3zhivNesujMT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654863777, "uuid": "84bc5cf4-a971-4563-9e55-ebf462e2888e", "value": 25600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654863777, "uuid": "d6e8f4b2-8df7-4df8-be31-39e42c325ac8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654863777, "uuid": "87cdf5d2-12d6-4580-91bc-69f3cfa5b292", "value": "DOC_UNIC.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b1cf4ad-e8b5-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1654862508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654862508, "uuid": "491da177-e7e2-42aa-bddd-bec25b825fe2", "comment": "Malware payload (Loki)", "value": "e1d4ac9d7419f64f1aa1690bc826cc7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654862508, "uuid": "04a468c5-75d2-4a89-a309-f662b78afcd1", "comment": "Malware payload (Loki)", "value": "674c5b8047dd2e40cbbd5b86b99b5191cbfb999f97b751e07faf8f8f882dd99b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654862508, "uuid": "48fd36da-e17c-4697-bd68-9692a7fb53f4", "comment": "Malware payload (Loki)", "value": "aeb72d25afc9c717a5b8209bdde084ad765254fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654862508, "uuid": "bfb1d1f2-b612-414d-a3d5-cf1affef88f9", "comment": "Malware payload (Loki)", "value": "4de33806ad5dece7b147ac4bce3bde7681381f65ea8a6d60fd6e8405839f6e334658017556537058c5a0365b6397924c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654862508, "uuid": "29fc2999-40bb-4d87-b02b-962a7f4b8863", "value": "T1ABD4E11A7506E99EC40A8537C5DA1C1453A2AE97172BE30BA887338D5E1F3EFCF065D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654862508, "uuid": "6a9736e7-7768-45f1-8c54-f1b5a77ce4c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654862508, "uuid": "a8428cd2-b7a4-4ed0-b9e7-dbfd1fd41137", "value": "12288:8T98pHrO9qOEKvCm0tlpFUp3OXd9Ug5bcBqPP3/3O:8T988wqmlHU5E9xbcQW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654862508, "uuid": "6a826a5a-1521-413c-af5a-2abb42fb87f4", "value": 601600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654862508, "uuid": "aee405bf-cd7f-4fb3-95ac-97e9021b4645", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654862508, "uuid": "e1781587-ddb0-4835-bb70-348b49ec8900", "value": "SOA-MAY-2022_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68db9b44-e863-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654827420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654827420, "uuid": "39b216d5-6b5b-421a-8eeb-fe46faa12d24", "comment": "Malware payload (Mirai)", "value": "727c33f5189406fab59958e79dbaf4ee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654827420, "uuid": "dbc4fea4-ae35-4ed8-bf66-f5eb28086cbe", "comment": "Malware payload (Mirai)", "value": "6852b28f76578b8078a7aae57c7ca0ccff3e33d44cd3d3bd314fd5efb408de1a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654827420, "uuid": "f5604e90-4c13-4a75-9a7b-a944a59891cf", "comment": "Malware payload (Mirai)", "value": "aedadd4235472a701837d4ebdd6553536fb25167", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654827420, "uuid": "db40a56f-07dc-41c8-b028-870e528cfb44", "comment": "Malware payload (Mirai)", "value": "81fb22b05f837014ed20ad417bb6226b305aff4683c4d1f45cf91ca20cd09e71a7409ea4a531d3659152c93d12c110c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654827420, "uuid": "642f8bdf-622f-4309-a1f8-9c53076711be", "value": "T1CF53BD36C02D1AD4F5984178B265DD3A5313EA0492633DF252DB4AA2600FEF8F95E7F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654827420, "uuid": "c5e04267-2037-428c-9142-2814c57b0cd7", "value": "1536:qau/pM1dbYeKLhz8vo3+4i6B6o6tE+frQRWycCOC3a10:q/BMnKL9M4i6BlwE4rQRWycx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654827420, "uuid": "15ad9822-011d-4065-84d6-30854b3efc72", "value": 62620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654827420, "uuid": "158c71b6-3f65-4342-bc60-dd3ed3c3821e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654827420, "uuid": "db78c96d-d613-4844-b368-436fccd072a0", "value": "727c33f5189406fab59958e79dbaf4ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dac2334a-e8a8-11ec-93bb-42010a9c0043", "comment": "Malware payload (XFilesStealer)", "timestamp": 1654857246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857246, "uuid": "db5e7480-03de-4c75-8608-36b682ede02a", "comment": "Malware payload (XFilesStealer)", "value": "adbd2a613ad5330d06b3f7ba5cc0c744", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857246, "uuid": "2a68498f-8256-45b1-996c-5f27a5123eff", "comment": "Malware payload (XFilesStealer)", "value": "6890333ee72c3d8d290232864a255b4aa749ae1901c28ed572e36fb1a9340fbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857246, "uuid": "cf26e427-e7e6-4d0d-9e94-ae3beada15db", "comment": "Malware payload (XFilesStealer)", "value": "bb6257a2889145c81eeb0f5ab43ba7061bf71edc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857246, "uuid": "66f4def6-5317-4b79-a850-4d897c34f1f5", "comment": "Malware payload (XFilesStealer)", "value": "17bf6a319bf90e7c42925772acbf5a084aefa30b7f17740dc87c18c8f50be0e03ec8379c70d703edd494504d4a4114b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857246, "uuid": "1aa8723f-064f-4133-8c2e-e7497474fba5", "value": "T1B593DAC49608F275E83A9733FC01ABF01D152D8FEA061347AAB9BF7535B950E29094F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857246, "uuid": "dcab4583-dbbe-4d91-bf61-8e94b059fe02", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857246, "uuid": "c5b3d2bd-f291-427d-8862-ef3e20c131bd", "value": "384:3g0VAxiHHKQdKLMHgCsedTufKcD8XObCi9/dtFpJYzM4is5+DrrhijqvV+9PK:wGrACfdTnqrKqN+VK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654857246, "uuid": "fecf70e4-3dd9-401d-a875-c907c819da63", "value": 95312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654857246, "uuid": "fff6e527-eb2e-4cdd-923b-83968bcf4fba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857246, "uuid": "b54ef9ba-7a7f-4331-9b2b-3939b2493c46", "value": "6890333ee72c3d8d290232864a255b4aa749ae1901c28ed572e36fb1a9340fbd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01259664-e8ee-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654886946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654886946, "uuid": "5dddcaed-5302-4d7a-826b-6d55c93ddb0e", "comment": "Malware payload", "value": "c229b8cef207bf5adc35fd088b6debff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654886946, "uuid": "6058b973-7b6a-4cb6-ba1f-13cf92ede068", "comment": "Malware payload", "value": "693848bcbfc40e2fc1fce81fb8ac3667d8b8806e1daf7c4f505be8680d72b31f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654886946, "uuid": "74ab17e8-6d77-46f6-9e87-7fd3deff7032", "comment": "Malware payload", "value": "ac49c823038bf961975a1efa35b4333e18ea8827", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654886946, "uuid": "1d0933ec-b1a7-4632-9732-06e8a30def04", "comment": "Malware payload", "value": "afcd87c01776fe5e78e37d4443e89ff4b582713ed018fcde135570f5e203cc36c73a7a073a996e8550a397d3eb5d7f9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654886946, "uuid": "1a5d2f26-f515-4360-bce1-0877f7cd16a1", "value": "T1E634A406967651FBD871C0394662E633B9B27C1A933497DF87D44E233F62BB0A939B10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654886946, "uuid": "9d2c8be6-056d-453c-b9c0-62bdaa2bc868", "value": "b561dc8699ab63942966f576cd8f7664", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654886946, "uuid": "ba9244cd-0d7f-40cf-8779-6d372b76b136", "value": "3072:HOoTzJzhYV/Mrc5i50hTloI566aGgty3I6Eam6fxr1R:H5hU/In5ITl7566a6Esp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654886946, "uuid": "bc803607-53e6-440b-b8a5-9f4c720077d4", "value": 240640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654886946, "uuid": "4bd110cd-4ab9-4f30-ac52-2f545ac94e98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654886946, "uuid": "9fb163e8-edec-40c6-8442-156502a162de", "value": "SecuriteInfo.com.Trojan.Inject3.40194.14753.20529", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3dd11f3-e8e1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654881689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654881689, "uuid": "7365ef2b-d029-4e16-b278-f39afe112b49", "comment": "Malware payload (Mirai)", "value": "06baf5c3813bc46e94263ab5c016cd3e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654881689, "uuid": "88d91364-2379-456f-af6c-d24a62a11aad", "comment": "Malware payload (Mirai)", "value": "69f24ce93ca7cd003c87c11ee60f9250848ef1e765289442a23f2aa79ca103a5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654881689, "uuid": "9b469fd0-8a39-4318-b540-a3712beabef7", "comment": "Malware payload (Mirai)", "value": "090262472affa98c444cd3c10906022b4845a587", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654881689, "uuid": "6c93ab2b-c367-4da7-8aff-7b24766cb9b9", "comment": "Malware payload (Mirai)", "value": "97a5d781f935ec280fa17b96520573aa444a9cd9db338d5d67760deaf23f11ccb4b46d67dc82977b469dd05ca970345a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654881689, "uuid": "751e5ac6-2326-4aea-a287-a7be765d32bd", "value": "T17AE2D1716311EB1ACBB04872E734024292951BAC22BB65393D820876A9EDF5776F8773", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654881689, "uuid": "f496054c-35d3-42b9-85fd-c64974b21dbe", "value": "768:Yd3O5hzBcSSYBi2puLmi1hsbiYAaF2ynsp7s3UozZ:yObzjSYAmi1hsuk2yspmzZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654881689, "uuid": "f610d3b5-914a-4b76-b661-c6484d4e0f10", "value": 32068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654881689, "uuid": "f45d24d4-eaf0-48fc-a477-fc71c85eadba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654881689, "uuid": "8bd39de6-ba2b-4dac-9881-7791beb4f209", "value": "06baf5c3813bc46e94263ab5c016cd3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a44014e-e8b6-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654862963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654862963, "uuid": "95680779-a8df-4a99-bee8-d48d70428f9b", "comment": "Malware payload", "value": "0c1b5cd8de9c5643abdeefbea92bcf99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654862963, "uuid": "c7792079-d52c-4e01-93a0-988e0865d931", "comment": "Malware payload", "value": "6ad72a7e5c6a6ddf53efe7019f0e1e187a4d656a3e2f9ae075aee20e5a443c66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654862963, "uuid": "030bcb22-9b32-4c44-a82f-51e14a6d0ed9", "comment": "Malware payload", "value": "47fc961d8024f987fbc6a771ca3c4ce1fa8f3c48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654862963, "uuid": "58f9094a-e7f9-4575-9e91-eca763cd7023", "comment": "Malware payload", "value": "c4dd742a8e15d903d4351b857beb2d3514bdb9841614eeb7d5aff58519a964b700e1c5ec2d619ab56e5690e1cd7fe75b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654862963, "uuid": "08f07cab-19b9-4d1c-9815-19a99bed76b7", "value": "T14CB1A519D5500897D8AFCFFA0AB7E60C6EB42110671542790A2B8CCEBEF4B253455786", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654862963, "uuid": "ed5bb58e-def6-450d-a9d0-cb436c93053a", "value": "157531becf28d6f7d1f7c1afdcb57488", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654862963, "uuid": "e188b8e8-d8b7-4781-8444-a8706719d38b", "value": "48:qvS0q5jVsMZL+rO+ZAbGBpJRayfhGDMQd2WdO+ZUI3ION2/ndNw4yO:CSlxsMArO+GbEEdO+1n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654862963, "uuid": "6ea6a536-66d6-421c-9ef3-e43f6297560e", "value": 5120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654862963, "uuid": "f85e118d-6c7e-4c6d-9d3a-326ff6193212", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654862963, "uuid": "b4a834a5-3294-4275-b010-aa01883feecd", "value": "SecuriteInfo.com.Variant.Razy.633639.32674.4478", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1d42b2a-e8a3-11ec-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1654855030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654855030, "uuid": "225e4311-c8f9-4b4c-8a49-63f1b1530b69", "comment": "Malware payload (AsyncRAT)", "value": "a4bc79c3e5cfdde8fd39d429e487a81c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654855030, "uuid": "23cbba54-5fdc-4de9-b559-ab0e99c5c377", "comment": "Malware payload (AsyncRAT)", "value": "6b0cc9619acedf4605e43786ed2777ed3142ca34c93524e5df941243364f7287", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654855030, "uuid": "1341f000-2bd5-437c-ac61-9e9cb6c99d0d", "comment": "Malware payload (AsyncRAT)", "value": "cf8b2b8f9ad256b21e0d1d1ea1636b73e2464419", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654855030, "uuid": "ab249f21-936b-4555-b43d-99755cf7c70a", "comment": "Malware payload (AsyncRAT)", "value": "6402b2f0b85b099b4b6b1350b6c617c3e8a44d7bff709ba38b76dee25d286550fe294439adce2e6fced142cf0d0d51a3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654855030, "uuid": "ab6d29a8-978e-452d-adb2-331ec72c4d7d", "value": "T162232B003BE9812BF2BE4F74A9F2215585BAF2677603D64A1CC441975B13FC29642AFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654855030, "uuid": "50b487c7-43c5-4c23-a69a-cf83941bdfab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654855030, "uuid": "f6f713b6-c778-4496-bb86-33a4ed53ffb4", "value": "768:CuIadTsErkZTWU/APhmo2qb2WkKSu5CyCHUPIhRCO0bVJTdVLBPO5TXiuDqVBDZm:CuIadTsX22HWQmCdZhRybVJpNBPe7iE3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654855030, "uuid": "2ac531cc-0be3-4686-9a77-fdc77a0888e5", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654855030, "uuid": "81068704-00c5-40d2-b0ec-7cd5edfd06e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654855030, "uuid": "7fe5cdfd-9c5f-46af-8a5d-0271eeb8b009", "value": "payment of invoice no23562.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "277689d3-e89e-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654852650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654852650, "uuid": "79155b68-6c50-4539-ad53-4338c48db175", "comment": "Malware payload", "value": "175ed4e47f1c3c01a4be9171d229c002", "object_relation": "md5", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654852650, "uuid": "91c30812-aa66-4ac0-a4aa-8999ef06f2d8", "comment": "Malware payload", "value": "6ba9a721584cf373d759cab90fef85981f14335b4214ae4dab88426d8ac6e464", "object_relation": "sha256", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654852650, "uuid": "156d76e5-8dc7-4584-bc61-e7286faf1fb0", "comment": "Malware payload", "value": "75fc50c5e919a2083d114f4fd8c0334b19a53228", "object_relation": "sha1", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654852650, "uuid": "48595fae-6f3b-434b-b52e-33cb468e3ca6", "comment": "Malware payload", "value": "77acef3bb31262a1a39db9b5212411369c0e633b4986607291ceddf189f3eb2ea3c9b3b42214a6553eb7d7acd4044596", "object_relation": "sha3-384", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654852650, "uuid": "f394405f-fe7f-4a38-b867-d7606882301f", "value": "T107F2F1DD4C71AC36BF57C6E311386D71838A273045A4211ECBA2980C9E5B1E7897D2DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654852650, "uuid": "c2009345-f8ae-4f41-9b61-44700c975b08", "value": "768:D+WTE+Sgy3tvtJ9VGWfNOxryjH37KiAvjUFmwsYVHXHifRxrX+hKH:KWT4/JiWSrg3PXb3iZhuhKH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654852650, "uuid": "df9bb3ce-1381-4ccd-81e6-08b14f2e1a57", "value": 35886, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654852650, "uuid": "27c19b55-1342-43c3-887c-ce0511896f1d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654852650, "uuid": "f1fb8908-d9da-489d-9a5a-e58f6ee76c9f", "value": "Dokumente_886582483.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e090f506-e903-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654896340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654896340, "uuid": "1f149065-de11-4b54-b6bf-f4513f91ecd6", "comment": "Malware payload (Mirai)", "value": "b91344628923da6b4a9b705725f13f39", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654896340, "uuid": "faefa145-3cde-4642-8601-3fc77e2924d3", "comment": "Malware payload (Mirai)", "value": "6c62d126d8ef6fdcf0c261d463e56cbd1a978b4799b96450107a13a8e017b576", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654896340, "uuid": "a8a67788-00f1-4060-814d-ee7027b2440a", "comment": "Malware payload (Mirai)", "value": "ba1e95ec9b8dfb7320e26164cd5fc52188fc13db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654896340, "uuid": "ca5db634-df25-4779-bf06-59b45e12d523", "comment": "Malware payload (Mirai)", "value": "469aae05cef5ca341ce665940b44b3d96c435db9b77670d1a24c247220e9e6a2093a0634dae4797794affb25a73e7a6d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654896340, "uuid": "58156652-4b42-4874-be95-8ee8093fe90a", "value": "T1FFC2D165E4A12D85EEB6EC765C51C3D87FD08A49C7B3EEE2B8C0EF14ED225023084D69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654896340, "uuid": "9af67258-0575-477a-97ef-a2ecf1f91930", "value": "768:MwxVZ4mSZRmtorE5rbF4qCimc2i3Rar44uVcqgw09Q:vzTtl5vF4xuRZ4u+qgw09Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654896340, "uuid": "ace8786e-865d-4aae-aafb-009165bfac63", "value": 27560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654896340, "uuid": "8a321d31-05ea-4472-a6b1-8cba276816db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654896340, "uuid": "3346c1b6-fc74-4c3d-aaae-ddd752aa5145", "value": "b91344628923da6b4a9b705725f13f39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1da96ab5-e8b6-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1654862942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654862942, "uuid": "27b7ca0c-d5b6-46ab-8f8f-2295ee6bbccc", "comment": "Malware payload (GuLoader)", "value": "0007553091df229a5b4a3875969b6350", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654862942, "uuid": "1705338d-e334-4378-8d97-13e0af90330e", "comment": "Malware payload (GuLoader)", "value": "6c80e964259187acc6df438d652faa5859fcbef7a91b5f571a62a7472cb7059a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654862942, "uuid": "1b88911f-06af-4bc2-ad5f-731fbec83ef6", "comment": "Malware payload (GuLoader)", "value": "25c8bdf0a07e2b02f418fb9222b81315bd1c60dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654862942, "uuid": "5a27c741-ace1-4618-a0a0-f04c4a8ef3f9", "comment": "Malware payload (GuLoader)", "value": "2537a4f3db0764cb5b4342154254a84dc6c6c2756b50605dd293b9aef1e111f732dc5bd0ce37833d89c22e899d39f20d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654862942, "uuid": "f4f3c574-3976-4080-91e4-8de7b1cc9fd6", "value": "T19D94E190B698C95ACEA453354C3B8D621772AD79BEB0864F236D7A2E3F731C3050B356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654862942, "uuid": "555b3acd-af8a-4bc7-b34f-b7a12a5d7378", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654862942, "uuid": "9e706795-c2d6-4a48-863c-12ee50c0abb0", "value": "6144:UbE/HUd+p92sncIWg1JbFkjPK+aM9aYNFhmznsgOVvSpuGrG+ZZ64v0z:Ub0p9l3Wg1tFkm+AoosbKjZH0z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654862942, "uuid": "c8caf799-fd10-4307-b1b7-d4ae5389a87f", "value": 440688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654862942, "uuid": "9d4cd93e-79e2-40a0-b2ca-d3042d9f1b58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654862942, "uuid": "0ba1cb38-7e02-4746-9be8-9a8b71364c03", "value": "SecuriteInfo.com.W32.AIDetect.malware2.14628.10271", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6599439-e8a0-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654853749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654853749, "uuid": "97bb0463-9a5c-4435-b394-a5a448586ce8", "comment": "Malware payload (Mirai)", "value": "4d30a1a8e29ecd507dcbf6f49c6080e5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654853749, "uuid": "6ac167ae-a2cc-4dcd-b0fa-cc848f1d57ca", "comment": "Malware payload (Mirai)", "value": "6df9002e84fd39a8fa47006e8e006b324001fe344a0ffed2df721e7f9dcc9399", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654853749, "uuid": "dea42d2b-6467-485c-9fa7-452ed885ab7f", "comment": "Malware payload (Mirai)", "value": "6a64323014cec3b344676fc3dcc5f63e4c990fb3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654853749, "uuid": "866393e5-e1c3-446b-b037-7adf149d5bf0", "comment": "Malware payload (Mirai)", "value": "1dafa7815136e05311f118ef5c3427d55e295bd2e1ea8e985ee56e2b22f48d14141ddffccd26e73854f47b6df9c83f05", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654853749, "uuid": "b68131e5-12dd-4ce3-8c56-0bd3e2a55fd4", "value": "T1F5830846FC918F55C5C922BBFA1E158E331357ACE2EF72138E146F2427CA82B0E7A455", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654853749, "uuid": "4c7dbfc1-8d8d-4e0d-9516-c26feff93ba0", "value": "1536:j8n2NVO0NIfJqMaMjP5JkawkbX6hxA5rfWqbBdhWa94bt47O2cdI3iWoIXGeYV1X:3NVEqMdPwVkbKh25rfWqlnJ4BqRoIXGf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654853749, "uuid": "856027b0-47ce-49aa-833b-e5bde211abc1", "value": 87516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654853749, "uuid": "875e2c20-a82f-457e-a7f2-0128455aeff1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654853749, "uuid": "5e507b05-332b-4da5-87dc-1724947dba3d", "value": "4d30a1a8e29ecd507dcbf6f49c6080e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f75a59c-e897-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654849764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849764, "uuid": "493ae0a4-639c-499a-ba67-c5e30b361a4c", "comment": "Malware payload", "value": "0768fd9a6c0344944a223b28eedff41f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849764, "uuid": "8ba101d3-6bcb-49ed-b501-22583d2c5c2d", "comment": "Malware payload", "value": "6e3f4c2e85d7fb134f7ca95e0593e76447baed8c9e2def7ae94d88bad3257189", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849764, "uuid": "2f70732b-92fe-4089-955f-2c53f2bca227", "comment": "Malware payload", "value": "7c6747ffd37ebd058a35320de47d9d67f040e96d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849764, "uuid": "bfdc3ac2-fc2e-4e79-97c3-7a35f9e77c24", "comment": "Malware payload", "value": "9f0d67353931233d5c0e2e9d3657c254edd38bb4cc534403be17dde162a26388a5e96e7e9424f6ce2b708774aeb1be82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849764, "uuid": "c272c300-b8db-4a81-9e39-5fb58bef4563", "value": "T111D5234B7CC19DB2C56605371729AEA4207DBD205F10CEAFE3A4FA4FAD314C05A29A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849764, "uuid": "0ad4303b-3a3d-4673-9703-ad5a075241c7", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849764, "uuid": "267e677c-8334-4871-b544-daf32e6f5afd", "value": "49152:384l4M9Pb7Tv/lz5sYv7nuJBuw5Jxl3IzIwwL3ajg7A1fF1NudkhBKaolz8x6PGL:3oM577/lzCYvURZ/L3a31fjmkhB0l8Ca", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654849764, "uuid": "3e88a451-fc31-4ae4-8c56-6ff9c03729cb", "value": 2968714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654849764, "uuid": "a34a2e8d-eb6c-4b51-82ef-b91a2d965739", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849764, "uuid": "cad951ed-f086-465f-adaf-e57e26aa0d5a", "value": "\u3010\u4e0b\u53d1PPT\u3011\u6c47\u62a5PPT\u6a21\u677f-\u4e2d\u56fd\u79fb\u52a8\u901a\u4fe1\u96c6\u56e2\u798f\u5efa\u6709\u9650\u516c\u53f8ppt\u6a21\u677f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09ac1560-e868-11ec-93bb-42010a9c0043", "comment": "Malware payload (njrat)", "timestamp": 1654829407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654829407, "uuid": "413962c1-e393-494f-842e-2178ebfa88ba", "comment": "Malware payload (njrat)", "value": "57d42220b60b7ce75d5bb688d7752629", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654829407, "uuid": "48987227-1101-44f4-aeca-a502782950d6", "comment": "Malware payload (njrat)", "value": "6ed188a93cc1c9ec74fcba1cfa49598ac74855bd4f69e0bd2c1b2fc5b2349333", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654829407, "uuid": "b1f62255-1266-4c69-8da9-7dcc87216cb5", "comment": "Malware payload (njrat)", "value": "01af24fc10c0bb8a624c29f7bc7d385e25405fc0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654829407, "uuid": "22f736ea-bcc1-413a-b9e5-515ada9ca853", "comment": "Malware payload (njrat)", "value": "9fec46a650a2075e51388e4e7875abd34992a3a316b5fdb07c21978a98206d5a24e2b9aae8655b5ff8cd452129d7d6de", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654829407, "uuid": "3203a994-d312-4d84-adaa-457419d807d9", "value": "T178733A4877F54A12D1BF0DB5897292220B35FC076A26F76D09D174AA5FB36C08A09FB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654829407, "uuid": "146af34f-7e71-4143-a49c-4e30566ebda2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654829407, "uuid": "00cef2b3-a1fc-4bcc-a637-e427095b5d93", "value": "1536:+crXV+w62EDpES5wpOk3JCK6pFocTP6fOpd/9nEh9TGKJUR:jtQwpOk5CK6YO/9ESKJU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654829407, "uuid": "414e9439-0d32-4e59-9ede-17c5b700f4d3", "value": 79872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654829407, "uuid": "22bfdbe0-2a2f-4804-95b8-1bd74c90ae01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654829407, "uuid": "80f34ea2-d82c-44fe-8482-34e30fa7dffb", "value": "57d42220b60b7ce75d5bb688d7752629", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7c606d3-e8e2-11ec-93bb-42010a9c0043", "comment": "Malware payload (XFilesStealer)", "timestamp": 1654882071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654882071, "uuid": "dd92e77b-47a7-4fcf-ac32-75815822760d", "comment": "Malware payload (XFilesStealer)", "value": "70b3a4540634b49fde78970bae68d17f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654882071, "uuid": "bbbac7f9-e863-4c44-adc3-e81ced3857a5", "comment": "Malware payload (XFilesStealer)", "value": "6ed229f6ccb424c901421bc0057e6b22e5b8fae926e2e7e1ef3d0cc8baf095b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654882071, "uuid": "8ce7dda9-dc78-42f2-b8ae-e6d589ff6d4c", "comment": "Malware payload (XFilesStealer)", "value": "4f87eafe413a864c067bd9c88473c6363873681e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654882071, "uuid": "165774e5-beec-4d9d-87d5-95174b438ff5", "comment": "Malware payload (XFilesStealer)", "value": "aed54ea9e182ba6fb7dd7bbf9f42718193f4c58c81c14ea4d8770c8145d2dbcfcf244640d1da599157dd5d8e0e1d7124", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654882071, "uuid": "5f528284-6b5c-4325-b6b2-466a594ed620", "value": "T1E393EAC49608F275E83A9733FC01ABF01D152D8FEA061357A9BABF7135B950E29094F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654882071, "uuid": "9288f779-6818-4c2a-b6aa-b875cb7ef268", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654882071, "uuid": "b7dfe453-1cdc-47c9-87a3-249e7904b8ab", "value": "384:2g0VAuc6vQya0rSEKQdKLMHgCsedTufKcD8XObCi9/dtFpJYzM4is5+Drrhijqv3:hALtaUrACfdTnqrKqNFBF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654882071, "uuid": "3dc64699-126c-4577-8351-aff7c1771e0d", "value": 95312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654882071, "uuid": "1240ac7d-384d-41d3-a536-8870d39c2f15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654882071, "uuid": "a3e0b53f-6b13-4417-9f2e-0fc6b105e5ff", "value": "6ed229f6ccb424c901421bc0057e6b22e5b8fae926e2e7e1ef3d0cc8baf095b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8fcd6da-e8a0-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654853726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654853726, "uuid": "b884e384-abec-49da-8875-a6416748fe73", "comment": "Malware payload (Heodo)", "value": "c938de99a5215f7f2ccaea14584a046f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654853726, "uuid": "fadf79fc-72e0-41b5-a5cf-c903c4403b0b", "comment": "Malware payload (Heodo)", "value": "6fd84844cc4c4afe850d95ba89f50c97f014c60926ea19ef9d6e835543388c4d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654853726, "uuid": "423b07dd-adfc-4c5e-959f-910ea3ea33f4", "comment": "Malware payload (Heodo)", "value": "60b97205cf7e48ce298bcb51d15310b966336d43", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654853726, "uuid": "707ed05a-cef4-49f8-99ff-524ce9bbbb5a", "comment": "Malware payload (Heodo)", "value": "478281dfd3c9706bf3be1cf472ec7caea708fc3f47b3cb9e1eb91153efa4277e4917d22e6c62b323887c9c5dd4034c69", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654853726, "uuid": "3621cb6d-8330-4b43-b093-3c7e4b28eb2d", "value": "T1D1E49D01F2AC80B2D06FD13989A34A4AE7B13C9497B593CB5251FB3A6F732E15D39721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654853726, "uuid": "97faf7cc-6392-4edb-a066-b84151d653a7", "value": "b7b90674fa6c5f9a16bdab0725f21bbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654853726, "uuid": "f39641bd-d498-4d6d-a045-92155947b974", "value": "12288:8nUIW4anSDGCH0fu1QJKwVbe1gUK7wrnUfpE:kUITnGCH+u1QJKLCwrUfpE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654853726, "uuid": "09607062-6d78-4d84-8627-94708b30673b", "value": 694272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654853726, "uuid": "7e613215-1f84-47db-98bd-2e490cf998cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654853726, "uuid": "6ddbb081-bcc1-409c-84de-081cccbb4f81", "value": "c938de99a5215f7f2ccaea14584a046f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f8e8510-e876-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654835618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654835618, "uuid": "1ad2a6cf-88bb-4037-b400-18dc1a76458f", "comment": "Malware payload (Formbook)", "value": "43ca77eb4fb2baabb5a2706c111bd3e6", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654835618, "uuid": "7f96315b-98e8-49be-aad0-bb8d363dde3f", "comment": "Malware payload (Formbook)", "value": "6fe3d4977127b286b44f111d1048b19ae3bd4016d53af1ba2c488c4751f45eb0", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654835618, "uuid": "afa64b01-da37-4b64-96b8-69978af1b1cc", "comment": "Malware payload (Formbook)", "value": "b7cdead0a74bc81359169092da0ea443e09bb762", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654835618, "uuid": "c96d1321-fd9e-48fd-991d-211259536c42", "comment": "Malware payload (Formbook)", "value": "b44cbd737a3b3f7d03bc2d5fa43d7c051db45281525a44629b76b917cf9852960f4e7e1af81a577d9288ac6fddb79907", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654835618, "uuid": "c3dbb6ef-f70b-4aba-a590-f0ab4d433df0", "value": "T1D053124EA57D66827B4F9FEA831614594DC4CC7C09E87D43405CB0B32CB9696CE63A27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654835618, "uuid": "8134b043-95d3-481c-9864-f2be0e2b6da2", "value": "1536:uzXbLlYNmJuJdryqT3Zs380j1AFUuILjJyvkvu6wSim:uz9amJSmk3+M0pAFk1OkWmF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654835618, "uuid": "a05aea4e-7d77-4a9d-be8b-d1da0edf06ca", "value": 65290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654835618, "uuid": "e18aa663-b219-464e-a952-b6792cb8ca12", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654835618, "uuid": "bed46926-cab1-4445-8dcb-506d67a72b33", "value": "06-10-22.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c55e5188-e87e-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654839171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654839171, "uuid": "2b318407-3780-4294-bdac-2080de1c0e39", "comment": "Malware payload (AgentTesla)", "value": "7646feb4f3fa5f37eb8b152a9bb1d966", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654839171, "uuid": "318c033c-559d-4d15-8778-d32952e93a56", "comment": "Malware payload (AgentTesla)", "value": "7197aff57d48b3b5a05e55f3128608a146a9186030d06867fb70496d68a6d946", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654839171, "uuid": "ece135f1-94e3-45d5-bec7-1db57c9fdb55", "comment": "Malware payload (AgentTesla)", "value": "fd4e26a2ba5af7d0b8932e8316ade064b37f8387", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654839171, "uuid": "ccc921c7-8d43-46d9-8efd-3f05a74bb98a", "comment": "Malware payload (AgentTesla)", "value": "2017237199378e0e360c5425d1fcb71b4384ffdef797de7b40258614bff1b29575053b8e4b1463ad777df8551d14e74f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654839171, "uuid": "581f2e1b-2895-4853-8e41-1ef09ac7d706", "value": "T187F42300B8F853C0F29B62B81D271102C67269994DBADF1FBF103BD706DFBC6461A966", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654839171, "uuid": "bb08560a-ef21-4053-bcf5-49b2b7dfd64b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654839171, "uuid": "638c4885-a46b-4f24-8f88-9ba3a9415115", "value": "12288:yG9C8+jXbW9qT9q0lJklQ/CmuYV0RuUknFPCgthEP81xgzlqFa6WGBG3sM+6zj64:yGlCXKOnjGQ/TtVXnFaqW88zlUh43s1o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654839171, "uuid": "1962f660-72f9-4a13-998d-58f73de251e5", "value": 738304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654839171, "uuid": "02d931f3-23cb-45a7-8263-f797d4231aa0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654839171, "uuid": "9df4dd5c-1a8a-4b15-9b56-fb3a814a90a1", "value": "SecuriteInfo.com.Trojan.Inject4.33633.24065.24537", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d95f7a4-e8a8-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654856902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654856902, "uuid": "d79d8a3d-ee5a-4d9d-ba20-3fad3c4cc182", "comment": "Malware payload", "value": "019203409d35842d93b46de7db4038bb", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654856902, "uuid": "8172fbaa-ea65-4311-96ea-fb56cbd6b3fe", "comment": "Malware payload", "value": "719a07f46b6fce1615a7b4bd1ed3e4d2cb86d7275ae37d3325ff2e9db64e2185", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654856902, "uuid": "1c351269-11f4-4717-9766-4df7824d5a41", "comment": "Malware payload", "value": "29d38d998e0a17af1d11cdef3b74855a54727c51", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654856902, "uuid": "7c613092-4c67-4d32-8b4e-d465cf608d1b", "comment": "Malware payload", "value": "ab71a34eabe44ce28a5db65ef84c976d5ab3d92e09dc889d18ed30a147873dad063be71ec8faf25dfa93881c9d1cc745", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654856902, "uuid": "354fa424-ee48-4ae1-8b86-ee8501626291", "value": "T1BB72C0B4C25DBC12CAA71235A04E9AF1FB71900AE435991EB519FBD48CB64C7832D39D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654856902, "uuid": "b2da9e76-96b4-43ae-a255-3dae1744a008", "value": "384:azW4FOKfKztM3wIs65n0i13LU3HbCXBqX6Ujnw+3KWvb:ckKfKJismv13wLCx7H+3T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654856902, "uuid": "8eb41042-3259-4160-8a87-eff2339be959", "value": 16256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654856902, "uuid": "afc66cb8-cba5-498f-87e2-92ac8448807f", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654856902, "uuid": "216e129d-b400-4376-82bf-133f2dffb694", "value": "TranQuangDai.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd7b091c-e8d9-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654878269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654878269, "uuid": "72ba7b9f-1ef2-40a3-8013-b6f16b8ccdfb", "comment": "Malware payload (Heodo)", "value": "693967b140b873ac0c6b8743cfdfa01b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654878269, "uuid": "2b5ce643-04f5-4b40-87aa-28a7b45693e7", "comment": "Malware payload (Heodo)", "value": "72544a27184aa9d90fab9d992610c92e5495edd9c06a533cefce984feafe5778", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654878269, "uuid": "143f9bc0-80f1-472a-9164-592e1f90797e", "comment": "Malware payload (Heodo)", "value": "02f560b620e8e6bdf0df321d579133410eb345eb", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654878269, "uuid": "fc59f7d7-e4fd-4dce-8216-fd8d220f1ab0", "comment": "Malware payload (Heodo)", "value": "871419612d1e0098183faf1f18f1b623d56a505f9af9b39d223aee0cf4e75f26fa8f15320e94231ef20e8f1faaea2ba0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654878269, "uuid": "d9dc01ff-5798-437c-98e5-d81cb5057c76", "value": "T124B4140573F43066E46B4D3C859E190FE7E67A074BB5D1CA239082AE3BB364279B9F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654878269, "uuid": "42ce0766-d142-499b-bf13-f33040c859ed", "value": "b71031ac72c27db547b44e7ae017554b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654878269, "uuid": "6554ebec-d866-42d2-aa42-c33c6a0aed2d", "value": "6144:TkzytaJpnASmmaNGQ7DYMT1atZNtpTKIEHzuLAcKhIepZn6kdRphRUQP7LwW1:oytafAS/aNPwHbCcKeep5h/uQgW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654878269, "uuid": "a1b0b8f8-6830-443b-b48d-944d45a45bf5", "value": 504320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654878269, "uuid": "5d278f4f-7717-482c-99e0-fd6a9609bdc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654878269, "uuid": "43ca17d4-f3cf-491a-8055-08fa4bcf901e", "value": "693967b140b873ac0c6b8743cfdfa01b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e3e7e92-e8a6-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654856285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654856285, "uuid": "c8772796-90b0-427b-aa86-905bd1e2099b", "comment": "Malware payload (AgentTesla)", "value": "3ffd8bdc31b446dfa478cd220d38ec17", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654856285, "uuid": "28b9631f-4972-4101-b4b3-8d10a7e93a1f", "comment": "Malware payload (AgentTesla)", "value": "72f252393f6b8dceff95b5b664b7d7136cfab0f0ab472f6f686df9d95e6d05b6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654856285, "uuid": "8884821a-189d-494a-af6e-2ce78ac337ea", "comment": "Malware payload (AgentTesla)", "value": "859ad3da71f63e8ad216b98cb089dacc06719761", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654856285, "uuid": "cc5519bd-ff43-46e2-8df9-1bb8635b840c", "comment": "Malware payload (AgentTesla)", "value": "891e353aadccd31e608f44a82f4d2f35a2be37499dfebb8d939a6d04d9de5d6af9f99e042b22414028a28fe55bb281e6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654856285, "uuid": "22368595-970d-4fea-968d-35b94aaeb881", "value": "T158E4F11A7609A54FC5164633C9DA1C0093729F87672BE34B6487339E9A1F3DBCE092DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654856285, "uuid": "de6460c8-b2b2-42b9-9c95-6a06330d627a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654856285, "uuid": "9dda4146-ed5a-4176-9ef6-cdde7096634c", "value": "12288:9tKD94rK9qZGAq3g1HFYrPr0jV67im+7T2qvUYQRlSzw4KN2O8itknIkkzA:Pwb0DmG8ak1YOntXkkzA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654856285, "uuid": "69562a86-9210-4ed6-9395-d3ff04ab6522", "value": 720896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654856285, "uuid": "9d62e2d1-5882-4f22-9fe7-64e2e5d810b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654856285, "uuid": "11a478ad-0771-436f-955b-a41a75ad1458", "value": "BOTXqOyP7TAyyGr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2479dd2c-e8b6-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654862953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654862953, "uuid": "be0bf387-27b9-4a76-80a7-edd10a02e3f5", "comment": "Malware payload", "value": "3f35679384b276b784d4f6264cdb8066", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654862953, "uuid": "23fd9a3b-9d2f-4ff4-b9b8-69dc72b8e193", "comment": "Malware payload", "value": "7699736a5572277fb3a5e7a0335559f5ff77db67f9799824b84d776ed640a1b7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654862953, "uuid": "e945dc6c-7cf3-4451-96e5-05014ec3e70a", "comment": "Malware payload", "value": "46edbb686d0eaadcde0e119460058ea8d45189b4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654862953, "uuid": "41a01e5a-ea21-45ba-b76e-262d6b3228aa", "comment": "Malware payload", "value": "225dc75cf86b0f5fd37397cd18556557b3c48e24cd8ca87a48ba681e81ce74a12dedb220a1872f28dd239af7b4f8f524", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654862953, "uuid": "465d5a69-477a-4603-a027-e2b62d1c2bc4", "value": "T1FCA5332B7DCB1F9ADBDC24369BAF881A10607E5CA364593357E874076077B7572830CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654862953, "uuid": "f6d426b8-321e-4c10-9fff-53d4c8bb3fe9", "value": "24576:IseLzYcshkT135PhwGw5JxyVatXaihP32cC22H1RrnprjlYKS2dJm/yNYpD0tmmn:Udw5So3l31dGvl1JJm/ySpDM2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654862953, "uuid": "8892bf27-3891-42cb-ae61-538999a4d8a7", "value": 2114560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654862953, "uuid": "e1429513-a85d-438d-8487-5a4d8aed1eb9", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654862953, "uuid": "1ba6822b-a49b-409e-9d25-c9f63ce69887", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.20048.8003", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "466272e8-e85d-11ec-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1654824785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654824785, "uuid": "543decc6-c5fa-40ea-b8d2-7aac8b049e01", "comment": "Malware payload (RemcosRAT)", "value": "22f6c4c671fbb3ea9345133985669d95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654824785, "uuid": "e7d381c3-ed6f-4b0d-b421-fd0f66d5a379", "comment": "Malware payload (RemcosRAT)", "value": "77a40984d84d87578177877a4d46c2bd97edf71cad17f7d8846215bb54b74ae8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654824785, "uuid": "c447a407-8c5f-4bc9-94e2-fe508b476455", "comment": "Malware payload (RemcosRAT)", "value": "e799e1e60046409aa19d5a67c05beb23d7ff69f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654824785, "uuid": "e9674423-74bc-42c2-99df-de332ed1c9a7", "comment": "Malware payload (RemcosRAT)", "value": "0a1d4e16c644142bb5d4cddddfa51a5c0c3311c8f5f80a047f9be32a5a44816e62374b1010519a9091351b2f672246eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654824785, "uuid": "894b6453-b19c-4110-81df-8f4472063586", "value": "T1A4558D1372489AC3C52965F2C856D53023E4EDCE4130E64A3DD6BE5B74F37822B6AA1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654824785, "uuid": "a6cc9124-4cc1-4673-adea-28b00ad1ca73", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654824785, "uuid": "2ae89323-f3c1-4f46-8575-aeb6eae28bad", "value": "12288:H72cAmIY3VscmUsCgYxGztgJQ4PRtcfdJ1W302E42c6Bbdxj/WtyqU:bRqgsoGOJQ4LEhWNSHHqI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654824785, "uuid": "2e8e6283-ff11-49a2-a8ae-5f220a8dbb2a", "value": 1402880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654824785, "uuid": "83121abb-70dd-4fa7-b5a0-960cce27ba8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654824785, "uuid": "05c2fe38-73d8-4a03-b1f2-8a2cb32eab89", "value": "SecuriteInfo.com.Trojan.Mardom.IN.22.31196.19611", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b46f1f1-e8bd-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1654865944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654865944, "uuid": "b32ef091-744d-4884-a01f-ac2bc6c7bbb5", "comment": "Malware payload (RedLineStealer)", "value": "41961ab74f5892a4753bac02b7a685ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654865944, "uuid": "c559573e-c794-4ffa-8b52-a920ce68bd00", "comment": "Malware payload (RedLineStealer)", "value": "77da9ff799ae59963db2dd8c517c3fe1d2c8072e986809a0b5f4c6ac4822741c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654865944, "uuid": "4e392193-bc1d-4ed7-8e3b-6f6563d0c2a6", "comment": "Malware payload (RedLineStealer)", "value": "a2f75a641ea38f960b208fe657a00f4dba22678b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654865944, "uuid": "0f6cf124-32a3-4639-8d04-096ae8b53f59", "comment": "Malware payload (RedLineStealer)", "value": "25bb486085cec78a32b421f96e8b4e1b906e4058c3a8a3edc8ba8ef7676c2b0382a855fd1e1a81a6aa3d21ae1e6aaa0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654865944, "uuid": "3282eb61-a93b-42ee-9450-82fa69050a37", "value": "T1AD74DF21B2D2C072D66610344826D7689E7FB9756B358ACB7FD05ABE4F303E18B32746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654865944, "uuid": "febe2d54-204e-4fa5-8d67-5910e1eab029", "value": "762627401d11fc10d31e1c6d301f7bb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654865944, "uuid": "0c5645ff-1aa4-4c1a-be33-9fcb5c0c4c5b", "value": "6144:IgHexmpDtJrkzgCZspYqiM5eqmoUJUt5jdiB18B:WxypJrhbiMeJc5jQu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654865944, "uuid": "866bf2ba-10d7-420e-b0a9-c9dd57dd4f73", "value": 359952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654865944, "uuid": "0938fad3-ec3f-479f-8167-832aad3be8e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654865944, "uuid": "6d6c2976-cdba-4f69-bfee-40deba66dd72", "value": "77DA9FF799AE59963DB2DD8C517C3FE1D2C8072E98680.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d73a42b-e8bc-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1654865706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654865706, "uuid": "cced3426-87de-48ff-a628-b3533cc18458", "comment": "Malware payload (RedLineStealer)", "value": "7342cff9fd170b35f730a1a92987c5fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654865706, "uuid": "b008efa9-9880-4593-8581-8b143a38d4b7", "comment": "Malware payload (RedLineStealer)", "value": "78898f697830488a9ff68faa4ce77c68c4bf70abf8070d0250c1c67485e4825b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654865706, "uuid": "531917b9-9498-467c-9c89-4769e22da0aa", "comment": "Malware payload (RedLineStealer)", "value": "48d73647918eb0a60b2771ef838d9e895214565f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654865706, "uuid": "9ee866be-b788-441b-afab-73422afc938d", "comment": "Malware payload (RedLineStealer)", "value": "b4aa20ceb892164a2f2e91945092770efaa1bbf06518ef20450a14af83f0f7ced35bfbf6b6cb76499f7e33902e848cf9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654865706, "uuid": "2a6d7985-ee8e-41fa-ac9a-226e07b7b28c", "value": "T19BA533C5CFC1A6D8CC9A9E754CAB46987B60E58A614EDF133344223D8BA13416F7FE06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654865706, "uuid": "c7f67cf3-d897-45a5-9622-0048591ada84", "value": "eea8833315914791ae4e7147fa224942", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654865706, "uuid": "227e2392-3975-4ab1-9006-a3f12ec17e01", "value": "49152:p1esf8yrDdtSXbl7Y5bBHduJEp9F4YzDpGu0n:p1e6trDdWhc5bBdxbFlzD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654865706, "uuid": "327ce792-93fe-4db0-8896-a81d2a9c27e8", "value": 2084480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654865706, "uuid": "3daf8701-6cc8-4117-a4af-9b9687fb8a82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654865706, "uuid": "491187d1-72d3-4179-8538-68bd00933cfe", "value": "7342cff9fd170b35f730a1a92987c5fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cceb0559-e8fa-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654892441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654892441, "uuid": "5c22b1cc-ae81-411b-be0f-88226a28c601", "comment": "Malware payload", "value": "ee5b26cc1dde07f58a808cb978c55e0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654892441, "uuid": "d8a30d5d-8b96-4830-9c8e-c91af1bf9c14", "comment": "Malware payload", "value": "79068d9f0284962e1aac9b5017b721af646f476fc21d332e7efc673f53d71186", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654892441, "uuid": "a330a93f-a933-4713-abea-510408619762", "comment": "Malware payload", "value": "3a1432d6a0d09b1ebbcc80e935b9e76f65b23d6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654892441, "uuid": "b743e1b5-4276-4d4b-b5e6-f0dd676eb7ea", "comment": "Malware payload", "value": "dc0c53ff26a3f8fe12a55982817c93f9ad8be5882dbd88a5d0b415670e6e29f3ce989980d07f9d5fe2d3a4f28745d57c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654892441, "uuid": "ebf42ba9-7773-4768-90d5-f9596fa95241", "value": "T184B4140573F43066E46B4D3C859E190FE7E67A074BB5D1CA239082AE3BB364279B9F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654892441, "uuid": "c45e10f8-ccd6-446f-9afe-a597acb68861", "value": "b71031ac72c27db547b44e7ae017554b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654892441, "uuid": "26aca59c-7ec9-419b-807b-1237911e044c", "value": "6144:TkzytaJpnASmmaNGQ7DYMT1atZNtpTKIEHzOLAcKhIepZn6kdRphRUQP7LwW1:oytafAS/aNPwHbWcKeep5h/uQgW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654892441, "uuid": "7287c076-a134-4861-909d-bb9dabbff05b", "value": 504320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654892441, "uuid": "5feabcf5-db8e-4e4d-8427-78746c8416cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654892441, "uuid": "424d0895-88c9-4894-9085-c24fca14c02b", "value": "ee5b26cc1dde07f58a808cb978c55e0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cd0ce41-e891-11ec-93bb-42010a9c0043", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1654847129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847129, "uuid": "fa5af62d-70f5-421b-946b-9390e6823695", "comment": "Malware payload (ArkeiStealer)", "value": "763861dd11039e6077c8a375189a884b", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847129, "uuid": "3ab20d10-a93b-4ab7-9309-3e10931f4ed0", "comment": "Malware payload (ArkeiStealer)", "value": "79b5365df45d5d8b1a392453e513c43fd3ffb32fa4b7446c2953e14a498a96bb", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847129, "uuid": "b08d0616-4024-47d7-b649-366c9e7ddfcd", "comment": "Malware payload (ArkeiStealer)", "value": "b77e042580ffd9646813172ff74f9b42ce0c2d69", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847129, "uuid": "cc824aca-2cc3-44c9-ac16-0e4d9c4250bf", "comment": "Malware payload (ArkeiStealer)", "value": "f761e226412ee7c3f188a3c26b5f0b8aa9612055d3184b0a7b0b6abad6e77123c32be2fd09cdd61883e487cc800e1558", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847129, "uuid": "1d16d67d-9e70-40ab-82d9-d0c2be2b7a3f", "value": "T18DE533B2B7051070F3BC43F423619E7A9BBD6C9F88C15BA31AC51396EE76746768900E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847129, "uuid": "6884f5f4-cbc0-485c-9bfd-afe53fb17dfd", "value": "bee6b6031caef490ea53179b1f7393a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847129, "uuid": "f2f39f2c-b784-4fe6-b2cf-cfeeae642c39", "value": "49152:vhwAouxw3AvnMainfj0feprnnq07Pg04xEZe6WSZvcoR2YC9SUE3AYaYmwsBIFt7:lML0WpqWPf4xEZKCcoqCAYaLPI1yUuTU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654847129, "uuid": "67c2cd4d-c8f3-4be8-8deb-9a401ad4cb2c", "value": 3023360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654847129, "uuid": "0b2f515e-9774-4c9d-8411-8debc20d6e87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847129, "uuid": "0ec8dffc-2f09-497c-a16c-f19aa1271043", "value": "79b5365df45d5d8b1a392453e513c43fd3ffb32fa4b7446c2953e14a498a96bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94389eff-e87f-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654839518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654839518, "uuid": "d84af74e-c7e0-4f5b-b3d1-95797c59fc93", "comment": "Malware payload (Formbook)", "value": "610eb36cbca9053a48efc8e6439eb24e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654839518, "uuid": "b76d2e60-657c-4e3f-b522-f787acd31336", "comment": "Malware payload (Formbook)", "value": "79efff3c21df7739b3bf710f18e7ab3c90ae86e0a189f494a59b1cecc2b2b7bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654839518, "uuid": "3a0bdb4d-89b7-411c-ba1d-09308317fccc", "comment": "Malware payload (Formbook)", "value": "2406dac08b7123ac0c7443db1abdd9cc45de59dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654839518, "uuid": "b240c4e9-dacc-4322-92f7-3b8c1f3e2772", "comment": "Malware payload (Formbook)", "value": "18b52341d07a97d07ba31456a87ffa52c200e4fe36e6e3fe9877a5c0d1ffe0071e424be45c41c4ce79219dd2f1a1fe3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654839518, "uuid": "9ef341ed-34dc-410b-9e1f-96ba9fb48e28", "value": "T1C7659D62A252C833D3621A38CC379BF856667E11E920B9876AF13D6CFF753A03537185", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654839518, "uuid": "bb05976e-42f8-4994-9b52-c030acaebd7e", "value": "66ebe8b38da518dd5e3cdb7bfad8bde7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654839518, "uuid": "69893c4d-9c70-4d76-8777-21c5a72a44e5", "value": "24576:Og/2082AZjjVzLh5eZO0rq8PS+C5zONkMsTWDHX:OULAZjrI/BDH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654839518, "uuid": "1ab32b67-ef16-4a5c-a6cd-c11aacbdfecf", "value": 1475072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654839518, "uuid": "eb0f7d4c-c20b-49f0-94f7-ecb0ef52346a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654839518, "uuid": "ea32cead-c4bd-40f5-b998-12ba938c47d5", "value": "05267389200-2-9002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9398a544-e854-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1654821049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654821049, "uuid": "e6e5b0d0-967b-4370-b587-0b0533441580", "comment": "Malware payload (Loki)", "value": "72c04e187f94d46bf5cb05a508387861", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654821049, "uuid": "e3830cac-0c79-435e-879b-091b70a9cd65", "comment": "Malware payload (Loki)", "value": "7a55eae7467ad00ca44249a6a5ae7c24d1e16f5206d074d9367337ab41a1acfd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654821049, "uuid": "87286d2a-7c63-4663-a213-156ccba42528", "comment": "Malware payload (Loki)", "value": "c0463d208b0b09cc092c34d5c16555ffd4694c42", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654821049, "uuid": "0e3043cc-68a1-4b63-a6bf-262b8da9ec66", "comment": "Malware payload (Loki)", "value": "6ec0123fcf66bb63f4cfec53075e68f1f42ed4aa821eec22453bfa17c3b78cfdb3c89ddd03127ae0d65b28e4c827dfb8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654821049, "uuid": "45f22e3f-5afa-47f4-b8ab-7c2a23f3007a", "value": "T18AA4125473F816E2DAB103B96C650740C3B1F62B9A66DB0F5841938F6CC7BC6871A3A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654821049, "uuid": "4a344667-c1e0-444b-8e95-b08a32b44911", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654821049, "uuid": "a9c451a0-9f53-4c81-a3cf-01c6b900141d", "value": "12288:W9qJ7zmt++P7Tqd98gGLvvIKaW+g9uVPQ:WqmtJvDpvfz+SuV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654821049, "uuid": "9d72f81d-23d9-4870-b9fb-1e4ac287804f", "value": 489984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654821049, "uuid": "c5cec5d0-8bf0-4da2-96b8-1c180d683a1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654821049, "uuid": "61838df1-00e2-4ece-bbea-104f9f7de8b4", "value": "72c04e187f94d46bf5cb05a508387861", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99c886d2-e8ca-11ec-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1654871740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654871740, "uuid": "be5bc6aa-b294-46be-be5e-aab0505345c6", "comment": "Malware payload (AveMariaRAT)", "value": "4fed1cf956ddf6883bbaa0d633937162", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654871740, "uuid": "44778b2e-c58e-4404-91d0-895c77598676", "comment": "Malware payload (AveMariaRAT)", "value": "7aa19913253d9a036b10df1f8f0bdb25567edda11fe99050d85a47249142bec2", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654871740, "uuid": "fe206e1f-fbbe-4b94-9f52-5c65499959d9", "comment": "Malware payload (AveMariaRAT)", "value": "06dc707bd66f484f02a09ac21043c7078e3b6591", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654871740, "uuid": "1067d432-18f0-49d5-b3bc-f44418f26129", "comment": "Malware payload (AveMariaRAT)", "value": "a46065c2c7696926dbab2b65adf8d84f0678ed66e7032ad8b758a2edc60b5ecefec961a72b2284552b60dab76ab57a87", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654871740, "uuid": "4e993040-4526-4c73-8aaa-06c83bc45c5b", "value": "T1A9E5331172C51031DE22287106EA7F30B93DBD615B28C6DBA3E46E2E1A701D1EB35B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654871740, "uuid": "de805c0f-6df0-4732-8cab-5753132f1bd3", "value": "ae9f6a32bb8b03dce37903edbc855ba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654871740, "uuid": "9ac1edcd-a41b-4603-a19c-e9c5071529b6", "value": "49152:KyvSw3UZiOBvk+arQ3S+HNmw1MO6sqdDe7E3Qja1wsYdK2sDNyy6NNei0U:KyvfE4EslwHsoMOPqdDHRYdEQQU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654871740, "uuid": "1fbb1769-55bb-448a-978b-1f050f07d5e7", "value": 3157871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654871740, "uuid": "2b6ff64f-0df1-489d-ad4c-610c58eb6ba0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654871740, "uuid": "0dd2b71d-2d06-4706-8f8d-86cbe17a42db", "value": "Axia Consult.docx_____________________________________________________________________________________________________________________________________________________________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c30ada2b-e8e5-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654883405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654883405, "uuid": "d23881cd-7ecf-460c-9a1e-be1a69d63048", "comment": "Malware payload", "value": "70e5ccbaf28b391c26a25f586fa3cb79", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654883405, "uuid": "4f1ebd4e-0b30-4b97-b75b-d8bad987ccb1", "comment": "Malware payload", "value": "7b17d997858faedde4c7c02b27f72e3bdbf623dc53d800873a18db5cbafebe96", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654883405, "uuid": "c3cd210d-bba4-4f01-8a8e-b1f80016ba5f", "comment": "Malware payload", "value": "78b026b0b69d9d8200d9af837b556f62853ce34c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654883405, "uuid": "a74a603a-e629-4176-a189-5bbc9e4b5744", "comment": "Malware payload", "value": "120de0d43c4cb2e6c2cdbe8b0bff945420427c8691bdfd9f6cbe76f12c7d59ff14b3a352dfd6c1e6549aadb7376c059e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654883405, "uuid": "c184846a-938f-467f-8ed1-ccd15f79354f", "value": "T168F2E10037E65E75CC680CBA8EEC520D66A7F0B1E4D7F412B36C8F54BD72A635AB8055", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654883405, "uuid": "a71e0db7-01de-403a-9e3d-464d76d4a6e2", "value": "768:AO4jwr9fZ2+Pq8C2y2Ow6SQpurhOav+PjYUnS03UA:yjsZ2+9Ny2X29nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654883405, "uuid": "16470bd4-ac23-4933-84ea-c4774497028b", "value": 37180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654883405, "uuid": "184fd5f5-6504-463b-86c0-20d2dfdaa9e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654883405, "uuid": "4ab29f28-2798-4ba6-98f1-c29b339e999c", "value": "arm-20220610-1750", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb53533f-e8ca-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654871796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654871796, "uuid": "21f981e0-dea0-4fd7-b77c-09c566ab6048", "comment": "Malware payload (Formbook)", "value": "132ee99c9c018c5b648f4faeb29e7814", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654871796, "uuid": "f286a5ce-178e-44d9-8414-e9d2c49a8b2f", "comment": "Malware payload (Formbook)", "value": "7b4e5aa55cbdd7022d83fb2a9b0f84744ad992fcee7633ad0e109197ebe15de7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654871796, "uuid": "8ffd68c1-6028-4262-a554-1e43d0587f70", "comment": "Malware payload (Formbook)", "value": "97cef0b1930d9da6cfab58353176e0809d325e57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654871796, "uuid": "f7f0d55c-0b96-464e-9d2b-81ff2940d93d", "comment": "Malware payload (Formbook)", "value": "d872321f0b7030022263e7524b1df4626990d1ac192537ae936eb44795995bc4eee3f453d4d068ecaef03325504a46d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654871796, "uuid": "c7d37144-7e60-4f50-bc35-f3a600546587", "value": "T186E4231432A502E0E3FA0FB51D433440A5BAA99759B7EF3F9D84664B17CEBCB113A742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654871796, "uuid": "fc2ec59f-30cc-45eb-8e41-c72e7cc4baad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654871796, "uuid": "5988c9d8-1144-4eef-aa01-f41c96549d04", "value": "12288:pt9C8+jXbW9qT9q0UhyjzEpLGqfU5RoEXflUDyO3JdeSgilA1BCw6uo8d:ptlCXKOnUhyjQpLGqfU57dM5dbp4Bd6y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654871796, "uuid": "963c8e02-c309-464f-8390-3a734f88caf4", "value": 698880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654871796, "uuid": "921552aa-5fd2-44db-a8a8-4527485d02aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654871796, "uuid": "b663ec7f-3993-4140-bcb2-b5d172804f81", "value": "ReqFQ.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ad6574f-e8c3-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654868520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654868520, "uuid": "99096eb0-b1ac-4f20-a32d-5878973e7f36", "comment": "Malware payload", "value": "97cba5c1be68a7e6e9b829affede27d8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654868520, "uuid": "79a1c002-db47-45f9-beb2-ab572f701aaa", "comment": "Malware payload", "value": "7bd7808fe59888e384914cbe7fa44a6daaf1e8134644c371c0495a5e881b6db2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654868520, "uuid": "4cc375fb-8a15-46a0-b9ad-26090b47005d", "comment": "Malware payload", "value": "4707bc8fcd4b82884786c84590c0397f86a336eb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654868520, "uuid": "538fde09-af21-4670-b939-80270f213402", "comment": "Malware payload", "value": "9b911e8e56188883a23131d61540e8c2ffe1373a9634bac17f6697ff376a1de4d1e5f73c2d2f25b2e0c6fc7fdaedd8ad", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654868520, "uuid": "35c0496f-a863-4e19-afc2-695e48fc873d", "value": "T1EE83D029BB747F14CED9A1A85EBA0D468E509D980305EFACEC5EB4D2890373CA379474", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654868520, "uuid": "75ff6bc5-8e8a-400d-b61f-7ec809d01082", "value": "1536:7nps8yhwKgLTASU2H5iXZW095jQx1n7fW8SZU2uIbx:7npLyhwK7SU2H5s00ja7fW8SZU2Zbx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654868520, "uuid": "32f5cfb5-49d1-45e6-9fb4-9cb6287cf0a6", "value": 82217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654868520, "uuid": "bd83e61a-497c-416b-8340-b24efcf7031f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654868520, "uuid": "64da9bf3-60b8-4cac-8c1d-7ca1753e202c", "value": "invoice payment.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af462f37-e8a0-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654853737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654853737, "uuid": "fc1b1297-07ba-4d41-83fe-c4c5cbbebd51", "comment": "Malware payload (Mirai)", "value": "e06e2f9ae0da73e578af8f3e25603f81", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654853737, "uuid": "cedbac70-a1b8-4ff3-9066-0460ef308c2e", "comment": "Malware payload (Mirai)", "value": "7d156ade0b461d061c71c93f7293155798362d45d3d5774447ef8da7971d4e8e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654853737, "uuid": "66fddb4e-2f70-4034-a1eb-e7219a58628d", "comment": "Malware payload (Mirai)", "value": "1364b1f60b2a9ae18327e18c31b54e12e27a1bc2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654853737, "uuid": "3645dd94-29d8-41fb-8b36-261bd683fd4e", "comment": "Malware payload (Mirai)", "value": "5a25da1b3295f055a43b9ac77db52ff52925bdbfcba2f68fe323af7a8f34b5bdaae1d49ccd01f5c0825e91637c055871", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654853737, "uuid": "fd56ccf9-6488-472c-9e47-48719d4ab85d", "value": "T12D73AEA8CD5C1CA2C6EA0134A5D0D9796363EE046A536FB4CE818F959007EDCB07E7F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654853737, "uuid": "ee2033cf-9ddb-4419-9890-e0b9ef15b45e", "value": "1536:c/i4My1GYzDMaJgcHxsfH6lp8/WnCeTX:cau1JwkHxsf6p8/Wn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654853737, "uuid": "060268a5-b3f1-4e86-ac1e-6ba54e757a4a", "value": 74916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654853737, "uuid": "91799068-7006-472c-89c3-b5abd1458a22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654853737, "uuid": "3454e165-c9e8-4ac0-9535-35b4c9846ad8", "value": "e06e2f9ae0da73e578af8f3e25603f81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aef29e0a-e8ca-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654871775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654871775, "uuid": "7f077424-14e1-429c-a6f7-bf46d70498eb", "comment": "Malware payload (Formbook)", "value": "f89f6b0e81783602fe1a78d3766955fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654871775, "uuid": "dcc9f38d-efe0-4bed-afa4-9bb48bd7f6e6", "comment": "Malware payload (Formbook)", "value": "7e98adbd789e5f62288e3784bb613e332642f2ac533ad873b5744c7a3d2afc16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654871775, "uuid": "67a44c93-e527-4a0a-afd8-1e7c736b5af5", "comment": "Malware payload (Formbook)", "value": "38936b4b64e1aef377319873761a3d958bada15b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654871775, "uuid": "78d99fc5-0e02-45ec-b364-7e46096317a2", "comment": "Malware payload (Formbook)", "value": "f902aa68a073d04f114efb6d4573205c3f3348c1ae8be8f7bc8687661849996e987db14cc9c36dde29f319168a589009", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654871775, "uuid": "c6fe520d-5c50-43e1-aab1-6e6cad3401f9", "value": "T1A5E4F1597606E58EC0164637C9CA2D1043A2AE57571BE74BB4C7329E8D1F3EFCE0A2C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654871775, "uuid": "8f0c469d-0c7a-4ebd-b3d1-769f54bcc94a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654871775, "uuid": "87886cad-b434-46d7-9a7d-b4e03e1cd87f", "value": "12288:A09ny9qTxLexQdpFFij+Pp65JOMhejXoZywLNU1HGjqLcCvpZoWu:AwyYxSKXFiCA2M4LoVQHG2o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654871775, "uuid": "41dc9576-8629-466c-aa3e-37e8bb87cf3f", "value": 704512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654871775, "uuid": "d6b17ca3-ddc6-463e-b5d2-4235d81e0596", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654871775, "uuid": "87b47727-5649-4f2c-8e71-e71a58b74d89", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69d3fa57-e897-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654849755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849755, "uuid": "0f35f193-4299-4108-9b56-54982753344d", "comment": "Malware payload", "value": "0f0904e63689e1b484f29153e3f89839", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849755, "uuid": "779a002c-55ce-409d-8074-23e7297470b3", "comment": "Malware payload", "value": "7f35d9508a8002fed61a22dd9802462439d9ca40a5444b400be7e6f282b19616", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849755, "uuid": "f6266b2a-061e-49b2-8fac-d8dc5fbef024", "comment": "Malware payload", "value": "c2138c613e01c27c52880afeed08ee4efa679871", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849755, "uuid": "3ecc3345-d81a-44bc-b8d8-6db107ed08a7", "comment": "Malware payload", "value": "7eb6c13e9b351a6a5fa956ccff2b3456de44d1cc49d3527afc33fe9a296f904896ade2e7a3cf084195fc671c06f84a14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849755, "uuid": "b6407c5f-7f3b-4335-915d-b989e995d65e", "value": "T1FE248C1075E2C473D472143509F4EBB95A7EB8710B65DAEB67940B3E8E302C2DA31A7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849755, "uuid": "d29fbe6f-d56c-496c-b2f3-006dbea999c5", "value": "86b9b6ea60160dd215c0b2cb4e0cf8c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849755, "uuid": "bfc221d8-6cb5-4200-b23f-f64c4ed98eae", "value": "6144:o85cmW+g8yrpbPihtm1wZj2uMuKM6h6h/AOoGK:oozg8yrpbPihauKM6kx5K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654849755, "uuid": "128e84a9-06fc-45aa-8b1a-6ebc85ceffc6", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654849755, "uuid": "3e03c335-b76d-47ba-b58f-8a070602a48b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849755, "uuid": "e758bdc6-7bd9-4d3b-9820-93bde23f983b", "value": "ppt\u6a21\u677fI5IRSA3IBO59XUIR0W695_\u539f\u59cb\u7684.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d5f818b-e8de-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654880309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654880309, "uuid": "8a79bdc0-4f26-4339-bb98-7c1bfd68208a", "comment": "Malware payload (Heodo)", "value": "b9556863b5cdd7a7df200ea64693592f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654880309, "uuid": "ed358449-bda0-4b88-8a85-df6a50028fe4", "comment": "Malware payload (Heodo)", "value": "7fb00760620f2552188d49812aadea3b558db7cf5cc732e2e1aee7347999ee26", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654880309, "uuid": "fa715633-9181-4a55-9d8e-50b1c9fe393d", "comment": "Malware payload (Heodo)", "value": "223af70b194f7c3de2fd188cca8df2985531361f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654880309, "uuid": "2959727e-74c8-496d-9f02-3df24227fa3e", "comment": "Malware payload (Heodo)", "value": "241d855d8c830ad7b7c1c2569c5a2d0861a640607e19df3093afa67ad7ea3ac8c864f3ff408705987429a68bb284de9a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654880309, "uuid": "45ea4e8c-86a2-41cf-b610-8a1cdfc9b1d8", "value": "T108B4154533F4306AD8678D7C849E0A0FD7E17A174FB1D28A135086AE3BB36527AB9F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654880309, "uuid": "e127dd72-2b3f-4e33-bbbc-a230cbc1d428", "value": "b71031ac72c27db547b44e7ae017554b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654880309, "uuid": "dfd4dfe9-6875-4339-bb3c-a7cf2196837b", "value": "12288:fytPfASAuSvQnb4HorHDKGwC4ZTJxlGRS:fy9fASOvQwoTDw3XC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654880309, "uuid": "ae8217cf-2bbc-4a47-89d2-54f9ff0d5e99", "value": 508416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654880309, "uuid": "9ce211b2-e580-4d23-9006-7927a3337c83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654880309, "uuid": "7ee6a1e6-4cc8-4cb0-8f47-b3d4fa6e2178", "value": "b9556863b5cdd7a7df200ea64693592f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "022a533b-e8ee-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654886947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654886947, "uuid": "f899bf32-6fa5-45e5-bf9f-45dc7fce2bbc", "comment": "Malware payload (AgentTesla)", "value": "7f1472f5c8f3a253342bd458a00f4bed", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654886947, "uuid": "9eb5c8a9-4830-41a2-80c7-7b79a1cb0235", "comment": "Malware payload (AgentTesla)", "value": "800a8f7e3b0a7e0c9686115bfb352cd7cc3a50400cfd27cf014a6ddde899802c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654886947, "uuid": "15f3ca94-7596-4a4f-80a5-6786905f82e4", "comment": "Malware payload (AgentTesla)", "value": "9d4d2b40a70c155610a083c2cb275706ddb982a8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654886947, "uuid": "e0416730-86d0-435f-8898-3efc36ac11d6", "comment": "Malware payload (AgentTesla)", "value": "de4f9837bb0a4d0226ba6615987dfe5b1420188736518b36a3f631c52a2b9d41a3849681626b14ddc20a879d2863fbf9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654886947, "uuid": "289ba52f-6350-4dfe-bc5d-83873363e974", "value": "T193148BF36BD8C8EEDB586234F3421E1703516DEC68D6A63D1FDE7A29C530A6960F8520", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654886947, "uuid": "0857d387-d63d-43de-be77-f83273329f31", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654886947, "uuid": "84ff3d0f-bdc1-4331-a5e4-525ce82c1d75", "value": "768:hPZPbhp6kELfJSCChd7ntnR+iEiiiM8n8nsoGGTdjt+++Gvx/bb2exNEzAlgql3F:LbWSjwTOfhhGo8r2PYBU4cId", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654886947, "uuid": "fdf49897-a7f7-46d4-9464-3234ca04133c", "value": 199168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654886947, "uuid": "52cee619-d8bc-4fac-a74c-a6795d062f2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654886947, "uuid": "ac6c1e8a-371a-4b38-af7b-03bb77218141", "value": "SecuriteInfo.com.Trojan.DownloaderNET.395.22741.19389", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b95f4f37-e89b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654851606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654851606, "uuid": "6caf23d7-238d-4f4e-bec6-664e7d6361dc", "comment": "Malware payload (Mirai)", "value": "b0d5ef46a8e773a18a161c40b629b4fa", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654851606, "uuid": "332dd4c9-0a79-4ff9-8035-b7a145c14301", "comment": "Malware payload (Mirai)", "value": "815298c832be8bc0ecb4c671fbc603a3685641d36e29895b147f20c129624fbd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654851606, "uuid": "c1f16e8e-eca8-4a64-9285-de548b9f74b6", "comment": "Malware payload (Mirai)", "value": "9d1443543c8e400ff7a208e87b3356d4142a66dc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654851606, "uuid": "6ff2f811-09c1-4511-b244-442e44cd5189", "comment": "Malware payload (Mirai)", "value": "945af9157aa0df7093e018b76ee628d1afaab41ffd5efabb4ffc273e6b538875946903d9aa7d4f957ad1cfe2af8bbb9a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654851606, "uuid": "883fbc40-58b6-49b7-84b2-68b296348593", "value": "T12C7327C1AEC7C8F6DC652A7560B3DF320675E97E2011EA97E7EC6523BD89401A1032DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654851606, "uuid": "1710a991-b890-409a-95ac-15f264ffa7f9", "value": "1536:9wPpTXOe9/J001VdgL3my6ULGB9GFHoaxXwInVY:9Pe9/JJVqL3my6GeGFI2AI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654851606, "uuid": "d36c18d9-0727-4a61-81d9-c85c58ccf97c", "value": 75452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654851606, "uuid": "a30322bb-1fa5-46bd-9b2c-3219963ad2f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654851606, "uuid": "43c57ec9-ba40-44cc-b8d8-35b75e510ebf", "value": "apep.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00c8705a-e8d4-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654875778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654875778, "uuid": "ea872976-144d-4b02-8966-042d1f5a74c5", "comment": "Malware payload (Formbook)", "value": "99ef02e0ccde303a56e0a086e58897d9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654875778, "uuid": "557c2ef1-eee7-472b-b046-31c694bc52a0", "comment": "Malware payload (Formbook)", "value": "82004564f9c882c4ae8edc74ef12e9ebde3e6018150864bfdaee8ac8f5048216", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654875778, "uuid": "871edf35-a70e-4d9b-9a5a-1ee9060faf5f", "comment": "Malware payload (Formbook)", "value": "c2dec60cb23cb5a547c90a668591d996bf42813f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654875778, "uuid": "1302aeb9-cd79-436d-aeb8-1e7b3c5479a4", "comment": "Malware payload (Formbook)", "value": "734f9270c788818ab268101b8f1930a87660ebb20c8bcdd41feb2fe46f008758c30c5bb3d1f5cddfd406fb8a2b673285", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654875778, "uuid": "eb8a907b-5317-45d5-9be7-114c5b14fe31", "value": "T1FF05BF802DD84BDED5E70AF65C92F300322E394E9796DE8BBF532605A4612D0877938F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654875778, "uuid": "73ed82df-a23b-42b5-b60a-19d9f8c9cc71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654875778, "uuid": "0837d047-fe02-48ab-8191-16a07be13a03", "value": "12288:MNsZUAaH1yDPjY1oQW9P8rM8S31AYa1zjACXQqcbSm0u7G:MNsZ/hDLYK9Pv8S3aYaBrXF+SxOG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654875778, "uuid": "9dccfce1-6547-4929-ab04-bb248db2791b", "value": 823808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654875778, "uuid": "ecf92d87-df8f-4e57-aeef-d32bcf9b7994", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654875778, "uuid": "db27fa1a-1ab0-49b2-a8ea-fe54acec0533", "value": "99ef02e0ccde303a56e0a086e58897d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7794f4f-e88e-11ec-93bb-42010a9c0043", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1654846073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846073, "uuid": "1cc45e70-d7d9-4816-b1d0-910dce0532ba", "comment": "Malware payload (ArkeiStealer)", "value": "330a2eb3396553bc96195c17ff2305a1", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846073, "uuid": "5b481ab5-9a00-4241-80c0-e8d90c20a5c5", "comment": "Malware payload (ArkeiStealer)", "value": "82290cac2fd22ac64fa1d3650ca109211d76cc98220ad73d3556e8617d12f289", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846073, "uuid": "1283a20a-d803-460d-85c0-f2f00fd8054b", "comment": "Malware payload (ArkeiStealer)", "value": "654312ec0ac7a6009a764b074c550e9d700e3bdf", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846073, "uuid": "fb8c40f0-3496-47ae-9c37-85c0ea6602fe", "comment": "Malware payload (ArkeiStealer)", "value": "62cb93715ae8fc6a9596548d4198c710df6d84441b52d333a6ce57d58688d0d6136d275a00acfbd28e289e73c1ed2531", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846073, "uuid": "cc635bdf-23cb-4fbf-ab6f-7180a46d564a", "value": "T163C51A035A8B0E75DDC23BB461CB633B9734EE30CA269B7FF609C53599532C5681AB42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846073, "uuid": "055e54bf-feac-4d6e-897f-545482fdb016", "value": "ded04cbec414252b14476348fc5550ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846073, "uuid": "5f115374-0b66-49f4-9859-759afd317cd7", "value": "24576:IwQdPUio7Henez9kTjNF5sHAEy1911v5y8r7ouGy6y+a9UIwuQ5p3h31YzE:IwQdPUio7Henez9wrUcDh/AI6ypE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654846073, "uuid": "02d94b5d-445c-403d-926a-350bf586c188", "value": 2541696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654846073, "uuid": "a0d7012c-6b81-4a90-95e8-684d887b82d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846073, "uuid": "0f168429-165d-4169-a53f-eaae8f3590d4", "value": "82290cac2fd22ac64fa1d3650ca109211d76cc98220ad73d3556e8617d12f289", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9c5c185-e8fa-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654892463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654892463, "uuid": "c148304f-3560-40c6-b4e2-293dcb2a53f2", "comment": "Malware payload", "value": "9f80ac87e0c30b4b22f7e56f5ec4ac66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654892463, "uuid": "bf611934-7890-4ca5-9585-4f9c27483256", "comment": "Malware payload", "value": "824ccfb240575c74585798501f436b8eb25af3b91c0502fa471c485d5ceff591", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654892463, "uuid": "ccbfefb1-d96c-4075-a0bb-31524f916ade", "comment": "Malware payload", "value": "905258bed07053533de079df6a5deacb4ac083a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654892463, "uuid": "845f7f54-eefd-427b-81d9-851e44bf9e13", "comment": "Malware payload", "value": "03b639f9366c74a9b676828a7621bf968ab782df4cd3db92826e6797577e19148a56af3452d85abed3da0d823aaf9d25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654892463, "uuid": "79244484-a7fd-4045-a663-88f4545301b6", "value": "T1FCB4140573F43066D46B4D3C859E190FE7E67A074BB5D1CA239082AE3BB364279B9F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654892463, "uuid": "1f83d819-8c50-4b53-99d2-4b231db15314", "value": "b71031ac72c27db547b44e7ae017554b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654892463, "uuid": "5288fe10-19c0-4f4e-aace-011ce67d4420", "value": "6144:TkzytaJpnASmmaNGQ7DYMT1atZNtpTKIEHzzLAcKhIepZn6kdRphRUQP7LwW1:oytafAS/aNPwHbjcKeep5h/uQgW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654892463, "uuid": "a21af4d3-a2c1-407d-8762-dce21ecdf56b", "value": 504320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654892463, "uuid": "dd41576f-7118-45d0-98fc-a749e8b66742", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654892463, "uuid": "c409791c-d4e7-4e83-a188-253a507514a9", "value": "9f80ac87e0c30b4b22f7e56f5ec4ac66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1263ffd4-e879-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1654836723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654836723, "uuid": "c9e2f852-d0c7-43b5-949a-5e0ea775e8e3", "comment": "Malware payload (RedLineStealer)", "value": "0d89cb117617178c6c34c1e10656b40b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654836723, "uuid": "0a96b112-eff7-40e3-9664-a4028a8b78e2", "comment": "Malware payload (RedLineStealer)", "value": "826a0a15b1dd1943316f40dcc16180705043558a14e9065227186d55bbe05343", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654836723, "uuid": "01e933cf-2cd7-4380-990f-67247f0a374c", "comment": "Malware payload (RedLineStealer)", "value": "55d58208627545a40e90e1e4ee832978b4c498eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654836723, "uuid": "ad54e4c1-32a9-4560-a11d-be8dd31078a9", "comment": "Malware payload (RedLineStealer)", "value": "f85589f8020627ecaf396b409aa8e63ce1465296e06dfc16035c3b3aa8bba5b83b6ec0c52c8710a0ef68ed107af492b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654836723, "uuid": "b26df20e-2754-4f7f-9990-da502f5a805b", "value": "T1DFC609039A8B0E75DDC27BB461CB633B9734EE30CA269B7FF608C53559532C5681AB42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654836723, "uuid": "2d79c142-ab47-4627-bc0a-27dbc8b66d23", "value": "1c09d997bba3225142a0281004608efa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654836723, "uuid": "520563b1-72e4-48fd-8f8f-cba21e1567e0", "value": "49152:oMjHL9CTy7Qjj2pIHohA5p8rFQCSEZBC:oMjHL9CTiQjj2pIHoGpa5n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654836723, "uuid": "3cdbc8bb-2780-4525-a797-56c2607524e3", "value": 11590226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654836723, "uuid": "009a496e-9da0-4a07-a729-38f94134cdc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654836723, "uuid": "9b213214-7517-44fa-87f5-0a9bdc130a12", "value": "0d89cb117617178c6c34c1e10656b40b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0089e4d8-e8ee-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654886945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654886945, "uuid": "b119288b-a4d4-4391-90e8-878eafbb9e91", "comment": "Malware payload", "value": "1cafb76a261b27d67560196d6868bf23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654886945, "uuid": "b7ff2f06-ebdc-4868-8e0b-c64fb30652b7", "comment": "Malware payload", "value": "839d3ebdb180914d02521eb48974990030b7d74dca8af200cd0101c2ad0bc38b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654886945, "uuid": "d8bdeeb1-3c8f-4208-9453-695adb30ec46", "comment": "Malware payload", "value": "776331adfa5b1253a1d88b6290fc7cea680978f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654886945, "uuid": "095acd78-1bf2-44c7-8252-3672fadfba8a", "comment": "Malware payload", "value": "b22a78eb76cc8c01d4e52fdb20f8059533bb0e3e6ddb8c879e5a369293b54862583e14dfe8e43a8c8665748e70c35706", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654886945, "uuid": "2e306050-3dc4-4633-8626-645ebde7e444", "value": "T1B3D4EBA1AE0823CB84A121B8E41F241C1FCF7D71A5BDA9EC850B7953FAB34CD709965D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654886945, "uuid": "4f061570-a45c-4c3f-9e37-cebb4b2ad61c", "value": "2a2a662be9dffc461398e7c94d0b55b4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654886945, "uuid": "182d80ca-6517-4b06-a4da-7ec487939a8a", "value": "6144:Pkpok88mBS1snKE14V9gye53CpjliopkcerC7yAIdA+pdEDIh28:spoeoS1IKHHG3CD5kcWC7MpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654886945, "uuid": "fa16a18b-12d3-4f4e-8386-f5d1533acbf1", "value": 614912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654886945, "uuid": "99bed76d-d5a3-4c9e-a9d4-2f3ffcaae17b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654886945, "uuid": "24e5c119-20d5-408b-bdec-c4eecc983c74", "value": "SecuriteInfo.com.Variant.FakeAlert.2.21192.30452", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dd5411f-e891-11ec-93bb-42010a9c0043", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1654847131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847131, "uuid": "1baca71a-8bc8-4af7-a8e9-40f8b3375f48", "comment": "Malware payload (ArkeiStealer)", "value": "86577298f45d241bc7d90dfc05d996f7", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847131, "uuid": "03fef96f-4ada-4232-8761-343a00ab5c76", "comment": "Malware payload (ArkeiStealer)", "value": "84737380889c0a048ca05cb8176457f85666beccc750c262d30c64441ffee857", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847131, "uuid": "c3473e47-c284-44df-8f90-53d0e70ba286", "comment": "Malware payload (ArkeiStealer)", "value": "2e1d4a1707c755a77de5737a38be300309e1543b", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847131, "uuid": "18339c24-e934-4c17-a168-47addabe1e49", "comment": "Malware payload (ArkeiStealer)", "value": "da41574eb1e1cb9fe2f3a50a51abf525f61ba85d74d1ca76832eb0ab94b9a2074d4ef186f5744a6ab83eaafc916489a7", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847131, "uuid": "d477d594-899d-486e-ba79-973b3ee1ebdc", "value": "T174E53391FA866B06D0EBDC35D6BD0A71DF0C90D1374A9B5B32EA015C8FB97832E0654E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847131, "uuid": "ffd4d236-5abe-4aaa-8ae2-eaca58d6d6b3", "value": "bee6b6031caef490ea53179b1f7393a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847131, "uuid": "3b14aa66-6e02-46be-8148-58b42942fe55", "value": "98304:LJDPclAP8F2TZzkOfFgvb99jce3hRiA7EOms:lclTcTZzkQFacARc6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654847131, "uuid": "8b2a4cb2-fe32-481f-a7bb-04c8dc88bef6", "value": 3207680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654847131, "uuid": "35f555bc-60b2-4aa4-9a93-881fe85b9518", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847131, "uuid": "e0bbfe62-0569-4d9a-b53b-867caea38551", "value": "84737380889c0a048ca05cb8176457f85666beccc750c262d30c64441ffee857", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57385bd5-e8ea-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1654885372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654885372, "uuid": "3b18258c-0317-4ddc-99fd-4744d2329f7a", "comment": "Malware payload (RedLineStealer)", "value": "3edba76e3eeec090bda81b7120025b9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654885372, "uuid": "3a667ac6-f9db-4967-a965-a0cffb4774ca", "comment": "Malware payload (RedLineStealer)", "value": "84752137ce55ddc79cf2cd02069fb6c68f55901453609024bc6ed508dfc026a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654885372, "uuid": "7f95b3a8-4563-467e-ab74-bdb7145eb4da", "comment": "Malware payload (RedLineStealer)", "value": "369b6de0bb06cbca3a79eb0a09202b430efe8f1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654885372, "uuid": "cef5d142-c148-4c64-a31d-87f41a1669d7", "comment": "Malware payload (RedLineStealer)", "value": "e54d2ef1e7355b373af64d14bc0cd1e42a569e424bfe814fb638f4db1c1cadff1e0164d09baf6e8672efe35a5901f02b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654885372, "uuid": "22753f97-8845-4ab4-8107-f4c125e1a8b7", "value": "T14B448D00BB90C035F5B716F449B9D369B53EBEB19B2491CBA2D52AED46346E0EC3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654885372, "uuid": "c4df6ec5-9eb9-4116-8f5c-1fd6c561795d", "value": "183878c3631ff73c16750d8f376c4755", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654885372, "uuid": "16c5993b-a9cc-401d-b38a-1210c959b70d", "value": "6144:jsTISqIs0gV90giTALRocOEms+5M+PXDGK:jsMesV9rUALRogr4X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654885372, "uuid": "099122db-484d-4897-a2e9-0c3b81803e25", "value": 274432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654885372, "uuid": "8a882150-812f-48e7-8cb2-b80dad10ed5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654885372, "uuid": "b74b9484-2a6f-480a-a6bd-94439483d90a", "value": "3edba76e3eeec090bda81b7120025b9b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5e82aa0-e8b3-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654861935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861935, "uuid": "83a92d0c-c07c-4138-869c-3f49acf17cc7", "comment": "Malware payload (Mirai)", "value": "7e4d4dba99e9bc10dd2baf7534260d6c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861935, "uuid": "33c1aa8c-5a78-4d75-9d5f-5d287d130307", "comment": "Malware payload (Mirai)", "value": "860be6bd6075204c40c96b92480c75e9ee218e37a9ec152e4fcdd8118115b899", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861935, "uuid": "20206109-d27b-468e-9ace-2c45bbf7a7c1", "comment": "Malware payload (Mirai)", "value": "bb57f22914c6a8efe5563d9928c3e80c9882b2c8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861935, "uuid": "03ec5927-aef8-4c77-afdd-0e98a2d9c4f6", "comment": "Malware payload (Mirai)", "value": "46c9df396dbfa140c24bb9013de5e48b42a10ac391ebb0f6d3c9c824c5c1dc391cb6de496a02fa10d153ac3dadc617ed", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654861935, "uuid": "f26192c9-6320-414b-b985-488081806ead", "value": "T17CD2E19ACD290B41F99A887C50AFE5473DB1C72B1792E5936F8430B7096EFB01E146E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654861935, "uuid": "e9c9522a-8b3b-4895-bf9e-5a8786f0ae2b", "value": "768:rcuOG9b1rQ6tkd2rM6yfHD+Kwn1llsNinbcuyD7UGQRjA:YuOG86tkdGMnPDtwrlDnouy8Gy0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654861935, "uuid": "9475feb6-e3e7-48f8-ba18-e760705871ce", "value": 29460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654861935, "uuid": "464a48b8-4b85-4e27-93da-f8af37718858", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654861935, "uuid": "f28ebdcc-8504-4cc7-abbb-93fe3b3c4e9d", "value": "vailon.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6ee6cbf-e8fe-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654894203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654894203, "uuid": "c2c3c760-c6c6-44bc-ade1-ea1c50152863", "comment": "Malware payload (Mirai)", "value": "8417d1358c35df683375bb2164648e7a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654894203, "uuid": "7590891b-ef49-47a4-994e-c40e5b56ed2e", "comment": "Malware payload (Mirai)", "value": "867fbd96415ec2d1419cf8d5bd74b2963fd7b592f69990a92c471372f51d86e2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654894203, "uuid": "37c242e7-6e02-4965-b402-581140e91c4f", "comment": "Malware payload (Mirai)", "value": "9a622bed3233e920a1f39189549dbb2db87cfaa4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654894203, "uuid": "41e6ea50-3ee0-4016-ab8e-ab3bd176d284", "comment": "Malware payload (Mirai)", "value": "4afb8ee4d9329b00a02c492d49bf09bd2c8ed93c795e901fd35969e746ceb98e04610141d07e107f304cba9e30b9a20c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654894203, "uuid": "6080c5f3-51b8-4ba1-a329-da21d63c7a95", "value": "T1A4D33B56FA818F13C4D617B6BA9F4245332397A493D733069928AFB43F87B5E0E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654894203, "uuid": "c98827e9-070b-451d-9f18-d46b3ca6f64f", "value": "3072:8+w0YDMi5NbSaFiNrcX/K0gYoLqAKeIdM/91+ldJ:8+w0YD95E8iNrcX/AYyKeyM/9I3J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654894203, "uuid": "77496f4d-bbc1-4476-9b97-9155b09c010c", "value": 131636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654894203, "uuid": "bc9d9ff3-9f55-4ded-bf39-136fd4876004", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654894203, "uuid": "6fe6a0e5-ced1-4d87-b3ba-38eb08836b60", "value": "PnBarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94cc4910-e897-11ec-93bb-42010a9c0043", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1654849827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849827, "uuid": "b6bd81d5-045d-4e7f-91b4-eabb10fedf9c", "comment": "Malware payload (Gh0stRAT)", "value": "4783f3b409ffc5777c39c0c37e377acb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849827, "uuid": "0f1d48be-d5de-45e3-8845-9d7bb1781dd0", "comment": "Malware payload (Gh0stRAT)", "value": "86c8f78d6c977f1d9a280a960a10c9c485419afbb8c70f7a90a82f0eadee9445", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849827, "uuid": "22a851ea-bc1b-4e95-ac47-a55c01b29e38", "comment": "Malware payload (Gh0stRAT)", "value": "37904e12045e46d559ffb3dbfba34cc360b0546e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849827, "uuid": "1784755f-eae6-4c73-85da-5da4602cb351", "comment": "Malware payload (Gh0stRAT)", "value": "6423cc3c887f7bfa74d4a40e4f69dfeb42a00a3cf526d8ce2ab274e8333fdc1c1c906bf2b7883beeea3f902d91c5e015", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849827, "uuid": "13435044-a93e-4d8e-8a80-fbb6c27e27fd", "value": "T190B58D43B5A64872C3C89671DE67DAF39B2076BE57F306367A4CEDC43A253447B22224", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849827, "uuid": "b753c117-f2eb-4615-8078-ba14b42c3329", "value": "eeac73be37480fd144f387e3563a0f14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849827, "uuid": "329409d8-c7fe-4e07-85c9-bfac5b276a36", "value": "24576:4CwsbKgbQ5NANIvGTYwMHXA+wT1kfTw4SIuvB74fgt7ibhRM5QhKehFdMtRj7nH2:4CwsbCANnKXferL7Vwe/Gg0P+WhV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654849827, "uuid": "35d1ad26-b2ed-4ac6-9efd-824f03e68535", "value": 2334720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654849827, "uuid": "2fad83bd-040a-4a1c-801d-8c8dce353f53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849827, "uuid": "6b5479bd-4c5b-4619-b41f-dffb35722a22", "value": "g.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8c917b0-e88e-11ec-93bb-42010a9c0043", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1654846076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846076, "uuid": "5cbd5e5c-cb74-4d58-ab81-740ee13d2b38", "comment": "Malware payload (ArkeiStealer)", "value": "0f78d106f1c8445712074308819203c2", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846076, "uuid": "228b36cd-c01b-4ffe-aab0-7ab56b1100c4", "comment": "Malware payload (ArkeiStealer)", "value": "8707db0c5f43898a663d03d935e37d6dd9a02cc9d4082c84b21aacea94d9bba3", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846076, "uuid": "a294e1d6-6d43-4fc2-b596-f69f15afb263", "comment": "Malware payload (ArkeiStealer)", "value": "2529730d80e6ab8cb7bf20559e7377e35726a812", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846076, "uuid": "a5c3fa34-d72f-4293-84c7-27b860ff717f", "comment": "Malware payload (ArkeiStealer)", "value": "cdd5543f6eaaa5225b7b7eb4952a23c75617dce6e38d70b1b6b7dd64a8eea31894c9ec4c7385c4825683e56bb3332242", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846076, "uuid": "bb53e2aa-d8e0-498c-a8da-fe917d826a8c", "value": "T10AC52B135A8B0E75DDC27BB4A1CB633B9734ED30CA2A9B7FF609C53559532C4681AB02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846076, "uuid": "01e3157f-0510-45fd-8ba8-f6190e18010f", "value": "5dd6748a8bf8c3a3d51aac89447af978", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846076, "uuid": "9a36e07c-bef9-4099-acbd-099246077912", "value": "24576:6AN0mRQJEjZr79ZP5FIj4LCGtK4oPthTrEC4Eh8LeaZMtQjce3nFyi3uQ5p3h31e:6AN0mRQJEjZr7HzTxith/f4rLefujco8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654846076, "uuid": "e85a1644-9104-467a-825f-999a4244fa03", "value": 2559472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654846076, "uuid": "1567943d-194d-4d91-b026-550f493ae7f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846076, "uuid": "92d12164-c0b9-411e-9b87-95690706ddda", "value": "8707db0c5f43898a663d03d935e37d6dd9a02cc9d4082c84b21aacea94d9bba3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1edc572d-e8b5-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654862514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654862514, "uuid": "a59fa20d-d62d-4000-b62d-13d4f636693e", "comment": "Malware payload (Formbook)", "value": "6549f8980d543a66c7abcd4070c0291f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654862514, "uuid": "ec5bb6b9-e27e-4466-a613-33fe170e273d", "comment": "Malware payload (Formbook)", "value": "87209c20648d8d6cf21075c3f46efa52f19c0cbc505a9229f19c2c9b025ce1d0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654862514, "uuid": "c4284799-1649-46b4-9149-55f4062186aa", "comment": "Malware payload (Formbook)", "value": "fd112d4ee46fb1626f6ff62524446f59c2b1def1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654862514, "uuid": "846ef970-7a9c-4f85-8fe5-d1f530dd0b21", "comment": "Malware payload (Formbook)", "value": "328e4536ece48538aa90899df67a1d0af527d2433afea1464b7e56c4bf3c5eb62fce1dd36a12f3be11218d43f816d0ae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654862514, "uuid": "98d00adb-85dd-4d2a-8649-04ff4caefa7d", "value": "T199559D1037E84F1AE7EE57F1B034051667F5F406E76AD34D4E0896AA2C92F46C8CA7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654862514, "uuid": "ad452742-2ab3-4614-8160-d08cd2d58fd0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654862514, "uuid": "8c68675b-8f32-4c82-b53f-958d5f56897e", "value": "24576:Kv3M6J5OYrwTQAFdoMvZUMiu+FySSqXBBTw6L8id2P:K0U4MwTPdNOMiumuWB06Lxd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654862514, "uuid": "a6e4a803-bd1b-4c62-9fcd-cac934737ebe", "value": 1290240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654862514, "uuid": "be49f4fc-86a3-4fc6-8cc3-c77fa4e1b800", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654862514, "uuid": "6164c930-bfd7-4721-aa61-1243e99186a3", "value": "6549f8980d543a66c7abcd4070c0291f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e3087d8-e90b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654899477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654899477, "uuid": "2d400d87-94af-4498-bf9b-9ac7f69cac60", "comment": "Malware payload (Mirai)", "value": "6d9773c2c55bbfea75f16a721e6dd6ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654899477, "uuid": "8ceacd1b-005b-4a88-80c1-028e0a0314e2", "comment": "Malware payload (Mirai)", "value": "873058f4e44c8f4629aeeb8cdfed68a8421e21a34422dfe0beec515bda13699d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654899477, "uuid": "213ed96f-2d9b-4f26-abf7-5c1db3b3ef68", "comment": "Malware payload (Mirai)", "value": "160afb44bcdb1f4bcc9c504fec30b453b394b143", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654899477, "uuid": "52bbd43b-44d2-45ea-bafc-157d8e35d1ba", "comment": "Malware payload (Mirai)", "value": "6b0e523387faa1acc18db54dcfb048b17cde0e5c502c12b60a5f4d6764965337812cb0792076a4d3109f048647074009", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654899477, "uuid": "1d190520-06f4-4d63-a49e-5bddd2fc2162", "value": "T1BB733C25B9393F22C0D5707A51FB8711BAE6329E31B0965E3CB20F5EBF6464068066F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654899477, "uuid": "653af9b2-f6f7-4a3b-94a3-218d9828aab0", "value": "1536:CUIUrlOYWJZregVg8f+c8ryPV45ovtVhBAguaabKS3:XIeh8f+cvxvtfOgua43", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654899477, "uuid": "8860aee1-b77e-4375-b440-109aa7cb29e3", "value": 74768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654899477, "uuid": "29d09501-e1f6-4a90-89e4-3399d185f2d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654899477, "uuid": "7a0830ad-b02a-47db-ba37-35d38a880721", "value": "6d9773c2c55bbfea75f16a721e6dd6ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee7ace33-e8d2-11ec-93bb-42010a9c0043", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1654875318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654875318, "uuid": "96b7ad30-6e75-47e5-92e2-60db548cbdfe", "comment": "Malware payload (ArkeiStealer)", "value": "e2f83065dd0468ec37d82ac99d99398f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654875318, "uuid": "da919665-4275-4573-94bc-00bf686346b2", "comment": "Malware payload (ArkeiStealer)", "value": "87587daf41fc56e6512d5a41845e9ac66d3c84dc4fc9874bd501279fa0a498fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654875318, "uuid": "385be722-b6fc-4fc7-8caf-8d3d74bbcd42", "comment": "Malware payload (ArkeiStealer)", "value": "388565ba8d06dd31ec36a6676d70737b466cea88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654875318, "uuid": "cae19f60-46f3-46fb-990b-287bbaa0e37f", "comment": "Malware payload (ArkeiStealer)", "value": "86404fff4c34f52d69ce5214696743b07880d5a9f758776329c87dc2102698c35793f257fbf4e1fd51c8bb93af8d3d94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654875318, "uuid": "f6ca728f-09e6-44b9-92b7-3193472667ac", "value": "T127E55C139B8B0EA5DDC23BB4A1CB533B9734EE30CA269B7FF609C43559532C5681A742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654875318, "uuid": "b1eaadb9-f3c3-44e1-ab59-899b14218b1b", "value": "5dd6748a8bf8c3a3d51aac89447af978", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654875318, "uuid": "cb80f502-bfdb-43c2-bea5-3289ecbd57ec", "value": "49152:OrASjvMYDdV+zrhb1PpmP/aTL3BtvBhxiCXooPswIJaxPPE:OrJvMY+Hhb5pmnaTLPHyokjX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654875318, "uuid": "a621d4e7-671c-4bfb-940b-91f061a61692", "value": 3191471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654875318, "uuid": "5a369142-4bb7-4b1c-b15b-d6b986ab7ff8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654875318, "uuid": "3ef92829-5d26-4f60-8a4a-02091c1da2d7", "value": "TJB1A4JAJA6KQM5Z1RVP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7913dd8-e8d8-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654877883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654877883, "uuid": "bf40cae7-0625-4a95-b38c-05cea644d52d", "comment": "Malware payload", "value": "b4cc9c9fa60de567b727e382d2429072", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654877883, "uuid": "2d87abe9-be84-41dd-b6b5-7dfdfcedf60a", "comment": "Malware payload", "value": "886bf42e6019f808994ba7e0102c16f7a29d74d3d2f24f8cf6a4083127a29c40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654877883, "uuid": "07b51097-77bc-4620-8872-9685e9021662", "comment": "Malware payload", "value": "e9e6b75d4cbfa677f392b6adc12686218bfed49d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654877883, "uuid": "076a85ae-48f6-483b-8436-41c23751f109", "comment": "Malware payload", "value": "b165623d793b2d8cf225ac0e161aed8f3863ac53f470b8a7e0bba784ea57125c96e18116d3836288a174f11ed9e7f061", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654877883, "uuid": "7469e808-3192-4290-8f20-5099af94ecc4", "value": "T17AE4F1097615AA9EC01A8637CADA1C1093729E57671BE74BA4C7328D9D0F3DFCF062C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654877883, "uuid": "669d8bf1-5866-4712-bb5d-cd2af74d0901", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654877883, "uuid": "5cc1dcdc-9149-4ead-beb4-336b94ff858f", "value": "12288:jhxZ1kR/Rw68AyI9q0ztTGcxl78lFGvvjn01kJzROz+WUup7AG95:fsBtTGcPg0v7tD6fVU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654877883, "uuid": "58169e2b-3164-4d38-a907-61e73a61e850", "value": 688640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654877883, "uuid": "ceb6c87b-dafb-4c25-8ebd-476cec33b154", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654877883, "uuid": "6f218062-80e3-4d11-ab8a-481b131f509f", "value": "specification and samples-pdf-.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9cfd177-e88e-11ec-93bb-42010a9c0043", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1654846077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846077, "uuid": "bdb647f1-9e31-4d19-ad4e-421858afaf18", "comment": "Malware payload (ArkeiStealer)", "value": "653eeb2be69216eec81ab99bdcc1fbfa", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846077, "uuid": "3b1c47fc-3472-4dcd-8af1-d7926204fe96", "comment": "Malware payload (ArkeiStealer)", "value": "88d1b3da75b9f712e55b05a30e713b99134c3decc4f073d3ad7a7e06270b526b", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846077, "uuid": "3599df90-43d1-45f4-acb6-5131b8a3aeef", "comment": "Malware payload (ArkeiStealer)", "value": "34d1bcefcfbe34a8e6151e121e16ed5bd450caf1", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846077, "uuid": "885aa0c6-df5b-4f93-bb86-59012ced6c3a", "comment": "Malware payload (ArkeiStealer)", "value": "da40aaee5d3c481c1efe77520d4f40814b42131371610e712ce22a5ca9d44be32ede423167cf369c3c315d8d8f364c75", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846077, "uuid": "907741bc-8400-40ff-93de-4a04fe217cf0", "value": "T107C51A039A8B0E75DDC23BB461CB633B9734EE30CA269B7FF609C53599532C5681A742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846077, "uuid": "4d21e9e3-bb73-4525-a824-b0286043d4c8", "value": "ded04cbec414252b14476348fc5550ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846077, "uuid": "93ddcce4-72bb-4cdc-891e-e2daaca7abee", "value": "24576:3ARdvnS4r3eneSNETjMRQi6jQsV91Uv5y8r7oScO/VdgofYj15fuQ5p3h318zE:3ARdvnS4r3eneSNQu2hKh/Ag/VPE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654846077, "uuid": "ec0ba81b-62ea-449e-be85-3be2055a068d", "value": 2539136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654846077, "uuid": "53c04401-3029-4ea8-9d76-9be079db54b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846077, "uuid": "ce0a4354-2f6c-4e60-874a-04b5dda46d30", "value": "88d1b3da75b9f712e55b05a30e713b99134c3decc4f073d3ad7a7e06270b526b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "404e51fa-e897-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654849685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849685, "uuid": "b4c59ac9-a2bf-4fcc-a206-ab244795557b", "comment": "Malware payload", "value": "f8e6b9c3efa23ad232f95aab77ba48bc", "object_relation": "md5", "Tag": [ { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849685, "uuid": "7203f2e4-2046-491f-b04f-f9eb470035ea", "comment": "Malware payload", "value": "894e9d1e20ca364dde0773eb7235ce676cbf45dbd9ef02be61e9ecefd8b226fd", "object_relation": "sha256", "Tag": [ { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849685, "uuid": "ca1430eb-a155-419f-b449-47c100bcba90", "comment": "Malware payload", "value": "28c10b457d03d9d88c8f82cdf7efbdfce4370511", "object_relation": "sha1", "Tag": [ { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849685, "uuid": "709af1ae-c218-4194-8a9f-23f57fa651c9", "comment": "Malware payload", "value": "105adbfea979875f260bd5f58aac7b12bdb37d534ef324856d872fb9e4651067dd942efb47d955d48e68494b1a8a705f", "object_relation": "sha3-384", "Tag": [ { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849685, "uuid": "7a281ddb-8251-4cfa-9988-254e40d5aaa7", "value": "T1C4C502BD62443358C41AC5B85533FD0AB3B6962E07E4E9AEB2CB7A407BDF851DA05F01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849685, "uuid": "2db89237-7a33-43ef-9a7c-f6b2ca42ea73", "value": "dd40f5b51f0c60504774fe5ba71e8a7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849685, "uuid": "11de87e9-782f-40c9-a05b-3a6ea89d8201", "value": "49152:yOAWgA9i5Th9k3Do8eqVWtbHvW/IodJnONn/YMvWzDSvDCAM:iW8Rk8OkNHksPvpM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654849685, "uuid": "f78703c5-c66d-440d-831b-2c5660cbbd56", "value": 2737048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654849685, "uuid": "9024763a-32dd-4fbe-9898-a7e6c2535511", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849685, "uuid": "fdd87846-f644-4a89-9af7-e44f0740af7e", "value": "i8041par.sys", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b7371a7-e897-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654849677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849677, "uuid": "ab1f9b6e-cdc0-446d-b789-46ffcb302a9d", "comment": "Malware payload", "value": "415240633837ebcbd80e080ba99c03a9", "object_relation": "md5", "Tag": [ { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849677, "uuid": "df99bbbc-7151-4fe3-bd31-2f2d35ef1b47", "comment": "Malware payload", "value": "89512dc510da375ed93a2ad340de85b7db7faee1f0fe21c04189e85a140e4970", "object_relation": "sha256", "Tag": [ { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849677, "uuid": "bbeb147d-bdb8-442f-8ed1-5ff647de2f4d", "comment": "Malware payload", "value": "8fd9307df8686e7d62ab39d4bf5fc13693f63044", "object_relation": "sha1", "Tag": [ { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849677, "uuid": "bf677eaf-a1ed-44bc-ab12-ad58d6f5ba3e", "comment": "Malware payload", "value": "d2e1ad3529c41c1f57ae54f739db5152ab6f189fdbe16524cc3235c6d7b5f0b1abc1f756473b3324a5e8be32f5b68bf8", "object_relation": "sha3-384", "Tag": [ { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849677, "uuid": "8f42ceda-eda9-43f3-b176-c7b686e537df", "value": "T15FD5CFAD6288339CC01EC4349827ED4472FA592E5BF5A5EE71DBFEC03B5B820D546B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849677, "uuid": "eb42c6bf-8a03-41a7-b5e6-f42037b9d781", "value": "df44970e3d8f28623f69dd293d236700", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849677, "uuid": "41182e68-5a5d-42d9-bb10-ffdcd59bb0d3", "value": "49152:4CM/iOtXcCG1/rUCAgkXJ8gYs4i/fn9RZsIRCFZFmYwnLtWV326a1cO3SJSOW6CI:wCrEgiYIvNYstyA6mc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654849677, "uuid": "e2ee5131-df5f-4730-8281-89f00688fdf6", "value": 2915872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654849677, "uuid": "2e814952-e9e8-4a1e-b7d7-f04ddf57092b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849677, "uuid": "bffbf07e-a053-4077-a61a-8f04c44f82a1", "value": "009196861164399231.sys", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7626e680-e863-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654827442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654827442, "uuid": "a3cbda70-5761-4fb6-b063-c238b96876ef", "comment": "Malware payload (Mirai)", "value": "343d06621da8735b181efc5e302ece2a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654827442, "uuid": "9d6ddef8-c9ec-43a4-8d30-3b532320cbf3", "comment": "Malware payload (Mirai)", "value": "8bafa89daf8cc167f68116e1d338bd00e7ec566ff54e9366afc2f47242eb1523", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654827442, "uuid": "788e424b-dae2-4cbd-bf35-c2c39e3f1f07", "comment": "Malware payload (Mirai)", "value": "1ec442baf0995d182de0d7d1d34d62cedafe7d05", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654827442, "uuid": "bdb51ff2-bc2f-4b39-8af7-d7430e18afce", "comment": "Malware payload (Mirai)", "value": "20dcd4b8ab994461877c082b66fca2bdd01f4eed0608c8f0b0c0798ad5978a46ee9b9f85e3997020eed7baefbf2bab12", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654827442, "uuid": "31dae456-c3a0-4167-a81c-618b326e8fde", "value": "T1D693C7097F611FF7ECABCD374AA92705258D641A22A97F35BD34D818B20B21F15E38B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654827442, "uuid": "1a9ef678-c951-4afa-86e3-8e3b264aa68a", "value": "1536:73icfTYLZDcdtZlsBqbyJAuirWE9EjZA1EH1a10X:7ycfTYLZDcHDCqrKjS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654827442, "uuid": "006c7e99-7bfb-4e39-b217-68692deb91f1", "value": 89596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654827442, "uuid": "9fddba97-a3d6-423a-9637-6a40461549af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654827442, "uuid": "058c2aae-40f7-4ec6-b733-70b522e9434e", "value": "343d06621da8735b181efc5e302ece2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae000c79-e8b0-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654860607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654860607, "uuid": "3e530efa-3417-4187-8c6b-392cf7e52bb6", "comment": "Malware payload (Mirai)", "value": "fed54b960e4986ca7e9ac459915bbbc3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654860607, "uuid": "994846ea-153f-48fc-a85e-1ef2d12f6194", "comment": "Malware payload (Mirai)", "value": "8bbe01b630a3ad1a323a93b105ca53e846a4eddb98fe866b003fd23b0b44b64d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654860607, "uuid": "5654c1c1-0f71-436c-ac04-d75ad960b292", "comment": "Malware payload (Mirai)", "value": "9e169d570ebe616f429436b547a5329ed4f6cc2c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654860607, "uuid": "99cb5032-f15a-4999-830b-6591c69574fa", "comment": "Malware payload (Mirai)", "value": "cc21b6c2ca2235d78dc829b10a5259463982dfd3fe20b9d411c99e34e22e6736616f56afd878931d66d10ee03b8d9ba0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654860607, "uuid": "df4f9255-1064-45f9-bcbf-b857e619452b", "value": "T1AF93B74D3E319F7CFBAD923487B34A21974933D926E1C684D1ACE9015E7024E741FBAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654860607, "uuid": "0a9f9459-3b3e-4f40-b0d3-09dd52385ed9", "value": "1536:iorsNDrt+3RilMeQsbUvZ81sBuVSeEU3PiZ1yn1eyy+b0hL:zstr4ReQscKsBuVSeEU3PiZ1yn++b0hL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654860607, "uuid": "710a6493-5ec0-42f6-992d-aa79b149831b", "value": 97144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654860607, "uuid": "f895a4f0-a4ae-4f7b-9aa3-a8c56979a3f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654860607, "uuid": "ac745f76-2823-4e94-b2c4-9525f86e3589", "value": "fed54b960e4986ca7e9ac459915bbbc3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8014037c-e8c3-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1654868690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654868690, "uuid": "fc98861c-800a-4a20-bc70-c06149db211d", "comment": "Malware payload (SnakeKeylogger)", "value": "abd128b91498e490c077a473cb2cf79d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654868690, "uuid": "a76646a9-743e-4f9c-a0c3-572babda3de5", "comment": "Malware payload (SnakeKeylogger)", "value": "8c145bba81176d193f1452bebb4fd890abb37b37a5a47b51f9ba8693636a92d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654868690, "uuid": "d2832bc1-a84c-4b9d-8812-c046581d8f4c", "comment": "Malware payload (SnakeKeylogger)", "value": "56f12f11359fe3fe9e4d64b92e5c976dafdb38b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654868690, "uuid": "7ea866ac-3c7d-4a64-b531-a620e8ad3618", "comment": "Malware payload (SnakeKeylogger)", "value": "8b44dbf956aed3efcd272c70af398b13d2c6ec03b4545b3add8884c1a1b38a7a2b50610a2fcb04dc56599b95fc6d54d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654868690, "uuid": "2aa68b94-21cf-450d-817c-8e60625cf0bc", "value": "T129C42350E150A5E9E4A78931136B8B74F3F19D2A51CCA30A43C47A72E17359BB20FBE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654868690, "uuid": "e6601cb3-922a-454e-9239-7be2f77dc3c7", "value": "dd1742eadfc6df18ded3c26ae64ad610", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654868690, "uuid": "f36dd3d8-abc5-408a-bc5f-3e7b200efa1b", "value": "12288:xiSxVcg2vI1ITVfmp6D84tVNxXtXN8fdAXJfc:P/GI1ITVIutV0fmX6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654868690, "uuid": "50f53c7a-c437-4c8f-af78-01b7cde5d670", "value": 568533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654868690, "uuid": "f8ba9e6a-5921-417a-bf62-4c05615ddb83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654868690, "uuid": "55eb31b4-8064-476e-89e5-bba3b4826e58", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5a9f53d-e8a2-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654854634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654854634, "uuid": "06287fcc-ead4-403b-a63e-f6887130831c", "comment": "Malware payload", "value": "dd3af10ffa86a1d4bb2e3b172c779678", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654854634, "uuid": "81cf8300-3edc-4828-a955-c4843710024a", "comment": "Malware payload", "value": "8c828b2ce29eb314d31d9bb18277046a3ac6e57f02d1facf45d9d2291b070358", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654854634, "uuid": "de59fa48-15e9-42d8-8f5a-8a35cfe28f80", "comment": "Malware payload", "value": "c1c59cf22dcbf393d2f711713947a840446e1556", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654854634, "uuid": "4a57bf86-a25b-4e51-b33f-092ed1c85a5c", "comment": "Malware payload", "value": "483f35a8eff7f00a68e309dcf5b5c07ba9566485d960ff97cf02f94a331a480003fee97d858fd77e18cdb7069f8ec99a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654854634, "uuid": "7b044a5c-a949-410e-99ea-0f4c44c2bfd9", "value": "T187452304FAD51F0ED71C563E088B8E2A2256FF4F1B14E0FB7798BA89123EA71455386D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654854634, "uuid": "744f8034-217f-438f-b0c7-411d9b318749", "value": "24576:Kq9IrAuOGZ+9ZPAWDOL14zXIQx/OOIQ9H+NDFa:Kqg7+9P6mn/9H+2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654854634, "uuid": "a43e031d-b3cc-4958-9b78-7fb388f2e2b4", "value": 1279488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654854634, "uuid": "1b8ef1a4-1ce4-463e-9de9-ff8a9c94f018", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654854634, "uuid": "b0b98850-e913-4e24-9e1a-00d5559d5952", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.4317.25163", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dae10ec3-e88e-11ec-93bb-42010a9c0043", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1654846079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846079, "uuid": "5161dadd-c291-4625-bd8d-e3126f7f4654", "comment": "Malware payload (ArkeiStealer)", "value": "4c6ff54f5e1bd372341e82e884fe9544", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846079, "uuid": "ae87c26d-6fb1-4a65-bc8c-f13a167dbd84", "comment": "Malware payload (ArkeiStealer)", "value": "8d39a36304a6bb5636302b76c228287645ff2d9cc52e31c589038bba5429c863", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846079, "uuid": "dbd6011f-fb4e-4ce4-aba9-af0cec61a398", "comment": "Malware payload (ArkeiStealer)", "value": "06d4534d4ff50ba6a085837c4d19ee1c7421a3cd", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846079, "uuid": "1c805154-bf2e-41f3-b364-415b0d16e91f", "comment": "Malware payload (ArkeiStealer)", "value": "b9862868dc2d7924626e7958e5ce1d4712d4ed80d9c51a12141037b3d30f1e17c5e58108decda7ced1aa435ca1394f11", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846079, "uuid": "01f7996f-c02f-4690-9d67-04596b7d374a", "value": "T15BC52B135A8B0E75DDC23BB461CB633B9738ED30CA2A9B7FF609C53599532C5681A702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846079, "uuid": "7f1cede9-066e-4937-8cb7-c59e70ae1ad0", "value": "5dd6748a8bf8c3a3d51aac89447af978", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846079, "uuid": "a544d76f-5c51-4392-9e2e-6f150be638c2", "value": "24576:3rASjvMYSOT/vQMoUJDEVSsR96nPthTrEC4Eh8LeGZMW5LuuHzkXqVuQ5p3h31sQ:3rASjvMYSEfnQeth/f4rLerRuHiBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654846079, "uuid": "0a472beb-0eb5-475d-9d5e-6607343113e0", "value": 2509999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654846079, "uuid": "a6b905e9-72a1-4de8-8bc8-19e98ee108c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846079, "uuid": "c3902ddc-43f7-4ff7-974b-a37fa1911c67", "value": "8d39a36304a6bb5636302b76c228287645ff2d9cc52e31c589038bba5429c863", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bad90581-e8ac-11ec-93bb-42010a9c0043", "comment": "Malware payload (Quakbot)", "timestamp": 1654858910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654858910, "uuid": "42ed639b-b976-4a98-9489-47bb4cde44d1", "comment": "Malware payload (Quakbot)", "value": "79cff99681ce454a099eb0c7467e7276", "object_relation": "md5", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654858910, "uuid": "04fa8cd8-a937-4c6d-9038-11c0402db958", "comment": "Malware payload (Quakbot)", "value": "8d705dcd0ae231b77f5079df18049f76848613c41a45d8f54015b40cf65aebeb", "object_relation": "sha256", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654858910, "uuid": "ef475f5c-f440-46ef-b2e8-4663ab298409", "comment": "Malware payload (Quakbot)", "value": "956f01891bf23ad5113020e565b104cfa260bda0", "object_relation": "sha1", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654858910, "uuid": "0a5de031-2eff-4f4b-8384-4d65103e2723", "comment": "Malware payload (Quakbot)", "value": "3cf847fa47b37bb8d6943f8fbe61035ce796ed0bad7063f095f4c106dee34edd13735e0d9e232722e4cc8d4fd9b999ca", "object_relation": "sha3-384", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654858910, "uuid": "a152909a-1cd0-43fc-8e4f-94d02d8bf1bd", "value": "T10525B062B3905C37C1632A3D9C6B7764A926BF112E3859C72BF81F4C4F356913B252A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654858910, "uuid": "ac724095-f48d-4a2c-a287-448b8e548d10", "value": "20989e3840429c9a803f6f380c7c63b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654858910, "uuid": "ac820f62-7162-431e-90a1-d617ee15cae8", "value": "24576:3FsIvAexp4zV2Kk546oeKg/EEgKny5Qy5s:1tGM8sy5x5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654858910, "uuid": "33572d5a-bf3f-43ee-af7e-ff8d8b150280", "value": 1013821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654858910, "uuid": "6417dbc7-393e-4a0f-8443-78020a66b2f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654858910, "uuid": "665ea68f-7c4c-4ac1-b286-d5294e78a9bf", "value": "8d705dcd0ae231b77f5079df18049f76848613c41a45d8f54015b40cf65aebeb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98bc8b27-e8e1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654881616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654881616, "uuid": "ce493745-a425-4f78-a182-1a9848f6f9f0", "comment": "Malware payload (Mirai)", "value": "620f6d44f42eb1b7b07d2f136d3d3d01", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654881616, "uuid": "3838e9ec-c118-4161-9fe8-ac121ec97ff9", "comment": "Malware payload (Mirai)", "value": "8da5ca7065aa003ef41583a1808f9ad234a260eeb473165684621288176a8226", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654881616, "uuid": "f5dd89ee-805a-434c-86b6-c5e292cf0d2d", "comment": "Malware payload (Mirai)", "value": "60c515741e5cf4144e2211bc6523e3034591ccd3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654881616, "uuid": "c3d0ab40-4674-479e-a7c1-c1912ad36012", "comment": "Malware payload (Mirai)", "value": "546f3e53f90d5f54127ad04a1c8de6ea303277615f750cbdb6d0d20319b6c94ee39da5025c4684b9e6cc86dd069a94b3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654881616, "uuid": "8dcac619-2113-44a1-978c-16572bff1182", "value": "T124F2E1AD8CE455CFCF6C9C7A88EC8BD0D86071C1258D6F7E433ADA58B94610B74C41BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654881616, "uuid": "431ee156-43cc-47a9-afe4-6f0745539cea", "value": "768:0OMhqomMZmpyp1i+v6OUW5sPKA54vDCc4jtRXW7:EhqomMZmpymzDb54WVLm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654881616, "uuid": "510695b1-f551-4e6b-801c-f9d6bc617869", "value": 34652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654881616, "uuid": "9aae7157-43a6-4505-a21e-fd898a99f01d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654881616, "uuid": "a5a2a0e0-f4ac-4392-83f6-746dc153f82d", "value": "620f6d44f42eb1b7b07d2f136d3d3d01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6331b6ad-e8c0-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654867353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654867353, "uuid": "419d5e83-c603-4bb3-bcbe-78be506abad6", "comment": "Malware payload", "value": "ffbe9d4be8767895f85e860bdb8a29a0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654867353, "uuid": "2daf23d5-610c-4b0d-886b-8f11bb88a49f", "comment": "Malware payload", "value": "8dfae643351f050a8679933e2777f9f499f1cbf467c30c49aa6a96614f2cef59", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654867353, "uuid": "91088cdf-412f-467a-849b-6df7e453321c", "comment": "Malware payload", "value": "6cb90b7922be31f38ee3a35f98f8811c72567353", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654867353, "uuid": "2f6edce7-8707-4de2-97ff-fecd60c80e9f", "comment": "Malware payload", "value": "b0674dced7c14b71062caa41fcc8f30242723483ca8193853f9737b9ddfcc2bdf3936b95dfe5af1f7c681d645abdcce8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654867353, "uuid": "5a7db1fc-38a0-4176-9f18-178e97927fb9", "value": "T15E658E26F2918437D0372F788D0B93D99429BB742D2898477AF41F4C9B79BC17A262C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654867353, "uuid": "f0aa2cd9-837a-4e73-bf48-792a7c092816", "value": "5d84950fbf1082beb08edcc1a2cb079b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654867353, "uuid": "16e8c9e9-bf47-4406-a165-862b6d9b0a7f", "value": "24576:TUSw8w3tAkq5/Mj/JKDyK65WK2UGm/OW3sZAsT++aLTh0cWFJK+On2:wGOtA/8kGXkT5mTecQe2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654867353, "uuid": "5ce0f524-7d30-4dfd-844a-71ada961dca5", "value": 1497600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654867353, "uuid": "cb072223-83a7-4209-b50b-a77df64bb320", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654867353, "uuid": "4635c91b-790d-44d4-9afa-98a0bb0a6ce8", "value": "8dfae643351f050a8679933e2777f9f499f1cbf467c30c49aa6a96614f2cef59.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c17801c2-e8e5-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654883403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654883403, "uuid": "a8240c2f-4e00-4384-b5cf-c058be9136c0", "comment": "Malware payload", "value": "56f49f9158eac5fa850454895f51671b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654883403, "uuid": "7dbbcb3f-6ef7-4835-aff4-8fb41356c95a", "comment": "Malware payload", "value": "8e15b121d253466fc7cdfbffdd20009a47b01f231bdf0e84fea50b35a5e329e0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654883403, "uuid": "d2ab1fc3-d17d-44a0-b4c0-615b51ef4133", "comment": "Malware payload", "value": "8a7e108ea29f179fc004ceaab03919c3b784c07f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654883403, "uuid": "4fbc9f31-9624-42e6-aadc-133a5c7c0068", "comment": "Malware payload", "value": "f9d1400bb1327d399dbc08c63151721bfc698a7bca5c7b679544935f610ebeed76d19cfb0db64bc3c25708433a17a579", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654883403, "uuid": "c4af8de5-dc9d-4027-b6e4-7f67fa362d78", "value": "T167530226DDE2C1931E67D832696D4297F763AFB4CF7C385A0C874B5DC9E1125A938802", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654883403, "uuid": "c3b5b448-65e5-472a-9389-cdbc3de7d546", "value": "1536:GZ/SvK+i2iC5r18BT2AlQvytUmZsTcPwJMMdxtc8DTIK:G0xipC5KBhlQqtDZjgtdDT7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654883403, "uuid": "9e6ba7a0-4646-4bf6-a67c-fd28fb816696", "value": 63136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654883403, "uuid": "65709ae7-1ccc-4cf8-82da-865d81dadf5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654883403, "uuid": "265dc437-58e4-4f21-ab1a-16e323eb95a3", "value": "arm7-20220610-1750", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60dd1707-e8aa-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654857900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857900, "uuid": "b480692a-2ceb-476b-bd39-73833771dcf3", "comment": "Malware payload (AgentTesla)", "value": "bcf1479f9839b44e49673f268e0e7269", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857900, "uuid": "a908bece-39b0-4462-b678-5e8469b22e9a", "comment": "Malware payload (AgentTesla)", "value": "8e44e3c86cc8fc702e1384b4f845a03c8fb3d55d3e1275aff19713c08e4c2d8e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857900, "uuid": "da0bee25-a0cb-4d54-b6e1-fb2434d0e281", "comment": "Malware payload (AgentTesla)", "value": "f3cadc8614fab8e763378f6656e1ef874972e865", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857900, "uuid": "a7e3c2c5-1618-4b37-afff-3cdcaeed0b03", "comment": "Malware payload (AgentTesla)", "value": "28a5101983286b35cf403f813567add68d0020b0640eff855dc012c8c68eb03dc65a9a87e9533964736a154246dc6f2f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857900, "uuid": "4f4263bc-7d19-47bf-9ab3-ceecc3154172", "value": "T1F5A5BF0077A0E75BC26E7336A434F73612B569C6BB27E7995630A6E73C433808E527D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857900, "uuid": "8cee4092-9c7f-4137-b202-5912990547ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857900, "uuid": "aa150287-84a6-4480-a3f8-c6d94b87c95c", "value": "49152:Cm+1GOO1hLVzT9BlK6e8kdqrOEIZJVXGq:CQO4hL9Crvz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654857900, "uuid": "9550d418-c22e-465f-9b28-4dda234e235c", "value": 2141576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654857900, "uuid": "a1f655cc-ccc2-47db-bbdf-a0594c31cb0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857900, "uuid": "3a993766-09e3-4f6d-83b8-399952b8209e", "value": "bcf1479f9839b44e49673f268e0e7269", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e534069-e897-11ec-93bb-42010a9c0043", "comment": "Malware payload (CoinMiner)", "timestamp": 1654849816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849816, "uuid": "9c7c8fd9-8439-4e4c-aa3e-17af9e0b5a85", "comment": "Malware payload (CoinMiner)", "value": "c019a68507dd787a28d28d00e711f0da", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849816, "uuid": "8d5299c5-6d19-4fdf-b339-d82fb7c059d3", "comment": "Malware payload (CoinMiner)", "value": "8ebe85fd149f9b1e93668a733182ad6e0cafd1a0b285800e4e6b226b8673cbaa", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849816, "uuid": "b1c5081e-b5de-41e0-bff8-90ea335be61b", "comment": "Malware payload (CoinMiner)", "value": "c60bf8f578aafcc4663e88ec97a0c6e0fcf5f36d", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849816, "uuid": "2c1d17cf-300b-4af0-bd30-00d0fc977948", "comment": "Malware payload (CoinMiner)", "value": "21ea9b1e5361f38753fb68308e24d9284cf64231d1d2d543c9b417c33b4c746b2c635ccb1bbc3a11c5f44343bdcd1d47", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849816, "uuid": "18561387-1023-46e0-b4d5-a6fa23e886fb", "value": "T170463302452366FCFE53BB306D5A776C996277988C6D82FCBA1077B70C2C7D0092B969", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849816, "uuid": "a5ba23f8-3fb2-44be-9f90-8dc6b9bfb56d", "value": "0dc6c5e06e22bd9f0c79c55ec1c09b01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849816, "uuid": "f73b119e-2e8b-4162-9c77-71712b10be20", "value": "98304:4iShUehcQSZOK1VwsFGc6sXficZjp1s0chUU1fbYxicBnQOU8sr43ux4:RQhRSAWVwsQRc6km04UqEg/+ux4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654849816, "uuid": "1c35358f-20db-4f78-a8e4-b994b61446e2", "value": 5688320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654849816, "uuid": "50f53b18-257e-4192-89d5-5d10925ded70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849816, "uuid": "2d06a579-3cbc-4064-8b11-535ff39da75b", "value": "ETH.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "112589fb-e861-11ec-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1654826413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654826413, "uuid": "5c81b6a3-53d6-496f-a8a9-8aba4bb09e99", "comment": "Malware payload (AsyncRAT)", "value": "aaccc7a6adca1ef406e82ca80c57dc01", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654826413, "uuid": "625589bd-208d-43a5-898a-f5fd53caa25f", "comment": "Malware payload (AsyncRAT)", "value": "8fa6091ecf36c321aa568e76eab235f21ff0ca7e5906d75cb8e6c26abd2ef656", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654826413, "uuid": "e65271a6-9fe7-4f14-88f8-d358f8ebdaab", "comment": "Malware payload (AsyncRAT)", "value": "16c05ebbbbf728f4cd9ce17f08ed6cddca397aa7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654826413, "uuid": "d4461bd4-9ff3-40f5-a101-209b7a50a4cb", "comment": "Malware payload (AsyncRAT)", "value": "ef6661b1124db4199ff5296dd08b199301e1558a89a043b3e682e62e62292df4c7b2916da1ce4b1412f7b457ed6ca472", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654826413, "uuid": "c1bb5849-9b30-4547-a68f-8af23632ed8f", "value": "T1D6235C003BE8C136F2BD4BB4ADF3A54582B5D65B6903D69E6CC814DA1B13BC586036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654826413, "uuid": "7ee99cfd-e162-46c7-b075-041c3c65e3db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654826413, "uuid": "36ef1eba-25d3-4e63-b6a7-313abd9bfddb", "value": "768:OqUR8bIL+Cyq+DiPLKjwiT8YbrgeCDkmSwhGL6qvEgK/J/ZVc6KN:OxIePLKTzbUtSZmqnkJ/ZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654826413, "uuid": "bb99c788-898f-4d53-a81d-57e176b23c4e", "value": 49152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654826413, "uuid": "a14bcdfb-8c24-45d7-b74e-52952ed364a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654826413, "uuid": "af949b78-f06d-47d0-9dee-9c005bec836f", "value": "aaccc7a6adca1ef406e82ca80c57dc01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb87e6e4-e8be-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654866669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654866669, "uuid": "07e1e546-d386-4c4d-8fb7-51b6a1021bb2", "comment": "Malware payload", "value": "eaba486ca44ce139b1a6c2520fe61837", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654866669, "uuid": "72e6792f-8401-426f-817a-66874bd82d12", "comment": "Malware payload", "value": "9075cfb0af23c680efc552a226ac48a6b907d5eef8aa50485bc5996cdb548495", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654866669, "uuid": "6c9dc12c-b5f4-4459-9551-5a6fd6559ea8", "comment": "Malware payload", "value": "189fac2249a10a568d13a81f6449bffffdeaefd2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654866669, "uuid": "f6af38e0-55b8-412a-906e-85f330d9f3c8", "comment": "Malware payload", "value": "53637957c1b57477421a66d2e647a28756152fc1b0077e18e74f3690a24d968843d889f2c7be490324c6ba0556c0b8e0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654866669, "uuid": "5002c3ac-954f-4b65-bd64-ceb097033d08", "value": "T16C151273B2814973F162DB78CD784E13593A39203E25649DB9E48B45EA6D3B93C0A3C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654866669, "uuid": "22375967-b2c9-4ba7-a6b2-e27e50604e01", "value": "9b81e630c1c8ce9faa2fdd1626cd40d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654866669, "uuid": "145f95dc-617f-4302-96ad-3f68743e1a58", "value": "24576:XmdyvK3pfyK2cNMcKjkaY8i3Yog4sLTW6mcxSDSs:2QyaCuhY8ioo5senaSDS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654866669, "uuid": "3e3c4e7e-9bcb-4bd1-92ea-7c5fe284e0b0", "value": 933376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654866669, "uuid": "57914a27-9e3f-4229-8862-66d2a0e8d44d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654866669, "uuid": "e53f266e-1b35-45cd-9aec-cd47831cad50", "value": "9075cfb0af23c680efc552a226ac48a6b907d5eef8aa50485bc5996cdb548495", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1e20e55-e8de-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654880397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654880397, "uuid": "7a9637a2-f853-4dc4-b77e-d4f18b358eef", "comment": "Malware payload (Heodo)", "value": "9e0352dc05837cab00246370b56af2e0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654880397, "uuid": "705cc53e-0020-48f0-99c1-6f22d8df13d1", "comment": "Malware payload (Heodo)", "value": "90a0cbe5b8df7f46d1d4511524f167cefc7446bf96965f11f0596d69ed9cdc26", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654880397, "uuid": "abb2a8a5-4619-45c3-8a57-2529e1184de1", "comment": "Malware payload (Heodo)", "value": "dd1e803d57f612cee240e867190d4800e8bae4ad", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654880397, "uuid": "a1fa01f3-27be-4b26-bc4a-70941d820e3a", "comment": "Malware payload (Heodo)", "value": "3f8c78c4529426b67fc5636aa91c04e12b03eb8695e9a1b615cd0ca3bcc5faf80a140983313b5db8ccbee3b9d256b87c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654880397, "uuid": "f34076ef-5312-4973-9a82-1c52b2b6416f", "value": "T1BFB4154533F4306AD8678D7C849E0A0FD7E17A174FB1D28A135086AE3BB36527AB9F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654880397, "uuid": "395c211e-7029-4323-a0b2-b8c707214219", "value": "b71031ac72c27db547b44e7ae017554b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654880397, "uuid": "2bb86872-04ef-40d5-85e9-ad83d98adac5", "value": "12288:fytPfASAuSvQnbJHorHDKGwC4ZTJxlGRS:fy9fASOvQVoTDw3XC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654880397, "uuid": "52b513e6-df31-4843-8eeb-e49974c6615d", "value": 508416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654880397, "uuid": "483276d6-148a-483b-bf9d-3d2bb11138f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654880397, "uuid": "886eec64-e6cd-4268-82f2-fdbe0af2f0e3", "value": "9e0352dc05837cab00246370b56af2e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f58edf0f-e918-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654905394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654905394, "uuid": "61b242eb-6284-4a58-84be-69c527ca9f04", "comment": "Malware payload", "value": "32a76d0a63c58b43c38dbc13cda0c81f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654905394, "uuid": "70d2c4ac-0c12-4589-b29a-338798115041", "comment": "Malware payload", "value": "9140c2247603ff773052b7fc97c3f257760830f19c18b55b8f490d663117210d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654905394, "uuid": "2c59dba5-7c1f-4b00-ad20-6729f34e4ad5", "comment": "Malware payload", "value": "5d378253bfc31ca2dc11d2c56414a913952c07af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654905394, "uuid": "09cee5ce-b50e-4956-bff2-2c06ba0a3250", "comment": "Malware payload", "value": "c8a2065e0f19cc67ea753ea9c4c45fc498e1d4d745a2ca87c6802753555b63c3948792aa8d482c7052628dfe63cbaf7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654905394, "uuid": "9d38d3f2-b0e6-41df-bc4b-582086d55379", "value": "T191B4140573F43066E46B4D3C859E190FE7E67A074BB5D1CA239082AE3BB364279B9F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654905394, "uuid": "e69c261a-3184-4ee2-86b0-3b18b20c64fc", "value": "b71031ac72c27db547b44e7ae017554b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654905394, "uuid": "228ad6a7-9e05-42b0-bb6c-c684ff04d523", "value": "6144:TkzytaJpnASmmaNGQ7DYMT1atZNtpTKIEHzkLAcKhIepZn6kdRphRUQP7LwW1:oytafAS/aNPwHbgcKeep5h/uQgW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654905394, "uuid": "38196bec-d5dd-4eda-933c-d74c94fff0cf", "value": 504320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654905394, "uuid": "59246c82-2834-419a-9bad-2894af996c79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654905394, "uuid": "a49cea0b-9086-49c2-99db-6c951ff75862", "value": "32a76d0a63c58b43c38dbc13cda0c81f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d097888-e8cb-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654872067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654872067, "uuid": "4add7be9-bae0-4c47-b285-f0d22a267ae8", "comment": "Malware payload (Heodo)", "value": "05e071bb36b696330de76d4bbd496c9c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654872067, "uuid": "5f8244ac-e8bd-4f56-9c4e-4d0a0ca182fa", "comment": "Malware payload (Heodo)", "value": "917d246ac14d2f1838f4e1fc5a6fcb76b9ec446ba9ca458fe9b34f79e4b850ed", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654872067, "uuid": "85c77147-78fa-43b6-b3eb-26edafe021ba", "comment": "Malware payload (Heodo)", "value": "04460e2307432b3cb50f02635cd2203c76233ef2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654872067, "uuid": "d7be2115-5b39-49ff-909b-c94a7bb4318c", "comment": "Malware payload (Heodo)", "value": "a098b416601f1f9708295a859c535b184f607d75100a290ceff8a118deda7164d97f009aa58e4b73e0d98f0ff38d3456", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654872067, "uuid": "2697159e-08af-4f60-86ee-223d4069867b", "value": "T13504026DD14C06DDD611137CACE90F3392FCF980A0262B5BBB70A6774BA4B96DB5B900", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654872067, "uuid": "fc1accae-20d0-4865-9b6a-a2dbf9dc6fc4", "value": "70e266113c1f28d1a5ed37642718e2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654872067, "uuid": "4acb2b54-e130-41f6-aa17-5c10b9a679a3", "value": "3072:rpjf/FcO4J8FYMh1PAzu8GmeR8dk5pL/rRn/02QBgjVcoe5Uy5i6zNL4ZNgzPKcQ:rRHWW6u8QKkXzN/09gjV/eey5/NsAziz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654872067, "uuid": "3063acf6-1021-4043-a392-343bc1515e3f", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654872067, "uuid": "4616db14-93e9-4f4a-be4e-6fb679ae7d63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654872067, "uuid": "1ded7471-17db-454e-8af4-c1a19c9ca16e", "value": "05e071bb36b696330de76d4bbd496c9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6225c9e6-e8cb-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654872076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654872076, "uuid": "c950dcc5-d4bc-42ff-9fcb-471d98fdd83f", "comment": "Malware payload (Heodo)", "value": "bbe8db1e0c6b98af638d720eecd1c341", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654872076, "uuid": "f781b5aa-299c-4baf-8560-a569f05f76ec", "comment": "Malware payload (Heodo)", "value": "918ab96e50ef15624c1b73eb249f1b47c29a24a68772b3d465f6686eaf469593", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654872076, "uuid": "c20bc25d-a855-4a14-88a3-a52556a78b32", "comment": "Malware payload (Heodo)", "value": "395e0704400f9c025c3da79a09d2ff783c1fb7d8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654872076, "uuid": "75103e49-b64f-40e5-9999-e345291f8e4f", "comment": "Malware payload (Heodo)", "value": "5c5cd6ef60d9fd9678a7da8227410efd65c03dcda7e1eb261bc097b5fc6f286d1e8c5b3640a949fad17fbf92f2663cef", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654872076, "uuid": "37f4f9cd-d601-4646-8910-2f58142281e0", "value": "T165B4140573F43066D46B4D3C849E190FE7E67A074BB5D1CA239082AE3BB364279B9F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654872076, "uuid": "2e61684d-afb3-4334-a561-87527753bf1c", "value": "b71031ac72c27db547b44e7ae017554b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654872076, "uuid": "3c89fde4-f82a-49e4-bf87-7dd351224f62", "value": "6144:TkzytaJpnASmmaNGQ7DYMT1atZNtpTKIEHzmLAcKhIepZn6kdRphRUQP7LwW1:oytafAS/aNPwHb+cKeep5h/uQgW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654872076, "uuid": "1abe345d-c2fa-4477-8001-fe07e1683145", "value": 504320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654872076, "uuid": "58913519-0cd5-4c3e-8cab-ad836b92803a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654872076, "uuid": "a043d997-a488-48a2-b40c-134dfbd787d6", "value": "bbe8db1e0c6b98af638d720eecd1c341", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a88051f7-e8a9-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654857591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857591, "uuid": "0ce050b7-57d6-4a20-a37c-1212bb6a4d4b", "comment": "Malware payload", "value": "c393e079a1f24eeafb565d2c78655437", "object_relation": "md5", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857591, "uuid": "206025aa-2058-4846-96cb-54171ca2a44b", "comment": "Malware payload", "value": "921d14955f0f9dfb5f8a92e7d65d50743e54db49e99524c948f882570e188446", "object_relation": "sha256", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857591, "uuid": "118d1f42-7acb-48a7-ba67-e97fad449d23", "comment": "Malware payload", "value": "997b6821a476b7ef120bfd7ac8b1035db279df17", "object_relation": "sha1", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857591, "uuid": "4e17bd75-e564-44bc-8279-54b256df8ad1", "comment": "Malware payload", "value": "b0c04dc987b5d64d56cccc54a4a5fa64768efdba18c37c603bb6cdaaf07cb950c2f933b2f603e7fa77044ba0e8b0f15f", "object_relation": "sha3-384", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857591, "uuid": "6125ffb9-4631-42b8-8609-9f785f2bfe81", "value": "T107F2E141FE55C0A6E3C74C278E731471018D795FCE413F2DBA78C29E1E22590EB2A68B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857591, "uuid": "d915bb37-f209-4438-937c-21ee964b8414", "value": "768:PzQrc7aht2OfKLtjLtWySCHUigY1zkj10h4cfqAaCkSJ4LzVi:PYGXOfKBJ5tgY1z+10qlfCkSeNi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654857591, "uuid": "4f7f2f5c-7eb5-4fed-9619-10fb6f90a5a2", "value": 35874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654857591, "uuid": "e7e1f286-d801-4c60-b77d-b5d71f09dc88", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857591, "uuid": "df3b1d7a-f562-41f1-95c2-7d0b4cc7fa0d", "value": "INFO 10062022.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0b6fd6c-e8e2-11ec-93bb-42010a9c0043", "comment": "Malware payload (Quakbot)", "timestamp": 1654882059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654882059, "uuid": "439aef6b-fe89-48a5-a109-616bb3fb1ffb", "comment": "Malware payload (Quakbot)", "value": "63c186fc82ba82975d2751840ee85648", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654882059, "uuid": "2477e087-c7f8-4f10-bab3-2c1898e44abc", "comment": "Malware payload (Quakbot)", "value": "924d2840283fda39ca3b54b2a066b047cb4d4e9cd1cfe90656d11aee7063ae79", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654882059, "uuid": "5d8611b3-2005-4ed6-b6f7-fc7844c41777", "comment": "Malware payload (Quakbot)", "value": "3d70b1f6db3bf2fafd367c14e3afe588e4a280f5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654882059, "uuid": "c648313a-e988-483f-802b-8c2591a9ed4c", "comment": "Malware payload (Quakbot)", "value": "5e2dbae076ab552cd967cc0a4795a3dfea0d34c8a108b86b694b43397e880831a23a619a89f998f16735b2974a224dc4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654882059, "uuid": "4c9682ff-b370-4923-ad20-d7b1a398e115", "value": "T19B25BF63B3905C37C1632A3D9C2B7764A92ABE112E3459C72BF81F4C4F356917B252A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654882059, "uuid": "392ef92f-6ed4-4a56-a9a8-15454c8716a8", "value": "20989e3840429c9a803f6f380c7c63b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654882059, "uuid": "93f9b39f-f526-4a45-8e7d-b3295993d354", "value": "24576:UFsIvAexp4zV2Kk546oeKg/EkgKOy5Iy5:2tGM8Mf555", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654882059, "uuid": "0ccbd856-a415-432f-bcb3-2cf8270b8bfc", "value": 992256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654882059, "uuid": "85e95c19-6986-44dd-9e61-1b3efdb73e14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654882059, "uuid": "bcdbe37e-a10f-4110-bb29-879f7c71dbd4", "value": "anything.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7503070f-e8de-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654880268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654880268, "uuid": "e9d98b4c-4041-4790-a5a5-6901ea12e91b", "comment": "Malware payload", "value": "709060fa331c8b5a03699308bdc46907", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654880268, "uuid": "14d27d48-2245-443a-b3e9-1011c4dee7d7", "comment": "Malware payload", "value": "9352cc41c17cb07968ae677c30ae9dc5d4e15e7faf276edaf16f75f793057173", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654880268, "uuid": "27edb8ba-3d6e-4c55-b49a-67a485ee1f89", "comment": "Malware payload", "value": "d84b51e339af90786e6769e434f2d7c8fca15a86", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654880268, "uuid": "6b21bf69-1641-49ca-964d-fc87985e6080", "comment": "Malware payload", "value": "d9db4515c8c2112468a1b72ed69b944e80a92bdec59cedebd4b965598d1d88d6a3947ef0ca5a02b901dab488a9c19dc6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654880268, "uuid": "9d6b16b9-0574-46f7-bf33-4bb22cbe0417", "value": "T1CF430A56F9419B12C4D122BAFE5E419D33133FB8E2EE3202DD247F603B9A9D90DA7512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654880268, "uuid": "8a3af933-3f91-4b66-aa8e-8ad283a09103", "value": "1536:FknaUAMq0bcZeXSQFvo5uKMRb7EQwYVvwvOj8FtniO6:TUAMq0bcZeXSQ2uKMR/PAG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654880268, "uuid": "1dfcfe5a-ec03-42df-98ca-78fea4b2986a", "value": 56572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654880268, "uuid": "8c93e0fc-fe2a-4a78-99ef-b6c51231ac23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654880268, "uuid": "342bc804-3d0f-4be0-991c-a373a8156c05", "value": "709060fa331c8b5a03699308bdc46907", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "285d77e1-e8a3-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1654854799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654854799, "uuid": "97c31869-e1b2-43a3-bc72-941023a90172", "comment": "Malware payload (Loki)", "value": "98e5c6208e9aad61a888b2305d2735c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654854799, "uuid": "25834dda-4835-4d70-9d8e-cc992ca26be0", "comment": "Malware payload (Loki)", "value": "937f52a6e81c8af8c39d79a46dc329f5ff558191e848fea6a176e2ab37e09fcc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654854799, "uuid": "75c3dbaf-2833-4580-9c93-6f548bc2bd4d", "comment": "Malware payload (Loki)", "value": "5acc028a92edef2b8a845a38c7d2a17dcb4930d9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654854799, "uuid": "f16900e1-c978-42ba-beb9-409105ef6847", "comment": "Malware payload (Loki)", "value": "0eb13eea1d6c374d6e4625ff22832935bf95f85b72b9a96f3aec97cef64ab73350e94932e1b25cdbe32af4342d8d7288", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654854799, "uuid": "b2697553-18c1-490c-8ce7-33e921388251", "value": "T19DD4E01A7A15A58EC0068637C9CB1D1057B2AE575B2BE70B7087329D891F3EFCE0A1D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654854799, "uuid": "4c72022e-b015-45e6-97d4-4f88713b174e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654854799, "uuid": "af4aab2a-5431-439c-9da7-6762a8f8d457", "value": "12288:2enKads59qkEE5sb8TBV1xWQvc7Loi/KSVuMf65f:2enwbxsbSV7Wai/VVl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654854799, "uuid": "43260a8b-045a-4b7f-a721-7e0b7986d414", "value": 614912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654854799, "uuid": "a8b49ed9-fd9f-420f-95d8-0d86fda2af17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654854799, "uuid": "a0faf5fd-94d8-4500-87c8-8bd6a98f0417", "value": "98e5c6208e9aad61a888b2305d2735c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e804216-e8e8-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654884391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654884391, "uuid": "634d3fcf-7816-403d-86b3-0c3cd23181f4", "comment": "Malware payload (Heodo)", "value": "574560609e5853a3dc5dacf3c173d6a4", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654884391, "uuid": "69c24064-2b25-4d8b-894e-e0469921765b", "comment": "Malware payload (Heodo)", "value": "97587a63de66ff77e7ac8b854a334981487a6bb1a165670e940bbd817b542c1e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654884391, "uuid": "22e200bf-0288-48dc-90b5-4c29bda53497", "comment": "Malware payload (Heodo)", "value": "e6ed574e67b92723f1dea8adeffbb6ab218a79d7", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654884391, "uuid": "2a494543-f082-46b4-9c7a-5e140e72d374", "comment": "Malware payload (Heodo)", "value": "eea7e0d5f5117c435e2d4319463d1199295e80fe407d7b7c7177a001dab1ed89a71746dec8eb92384cf35313312555f8", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654884391, "uuid": "0ff69d9c-8fbd-406f-a921-3fc3f55de965", "value": "T1C9B4154533F4306AD8678D7C849E0A0FD7E17A174FB1D28A135086AE3BB36527AB9F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654884391, "uuid": "726cd0b5-c18f-426a-84ec-9b85b3ab8acd", "value": "b71031ac72c27db547b44e7ae017554b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654884391, "uuid": "f5c1b5cc-22a7-42e3-b066-b7dd8d7b6cd0", "value": "12288:fytPfASAuSvQnb4HorHDKGwC4ZTJxlGRS:fy9fASOvQQoTDw3XC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654884391, "uuid": "b5cf2e04-7f80-42ff-91af-e9d9990a1083", "value": 508416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654884391, "uuid": "d653f97a-975d-4322-971d-7bbab6e36f19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654884391, "uuid": "baef841a-415b-46cc-9817-f0b272a38b5b", "value": "574560609e5853a3dc5dacf3c173d6a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dad8129-e8a8-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654857063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857063, "uuid": "fc7b79dd-eaa6-429f-90aa-7fb5173dda9e", "comment": "Malware payload (Formbook)", "value": "5acff997403b61e5588f11b45c7aca96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857063, "uuid": "4c89d63b-3a5d-4bce-9d0f-b77368b1e001", "comment": "Malware payload (Formbook)", "value": "976a06a6e0f8503df2f8b22cadde37e63f842aa7145da7f360418fcc890b8395", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857063, "uuid": "cdb38b64-d23f-4ff9-9eb2-0860d153b650", "comment": "Malware payload (Formbook)", "value": "1bbf2a3016e5cb97fe7de40b43c0d81784a68f2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857063, "uuid": "765d7a15-20c9-45ef-9917-b7f19b429d4d", "comment": "Malware payload (Formbook)", "value": "dc65a1a1a22c851a1bc32acff50dc701e17032170cc8ee06f1cdbc4ccf06a9f049310140b44379521729a8a4e6fafaf8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857063, "uuid": "a9a21c6b-bcc3-45bf-8735-9e7d477e5d7b", "value": "T199A49D21276C6FA2D67AD7B911A2861107F2944FFB23E52E7EB308CE5451F4047A2F36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857063, "uuid": "76d20b65-1d9f-4970-b167-510bd54377d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857063, "uuid": "465dce5e-1946-46ed-892e-3c8eead86f0f", "value": "12288:92r5YvweLX5hn7xoOgNfT1h+BKkvUiSRzTH1:2iLp5loOgN77IozTV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654857063, "uuid": "5fcf2487-cea4-42d2-83a3-382668b40685", "value": 487936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654857063, "uuid": "4b640bfd-2f9f-46f4-9a37-9bf9271f52c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857063, "uuid": "1df75cf6-e207-46c5-a927-56ee42a8531b", "value": "Original Shipment Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "decec48f-e88e-11ec-93bb-42010a9c0043", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1654846086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846086, "uuid": "a5b320dc-a7e9-40eb-ab48-3aabbe96caba", "comment": "Malware payload (ArkeiStealer)", "value": "5c3222c463dc3c4f83c37d340df92f98", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846086, "uuid": "02db3c45-cb2c-4d0f-a813-433e56f8beaa", "comment": "Malware payload (ArkeiStealer)", "value": "97a0cdc140d31645bd20d5048e40c299c6c6a0497ca1de080b9a7e4e1eb5a139", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846086, "uuid": "4b2ab9a1-f755-4fab-b2f1-c9b1ddff6943", "comment": "Malware payload (ArkeiStealer)", "value": "812734b417ca7df375c7fea0eae5ee76b62cea1b", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846086, "uuid": "fb1852e9-2c90-469d-86b6-6d63f78ac7df", "comment": "Malware payload (ArkeiStealer)", "value": "d6cf590a04ac47d8b352f5fd333305d4dbb4652a55146a8bf69a3ed1a32f77a0c1ce63117091ecbda7670d14ffda91c6", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846086, "uuid": "4039aea3-8eb9-42a0-b0bb-684a6c033501", "value": "T1935733735280BD93D1B643B62C268844DC29F5B24F06266BF19F5BE4C15268CDFF4B2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846086, "uuid": "0ebcb183-e8b8-48af-9395-e81e4166a45e", "value": "e81c04337118138a69c6d64241de5089", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846086, "uuid": "96809304-7b28-4d9e-aa4c-be6590b00596", "value": "786432:UfccPonEGicqyyx3O/3aqF5yoR8be+uwEfKN:UfrwnXicI3O/nke+uwEfKN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654846086, "uuid": "afb9338d-2c3b-4560-939f-30f8dfaaf66c", "value": 29059808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654846086, "uuid": "e3619cf7-0e41-493c-acdc-aa093dcdb312", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846086, "uuid": "a94ba4bd-82f7-467f-ba42-efc11ce2d224", "value": "97a0cdc140d31645bd20d5048e40c299c6c6a0497ca1de080b9a7e4e1eb5a139", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9f79a92-e8d1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654874800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654874800, "uuid": "13468864-7d3f-48b7-b8de-4ebe7c2febcd", "comment": "Malware payload (Heodo)", "value": "113c91409bc5f076513c088412bd3234", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654874800, "uuid": "951041aa-6008-4d65-9de7-17dba11af7fb", "comment": "Malware payload (Heodo)", "value": "97af85888466aedf82a1d0c0cb7e2e6ac67c0b24e015475ed0c90a07424811ce", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654874800, "uuid": "39dedcce-1e4a-4227-a0ff-80108317f078", "comment": "Malware payload (Heodo)", "value": "9197fc2fb3a31cf8869b7d2180c4a1b3034facf1", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654874800, "uuid": "ba1c32c6-c04d-4c3c-8130-547ce3d1d462", "comment": "Malware payload (Heodo)", "value": "c3eb9ccb003d2a81ae394894e16f672cd09ccb87a4edc3b45cbbc65e43be62a44240407ad0f3ee4a2d18b1d98040c711", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654874800, "uuid": "d37d0c1b-e263-43a0-a785-daf60d593e36", "value": "T19FB4140573F43066D46B4D3C859E190FE7E67A074BB5D1CA239082AE3BB364279B9F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654874800, "uuid": "2674a116-17b3-4d98-9227-5a1f55c16fb9", "value": "b71031ac72c27db547b44e7ae017554b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654874800, "uuid": "701acbc5-9c41-4b2d-842e-2d56c4c09913", "value": "6144:TkzytaJpnASmmaNGQ7DYMT1atZNtpTKIEHzaLAcKhIepZn6kdRphRUQP7LwW1:oytafAS/aNPwHbecKeep5h/uQgW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654874800, "uuid": "0a489c13-9f63-4dd7-93e2-cab9ee579b41", "value": 504320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654874800, "uuid": "e630f437-e7cb-4d1d-975a-87e55290f393", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654874800, "uuid": "df7d8213-08e1-42ff-9fb5-cbae561e15c1", "value": "113c91409bc5f076513c088412bd3234", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f06c41a-e891-11ec-93bb-42010a9c0043", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1654847133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847133, "uuid": "4d65a553-fcb2-4486-b12b-a2f3ccf3e024", "comment": "Malware payload (ArkeiStealer)", "value": "0077c306e4148708a79abb5b510a8eaf", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847133, "uuid": "09c25b14-3a5f-4f52-b0b6-44c04690ad17", "comment": "Malware payload (ArkeiStealer)", "value": "97def68d0b23baec832370974fb1e89e28201bbe0bb6ece986953343a49ee4ae", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847133, "uuid": "8e421a84-c940-4239-a08b-8a4101d8f7fc", "comment": "Malware payload (ArkeiStealer)", "value": "4c22ebc7222a1ce0adb55580de81be62169697a5", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847133, "uuid": "8b4d9737-9eef-451e-8785-d3003b61bdbf", "comment": "Malware payload (ArkeiStealer)", "value": "53ba4c810e9133205f7cbbbfd62930b7cb59db31cb12d753a92e92f855650b08ae5a3dcfaac67b7e79701b306602df0d", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847133, "uuid": "bfa51f72-187a-4c48-ac5f-73c04f83bb3a", "value": "T1EA560215A3D251C7F3B3AA30E6B6655B04387D12E51AC42D725C622D09B0B0CAE5FFEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847133, "uuid": "f99fe873-9038-4828-93b7-ad3e9b8207ef", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847133, "uuid": "8fbd3093-fe4a-44b2-977e-98e569e490cf", "value": "98304:HIDJwO2NKRZUFXelqX9GlMGDGlXimhM+dP6:aOdNlFwqN8KXilk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654847133, "uuid": "f32f8ece-7275-4e7d-b928-630429d650e2", "value": 6323712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654847133, "uuid": "39f35d27-3756-4f10-b709-6b496151e8f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847133, "uuid": "9c10f6c6-d906-4152-b466-b305cf447362", "value": "97def68d0b23baec832370974fb1e89e28201bbe0bb6ece986953343a49ee4ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "025c5aa8-e8e8-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654884371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654884371, "uuid": "e47b7e92-af64-47f7-827c-8594c11579fb", "comment": "Malware payload (Heodo)", "value": "44a675f93b279068a8a0a892083b89ca", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654884371, "uuid": "806783a6-0725-43e8-a884-3e823cbcb9ca", "comment": "Malware payload (Heodo)", "value": "97fc86971e1552bbb4b1dafe225d3c1ce760c52cd2acb7230a0472697ffd6886", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654884371, "uuid": "6921c66d-f51a-46ee-95e0-0785a748abec", "comment": "Malware payload (Heodo)", "value": "5a1bae2aa80bdb81c45e13bc30875c1fed1ab1a5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654884371, "uuid": "f941e845-1ee7-491e-8890-c1d57af760f2", "comment": "Malware payload (Heodo)", "value": "9de5433c5bd4ae36215a7bf78e6704cd7b1a6eddcfe17415aec141a24647c2d452e2e9b91736ddb84673f4a345536980", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654884371, "uuid": "56547a66-8f58-4bdc-8ed0-f448e00df19b", "value": "T1C2B4154533F4306AD8678D7C849E0A0FD7E17A174FB1D28A135086AE3BB36527AB9F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654884371, "uuid": "7df85587-3a0f-4d52-98dd-81c57623ae1f", "value": "b71031ac72c27db547b44e7ae017554b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654884371, "uuid": "bbde239f-0de3-45ef-aa95-982e205a6249", "value": "12288:fytPfASAuSvQnbLHorHDKGwC4ZTJxlGRS:fy9fASOvQnoTDw3XC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654884371, "uuid": "7508a46f-b498-4a87-a6f0-93e0a3079d92", "value": 508416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654884371, "uuid": "64ea6706-90d5-47a0-9f2f-9fe664289fe2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654884371, "uuid": "93317656-81a5-4864-9930-180475613a37", "value": "44a675f93b279068a8a0a892083b89ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36475487-e897-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654849668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849668, "uuid": "3fa70ea0-0b86-48ef-a27e-f9c8603177d4", "comment": "Malware payload", "value": "2633f501f84e2a8308085f0346f86579", "object_relation": "md5", "Tag": [ { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849668, "uuid": "4db89d96-3b1a-4766-979d-b267da072005", "comment": "Malware payload", "value": "98e7fed39ba4cef4d4daf58b7b2cac2e42dea54e79ad16429af4e7852a490782", "object_relation": "sha256", "Tag": [ { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849668, "uuid": "5690da02-4651-4a7f-9b6b-ad93a8be9b0a", "comment": "Malware payload", "value": "b92167f3be5cdec71f79d2f91e20efdb8176c727", "object_relation": "sha1", "Tag": [ { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849668, "uuid": "0eb7881c-ee12-46c0-9912-78b64c7e3be8", "comment": "Malware payload", "value": "4acfa11154cad217abc13ffafa43048791a4b901b6d63154c97789b4aaf2187f6f28c50c1501a44f13ba40b982415930", "object_relation": "sha3-384", "Tag": [ { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849668, "uuid": "67eebef5-e05d-465c-a51e-baf4389b5e5b", "value": "T148D5F1BD61843398C41E88384533ED49B2F6552F07ED99EAB5DFBAC07F6A410DA16F02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849668, "uuid": "4df511b6-d7b4-401d-9a9a-acaf0fc4c94e", "value": "83e3964a663145dcbd99bdb8bf746d9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849668, "uuid": "d11eae3b-47a4-4d48-aab4-c7f3062404b5", "value": "49152:lfRQ1ZpkKb4n7AMvQFtt+4c3luDyNvpM9Dh14o0kT5FfCNxK76yMlEFaeEV:vQ1ZpjkAXFttHc3lu+NRcs5kjCrKOBY8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654849668, "uuid": "3e3409ae-4eb1-4a68-856e-1400a5bdcefb", "value": 2787728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654849668, "uuid": "fddb013d-468d-4df1-a3c6-de2b1e769a5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849668, "uuid": "718a459b-a877-4a2c-b9a1-d358ab8dc85b", "value": "8EED17F1E186.sys", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d404835-e860-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654826192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654826192, "uuid": "326fe06c-f8fa-47b5-8c41-1836625c81b0", "comment": "Malware payload (AgentTesla)", "value": "c0b1afb1c4a08919dcc1df352c880799", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654826192, "uuid": "24a9812f-bc56-4a11-9d2e-9de94c9ea1d2", "comment": "Malware payload (AgentTesla)", "value": "99dcc8fa5f3b1a9be8a0a70eb16a30bf06b8b0b618504b649470c7bdd87a5a5a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654826192, "uuid": "04754621-380d-491a-aeca-8618c738f6be", "comment": "Malware payload (AgentTesla)", "value": "dfae4dfb03444d0d8cd97d395f45b83315a7a1a5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654826192, "uuid": "ed86a453-1637-4200-84ea-9d9424c8da17", "comment": "Malware payload (AgentTesla)", "value": "52fc86085f2c5b8b2adf1acdf2475d22da0b3e23edab349464c1a38f416407cf6d6235add6828899517ae1030513d3e6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654826192, "uuid": "ed983dbb-4de5-4c77-a171-5c55864c9cbe", "value": "T119A49D20276C6FA2E57FDBB541A1811047F2950FFB23E52A7EE708DE1855F0047B2BA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654826192, "uuid": "1747f7e3-64cb-4478-9406-ca0c2448542d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654826192, "uuid": "716fdb52-686f-406e-89ad-b87522c406d5", "value": "12288:QertCDiKVnVDi3lhvhfR0AT6Hbw4KgpznR5H:5r3KyVhJJOlj/1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654826192, "uuid": "2081961a-e1ab-4d82-8136-03b91009da9e", "value": 465408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654826192, "uuid": "5b2b5809-f105-4f0f-88a5-9fa2f8cd16ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654826192, "uuid": "d94993b7-7278-4a8a-a437-a1b5ca2fdd11", "value": "DDC payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4213502-e8d1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654874817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654874817, "uuid": "9239d63c-5d59-4a25-a462-2067c2a1791e", "comment": "Malware payload (Heodo)", "value": "0bc4732380f9ee61046810cd67861992", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654874817, "uuid": "3aa22ce1-ac83-4939-8b51-93af69b9993d", "comment": "Malware payload (Heodo)", "value": "9a76e18600618bbf545e840eea8495b508614ac599a58bc3a03371d259ae688c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654874817, "uuid": "a1981b22-b6b1-48e3-a0e9-554b6dc0f643", "comment": "Malware payload (Heodo)", "value": "5e5f116aabe7a1aab84d2246099e5f1156cf68f6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654874817, "uuid": "5d36781c-5af0-4574-a2f7-e598e03cad38", "comment": "Malware payload (Heodo)", "value": "47c4a50de3b8857d1c3385c9b830a4237c592e265abae52510b64706709d0ab2f4ddcb620df1e93c16d51c150e3a49fd", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654874817, "uuid": "f6319173-ca8c-46a0-93ba-a8e8ae0778ff", "value": "T12AB4140573F47066E46B4D3C849E190FE7E67A074BB5D1CA239082AE3BB364279B9F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654874817, "uuid": "749ddf0a-d1f2-4e7e-9214-b3f3e0c9acab", "value": "b71031ac72c27db547b44e7ae017554b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654874817, "uuid": "0c4b0fe1-1430-48e4-88a9-9c21c43977e8", "value": "6144:TkzytaJpnASmmaNGQ7DYMT1atZNtpTKIEHzpLAcKhIepZn6kdRphRUQP7LwW1:oytafAS/aNPwHbZcKeep5h/uQgW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654874817, "uuid": "5f8bc328-31e3-429c-b8fd-d11b05a3d47f", "value": 504320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654874817, "uuid": "b239c0e3-effc-4f15-b228-97597a02f694", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654874817, "uuid": "a65fc488-480a-4a55-a61b-b4210fd8a8de", "value": "0bc4732380f9ee61046810cd67861992", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a989ff38-e8fc-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654893241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654893241, "uuid": "a473ad42-c0ec-466a-86b0-aa70277b2b23", "comment": "Malware payload (Heodo)", "value": "4521a64f9f2102885f8b84f0737c0b94", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654893241, "uuid": "82be4677-9f38-49c0-8a0f-64b35564e6bd", "comment": "Malware payload (Heodo)", "value": "9b08eaf2495dde7bba59dfc874ef32bc7df37105cd26e83b131dad62b42ccc4c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654893241, "uuid": "a9cc7b34-5b7c-4dab-b9a2-848d055dcd3d", "comment": "Malware payload (Heodo)", "value": "b91adcc7f622092fa155f3db1bc374f51b1c62bb", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654893241, "uuid": "27b033e0-a731-4ec3-844b-c4c708df1c82", "comment": "Malware payload (Heodo)", "value": "6fd05855ebb89730feb746893e8c1a82b3fd17aeeae18e6c53f03c3e84124ff564c4f0c93046aa5ae78dc662193eb79e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654893241, "uuid": "a8d6a48a-d39a-4c6c-b5d2-7eb3cf8391ce", "value": "T1E2533956BA5AD85DF915C73548D74BAAA323FC304F9B0B832269B3116FFC8A0561710F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654893241, "uuid": "83915a48-577e-4010-a363-fc33cd6c2d0d", "value": "1536:NpKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgDDOJiA6Cv/UGLI36yOAoO1:rKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654893241, "uuid": "3d1d758f-bcb8-4c92-8ae2-a3e9ce05fa19", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654893241, "uuid": "841756ef-c67a-45e0-9514-cfaf0e2adde2", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654893241, "uuid": "c2718e75-f858-445e-b531-c14908a32383", "value": "9354.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e27498c7-e89c-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654852105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654852105, "uuid": "cd8590d8-014e-4c27-9775-45de3729b702", "comment": "Malware payload", "value": "80025f1f4fae9a41737149f526bd6bba", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654852105, "uuid": "895db179-6d73-4284-a39d-a221f54aee88", "comment": "Malware payload", "value": "9b7008c43814c7bf18375774bd2ed5f3bda9316dbef20b7e086fe921838f1186", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654852105, "uuid": "1e96d07b-b0da-4cb6-8c87-6b7ab5169cba", "comment": "Malware payload", "value": "d25d8486965e1d43d4f51fc00cdef693961337ce", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654852105, "uuid": "f9808d32-610a-47d8-9ef6-3c35b6d302bd", "comment": "Malware payload", "value": "219e311d77303587c204f45ae40a26d7d5d699b11a733dc4ace9ca951cbac781bcda4b54bdfe22217f46340ec421a801", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654852105, "uuid": "5632ddb9-f647-48f3-be77-7cfa7c97097e", "value": "T18B645A89B38765E4D12EABFDC30664885700327A6BBB640D31FC90DD174FB936768CA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654852105, "uuid": "ba7de951-682b-493b-9160-c0d0771d6591", "value": "6144:5/Yr50/Yr5q/Yr5F/Yr5Hw/Yr5H4vpykGJogbi:5w6wowbwiwCvphh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654852105, "uuid": "e00a50db-3ef8-4cfe-b9c4-5250fa1c9d3b", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654852105, "uuid": "5180ab70-5c29-41ff-a598-fe46a96c11bd", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654852105, "uuid": "d7a1c096-0eb7-477c-97d3-367e5ed40ddf", "value": "huh.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1336b0d-e8b3-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654861927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861927, "uuid": "6ada15d2-69e7-4c0f-9c31-98a70bd5ce83", "comment": "Malware payload (Mirai)", "value": "a4070185f38fce78e0573d6c6ab3b3b7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861927, "uuid": "3323fa29-ec81-47c6-be82-c3f72cadc4a5", "comment": "Malware payload (Mirai)", "value": "9ba1813314119c4892b8f4e0022cd3d48baad486a7a22149b29ecbfa5a4d3487", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861927, "uuid": "3a2f7eef-e102-4495-b3c1-d905c388cd02", "comment": "Malware payload (Mirai)", "value": "8440088d52d5bb4843da96df82ef410125009ff1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861927, "uuid": "fbdaed99-345b-4cb8-aa58-0a1b24a9482e", "comment": "Malware payload (Mirai)", "value": "ee8cdd596ec81a6418bd5d845b06bd184ea0b298e49f3286be480049ca669b0e4610c27b243a12659103e902370d9578", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654861927, "uuid": "c83686d0-2bad-42a3-ad86-7596cea579c2", "value": "T1C9D2CFBD972A8595ED1AA07A2FD413F03E340F33DD0158463E4D9A83CC9AA9C7C985E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654861927, "uuid": "e591a271-8101-4af0-9398-a581b4935efe", "value": "768:C6fVfZgQzx415XnvTzfDVk4y+9LUuCN+/EfQJ0JgGlzDpbuR1Jf:CuXSXvTuELaN7KsVJuJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654861927, "uuid": "3cd95198-7306-4e56-8edc-b5b572e5edd7", "value": 29764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654861927, "uuid": "e2435f98-a43e-4657-b801-bcc42f04d851", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654861927, "uuid": "792fdd9f-f11e-4ad7-b0b5-ec1654a08eb4", "value": "vailon.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c3fa930-e8c3-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1654868576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654868576, "uuid": "00984bad-c42f-4c02-b895-1fd41225ce85", "comment": "Malware payload (RedLineStealer)", "value": "ffd9c138e839111d665852d1ba1bb29a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654868576, "uuid": "047a9c32-fac3-4d73-bbd8-c49eb77a5c28", "comment": "Malware payload (RedLineStealer)", "value": "9bd1bb01d1a9ea2d32afb9811b491f60b09913a5aa19964f8d8c1402cfcc0523", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654868576, "uuid": "d510d0d7-054d-4c4f-a92f-4c8ec0e8c8e7", "comment": "Malware payload (RedLineStealer)", "value": "555526fa9c909f3f6a2e0e4ec570eca8f9b22286", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654868576, "uuid": "ed81152c-2d27-41cf-b04b-f8214a630cbd", "comment": "Malware payload (RedLineStealer)", "value": "522be45f9bfe6c1d7bb05585e2e4150809a2ea22838c6fc08c8140562778657ce8388ef65998e1d777b4a3f00bb3859d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654868576, "uuid": "92a93e8a-35cb-46b1-b7ff-770092f713eb", "value": "T1A8B5F8039B8B0E75DDC37BB461CB633A9734EE30CA269B7BF608C53559532C5681AB42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654868576, "uuid": "1ba10555-8d15-41c6-b30b-54fc11bd08be", "value": "edfbe68f7bef8503c0900cdb25c277ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654868576, "uuid": "d0093e86-cd34-4095-83c6-4c89518eb9cf", "value": "49152:idPYWkHTbhMidR1RiqtOGkOfeb/CquapvE:idPYWkHTbhMidR1RiqteOypM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654868576, "uuid": "66655846-4fed-49d1-8258-0a6c74c9e689", "value": 2383915, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654868576, "uuid": "0894f38d-7f52-410a-b966-eff169e8f227", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654868576, "uuid": "291d69b3-9167-4e18-a551-3a3924c6e73c", "value": "9bd1bb01d1a9ea2d32afb9811b491f60b09913a5aa199.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62fb87f1-e8de-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654880238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654880238, "uuid": "61684356-58f9-4b7d-b49b-85a077684f48", "comment": "Malware payload (Heodo)", "value": "6fe873665d4e5216a03a65bafdee5d1c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654880238, "uuid": "cb2bb84a-1b5b-4415-aae1-66cb9bf3d017", "comment": "Malware payload (Heodo)", "value": "9cacd267c428600fac9a881f3cc1ee6e41a6dc3f7d0ab394fabb0c683481e5e0", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654880238, "uuid": "7d6eebcf-34a9-4a34-aca7-79cd96429876", "comment": "Malware payload (Heodo)", "value": "fcc979067316644cc874cdd9c3a546deaa876c88", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654880238, "uuid": "1f258336-36a3-430d-be07-220a224f3c93", "comment": "Malware payload (Heodo)", "value": "9825fd7661b166df76779486f17b9c1cc8bf4181ef0debd1f3bc96169191c89c3055a5802c35ee935bfb90540d0b9e3e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654880238, "uuid": "a1f537ac-6670-4235-9607-d864e8ccd2c2", "value": "T127B4154533F4306AD8678D7C849E0A0FD7E17A174FB1D28A135086AE3BB36527AB9F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654880238, "uuid": "d05ba3bc-6dbb-4726-9bf4-e27893375f5a", "value": "b71031ac72c27db547b44e7ae017554b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654880238, "uuid": "c6232f37-bccc-4198-b5f9-9220885b0b34", "value": "12288:fytPfASAuSvQnbPHorHDKGwC4ZTJxlGRS:fy9fASOvQboTDw3XC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654880238, "uuid": "44599444-5419-4f54-8f8f-08b7d84054c2", "value": 508416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654880238, "uuid": "1a3e1152-cea2-4078-ac08-f0b753372de4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654880238, "uuid": "8821e2ae-0657-4839-829e-ab3404bb034e", "value": "6fe873665d4e5216a03a65bafdee5d1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cadca0a-e8ac-11ec-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1654858672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654858672, "uuid": "0349c755-a348-4eb4-9117-05221acbf398", "comment": "Malware payload (NanoCore)", "value": "0cf75c2b0b187d690a4ff2208281856b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654858672, "uuid": "2b2a759b-9a21-4056-9e9d-26c9d5042337", "comment": "Malware payload (NanoCore)", "value": "9d261935e3ab110f1d91fb0ba5fe7de2dbe141121acc8f470a64cff5222c5a52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654858672, "uuid": "1afa72bd-f424-4dd9-b90f-a9dd17200fa1", "comment": "Malware payload (NanoCore)", "value": "a59e17c9669227188eabbb8812af6db9abdfe089", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654858672, "uuid": "bb2b9cad-270d-4ac0-82f2-b94e364972df", "comment": "Malware payload (NanoCore)", "value": "44a3239b134f734f81581446dfd403a5ce35ebb634389e71b2c66300d779ad1a8ea5c9d866a6e96d5d34ef72a65b827b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654858672, "uuid": "506715d0-1e89-4ec0-9325-3791d47fee85", "value": "T16C14CF1637A84A2FD2DE86BD611202139379C2E3A8C3F7DE28D455B79F667E50A070D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654858672, "uuid": "80c02da6-2532-4942-94a4-42fcef3f8498", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654858672, "uuid": "8f5e657c-30bc-4862-8b86-88ab13b4d010", "value": "6144:gLV6Bta6dtJmakIM5cEcNr2JvU639Wn2aM:gLV6BtpmkKcNr6lNci", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654858672, "uuid": "359667da-7f2d-4c2d-86f3-179cd28eb4f3", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654858672, "uuid": "f4ca361a-6dba-4f4b-b146-f50cde2f4aff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654858672, "uuid": "76a5005d-045f-4dc2-bdb0-b86282532edd", "value": "9D261935E3AB110F1D91FB0BA5FE7DE2DBE141121ACC8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b477761-e853-11ec-93bb-42010a9c0043", "comment": "Malware payload (Arechclient2)", "timestamp": 1654820525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654820525, "uuid": "08d8fb51-a77a-4981-b57c-39a3c2cadad3", "comment": "Malware payload (Arechclient2)", "value": "184be2a73a16e66153a8af6958c16b9d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654820525, "uuid": "4d77783e-0403-4f71-8743-9daed0e16786", "comment": "Malware payload (Arechclient2)", "value": "9e9eae41469ebcfc9d59edafcb66c6f2eed5850c06d0306f4a1cc3eb47afc85e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654820525, "uuid": "de7cfe7e-040c-4da9-b88c-4744fb5dd7b7", "comment": "Malware payload (Arechclient2)", "value": "119957a445db96c9e151a326c535fe36c70adda7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654820525, "uuid": "be88bdb6-3080-4361-ab78-42cd059085e2", "comment": "Malware payload (Arechclient2)", "value": "1daef387dbd74567cadd6a215ff911adcbde7dd00248b75b5f14e64007d8e18d214e860fe07658e8bc7b55bf9c747412", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654820525, "uuid": "a187010c-2e59-4e05-9f0e-8fa526ecd6a3", "value": "T1DF15386C3B621A72ED1DD1B08749CA05BB260FC77348D9A3539BE5CB874E1632D44AF8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654820525, "uuid": "2df76e82-0e36-40b0-b4f7-d4f99b061d79", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654820525, "uuid": "8b7a64fc-7cd3-42f5-9bff-4c75e6685041", "value": "12288:PKxteNAUgv0gnEg4zK2QAXUAzC/csZ8zA6J1+wc+BZKm3J5DyARVB:Vi0gnEpQAXUl/cRfu+BZv3J5DyARf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654820525, "uuid": "5e517555-3a97-4f9c-bbcd-d658c0feb152", "value": 926896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654820525, "uuid": "27bfb98b-9134-4730-8f48-20318ae77a7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654820525, "uuid": "76ab6196-32ed-4c43-a8ba-6322e988b930", "value": "184be2a73a16e66153a8af6958c16b9d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b5e8184-e8cb-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654872091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654872091, "uuid": "d44006e9-0999-4a1a-8201-18c76a7c9196", "comment": "Malware payload (Heodo)", "value": "ca796c62b19fb68809ec18247cfa9311", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654872091, "uuid": "548572e6-eb12-46e6-bf4e-59e0e67c41de", "comment": "Malware payload (Heodo)", "value": "9ebb14a5925223af90cc14a864ba176f5439f4792905b852ed19178eaaaf3bd1", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654872091, "uuid": "c5a70eaf-7f00-47c7-b1ec-9bac432c1cbb", "comment": "Malware payload (Heodo)", "value": "1ad5428487a82aa89aa6177db594466b652c5d61", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654872091, "uuid": "a6b341a8-091d-4869-8268-bad11ba3a01f", "comment": "Malware payload (Heodo)", "value": "b32f92b6427b95bca701d468176bcd2b7a9340d7630ad2c1e6da5c3ded5501676f4028bdd6baa91830a3060df43fcc4f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654872091, "uuid": "75a1a413-3999-4156-8414-d586795c8608", "value": "T151F4D43EFF51E8E9F8439230814A9170B124BC2D8271797E3648FD64BD72698EB2DE15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654872091, "uuid": "afc32467-f9b0-4e7b-88b0-e6b96377d448", "value": "98dfbb430035f9300f4be2418dab914b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654872091, "uuid": "949e7be9-2369-4a5e-b3e0-a7a1f7d7ae16", "value": "12288:yFbnmV9v3WtGWt4T/humzyMSoGGeqh2tiDek/bPUkf80pG4:yFbO9v3WtVt4T/huKyMJJeq4Qb/Ikf84", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654872091, "uuid": "a32b29fb-c589-4df6-b59f-49651d20c5af", "value": 743350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654872091, "uuid": "605c9fe5-deb1-4628-a3aa-dffdf8c8e3ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654872091, "uuid": "009eb461-e7bc-45b9-8d06-40e35e25d136", "value": "ca796c62b19fb68809ec18247cfa9311", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "504e664e-e891-11ec-93bb-42010a9c0043", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1654847135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847135, "uuid": "4393c249-ea10-464b-9982-c361b0e5382f", "comment": "Malware payload (ArkeiStealer)", "value": "1f2d0538232bce210f9df91524f55ceb", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847135, "uuid": "c092a4ad-07cc-4d91-b6da-7b4f3903fd0a", "comment": "Malware payload (ArkeiStealer)", "value": "9fa73905db072b6b56a79b26476570af13890627e72c9ca66095d33f67d924a0", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847135, "uuid": "73efa7cc-9ab8-4f25-a903-36f048b61615", "comment": "Malware payload (ArkeiStealer)", "value": "87acb0bd7bf9961c6ed2fd08f44b01cd435b6401", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847135, "uuid": "374862a5-7979-47fd-a7ed-a0cc995c5f69", "comment": "Malware payload (ArkeiStealer)", "value": "9c87d4116943e0e6ac1484d23eb9e54661804f96485dbd5227d7d61141de9c7985987d7d4da26b78578e3766ecd094e5", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847135, "uuid": "74621e88-e5d6-4ca8-9068-9b8718e38231", "value": "T19A56F111A3E692C7E3B39A34F6B6655B04387D12E21AC81D325C332D4970A4C6D5EFEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847135, "uuid": "8671ee09-efd1-49c9-9909-ebf2aaac1cf5", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847135, "uuid": "e6af869e-b783-4edb-a073-235731f96ace", "value": "49152:nIPJeoDR6qyV2RmtZM3elkmDIphYD2AIM:nQJeoCxtaezIMD2fM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654847135, "uuid": "e16512a1-6e1f-49e5-acaf-8adceda677ba", "value": 5945344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654847135, "uuid": "83c8675a-c65c-47b8-92fc-850949f72469", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847135, "uuid": "5f53c091-762d-4ed0-b3c6-a92d0abe6154", "value": "9fa73905db072b6b56a79b26476570af13890627e72c9ca66095d33f67d924a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c4e035e-e87e-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654839102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654839102, "uuid": "cb0a1762-84ea-4ced-8bbe-978ced6d199f", "comment": "Malware payload", "value": "a04a8411d398245620aeadca766fffba", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654839102, "uuid": "67556d39-2518-4814-9ff8-cad73d500ac2", "comment": "Malware payload", "value": "a032d6e8521f7315b984f3699bad60054d0611bf36c80abf51b4ec3b321b600b", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654839102, "uuid": "96291b79-310f-4b70-9ea3-a34733d46aa1", "comment": "Malware payload", "value": "fcb6fe622b5d6bd8280580db7336e7d3ae3c2324", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654839102, "uuid": "430d4030-30cf-4b17-9572-e840a3ad8426", "comment": "Malware payload", "value": "e426e5abf303ef781022566badc4cf7605a90d79a754a4438b1619f7d31c8438890207021691503a995933055b861306", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654839102, "uuid": "78c28620-c13a-45fb-ba5d-b39526242f16", "value": "T1FB011E512C9F806402FD16E37B73042BEEE1913066B17534A7DCD4295BC106DC5B2923", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654839102, "uuid": "847c1822-9f4f-42d6-bba3-daa600be3e5a", "value": "24:dF/URhU/qaG2b6xI6C6x1xLxeQvJWAB/FVEMPENEZaVx5xCA:f/URat+G+7xLxe0WABNVIqZaVzgA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654839102, "uuid": "2b86d447-2c69-4140-9d1e-df3bc313c49c", "value": 829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654839102, "uuid": "d605fd96-2442-4271-be0c-587f654681bc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654839102, "uuid": "78074b0f-ea8f-4418-bae1-dac432f6d83f", "value": "lodar.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a9e21c0-e8cb-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654872063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654872063, "uuid": "39c55e5b-97b0-40a5-8b4e-544ac266f735", "comment": "Malware payload", "value": "1ae43974e0dc9d3191d2995dac7f120e", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654872063, "uuid": "11f14ae2-36c1-4f7a-8394-2d685baff137", "comment": "Malware payload", "value": "a070fcf0b20e1bf5e7572d3c2eae1c68d8efe019b632a539d8f86aa333c36b9f", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654872063, "uuid": "37a2d62a-5efc-44a8-8654-1f4570cf4199", "comment": "Malware payload", "value": "175ea4991d4212578966bd431c90c7f83b928929", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654872063, "uuid": "e0358d59-8f75-4734-9e67-90a55bd24f90", "comment": "Malware payload", "value": "28cc690078de6294bf2a51ca9ddf97745c9db57eb4d21a873c9a51ea53a94e9c421c3882a1ddd52e26bd0d2b92be4e9b", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654872063, "uuid": "08dad821-c6fa-47ba-b151-a0623c3b9aed", "value": "T14DC612CBF708E8AFC4F69232C575121671A79D210A8397F61D08B23819B79C55F1ABCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654872063, "uuid": "2c3b5c7d-3061-49a1-8f7c-221cb79b92b2", "value": "196608:3veWhAO4OFcitjKqtfd+r/bo1E8lBbQcqp5inUFe9yWUKjrJ6JXUHXcuX8AKrRG7:5AYKmoo1h3Cp5iUF1vkr6XsFmE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654872063, "uuid": "9ca14778-1e23-4816-bbe7-9a4c0886e472", "value": 12474289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654872063, "uuid": "5dafde33-21ab-4758-9a38-b4f887b029fd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654872063, "uuid": "986f3a98-59da-4122-a909-92ad77a36d7b", "value": "Cool Caller Screen.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59abcb79-e8c8-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654870773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654870773, "uuid": "e47ffcf7-68ff-4406-9e8b-409990e87f3b", "comment": "Malware payload", "value": "935efee52d7c9761b93bf19470a233b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654870773, "uuid": "51c092f7-e38a-41f7-b554-7b3ac0821c4d", "comment": "Malware payload", "value": "a0bb62f64b56c9ba7cf6672ffc30141b83763fb7fece4c55284d1fab65529ac6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654870773, "uuid": "62e64bcf-7a91-42fc-aec4-1c94e5e0f102", "comment": "Malware payload", "value": "49310de06329d5b0d275d445f3e1d27e8ba5a868", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654870773, "uuid": "7c1eb0f5-b00f-4f77-9380-c33f39644cd0", "comment": "Malware payload", "value": "15f3c64a19aa07f1059fc7f3122b988ecbaece70a83e026edd97aff8d2a97384be59d06e6ab6e9df51c0c8175fa44f8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654870773, "uuid": "021f457b-0f16-42c9-8b15-1c3828f520e3", "value": "T1D8936C41B3D241F7EAF10A7100A6722FA73676249724E8DBC34C3D839953AD59A3D3E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654870773, "uuid": "90c58ed3-bf9d-46f1-b405-d3f10523bfa4", "value": "771106f54fcc51d1aa3989e528332f80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654870773, "uuid": "43db2929-8a26-4798-bc2b-819e34fde9dc", "value": "1536:G7fPGykbOqjoHm4pICdfkLtAfupcWX50MxFY+yIOlnToIf4micpO:8q6+ouCpk2mpcWJ0r+QNTBf4v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654870773, "uuid": "74694bf7-0645-4047-922f-255f62aaac03", "value": 92160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654870773, "uuid": "2827e475-07aa-4a57-8b68-b49c8d00e235", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654870773, "uuid": "5161f7c6-8a1e-4346-9206-bf1f532fb70f", "value": "real-deupx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cacb925-e8b3-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654861866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861866, "uuid": "74e0ccfe-48ae-4674-858e-587c559a9257", "comment": "Malware payload (Formbook)", "value": "b33b646bddceca6f58f72ce12118fe0d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861866, "uuid": "c7a45b47-7ee3-467d-8d23-6241b2003532", "comment": "Malware payload (Formbook)", "value": "a1623c563f7bf714a3a151eb450418c8f3c837f452c1f3e2b43d979bf211e2e9", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861866, "uuid": "96cff6b4-468d-4ef4-9fc4-3ba17681e461", "comment": "Malware payload (Formbook)", "value": "20aee83d06c9f8be6d747bb6c72698dbf487550d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861866, "uuid": "6b0a98a7-c67a-412b-81a1-ed79a5364a30", "comment": "Malware payload (Formbook)", "value": "689d7af824d704ac32b3bd8235957a2ae9a4f4f449f36500617bad33429efa5a1ea1e26b8246b6e92591258e45f8bcea", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654861866, "uuid": "d542b372-81a0-47ea-bb21-c7738e7650a1", "value": "T165D423237CCEA7C936842E74186AC9E0D1E725C34A3862C1668F3D162E16F65DDB7C72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654861866, "uuid": "65a8749e-70df-4749-ba7a-4f488e008c07", "value": "12288:lAti+oEZpimfGQRbcEHENtJZMW5E3UApTfsB620f/U:lAtw+iGFbzENtJCBpTfLf/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654861866, "uuid": "e962ede2-01f8-4e15-b994-359a8d375a8c", "value": 615423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654861866, "uuid": "1512f262-bb49-42f3-a282-22ca6e96785a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654861866, "uuid": "12c07aa0-c976-4ea4-8d95-c922111eaa89", "value": "Arrival Notice.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "177d638e-e8c7-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654870233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654870233, "uuid": "5c281ed0-146a-450f-a2bb-58f7eefad31a", "comment": "Malware payload", "value": "986c79da65bfe2e0983558f85855eba0", "object_relation": "md5", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654870233, "uuid": "04762b42-b118-4eba-9372-8cde46bb6fda", "comment": "Malware payload", "value": "a1f8de32f8763a71605ba507cd68625fc19ee5d28834f1e7a082bd97ca22fc54", "object_relation": "sha256", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654870233, "uuid": "fae7a790-3c21-4913-b3e5-de724709fd9a", "comment": "Malware payload", "value": "1b990472bfa431b77794f1455efe9d2512abeb3a", "object_relation": "sha1", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654870233, "uuid": "b36678c0-fd0d-4530-ad88-ec49d8bbe7f4", "comment": "Malware payload", "value": "7a20cef77a4dcbc3bbe7443801ea5ef29662216e6eec25b6f25bd3bf1022147aad68c033601d24cf6c6a1074fdcfa259", "object_relation": "sha3-384", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654870233, "uuid": "cb7267fa-5013-4fe9-908a-8826183e1ee9", "value": "T167F2F19BDE38B3F7EAF1AA37DBD4557409814D8A077AE18481F2C17C15B6E22961A420", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654870233, "uuid": "a0d115a4-7913-403b-b6a3-8f1869a5c628", "value": "768:Hdmn8rod1Wm8Tmu6dfs7EXknOfUUAUKszc3rJwX:WZ1H8SuqQTOfUUVNCrJu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654870233, "uuid": "aeeac2d4-2fe9-4fe6-9029-217201dfeef9", "value": 35864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654870233, "uuid": "0119405a-3ed2-4cde-add7-384036434da9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654870233, "uuid": "9d7d0a07-5b3a-4fd4-aa41-80279af2568d", "value": "536-1006.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6c549ae-e8c8-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654870929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654870929, "uuid": "0a86231f-bd21-4806-b6b8-4ed4b8c31c9a", "comment": "Malware payload", "value": "d4a3c5d31f66851cb9449dd1b50a72e6", "object_relation": "md5", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654870929, "uuid": "75707d02-cd7e-4a5a-b125-aec38b6d0e45", "comment": "Malware payload", "value": "a2f83001284652814b7173e721cf6d2610bd04bfa8060e5f082a75ee1b16c1af", "object_relation": "sha256", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654870929, "uuid": "5f333521-4728-469b-903e-4b81ec2d2aaf", "comment": "Malware payload", "value": "0804d32862409105caa0f607b30acc5e58986737", "object_relation": "sha1", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654870929, "uuid": "e6f80414-5e4e-4d94-b46f-343337d44fa4", "comment": "Malware payload", "value": "f61a58b0124f0d071ed862073c123c63689b2664e9e5f80a44699a37ac8e3f3464e9de9b6669925eb8ec1aaa82256ae8", "object_relation": "sha3-384", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654870929, "uuid": "3aa9b92d-c59a-495f-aa6c-f7873cebe3d6", "value": "T1F1F2F18025317541F3D2FEEE2F313398A6105A4E87BE52BA6E0948C5B72EA169DC197C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654870929, "uuid": "88cc95b0-8709-4a0f-9b69-0caa9646fdc0", "value": "768:4sEYLlMcylaqRKslmXrg0VV9CmlZB+HTZmkoGFa03H6xBGmB:4sHZMcylrRKslMrg0LlZ8HVmTK24mB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654870929, "uuid": "be050845-7ae5-4e6d-a2a3-4ab7f48f2354", "value": 35868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654870929, "uuid": "75c2bf8a-4ade-4e96-944f-89c777d280ea", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654870929, "uuid": "8d9fd233-00e4-41b4-a2bb-5130dbe72f87", "value": "elenco-422.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dfd8737-e8a7-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654856607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654856607, "uuid": "5674e56d-089f-4109-b8b4-a13a95da7ef0", "comment": "Malware payload", "value": "20f1ed8cfef38812215e176317ed9e3b", "object_relation": "md5", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654856607, "uuid": "eae26bd0-23cf-42a9-864e-7ed2e01ad953", "comment": "Malware payload", "value": "a6f871a8d902b0d87f5609a472db761d2aa97dc75bf35a50415bbd2c8e17e354", "object_relation": "sha256", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654856607, "uuid": "4dda33c0-10d0-40aa-a8b2-14af57bdfe75", "comment": "Malware payload", "value": "5b29e1082a51dde7b82e8736bce9348616067d10", "object_relation": "sha1", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654856607, "uuid": "b37be4db-f341-4322-b737-94b33dd6a556", "comment": "Malware payload", "value": "b4a884b2e279b1073a41106f5ef21f4d3c650a79d8751ddb2400590db04faa237a9ec0a9225a923c808f34065f7aa242", "object_relation": "sha3-384", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654856607, "uuid": "4d2af7ec-bbcd-42ed-8033-e5f576605f44", "value": "T121F2F1D217729F22F6872A4E0C0FC9A6AA78F33CBFC1C5DF65B0C490F55A3686456264", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654856607, "uuid": "71e98979-16e0-4c2f-89a7-9b2b60df22bf", "value": "768:SgTviSA7H/Uv50d8usfxOj2jOsyZHbqC8O050U/7fIgH9Py:SzSQ/UB4Wj4pbqCo9/bIgHc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654856607, "uuid": "adf0396f-75c8-4ee9-b6d1-8eeaa3beda17", "value": 35892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654856607, "uuid": "7e0a1103-4f6c-4e3f-bccb-eb64e569c9c2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654856607, "uuid": "0b1a0fd1-8f34-447d-bfaa-0b871ec171e4", "value": "ohne Titel 89532529715.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a255874c-e8de-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654880344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654880344, "uuid": "158905d2-15ed-4e40-935c-11a16003de41", "comment": "Malware payload (Mirai)", "value": "257a3b1a7dca403a84da3e612d0006a5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654880344, "uuid": "aa0b9b17-834d-41e9-82a5-73689f9bbd12", "comment": "Malware payload (Mirai)", "value": "a81915e5ef68ec2142c40e774aa5d25883d9555b374f1f5f11f10b1f38df6976", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654880344, "uuid": "52b15040-2c06-4703-af96-0cf235367044", "comment": "Malware payload (Mirai)", "value": "bdc8c654d4b31f99a95731f8af289f3fb1f11762", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654880344, "uuid": "f92d5c91-014b-4493-a216-57d246584a78", "comment": "Malware payload (Mirai)", "value": "ab9157879511a2e47311502b58e5bf2378d74f6ecc719b363693e031e8a5cc2cb9032ad9be3400857f7fc8bc14e358a1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654880344, "uuid": "ff231110-afd0-4dae-9f0d-26c282e02476", "value": "T14A932A85BC41A622C6D912B7FA1F028D336513E8D2EA7317DE205F70778B92B0DA7746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654880344, "uuid": "8721307a-6d25-4eb2-b56d-8ce79d49463d", "value": "1536:KEvfC59RGD1E1AsWaxXwmSRvc4nzc7pNTNAuAnROteQVVI3jjv6K:KEXS9RGU3Wegp14NTNcsDEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654880344, "uuid": "94848a90-9d30-42f8-9895-29a65ed24c8a", "value": 96404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654880344, "uuid": "fe9b9961-35ee-4818-b33f-b9f1566b8076", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654880344, "uuid": "55d53299-6c9b-404c-9c00-ee7bc6dc008e", "value": "257a3b1a7dca403a84da3e612d0006a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f197bf1-e901-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654895290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654895290, "uuid": "41569251-5626-44ed-ad04-531ed891348d", "comment": "Malware payload (Mirai)", "value": "9ca14d0e429cec276e4f38dfade3c30a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654895290, "uuid": "1f45e7ce-8244-4015-870c-02db005793d7", "comment": "Malware payload (Mirai)", "value": "a83378687ee385340bfc726912d021896d81456ae92e381363a82c15999484e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654895290, "uuid": "e57f8278-b897-4dbc-82c2-78927f67ddf3", "comment": "Malware payload (Mirai)", "value": "1cf638960f9f701cabd9765b72cbf26b1c55e9ac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654895290, "uuid": "5b1475a5-20a9-4efe-aa05-4b18df5f1501", "comment": "Malware payload (Mirai)", "value": "915ce12b5155d03d4abdf261ef06c749c241d58ce2c75cf186d91278736211117384a4b2b1e34f08e58accba038996af", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654895290, "uuid": "aacb8854-22d3-4c54-b872-e8271081a730", "value": "T17DB36B22BE660827C1D4617E22E74321F1F3534E64BC9B1E7EA30D4DAF246503677BA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654895290, "uuid": "8fbc7c8f-d0cf-4ca6-9dd6-05b4010ba74a", "value": "1536:dTD7QlLB2Uktl6zDrvq6YEZwuDpNue7x9Z1tJB5ptWDphaUHx:dnUlUwHy69wulNlZ177Opha2x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654895290, "uuid": "772516ac-76ac-414a-afdd-a9f18d0c6e16", "value": 110856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654895290, "uuid": "af962ef2-7f38-4e9e-9784-299ad3016219", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654895290, "uuid": "d54d38c7-6a30-4ee6-8335-456f88eaca6a", "value": "9ca14d0e429cec276e4f38dfade3c30a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "917db1ad-e8af-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654860129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654860129, "uuid": "cf4c78bc-9617-4486-9e3e-f95d1ad32dca", "comment": "Malware payload", "value": "d88fee286e7a52551b211fab6491d5ed", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654860129, "uuid": "28c519b9-9e70-4a54-93d8-d25b537114d3", "comment": "Malware payload", "value": "a9a90106ce6201ec43891b5eefe6b2a930eb4b0144451b261975ce6d5cfa06a4", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654860129, "uuid": "f3e19ce1-088e-4894-9e2c-8003964668c7", "comment": "Malware payload", "value": "7e98ba16c443e6bf193037c76128ac7e668ae60a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654860129, "uuid": "c5851ee6-1759-4dca-8f17-b0f90974781d", "comment": "Malware payload", "value": "fa0455a1978b57a3210919c1383063aafa8a84a3bc446dcc1009e358fca38e0d70890696b30c1b8c53fbd49c2bf5baf6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654860129, "uuid": "dffc7326-fc92-488d-b94f-5b5f73a2feb5", "value": "T145F2F24B1BD550CFFB03B4E7952538C6203C2159CFF267B27066D2673BB6866C90281E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654860129, "uuid": "07061830-8a86-43c8-9d76-1c59375250cd", "value": "768:Fa0FS8A99lVvIU78ApyuGuiXiarxcacO50LImjYwC644uwtUhlh9:I0U8UX9BDpe1GnIWYwC6buD7h9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654860129, "uuid": "f28987a1-5a79-4c94-995d-5aac3b25e1e2", "value": 35882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654860129, "uuid": "0f8b2fec-7004-4e96-8ac3-f5cfc1f3f0af", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654860129, "uuid": "6cbf3e77-015a-4ac4-b979-2814901c42e0", "value": "D\ufffd\ufffdTAILS_10062022.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "201bd1c6-e90c-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654899882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654899882, "uuid": "664a2132-a294-4993-994d-4374165180c2", "comment": "Malware payload", "value": "1f0da26298d3233cf39b3c4fd65d54aa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654899882, "uuid": "8729a42e-d32f-4a0e-a2e3-e9067f93c701", "comment": "Malware payload", "value": "a9d5b5757d7b35137909fe6ec8dd9ec4f3760a0ebdb521de430efff69c9b6eb9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654899882, "uuid": "76551747-02de-4581-a485-0919fb227418", "comment": "Malware payload", "value": "658ada869db7d4363a0dd409a9155e3efff6ad37", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654899882, "uuid": "d7ee2055-14b9-4c48-951c-119181973b4c", "comment": "Malware payload", "value": "da5ea89d5f41f69c8e00e88b0ae9b999d6a1d4b31d648ab01a39143821262a760fee283d3848c3ac8f97b3adc676ca20", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654899882, "uuid": "758cddc6-4ab8-4b05-a50b-b1a7769617bb", "value": "T1EF45D02C53B8C623F16E5F72915500169BF8210BA28EF71B2DC76CF819A72D32E592DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654899882, "uuid": "ea9cee26-960e-4061-bd17-a4580a2648cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654899882, "uuid": "86b4d9d6-82d7-4fbc-b995-450c4f71fb00", "value": "24576:0TKPLNZQArrPH0OJExpAcwGk98nS2l6+dpKYJ:gKPLN9H0OJ4fHFnrl6+dU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654899882, "uuid": "e8cfd9a0-00ae-45d2-af07-78c4aaeb0d06", "value": 1164800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654899882, "uuid": "639410bf-102b-4a92-8e16-b55cc5c19d15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654899882, "uuid": "4a7ae45e-8381-444f-8c81-85749f09b805", "value": "1f0da26298d3233cf39b3c4fd65d54aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbca89de-e8e1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654881675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654881675, "uuid": "923a8495-017b-480d-87ec-90246fc99eea", "comment": "Malware payload (Mirai)", "value": "11969524054ff2deefef7416286f3b1c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654881675, "uuid": "30202766-4b53-4fbb-8394-65306f57b5d4", "comment": "Malware payload (Mirai)", "value": "aac7307c6bca3b6a7eecc0ba0dd4c5264d033175b7b4ec91b3c8eed698b47d4c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654881675, "uuid": "47164ad1-d81a-49b0-9c86-309c0ed947d9", "comment": "Malware payload (Mirai)", "value": "f986ed32b8984be9bad9bc30018166eb2b2c10e5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654881675, "uuid": "88e0ed89-d02c-4cae-9daa-0b6d99ab4fc1", "comment": "Malware payload (Mirai)", "value": "0cce6c427d0434aa633ea6e824c43966b840977c86441e527ec7968fb5446dfa194623af167d915f283705276cd50cf2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654881675, "uuid": "f4448188-7c73-4eea-a8b5-c772151a12c2", "value": "T117E2E159567E6350DA3D6038286F9D8F180DE3C7C10A897E6E86B41F4D6CF8C2E366C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654881675, "uuid": "201d08ba-cdf0-4db7-8b9a-75b26ee02752", "value": "768:m/+bDuRAFGrMAiY7rxETX8T+HS/wGZzQzBmnbcuyD7UHQRjn:NbDsrJiU0MTH/TNQzBmnouy8Hyj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654881675, "uuid": "d4c71ebb-ca30-466e-a393-13e5180b89a3", "value": 31940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654881675, "uuid": "082b76d3-7bda-47d4-a341-5f61fa367bd2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654881675, "uuid": "9e64e72a-9194-4c3a-bcb8-7eb08a94dba2", "value": "11969524054ff2deefef7416286f3b1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e01dac47-e88e-11ec-93bb-42010a9c0043", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1654846088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846088, "uuid": "92981d1f-8fb6-4c4c-8b56-22bc6ea54444", "comment": "Malware payload (ArkeiStealer)", "value": "db6d237100eb8c3c98394e27c882045f", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846088, "uuid": "6f4b801d-492d-4336-8671-b09c4f445365", "comment": "Malware payload (ArkeiStealer)", "value": "ab37a574af8ab7ece7b24d9c6bca61e2c08ac73928269473946f8476a9eac661", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846088, "uuid": "2d4d6a87-8cd3-4c17-aba9-bd44101f325f", "comment": "Malware payload (ArkeiStealer)", "value": "a219db26924097717fe93aab3dc496714b771969", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846088, "uuid": "3016e036-85e2-46ee-9483-914ae816296f", "comment": "Malware payload (ArkeiStealer)", "value": "0e6b4f6405d0d1a1f6e3b428e1544232163e8526dc57b26f63e4f9de7eaa27542b73d55fb926eae26f7c36d852ef87a9", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846088, "uuid": "8760cb6d-7ca0-4019-8d5e-40d08d17051b", "value": "T1DB84AE10BB90D035F5B712F459B993BCB63DBAA0972490CB62D52AED56387E5EC3030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846088, "uuid": "39c2e21d-c0fc-443b-be9f-fc46f4167ae6", "value": "f3934bb0048d44387137e6b580143d69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846088, "uuid": "be893e13-13d9-43a6-8dd2-d74eb1d52a70", "value": "6144:LmUz60Kr/o/WkUt+M4uTZ2X0gCmZhTAIce7FsX/+cE9b6bqgQlH8LJnmnln0v:LmeyefUoduTAXoOv7FsHE9bfuLQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654846088, "uuid": "e26d689e-f400-46ba-8d52-aeda8bd12345", "value": 382464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654846088, "uuid": "89e43fe7-0e15-4f4d-bf4e-51710c6f6aac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846088, "uuid": "1e96708e-a73e-49a1-9455-b22d650a01cc", "value": "ab37a574af8ab7ece7b24d9c6bca61e2c08ac73928269473946f8476a9eac661", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0f96934-e88e-11ec-93bb-42010a9c0043", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1654846089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846089, "uuid": "2f2dd4de-d3ed-4e77-a6df-776e12bd1110", "comment": "Malware payload (ArkeiStealer)", "value": "5b812945a24947adc57eae47df8050d1", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846089, "uuid": "ac448d2e-ddc5-4f8e-aaca-ca79c3a41898", "comment": "Malware payload (ArkeiStealer)", "value": "abb08bdf551adf8d5e7d9e15a893f24dddda6d99ddbf683c2f4bec56e7b1ad90", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846089, "uuid": "2f81209c-4eb2-4e3e-8796-24d96d86545c", "comment": "Malware payload (ArkeiStealer)", "value": "2d473e9149e62c450c1c40a9763bff7301f953c2", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846089, "uuid": "f93b2b6f-5378-4d7f-b429-b658f1f49682", "comment": "Malware payload (ArkeiStealer)", "value": "e927f59fcd6988dffe0a403ede75c043fb553fe9c7d55abcccc9e03b3bd539dc5680f3b0e00a94e488cbaedc2b83cdaf", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846089, "uuid": "fb48dd40-1330-4eea-bfd5-a9c08efc029b", "value": "T1F564F13077E0DC37D2A357300C71E322AA3A76221A79D98B77A417391E316A1A77935B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846089, "uuid": "2563f0dd-5484-4dbf-bc94-6da470ce2136", "value": "9718b2f3504348206033aee623aab453", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846089, "uuid": "23f92c56-9e4f-499b-af06-d9e42c2186f7", "value": "6144:B+EkHFrQCYLX4nTjzVlDj5o+U5JkBRi+vDl0/IILrOy:MEGF0FLITjHlGJMe/IWrOy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654846089, "uuid": "0780eadd-945e-4608-a5d1-df9acc91a548", "value": 314880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654846089, "uuid": "1bb109a8-605c-4b36-91df-ec2e2f1f5833", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846089, "uuid": "7000a63b-e843-4404-a2fd-88f8e4b62789", "value": "abb08bdf551adf8d5e7d9e15a893f24dddda6d99ddbf683c2f4bec56e7b1ad90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88c2be71-e897-11ec-93bb-42010a9c0043", "comment": "Malware payload (CoinMiner)", "timestamp": 1654849807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849807, "uuid": "b94dafa5-27ed-4c75-b979-3229adb6e2b8", "comment": "Malware payload (CoinMiner)", "value": "9d9d7ad7c39f6f7224fa6dea2b086cc6", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849807, "uuid": "89c60e6b-3bba-416f-9727-6d3840774409", "comment": "Malware payload (CoinMiner)", "value": "ac1af3a386b2dcf0e2a2955101dc91de7f5e62c900ba4476b0b842d1aa951bbe", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849807, "uuid": "0c63f6f1-b07c-458d-91bb-11d383013b26", "comment": "Malware payload (CoinMiner)", "value": "66f395df6a0cfb3ab30df0ee865c045dd240f12f", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849807, "uuid": "07d2e30b-8847-4a01-a9e9-037410f41658", "comment": "Malware payload (CoinMiner)", "value": "96d95e1748a0becb5e4ee26b4f048b06c4744e7543e2732cb0fe4ab1e8d4be3c466cae5709d720a58de83d3a0da3981d", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849807, "uuid": "27e80498-f559-4928-81eb-a09a35b16027", "value": "T1EE5633581C63167CED06E874650AEB0FFD1650116E15D3FBA8E100F8867FADA1BA0BBD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849807, "uuid": "e5084459-00d6-4a6d-b746-36ad58c62f9a", "value": "0dc6c5e06e22bd9f0c79c55ec1c09b01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849807, "uuid": "303a1e2b-592b-41d7-b650-e9802d03c345", "value": "98304:Bo/w8innX1N9Z9ShPsI786rWYrp2tPQG/Oql6686QgQOZkDr+L4/r:O/9iNZuTQkWQgag9ZGr+LWr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654849807, "uuid": "9c99c1cc-cfdb-4087-8f62-016631835c9c", "value": 6186496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654849807, "uuid": "ed8468e3-a30b-4b28-aa33-6ed03ae888fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849807, "uuid": "4e31173e-cb7b-49da-a8c0-5c79089d09e4", "value": "ETC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf1b95eb-e898-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654850354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654850354, "uuid": "a3d4bde8-d142-4c84-a9e8-c96e518ce868", "comment": "Malware payload", "value": "e5bb45802a2ce97804abb29ee02e25c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654850354, "uuid": "c3ab96ad-5473-4984-9ce6-9b05e65c0719", "comment": "Malware payload", "value": "ac6acf3bb7fbd88e09d37197a65e004d737c77cb0562bc7822b305363070aef4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654850354, "uuid": "ef8346e3-60b6-447f-abbe-22870d9e29b4", "comment": "Malware payload", "value": "c00a0e7d67706ad6079584f4093ab170dbcd4b3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654850354, "uuid": "f53a5633-26cf-4a7c-9eab-6f12cbe53931", "comment": "Malware payload", "value": "29bf7ce2a5bc06ff044112b311c391d6dc02dd94aebff1231e4e336fc280ff7e9d451d7690ad151447245be2838c6d1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654850354, "uuid": "1a319308-84c9-4fe2-8f4a-dd4ee2b633a6", "value": "T13885330D0770C85BC0CD6A316097898A7130E781B965CE6F88B37B1B65726D49E1BEFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654850354, "uuid": "9d686108-8af1-434e-b815-0475edbd5c4c", "value": "f78e53a0ac623fd40dd26c560f438d3f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654850354, "uuid": "5b276cd8-8c72-46c3-8d4d-0489a995e169", "value": "24576:ET1VHaHZl7CdFLpFVN/AaLf1nXHhgYhq3WUafba7/zQ317+epQao9WdslUgijNxb:4Fdh4aR3hhqn7EIeaa2Wepipx9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654850354, "uuid": "5dc8c449-25c2-44cc-a760-53fca01e3650", "value": 1795072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654850354, "uuid": "6ef487c7-da3b-401e-96a3-0692be28fc96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654850354, "uuid": "fb90ee5f-0086-4b28-a7c1-26448c66cc62", "value": "AC6ACF3BB7FBD88E09D37197A65E004D737C77CB0562BC7822B305363070AEF4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e328589-e874-11ec-93bb-42010a9c0043", "comment": "Malware payload (Kutaki)", "timestamp": 1654834676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654834676, "uuid": "54e4bbe7-5acc-453b-b27c-368772c16cb5", "comment": "Malware payload (Kutaki)", "value": "a41bdc41930f991a9f85c37bc1cc4ab1", "object_relation": "md5", "Tag": [ { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654834676, "uuid": "c0129d3b-ade7-4a05-b7ab-6b4bc6cf072b", "comment": "Malware payload (Kutaki)", "value": "adb3a34eb8e6464c7e2b7b4cbd314ed8bce96482c5ce66a09ece79b86591daaa", "object_relation": "sha256", "Tag": [ { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654834676, "uuid": "a0ca24e7-aabe-49e3-a471-64d3f5d69230", "comment": "Malware payload (Kutaki)", "value": "d240f8aa615cae62fd7f69d57d07a72eb20e406d", "object_relation": "sha1", "Tag": [ { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654834676, "uuid": "d3ce6277-ca67-4163-a39a-c9a74bdb24fa", "comment": "Malware payload (Kutaki)", "value": "fb2b19bcfe773803df6f18fcb97be97504032b4e6b7e16c24845d29db734f198061e20a2140c3c203276128f3ecd646f", "object_relation": "sha3-384", "Tag": [ { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654834676, "uuid": "75a9e879-c651-4d72-8626-6a8b0e2ce4b5", "value": "T17AA423B8118A97AEACD938ED8A13F4B5029499EB035D78C05ED963B3C018757FCE7216", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654834676, "uuid": "12d4c03e-72f4-47dd-8df2-a25375f7158e", "value": "12288:UCuTrDlUKtb9HpNs3gg7IreRw1pZ4SA9jcV/Mh29EMSi8ckn/bYR8:UhDlUKtbvNs3ggcKCS3cV/C5MSi8cknd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654834676, "uuid": "3a602657-8704-4fca-a231-699c9e99f779", "value": 469889, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654834676, "uuid": "20dea735-0965-4318-9b1c-99b520db4bf9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654834676, "uuid": "ae3baa0f-cc14-485c-90dd-ed9230816e88", "value": "a41bdc41930f991a9f85c37bc1cc4ab1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cee02534-e8a0-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654853790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654853790, "uuid": "6c782568-ec5e-4470-acbf-35a084b3fde0", "comment": "Malware payload (AgentTesla)", "value": "bb0869e34035aeb561619e2cda798449", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654853790, "uuid": "8d59b9db-f381-4602-855c-b35ed8d38f7a", "comment": "Malware payload (AgentTesla)", "value": "b05536bc5f92e9b6054515a944f8c96202ff23e6ef039dc617f8737ba543c09b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654853790, "uuid": "36b98525-882b-4322-982f-6b832f4c1c41", "comment": "Malware payload (AgentTesla)", "value": "1b44f78ea2a0d1d37e5d42b9cb30776b2bc9a339", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654853790, "uuid": "a515e663-928e-4e73-9afe-4b0faa7d8d14", "comment": "Malware payload (AgentTesla)", "value": "1bbb927b431ebfb239a8dae2801e7a9499da8d1b467211c4a53dfa73ad3c3c4265fe293a84dc33956b51bf94f648240e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654853790, "uuid": "0e3a04f7-5abf-4eac-aa66-bf5b4296dd2d", "value": "T1EFD4236077781392DBBA4BF5586503009774F15B42BBCF1E8D8425CE8ECBB92EB17642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654853790, "uuid": "b5d2d0a3-3625-4703-8628-cb99f913132b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654853790, "uuid": "ea70cb82-657d-43b6-ba5b-05d10a60f52e", "value": "12288:o9qrbnCoiEGnlG+JtFN2bNsSCR3VzkG6jjS4bjiSnVB:oUCTjlXJtj2baSK3VCjrbjt3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654853790, "uuid": "816a1626-4af5-4dae-b791-9f334e209d83", "value": 634880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654853790, "uuid": "380bf1ee-c941-48af-9f18-224d3d1539de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654853790, "uuid": "a6ba6018-0d79-4078-9384-3c3999f61ccc", "value": "bb0869e34035aeb561619e2cda798449", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f02a5eb5-e90c-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654900231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654900231, "uuid": "94e4197d-0293-4f9a-84b9-2f3d92216e93", "comment": "Malware payload", "value": "a006e218b8d29e9ef58824286e0a73eb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654900231, "uuid": "bc5d387a-def8-4c0d-af9a-1c4a207d1ed9", "comment": "Malware payload", "value": "b0733b60cb298a6af58554ee275fc72fd859d747d3af92b0fad87f113564304f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654900231, "uuid": "315e97d0-8092-404c-ac3c-44b9c906a22b", "comment": "Malware payload", "value": "d925da182288378d27d248372b8e8a01e434ac8e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654900231, "uuid": "82714ceb-d173-4972-b0da-73b635f16bc1", "comment": "Malware payload", "value": "89d3e539f2ad72eedb5b689a6acd995136370ecfc067f18a55ca8e7cd802da535ad86a96fca19263ca4b72fdfc8baabd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654900231, "uuid": "c819cb8b-d977-4fd7-8e6a-ce6a8361fb93", "value": "T1B535DF2853F7CA2BF03E6B379112401A95F92017A2CBF7072DC629F518E73A36D9919D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654900231, "uuid": "c83a5d2a-dcad-4ee8-88dd-505444cf335b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654900231, "uuid": "52aaae47-52e6-4b03-9edc-0b8d60c4f83a", "value": "24576:sPguNoMnz2xa3+/48dYSQHIoOOTe3Mln2xddl/y50L9:Gg4nz2UG48uPIoOke322Xdl/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654900231, "uuid": "cbcbdcc3-d73e-4d10-81a6-77a5407546d0", "value": 1158656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654900231, "uuid": "2a6fa8a8-52b2-4cd0-819f-4d4a04fa0b69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654900231, "uuid": "fa3f8853-59bd-42ed-bdf6-a8c5dd7fffc9", "value": "a006e218b8d29e9ef58824286e0a73eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6226f39-e870-11ec-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1654833106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654833106, "uuid": "4816f6aa-738d-4b97-b88e-dd5af0b7b932", "comment": "Malware payload (NanoCore)", "value": "080659cec955fc5038c1ae4aafcf0bd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654833106, "uuid": "8786bbca-35af-4aef-8e32-e47952d6d480", "comment": "Malware payload (NanoCore)", "value": "b09a64c4cd68cb708ee8e705e53be0b55997c35271676d05a8c0aeac9888fdb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654833106, "uuid": "01cf67e1-6376-4cb8-859f-8ae71cda48d9", "comment": "Malware payload (NanoCore)", "value": "c5ba62735b5c8672c1c8a92cecd2eeac0e1c9ca0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654833106, "uuid": "713f8f69-8070-4c53-97cb-cb9d24bf4350", "comment": "Malware payload (NanoCore)", "value": "65f228c915f83d984fa6ca4df3bafd465670b9d4d607ed602793352ba3a4c426e100bf24f16a30e11825ebc25e0bddc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654833106, "uuid": "8a7912f5-d163-40b0-9067-3d163e09cdbf", "value": "T13414BF5677E94A2FE2DE86B9602211128379C2E3E8C3F7DE28D454F79B267E406071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654833106, "uuid": "86f169c3-ce1e-46b6-ba80-5d70419ab84d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654833106, "uuid": "d5e71ab0-9bbd-4ec9-9511-aeac7c82c7f9", "value": "6144:wLV6Bta6dtJmakIM50lWUu5LYkO0TrWS:wLV6BtpmknlM5LYkO0TK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654833106, "uuid": "4af96504-970e-4f30-adeb-20e2a5d15024", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654833106, "uuid": "8da46e29-1258-4785-bc4d-50158fe05c8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654833106, "uuid": "76c35e29-9a57-4076-85b8-acf7ef2a4379", "value": "080659cec955fc5038c1ae4aafcf0bd6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "287829a2-e8b6-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654862960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654862960, "uuid": "8615bab5-23e1-43f7-9843-ddeba2e0672b", "comment": "Malware payload", "value": "961e093be1f666fd38602ad90a5f480f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654862960, "uuid": "9e0b2340-d118-47a6-a2db-9b147905a5ac", "comment": "Malware payload", "value": "b183bd6414c5123465075d76d2413c999d569492fb543acbc29690b4b745bdf2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654862960, "uuid": "e1bf7371-f157-474a-a8ca-fd3a0d4e6eb8", "comment": "Malware payload", "value": "3574fc3a80d80146a7067a478db209e452757950", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654862960, "uuid": "3a1ae6fc-e7a3-46cd-bdd6-422a4b17f841", "comment": "Malware payload", "value": "f6e2b2168c54e54faed9507ece13b80dea9d749af74d1b9b77ccf82ea9776c6b9eba89a5db48a30b77867540eab4fb77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654862960, "uuid": "407c183d-48fa-4936-989a-6c3e5012ff67", "value": "T159C2C5277F6A2AD6DE1581F01F2547094A259FC63A0F4FBB714B3094CA34CE29C9ABD4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654862960, "uuid": "3441e2df-15c1-40a0-81c4-92b4aa35ecdd", "value": "ba072a972fe6c47c8cf7a0347bb0af7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654862960, "uuid": "2db31b06-5b2e-4d6e-a553-a77df8a843ff", "value": "384:y7cqdIxXkRswWS/YWyiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiLiiiiiriiii9:yk0sS7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654862960, "uuid": "8ad6e977-d4f6-4a15-97d3-be9ca179cb19", "value": 26112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654862960, "uuid": "2f37d0f9-24a5-4b04-b5bb-eeecd9d3d46e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654862960, "uuid": "e0a06178-f134-4972-8263-b9262f5672e8", "value": "SecuriteInfo.com.Trojan.Malware.1725973.susgen.332.20881", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f93e323a-e8e7-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654884355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654884355, "uuid": "58a3c877-1d74-4ea5-b674-32c1f18a129c", "comment": "Malware payload (Heodo)", "value": "e47ea524edb55ffe17734fea5816eb2a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654884355, "uuid": "b093270e-cc33-4257-824f-8c3e7870d533", "comment": "Malware payload (Heodo)", "value": "b1ea6dfcf37b87ec63ae245b21d9ba63c1dd716b8e58bcd32e5617a02f9c205c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654884355, "uuid": "6deba9cf-446c-4d67-8b2b-7efeff96d3ae", "comment": "Malware payload (Heodo)", "value": "898529c48c44e2f8004fb3071ead5486b73bda82", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654884355, "uuid": "e5ddde8e-57fa-4543-89e1-3fafcba55c59", "comment": "Malware payload (Heodo)", "value": "0610f8e344f8d693eee6f4d351344a3f3a89aa78fa1eec5f01f9647608bd36e694ba7bcf3d18badac8acc51695d128cf", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654884355, "uuid": "1b504a25-f929-4477-83a0-f3440895c2e4", "value": "T1F4C48E0772F1B5B8D205C0344A4EE532A736B9CD1422EE5F26E1D6302FEA9A21F7E55C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654884355, "uuid": "8bd0716d-19a2-4634-8a98-0c73facc478e", "value": "1c5c45f819ffed1f8a226b23fc12dfaa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654884355, "uuid": "220493b3-13c6-455b-a5ac-89d51b491bfa", "value": "12288:yocc2tri1Ut9aa2lI1ZrmNQo3A17bDRRySLhqcsV9HdFFlsQzTM5i:yocc21t9aaLowpDDySL8cW9bui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654884355, "uuid": "8c13cc47-04cb-4aab-8630-ecde0991f6f2", "value": 591360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654884355, "uuid": "bb800bdb-c70f-43c0-b97b-49389c0bbbdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654884355, "uuid": "f1a15961-a7a9-4877-89e9-e237415f42fb", "value": "e47ea524edb55ffe17734fea5816eb2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "321a0f11-e911-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654902060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654902060, "uuid": "a2841f16-3921-4107-b7dc-793ace449380", "comment": "Malware payload", "value": "46b1a0a0628361ebe5873631027c91ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654902060, "uuid": "3f65c789-61fa-4e34-be52-d86c34ad4ae0", "comment": "Malware payload", "value": "b2423102968475baf26b7dd27c2a802bf04007b2faf7e3e60609b23384e4392a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654902060, "uuid": "88581e45-e32c-498f-ab85-a2010e8609a1", "comment": "Malware payload", "value": "b74076933abab9e5f763163f2606588a052b2c9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654902060, "uuid": "038f52ba-4e1a-46d1-a4aa-ef179ee2b61f", "comment": "Malware payload", "value": "b06ddf7d3365122ade785cf0867e9f50c09a811c2492057ac2fa9ef949ff1be5c92229cefde1b7c7b1737d57509fc63c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654902060, "uuid": "28a79cc3-9172-4f88-b7ba-58495253a5d1", "value": "T190B4140573F43066D46B4D3C859E1A0FE7E67A074BB5D1CA239082AE3BB364279B9F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654902060, "uuid": "bed52266-8bb6-40db-a8df-9a6bc43df963", "value": "b71031ac72c27db547b44e7ae017554b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654902060, "uuid": "344ce0e2-0497-4a64-8a26-1c17e21964a5", "value": "6144:TkzytaJpnASmmaNGQ7DYMT1atZNtpTKIEHzmLAcKhIepZn6kdRphRUQP7LwW1:oytafAS/aNPwHbycKeep5h/uQgW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654902060, "uuid": "4067b1d0-885c-49eb-817b-216e003cc3e7", "value": 504320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654902060, "uuid": "f9882e6b-9e07-4aa1-af8c-30fab42f8643", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654902060, "uuid": "e936caed-3d4d-4399-ad3f-704e39036258", "value": "46b1a0a0628361ebe5873631027c91ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81498250-e8ff-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654894462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654894462, "uuid": "d2ef12b0-4b84-4f34-a3cd-ef08b5bd1011", "comment": "Malware payload (Mirai)", "value": "40e255312b8bb052cbeffb82f07016e5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654894462, "uuid": "bdbf80e3-dc9a-4fe7-aca7-3c89a41b98fd", "comment": "Malware payload (Mirai)", "value": "b2c4d59191cfadbd395325bc700173c5d8e4bd9d496fea9d7fb44c3578f604f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654894462, "uuid": "87cb0b57-3da4-46fa-92b6-f15dfc19b11a", "comment": "Malware payload (Mirai)", "value": "0bbd890e9045c7146e11510ade6d8d11cf6e7169", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654894462, "uuid": "792444de-a73e-450c-b44e-6d38a08dde10", "comment": "Malware payload (Mirai)", "value": "8cc7b3e0cd25a67a3d8215c5050db71f985761a06cdb181cc48784163d9de7bb6e1f6f2ef0925ab05988393a3780e9f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654894462, "uuid": "eb80e71c-1062-43d0-8bb9-04e15bf46d64", "value": "T1A2C2E1ECF0985545DBED997D147907727B89658022EEFF8603A50C8EF93548FB4481F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654894462, "uuid": "e52fbcb8-a189-4c93-9b27-9358234e21fa", "value": "768:Lk6Qqy5HZlbvsV67J5kO/sKSCqgaCp1XWz:o7btvsV63lMKaYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654894462, "uuid": "7532732e-f2ec-4e80-82f1-75f98f8c2583", "value": 26716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654894462, "uuid": "889f7920-af07-43de-8a8d-f6f1182883c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654894462, "uuid": "051f686a-2c15-4f45-8195-0718f00643e0", "value": "40e255312b8bb052cbeffb82f07016e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63fde596-e8cd-11ec-93bb-42010a9c0043", "comment": "Malware payload (Quakbot)", "timestamp": 1654872938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654872938, "uuid": "97fc31db-5abc-45b5-9dae-d62fd52098b9", "comment": "Malware payload (Quakbot)", "value": "69776575be8a84b8f86db3dc4410571f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama188", "colour": "#E17D02", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654872938, "uuid": "ed16e25b-8b46-46d0-82d4-61fe88c85c5f", "comment": "Malware payload (Quakbot)", "value": "b32dfd36dfe13d1f702a43371da6f7c999ec0c984542c8d8b6927304f6f4d466", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama188", "colour": "#E17D02", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654872938, "uuid": "d1ac545f-169a-493a-aab3-1840cb1a1906", "comment": "Malware payload (Quakbot)", "value": "15bec9dd97be87673a5983969e0e1a0d80b51dcc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama188", "colour": "#E17D02", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654872938, "uuid": "32361eee-426c-422b-8eff-d211e8d08e7d", "comment": "Malware payload (Quakbot)", "value": "a1b45923e99311dbf4d386f9378a577284256a36e17f9cf09072dcccdb8db5c303dd97521a2355d96698ab39d5a4fdd8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama188", "colour": "#E17D02", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654872938, "uuid": "437d5a2c-73d4-4ea8-ae4c-b2d9f46f350e", "value": "T14B25B062B3905C37C1632A3D9C2B7764A92ABE112E3459C72BF81F4C4F357917B252A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654872938, "uuid": "4eef27e0-2c1a-4322-abdb-1974794b3032", "value": "20989e3840429c9a803f6f380c7c63b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654872938, "uuid": "b5d547dc-9a23-4ff1-841a-c0bd103ad229", "value": "24576:UFsIvAexp4zV2Kk546oeKg/E6gKZy5Iy5:2tGM820555", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654872938, "uuid": "2aef3285-a32d-4d95-8bc4-d128e4d04e0a", "value": 992256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654872938, "uuid": "45466f89-97bf-443d-b2a4-1ed0941ce353", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654872938, "uuid": "8732c693-3b04-43cb-a3dc-bc15f669a01c", "value": "wibble.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74978b24-e8cd-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654872966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654872966, "uuid": "ad2d3601-82e7-4667-bc4f-bdce428ed242", "comment": "Malware payload", "value": "d5e9368cc9977a2141db0a2f9b397217", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "obama188", "colour": "#E17D02", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654872966, "uuid": "3921d777-0846-49bb-98a5-c566669d6472", "comment": "Malware payload", "value": "b33443096c06ed6794200fec63e1c600e450a0c6b3b83c8e3c5819329e5d37c6", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "obama188", "colour": "#E17D02", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654872966, "uuid": "751887ee-4334-4d35-b298-e27f501c74b4", "comment": "Malware payload", "value": "89a5a5498ceb611553040f84d62e95ae00ca5c2b", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "obama188", "colour": "#E17D02", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654872966, "uuid": "6714312c-c228-4183-af2b-e14fe9b8ea2e", "comment": "Malware payload", "value": "d72ba43a0b410fc258de57a21c87da690a1d7eb046b8f0c4d870cc9003e40de2ce48beb243c35b630f59e8b6cfe01aa2", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "obama188", "colour": "#E17D02", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654872966, "uuid": "6d168284-7055-4f62-8f6c-f4a46d26509e", "value": "T1B941C87F594B8CAA47612678D93AD288ADB690131A09D149318CE9BE3FF020998C74CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654872966, "uuid": "3b19e1a5-3492-45e2-8800-c275104d151f", "value": "48:0WV4M65Kpt3MojJIj6bLt0xfdbCNR1KEqPPXr5HR/8tH0HrB/igx/RBSoiLJYG:z3ZJajeLmxhCNzwnXMN0HggTwoiNYG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654872966, "uuid": "a6b2f3d2-e61e-420e-9ec8-f704f675aa5e", "value": 2378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654872966, "uuid": "1be0f343-2ca7-446c-a94f-db74e20e9a90", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654872966, "uuid": "4c7ac525-612e-4305-8f10-978e2aa31d63", "value": "2940353352_1175434622.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8970be45-e8a0-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654853673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654853673, "uuid": "d3c93ba4-2c2a-4421-89a1-2f2a73c2bc71", "comment": "Malware payload (Mirai)", "value": "0edba8c9c4dc4b606125d94f5ba9f144", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654853673, "uuid": "8c82baad-6ec1-4d33-a088-ef7b954f50db", "comment": "Malware payload (Mirai)", "value": "b4cc9d5c2f75470bd5d48ae95c75125e3bb9008ff7473b844fce0552c48583a0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654853673, "uuid": "ef4b1385-96ce-4de5-95d9-9fd92f3aa6e1", "comment": "Malware payload (Mirai)", "value": "ae9d77f5044d7fba5a638e67f7f760290d1a9d2c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654853673, "uuid": "03f1ecec-4499-4d9a-99ec-24c302e924f0", "comment": "Malware payload (Mirai)", "value": "1940df41601e5a64b843de2490e2f296cd1fd1bdd65306433dd567483b1b825b811f65be0b6d1318aa2174cef3bd530f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654853673, "uuid": "95653fbb-3a41-44b0-b25d-356a4ec3beb1", "value": "T1C9630955FCE18A19C5D463B6FB2E11AC333263E8C2DE3307DD285B2467CA61E6E72581", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654853673, "uuid": "8175807d-800d-4a74-8351-1bf97a31434d", "value": "1536:iYt9O4PoLKyKz5GcXGnpEygzuF2oNFTtY2z79RZIBCVPpADQXL:iYt9n55XGpFgzetNFxYa7ZIsVPGDA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654853673, "uuid": "dd03d91c-b974-4370-964d-844dc5cd0ed1", "value": 66996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654853673, "uuid": "c7797a13-927b-4d39-8ebc-1c5317cf9232", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654853673, "uuid": "b1e6ade9-cb41-4cfc-b341-0beaa9bcf2a7", "value": "0edba8c9c4dc4b606125d94f5ba9f144", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fb7201f-e878-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654836504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654836504, "uuid": "b8878bf2-448c-40fd-b00d-30cd16aa3fc4", "comment": "Malware payload", "value": "215045d3d5e9c0b73e62706b273d3d67", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654836504, "uuid": "190f8c65-c3bd-48f8-bcb5-2be7d56ab2bf", "comment": "Malware payload", "value": "b55d75a2cc39ac066ceaa640ec801b2960bee64330d1cf174e2f9b9acba49b4f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654836504, "uuid": "f7dfdd9c-f1db-404b-9a16-a98738850da2", "comment": "Malware payload", "value": "9538be6df6bde31e1a3befe6c0010c45e18d572a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654836504, "uuid": "77fb432f-1f7e-44da-a49d-f171ae90b37d", "comment": "Malware payload", "value": "69c5a445c3e981e40f32e7be935fc6eb7dc973624e182f035b693dcf55c232b8db1b28af0758dea0087d97b8971879db", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654836504, "uuid": "27d6a686-565c-44a1-a3d6-e3db49d4f8a8", "value": "T1D74712323DC3445CC908067E147CA9C267797B9A3A55CF3FB19A135C8E421AFB7261AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654836504, "uuid": "f64e1ebe-b9b3-4628-b07f-a0a98b0cae22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654836504, "uuid": "88ac5445-b033-4550-90c8-1a2969681bd9", "value": "393216:hzVYyiuzZAW8OqmnzdF231DZn63yNoiMgGH:hzi+x8UzmlI3Nuc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654836504, "uuid": "fd25ecc1-996f-4750-9c87-b0d7c211a082", "value": 24833536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654836504, "uuid": "64febfd0-2ed4-4aff-bf63-d4f5434b6f3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654836504, "uuid": "688566bb-05b4-4e7d-8bbc-503ed84f85f1", "value": "215045d3d5e9c0b73e62706b273d3d67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57e6a2ce-e8b1-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654860892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654860892, "uuid": "b916b7b8-d57a-49fc-a9ae-ad850cb33bd8", "comment": "Malware payload", "value": "7dd467c1a2660536144382f5acca169a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654860892, "uuid": "7a9bfccc-5393-48c6-aa27-11bbb9c429d0", "comment": "Malware payload", "value": "b59952e0180db416775c5531b9f9fcbd3433042e0b033120d0f15ca1f381fff5", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654860892, "uuid": "7e88a01d-3ede-436b-8ca8-fe8f9a974fe8", "comment": "Malware payload", "value": "032744672014482debf88036855744d644d2f295", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654860892, "uuid": "c24baae2-0a02-48f2-b044-cff0e8d62cdb", "comment": "Malware payload", "value": "cc65610b90135ebfdef56a1468ee826df3faa05bba53734d5a0193bf474f57c09971eef6070b6a0dcd48a762e6c42e14", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654860892, "uuid": "6ad059ec-4c7f-43cd-a855-7c732fbdefbb", "value": "T198329D39D98AF815C27741BC909A02FEFB91044AA925D41FBB18E4D5C8B5A87433FBCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654860892, "uuid": "4d9518f6-7a26-4b24-81a6-906066caed45", "value": "192:CtojHgA6Owu3gn0i13pNXNnaQiBQR+X6Ptpwjnw+umHBCioTQ1:aoj6/Agn0i13LNnbIQEX6Ujnw+3FoTQ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654860892, "uuid": "175b6193-0986-4893-8278-462f04993149", "value": 11576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654860892, "uuid": "602a12f3-bcfb-4ffe-8972-78418abb81aa", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654860892, "uuid": "d6be2b0b-2726-4ffd-ac2d-9e1077a3e9d1", "value": "TaiLieuPhatTrienHeThong.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94a42a6b-e8c4-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654869154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654869154, "uuid": "e4686529-3b6d-412b-b193-0ea615a517ba", "comment": "Malware payload (Formbook)", "value": "b24e35899b7707918e7fe50ac0db3f45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654869154, "uuid": "58eb44d1-42ed-4b44-87f6-13461dcac940", "comment": "Malware payload (Formbook)", "value": "b5b57cc83862714ae5ff166a66d6f0ac6b01bac3559e4c4d0164e98c0d01a6a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654869154, "uuid": "cea733b9-47ff-4ac9-83a8-581492616ebc", "comment": "Malware payload (Formbook)", "value": "ab3690243bbb096f01e4cff5549c1c82c1f87291", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654869154, "uuid": "d84f0acd-a7ef-4816-a6d9-00b288216fe6", "comment": "Malware payload (Formbook)", "value": "a2b373d2604b59bad75db7a3143ebba467575e04f0dc6984b4bdab95333744bd030074190caf3ce033491ef7cf92a4f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654869154, "uuid": "d3d8c903-b460-4816-91f5-838c34816d78", "value": "T1BEE4E0193212E68EC5168637C9D62C1043A2AE975727E74B7087339D9D1F3EFCE0A1CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654869154, "uuid": "6f92a189-53f3-433e-aaa8-1c240feeac21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654869154, "uuid": "744237e4-b7a4-4bc2-9403-1a5961a1164e", "value": "12288:WowSYwx2EgN/EX9qb1EyST4dm3pmwYiE7aXpiGm6fjzHw7jzMgmYJyGoDrrcSq5:8PuSENYiEMmOjb0JFJytsS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654869154, "uuid": "3c98bec0-9b24-4306-a904-360be3bb031f", "value": 684544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654869154, "uuid": "335880fc-b960-48cb-8102-619c98d8fa19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654869154, "uuid": "cb85a3ad-87b7-4e18-bc2f-78aca732816a", "value": "Shipping document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bde99df4-e8a5-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1654855909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654855909, "uuid": "2829aa0e-0caf-4dc4-8c7d-41a4ea917dab", "comment": "Malware payload (RedLineStealer)", "value": "4b6690ae9345420a095bdfb7c5064756", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654855909, "uuid": "0e673bea-70e7-42fe-9c8d-dbca1022e8b4", "comment": "Malware payload (RedLineStealer)", "value": "b82af5f52e227885b6c58f785785481372a9432e415f405fe978517291179a10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654855909, "uuid": "f1dbac01-73b8-4922-a69d-740dc9196bdb", "comment": "Malware payload (RedLineStealer)", "value": "9c109838f4f553ef71c08452b59fd6c5ccd2ca48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654855909, "uuid": "77145a1d-bd10-4cdc-8493-748071a08ada", "comment": "Malware payload (RedLineStealer)", "value": "55addf03931fc1e7e54af975f7a7ce4330015defc9a1cea4a25f17de970e2665fac1debe8697a973ed70a52b20bad95b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654855909, "uuid": "05508ffa-8655-4e7e-b104-b6e34b8dc905", "value": "T16AB508039B8B0E75DDC27BB4A1CF633A9734EE30CA269B7BF609C53559532C4681A742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654855909, "uuid": "86062cda-da1b-4518-97b4-e2c145e9aabb", "value": "5dd6748a8bf8c3a3d51aac89447af978", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654855909, "uuid": "a1ef2087-3b53-4c08-9dd1-80e511ab266e", "value": "24576:wMgoOtAyhVhYiehvG75zrJSXUkgliXqsEQLoPbod079+p7uQ5p3h3L3:wMgoOtAyhVhYioW+9qsEiaboy9a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654855909, "uuid": "3ced547a-c864-4a41-815f-27121acf349c", "value": 2371501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654855909, "uuid": "c3de61f7-8e93-4177-bef3-de14d27856eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654855909, "uuid": "96ae2e77-89e2-4efa-beaf-40b99753d6b4", "value": "b82af5f52e227885b6c58f785785481372a9432e415f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b94d4da-e8c6-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654869971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654869971, "uuid": "73f2ad64-778c-4387-9c0d-ecd9367615c8", "comment": "Malware payload", "value": "b13327a6c1fa7385e13475a79aff7e4b", "object_relation": "md5", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654869971, "uuid": "6e10bd06-0e55-41df-826c-0e40b7b1b3d2", "comment": "Malware payload", "value": "b9fa7c01dee94d0730b4e3fc5c406ac8aa5e7c9abfb6e358dc8eeec4d29de5dc", "object_relation": "sha256", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654869971, "uuid": "0363b3c5-04cf-41ba-b230-7dcf13b92dc9", "comment": "Malware payload", "value": "9eaf9336ed038134c94f762f66dc5edf647463e0", "object_relation": "sha1", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654869971, "uuid": "7f2e7f68-2513-4f05-a9d6-fb4f88160fa4", "comment": "Malware payload", "value": "ae8aad2c27d89a08b769ec725a033307a62aed2c887179c52c26443bbd19a4981f6db725532853dcf53a267da3f8ea82", "object_relation": "sha3-384", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654869971, "uuid": "760b2941-1803-487b-a0a1-c4d920bb60a1", "value": "T148F2F2929D1AD0ED9BCEAE5A5424C424C6D947AD28372F3CE73D0B5C3EA7A4302765B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654869971, "uuid": "03a2efe2-201c-4fa7-850b-5af2852bcd65", "value": "768:xXRkpCHFZdVQN6WNr0tTEOtE3u1Z4lJG+1E1qoKEIVfx2KaOch3l:rkpWZdpWNofm3u1Z4lJK11k32Pb1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654869971, "uuid": "dd7c3a94-3d59-4c9c-a6dc-33cf13ef49b3", "value": 35886, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654869971, "uuid": "b6d14a69-ccc4-4c44-9dec-29fa2c23c10b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654869971, "uuid": "ca943348-6dbb-4590-b46b-213b000531bd", "value": "Dokumente-952417715.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cab265b0-e8e1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654881700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654881700, "uuid": "d58b96b8-0996-4a3e-854f-620e7eaa5359", "comment": "Malware payload (Mirai)", "value": "41987d84931b87609e36f91dc590ae4c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654881700, "uuid": "f95f9f70-1e98-40c0-ab8a-3dae92a4629e", "comment": "Malware payload (Mirai)", "value": "ba5670d64eb0bc62f529b56a752c328371a45d536b386ce6d568abf109c25ab3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654881700, "uuid": "6447a292-266b-45b9-8fe5-c7677f6789ef", "comment": "Malware payload (Mirai)", "value": "b79d1baa1d6347f92a815925c85f5f01258d82de", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654881700, "uuid": "1393700d-d66d-4ea0-826e-ffc818950fb9", "comment": "Malware payload (Mirai)", "value": "81ad403ef41a5e09f6490921636eca4d9fa271c42b258c028a54c2a8113da64e7599b8f219e318368e842f9fec7ba3b4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654881700, "uuid": "51ffbe3f-9d3a-4e59-ac56-ea6e049c48f4", "value": "T1C8736CC4B8024E7DF9CBD9FE44210E09B921631125A31F2BA6ABFD937F321559E07D89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654881700, "uuid": "19e92831-bdab-4a61-9f0a-95a924aee019", "value": "1536:1xfHzEJn28h1nbXRVQQ0wWv1aNFFaf5NZNBWRB82VuxaMH8O:1xLQ0DrZHIixtt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654881700, "uuid": "b1b97fe5-c40a-415a-a15a-6d76a4112efa", "value": 80620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654881700, "uuid": "7124905b-babe-4e05-87e8-b029ad94ad5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654881700, "uuid": "ad7525dc-75af-4a0e-9bc0-d9e6fd725bd3", "value": "41987d84931b87609e36f91dc590ae4c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "239dfe14-e8ac-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654858657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654858657, "uuid": "7705d7bf-cfa7-4faf-96de-74cac3add243", "comment": "Malware payload (Formbook)", "value": "59136b578ffcc5aa8019b7783c2a91ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654858657, "uuid": "4db3ca11-9458-4220-99fb-e2f6ac693601", "comment": "Malware payload (Formbook)", "value": "baffb4ed4f1a2f98fd41a3c797a242e49ecff7bc72bcf16bfbfc98bcecbaaabb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654858657, "uuid": "d4f2097d-2abc-4965-8822-d18e50cce2bf", "comment": "Malware payload (Formbook)", "value": "fbbfd00a4c6902712fa2515e6be8d0365ace16f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654858657, "uuid": "6800f43e-6dca-410d-91bd-316f595e4c31", "comment": "Malware payload (Formbook)", "value": "faead3b481117a1ffd4615b7ddeddfa378541e67ab26f41541b0f22f3301ec300954473949a6fbb9797abb75523d1c72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654858657, "uuid": "8e8b05c8-1d4a-4bd6-b520-02d450f07077", "value": "T11F7312E2B516DDD8DC164BF20C76966000675E4C88A9950E30EE3F3FB7B335328A6D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654858657, "uuid": "beef2eef-97c2-4a83-8535-23c33731cc28", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654858657, "uuid": "c10c7d88-2d54-425f-b194-1b40cdcc1677", "value": "768:kY8e2W5SU2Ip4jBqltCF0AxEjenoB69+Fxc:5R5SFHBWAxEjc+0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654858657, "uuid": "24ecc197-9dc5-49b9-9d2c-d000d6c80431", "value": 76288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654858657, "uuid": "9ae67a02-da6c-42d3-ac32-9907a522d9cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654858657, "uuid": "b320d219-8792-458c-9a36-222eb0901ecf", "value": "MT103_Ref0012938008767 Confirmation transfer Note.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7578ba96-e8ac-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654858794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654858794, "uuid": "60931645-d4b6-4116-8812-c94cdf562c14", "comment": "Malware payload", "value": "a5216bf04b6bd329b94a9c8cc0728c09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654858794, "uuid": "4ac31f40-f0a7-4746-9dc4-53b10c256ded", "comment": "Malware payload", "value": "bbeae4b40d81ddb3432c495c2ef4d6f5de9a5646131efb99ffc7b923a5531c42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654858794, "uuid": "0f06cd85-6c39-43a3-8414-6aad8e1aa11d", "comment": "Malware payload", "value": "b6194ea204b50e8ffbebd395a9cbcfe8a32d0005", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654858794, "uuid": "a42031a6-1b71-472d-bdf9-f2c81b1072e0", "comment": "Malware payload", "value": "bccfc422c773a2434919b888394ecdc6bf1727628b281efdbf2e84fa1f602eef0b718c9ff4f6f923a7deac1a30ff94b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654858794, "uuid": "86bc3f7d-0b37-434a-a68b-445455fa4ec5", "value": "T171B1620A916408D7E89F8EFA09BBE70C59B4362137150279061B8DCFBEE0B54B852786", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654858794, "uuid": "06645620-f5fd-4cde-bea8-1733affce4c5", "value": "157531becf28d6f7d1f7c1afdcb57488", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654858794, "uuid": "6a2499a1-23b1-405f-9365-b7d50eeb7dad", "value": "48:qvSmq5tVpSTL+rO+ZmSYCEayfhGDMQd2WdO+ZUI3ION2/ndNw:CSXrpS2rO+IX6dO+1n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654858794, "uuid": "52bd6f25-dd53-4741-8d26-1b809002d8bd", "value": 5120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654858794, "uuid": "17fb1e83-7619-4e4c-9080-19ee0ca091db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654858794, "uuid": "5c531b69-cf41-4c21-8666-403100da54fb", "value": "SecuriteInfo.com.W32.AIDetect.malware2.24526.12635", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c5528c0-e897-11ec-93bb-42010a9c0043", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1654849840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849840, "uuid": "f9133237-a046-4b81-9aae-851d0f13a0e6", "comment": "Malware payload (Gh0stRAT)", "value": "8dc3adf1c490211971c1e2325f1424d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849840, "uuid": "23ee2d19-ca32-40be-b005-7758ecacd669", "comment": "Malware payload (Gh0stRAT)", "value": "bc29f2022ab3b812e50c8681ff196f090c038b5ab51e37daffac4469a8c2eb2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849840, "uuid": "8202f68b-9fbc-44bb-be84-97f56f2345b5", "comment": "Malware payload (Gh0stRAT)", "value": "4eec4a4e7cb97c5efa6c72e0731cd090c0c4adc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849840, "uuid": "764fdfbe-4b31-4016-aa49-febe5337a1e8", "comment": "Malware payload (Gh0stRAT)", "value": "e1d5e8a7b41fdcdf19ab92e6f82ae2a0b79c3e4fd61a2a705617f517eacc894f237373ef19de9ac2097b328e89ac61b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849840, "uuid": "9c09fa4b-ea3c-4a06-8add-939aeff203fb", "value": "T105257D43E6765C93C3CC4836CC7AD27273217A5CB3F79636B180AAD7B6B52603D2065A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849840, "uuid": "4b7440f5-647d-401e-82e3-bdc4bbaad8f4", "value": "5e0a0792d2594296eb53ee9831d05da1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849840, "uuid": "2191a44d-9b44-45bd-9e42-307a07296ba3", "value": "24576:N+wT1kfTw4SIuvB74fgt7ibhRM5QhKehFdMtRj7nH1PXw:cerL7Vw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654849840, "uuid": "78f1e88e-e155-4db1-aaee-c8950ed964b5", "value": 964096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654849840, "uuid": "b86f2254-a14b-410c-a8d9-9fdce7ae4849", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849840, "uuid": "b5696999-739c-45a1-ba85-64ae182de6ea", "value": "S.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8833294a-e8c2-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654868274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654868274, "uuid": "ec98a3fb-59d1-456c-b6f3-4606f4abf9bc", "comment": "Malware payload", "value": "12e889d74a4a619a037bb4d6299f1685", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654868274, "uuid": "fc2d7ad8-9ed4-4ea4-9c44-c5acd201f5ea", "comment": "Malware payload", "value": "bc2a33f649663fd21520e3d11dab179594c90eb8fdaaa7eb0fe8396b6e3933c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654868274, "uuid": "b9b2cb66-7fc9-4115-a838-254ced537ae0", "comment": "Malware payload", "value": "29a008a90a51653fa56f61d382d0089c4e8e85b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654868274, "uuid": "412cc39a-86ef-4252-a023-01c3facefb12", "comment": "Malware payload", "value": "e1868b7d2a102254c876b92051bd764753cb7572a17a49d5c40885644d1930a9e6098ca5e7819bac5ad6409cc1335b5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654868274, "uuid": "ef5c2236-7884-4667-bc6f-57267d3cfb3f", "value": "T13895C03BF268A53EC45E1B3245B39250997BBA60B81A8C1F07FC384DCF765601E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654868274, "uuid": "b28b0030-9b6f-42f5-ae62-921fb64321b3", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654868274, "uuid": "9c845bb9-8ba4-4a26-b36d-a190f0b9d132", "value": "24576:p4nXubIQGyxbPV0db26WiJVEu7Uvosv1Et9uGpckT52zedlq89Ws5uIzk5aM/pha:pqe3f6ghSffPMWrQ0Zko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654868274, "uuid": "4b638c26-3f55-46c6-b809-d97448ed5574", "value": 1935768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654868274, "uuid": "9f2bad9b-aad3-4bc4-b69d-598ca54e224d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654868274, "uuid": "f2f51eb5-c18b-40f8-a22b-7d91436ca26a", "value": "VkDJ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d521eb29-e8d9-11ec-93bb-42010a9c0043", "comment": "Malware payload (XFilesStealer)", "timestamp": 1654878282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654878282, "uuid": "43443bc5-51e6-4b9d-bae1-c704313ec272", "comment": "Malware payload (XFilesStealer)", "value": "b02f16632a71d8db3c239bdf38d3cdcb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654878282, "uuid": "0dd40ede-a2ff-4408-a4d4-bcc4fcf5a746", "comment": "Malware payload (XFilesStealer)", "value": "bc87ecc3ce7983e31c2f9dace762fda8321382b5b2c8f153b428bec85dc62f66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654878282, "uuid": "87c5c812-c0b8-4fdb-b08b-a32d9c4783b8", "comment": "Malware payload (XFilesStealer)", "value": "a0fdfd33287fad2b7ca2464cf5f4701ea4204ad1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654878282, "uuid": "966626b6-bcea-43c4-9ac3-31576a1f7c1b", "comment": "Malware payload (XFilesStealer)", "value": "76b93cd5dcb52432c810a75cf1ba304cf3aaa99cb58030875daa41c8226a2022428b9f23c5351980159c338228b9f3a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654878282, "uuid": "529c123a-0248-4bef-bb33-c6768120d1a9", "value": "T1EE3376F08FF4B9A5E1192073B864B13C37D79E0EDC655836E69BF14A34629C220E5E1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654878282, "uuid": "4045e2e3-4c30-4329-afcf-a09fb2dd4102", "value": "192:FYvL6BQZZyw1TqEjbD6uTBQesr3JPnY2F3991ZunhyY8PGCz9QwAOSWCGQyBbd2t:aQjwNqEjbnTBQesrpnY2LHZwWKKjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654878282, "uuid": "01502842-c77e-4fab-9f39-65f2920c1b6c", "value": 54272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654878282, "uuid": "ea27eb85-a439-493c-8a7b-9530c4507d5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654878282, "uuid": "92f7a350-256a-4d83-9d03-fc6bc6558c21", "value": "b02f16632a71d8db3c239bdf38d3cdcb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51565017-e891-11ec-93bb-42010a9c0043", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1654847137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847137, "uuid": "d30e1837-e74e-411e-9e26-cc2a72874cd7", "comment": "Malware payload (ArkeiStealer)", "value": "477c4b1f629a2031f38fede68475c7be", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847137, "uuid": "5f2c524f-c0a8-449b-a2fb-5da96ffce6ec", "comment": "Malware payload (ArkeiStealer)", "value": "bc8a0dfae21c3a5319851f57837b294ea9aaae1d54a1be188169ac00b67db738", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847137, "uuid": "bc09a72f-102a-4fc6-81be-a3ad2922e055", "comment": "Malware payload (ArkeiStealer)", "value": "cd854fbfc2057604f0806c13badcbd979c4c6165", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847137, "uuid": "5bbe5189-ca22-4a43-8eae-19b637e6c578", "comment": "Malware payload (ArkeiStealer)", "value": "478989bb4c189bfaad16d0502109324833cdc4cfce78d5085ae99292878725e7784f26f329a8735b39a6120733a0ea2b", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847137, "uuid": "d08d9dc3-5888-4318-bd1d-4b5275c391a8", "value": "T106D533026B8F0010EBA28D3A9A152FE25AF4AD44331FDB4B2B5E751E5FB3B593F41854", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847137, "uuid": "e3c10a72-04b4-4770-92c5-48399fe05ccc", "value": "79b3362178937bf9559741c46bb9e035", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847137, "uuid": "e9430a89-9fd0-44b2-8fe1-0bea298ff698", "value": "49152:yXG/fWcznLyvD3s1R7fl2/QQYvVVSatHhbG44Rs8QJStrAS0j/nM:r+4yg/79uMS/Rs8Qr/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654847137, "uuid": "626f0476-1e82-497f-ac20-39fa5b57e93f", "value": 2804528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654847137, "uuid": "83b9325a-a158-4477-94cf-c9110841d65d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847137, "uuid": "00d932b9-fe6a-4733-b31b-52a0bf77597e", "value": "bc8a0dfae21c3a5319851f57837b294ea9aaae1d54a1be188169ac00b67db738", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0b05509-e8ca-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654871751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654871751, "uuid": "6ff4a3c1-df86-43fe-8cba-574c3420aae3", "comment": "Malware payload", "value": "6b14615667f92cc65a1e6be43ebe1f73", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654871751, "uuid": "b13d3f9b-d824-491c-90f7-df2a308de070", "comment": "Malware payload", "value": "bcc702bb02bf035b3ff6ffa26b98232e3ef55db82ddc513f0d037f7f4fcb48ff", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654871751, "uuid": "0e939224-1a54-4f4c-8db1-d147701522bd", "comment": "Malware payload", "value": "6eaf743835c51245b3a0e0a3e79044f758c3814d", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654871751, "uuid": "e94f14e0-2c4c-4508-b6e4-3b4fef29f066", "comment": "Malware payload", "value": "32f26a6a0b928197851cc10a2eb249b7f24ef05910e71dc678c9f584240f14e2e928e9af19d759aa6bba5b3a4d5a4ec5", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654871751, "uuid": "b9f12fbf-856c-4aa9-95b6-bbf96e936d60", "value": "T12A84239D792463D7CA2F0A388B5849C24067DE233B401379B8BA76ED8277FF016C4676", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654871751, "uuid": "cdd92878-875f-4e8d-8b02-a58ab7746315", "value": "6144:3pBQ0PkfuhloWKi1D9ik9mtnmuNgRTccgEqopvwsFQQ7WM2FFoKrKOztwHq+VVA:Dkf2loW8NtnmuNBcgEjwsSQ7xKrzzsVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654871751, "uuid": "486927d0-9a56-46a9-92e0-ed4fbac19322", "value": 388808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654871751, "uuid": "788d8841-fd22-4320-a805-d36246e9a07e", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654871751, "uuid": "a752b5d3-3d91-48f2-9773-965205a73343", "value": "New Quotation 10062022#_10.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e7015c4-e8de-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654880257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654880257, "uuid": "532314ad-d11c-417c-b3bc-4ef0525b9c63", "comment": "Malware payload (Mirai)", "value": "5944bfac28fd7272737b6f6255a45f41", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654880257, "uuid": "afeeae65-4c95-4c3e-8058-8ede7757e317", "comment": "Malware payload (Mirai)", "value": "bd1f9d3a320e13edcad8c7d083fab40602ecc0d0a80aefa40cc27fe6005f3e0f", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654880257, "uuid": "e637ce9b-542c-48a2-82cf-2c4dae17c595", "comment": "Malware payload (Mirai)", "value": "8e81f162958bac06f9a89eeebb8887e7a4264a8a", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654880257, "uuid": "5a290f09-8ab5-4227-a0f7-313a6c1a213e", "comment": "Malware payload (Mirai)", "value": "404ae45e957e961d5bd88fbe9557bdc9d5607fe0481772153b16f84c24e0e0762df637021b5fb3e329ce0c0808b9310b", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654880257, "uuid": "05f0439b-934f-4c96-89a1-95173cb6e87f", "value": "T1EB031911254192EDCA8AC235996FD573E635BD6D22386D1F3BD47FB51E22E20331F288", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654880257, "uuid": "bb5b69c8-6d72-4052-92c2-ddf0f3e8e5a4", "value": "768:KXXrsTRBCOWH3+qD9ViD3l+ElP/Agce+c8A7YdNaoMK8b:yXYTvCOWH3XXih+SHT+tCYdNak8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654880257, "uuid": "1b5acc14-b1e7-4752-a9bb-b43f27ad91f1", "value": 40688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654880257, "uuid": "ddcd7b7b-fe93-4c45-af94-9e98cc5e23a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654880257, "uuid": "2f640439-e5ce-4d36-907b-5a5def005ef4", "value": "5944bfac28fd7272737b6f6255a45f41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6245d27e-e8c4-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654869070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654869070, "uuid": "69359439-f600-4169-bc80-9bc30b8618f3", "comment": "Malware payload (AgentTesla)", "value": "b99e73aefd753990c98f054937f0c2cb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654869070, "uuid": "bde4f865-3f79-45f7-8843-6c66c87e796e", "comment": "Malware payload (AgentTesla)", "value": "bd9ec18e25eb49dc93d49df80b79df544ba40518e29add911919f77c89ac3cde", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654869070, "uuid": "b5e7f524-33e6-45bd-8a5b-0c2af5618c8f", "comment": "Malware payload (AgentTesla)", "value": "f4daeb9ace4ae23d95f3ed70bf7c7179004ef230", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654869070, "uuid": "ba956143-51cc-4746-98e0-b40ec4bed794", "comment": "Malware payload (AgentTesla)", "value": "6523acdfab63b67326c63366f72d327fa56c713fb2cb448d476571266d7cb054ad95415997d91973c8d67586df5ad3ea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654869070, "uuid": "0c301429-d6cb-43d7-b681-cceab3295b59", "value": "T111C49D21726CAF92D47AD7B44055851003F2A44EFA73E12E3EF729DE54A2B4106B3F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654869070, "uuid": "08d3bc1f-2311-4428-97cc-82df5b31b59a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654869070, "uuid": "ebe1f7d0-9513-411f-8920-5830035adb53", "value": "12288:XPkcHuQKHCv07tRhd+xLyoxEu/eBNYXw:PUzRd+xLSvBN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654869070, "uuid": "312e48ff-6be4-424c-82dc-261a946d4004", "value": 569856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654869070, "uuid": "87dfb313-ab17-4942-9d2f-b0b14e6c209e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654869070, "uuid": "e734dde4-27ba-4ae1-b3be-332a7a7ffd4e", "value": "PO8765.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "822684a7-e901-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654895322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654895322, "uuid": "b522a385-c43f-4cf3-8d96-de992dd70ae3", "comment": "Malware payload (Mirai)", "value": "e671648f81a034582b57952006849acc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654895322, "uuid": "3606ab00-a63a-4f09-9773-953234c205a0", "comment": "Malware payload (Mirai)", "value": "bec9b84d09c8bd98e1a7f1405941f629e9a9c423faef0bd4b479c32a3724026f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654895322, "uuid": "551632a1-5662-45b2-9a9b-013d060a5043", "comment": "Malware payload (Mirai)", "value": "49b77acd338cb94a78db436cddfbb10d782a206f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654895322, "uuid": "ba0d5c5e-f9ad-40f6-87b3-983af1387db0", "comment": "Malware payload (Mirai)", "value": "e9b5e34ad46764545cadfcfe27a01bfdfe9cfde81626d4ec71737701ecf52d9cdf0fb0fdd6fb53a6a7c626382d71e122", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654895322, "uuid": "03e81936-d802-410d-86bb-05fdc435125c", "value": "T150535C34AD392E26C0D4A57E21F78365F2E6234E65B8D61D3C760F8EFF14A8068172B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654895322, "uuid": "efefca11-aa98-4002-b1f7-1dae3e97db3d", "value": "768:+VoUo3KSybT7h6pbaeoH4+Y5ZcVpKcogAWsyoU9twd8U4EO3mO+WG6z:+Vno3KSybT7h6pbaKcVpKBgAvyHfZkC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654895322, "uuid": "c68c5aea-d8c5-4e7c-8f45-1516c16a3831", "value": 62616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654895322, "uuid": "39686c2b-fbb0-4471-90a4-94eb9cb0396f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654895322, "uuid": "585dff1c-3cd3-47b8-8b78-c035b3436382", "value": "e671648f81a034582b57952006849acc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d6833d6-e880-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1654839722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654839722, "uuid": "f5c300d5-3e46-47f2-8662-9cb6686d6a7c", "comment": "Malware payload (GuLoader)", "value": "c69011df1fdebc08f5098a7f4d6098d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654839722, "uuid": "1ffd88d5-71a9-4c3b-bacb-f6a71b69a8f1", "comment": "Malware payload (GuLoader)", "value": "bfc7d8f7a7cca1215bd7dd211488ce0220cb4ca66b6d59a3eb8bc69047e6ac1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654839722, "uuid": "35739c0b-963e-4dcb-a9a0-dc389e03de3d", "comment": "Malware payload (GuLoader)", "value": "bf2f7b8a13510e3086862c1e308734654269d35a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654839722, "uuid": "32f51667-cdd0-4834-a40e-cbe6f1c4d440", "comment": "Malware payload (GuLoader)", "value": "b49b6f60b50ee76ab137487b807c855c15db800e139752fcd71c72e813d81fe6f2cd8f013b7e2f30ba47693762ff3aa6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654839722, "uuid": "c7cbdfac-a637-42c8-873c-576ccbb07480", "value": "T1521402606B60D4A7EDA107309D7B9F768EF6DD6468616F4B13203E4C3E32BE19A0E354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654839722, "uuid": "5f0645ef-216e-423f-8d8e-1c9e20fb0285", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654839722, "uuid": "3005c445-50c6-4fdd-9f5a-1e3341704e3c", "value": "6144:SbE/HUc48U7rnWUeS4O4n8B6vHrrAnERH9My2Y6:Sb8UHnWhO4Nvrknaa3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654839722, "uuid": "83af280b-4e5b-4a74-be26-2762ae0ad531", "value": 197080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654839722, "uuid": "21548295-5fb3-4f12-a39e-f19dda2623b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654839722, "uuid": "d7c0bbfa-11fb-4494-a370-eedaf167f6b9", "value": "New Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51b8172d-e8a9-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654857445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857445, "uuid": "02686520-734c-4016-8114-0105ac453795", "comment": "Malware payload (Formbook)", "value": "56234600028fe5cc01fb16ee4280735e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857445, "uuid": "81f7507a-1b10-479c-8bb9-0bd834cf8f87", "comment": "Malware payload (Formbook)", "value": "c04708f604cea2a594be750922eeaa181acadef6dc4669dec3dd4b07e40914a1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857445, "uuid": "20bab61e-90cc-4ad8-a726-dc1eb1233a47", "comment": "Malware payload (Formbook)", "value": "6bd3bfe0a52c736c416959185041af2f5a112223", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857445, "uuid": "e83ff0c8-83b2-4b03-a648-3f8c68814af7", "comment": "Malware payload (Formbook)", "value": "338ab744c0fa02f8abf25857108164e78d26676c0f86fd6ccfcd420e08452d508d76b76c2ce017de45deec397a0811b8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857445, "uuid": "afd93fb5-7c3a-47f8-ba4e-d7bf1560c93a", "value": "T1F6D4CF98761075DFC857CD729DA81D24EA64A4BB531FC203A01316ADAE4EACBCF251F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857445, "uuid": "21ca56b0-e15e-4922-9c31-fa42dbce0e08", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857445, "uuid": "f0a3f48d-db57-43cf-b039-077519674176", "value": "12288:NzgFPl9q7o6UNC63pNFIalUYUa3INIAczKyJ6zWpFdb/zoc2uv5VbY+XC27LvPDO:NGlYo6UE+pNbICAQKy+ALb/zoc2uhVj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654857445, "uuid": "8a6b6466-b81d-48b4-b600-9bb6028a947d", "value": 654848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654857445, "uuid": "7e70308a-83df-45e2-964c-aecf63495158", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857445, "uuid": "1849c5fb-cbb8-486a-836f-73ed9570a044", "value": "56234600028fe5cc01fb16ee4280735e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84d74480-e85b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654824031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654824031, "uuid": "b4edac36-c610-470f-bb3b-8a3bb2c97d7d", "comment": "Malware payload (Formbook)", "value": "91563a68457129371ff0016769520698", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654824031, "uuid": "83a32165-9a40-4ae0-90fa-44e372582ae3", "comment": "Malware payload (Formbook)", "value": "c20358e89b0e1c53b16cc6ee449c6202554488ecbab62ec89489fed5ea7b2ac0", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654824031, "uuid": "bbb3b2c6-52a2-4a58-af38-95857ed3ed1e", "comment": "Malware payload (Formbook)", "value": "c1f24896deb5213cefa3f1aa2381beb1b661ba5e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654824031, "uuid": "fe4c4981-694e-4273-815e-5558429124cb", "comment": "Malware payload (Formbook)", "value": "f1c31a3cec51dee5455291b790b2c920838746232cdf66e7629b60a82b9de3cc8b9abad132f0ae4bf7eaff3f976a9f73", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654824031, "uuid": "6249a04e-e7b2-4b17-8106-29de71783548", "value": "T11CA42393B99F2339C578FEE279D31102FDA480427DC1B655098DFD1986E088582BA7BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654824031, "uuid": "f492e4ec-f79b-40e2-9ea0-f6050a134325", "value": "12288:iwomXszWxqfISUCxBP+RWoLLVj7FCJQR6sZEAMv:XomkflUCqfVjJR64ENv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654824031, "uuid": "beb18589-c47a-427b-82af-d91ab50cfc92", "value": 460496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654824031, "uuid": "4546dbc5-db6e-405b-9f8f-59fe27692ec9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654824031, "uuid": "a1f253b5-c4f5-4e48-84a4-a98e444f66a8", "value": "DOCUMENTS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "524fe66d-e891-11ec-93bb-42010a9c0043", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1654847139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847139, "uuid": "5f4a8931-3a65-4de9-a6ca-7808075f1037", "comment": "Malware payload (ArkeiStealer)", "value": "5159a796d63d53c906d01eb64dcce9e3", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847139, "uuid": "5814274f-67ef-4783-b2ec-fa51f6af8c2a", "comment": "Malware payload (ArkeiStealer)", "value": "c21d6944cc1e7140d365c0ce01faef915aeb203c61ad8d5601884fce8976668f", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847139, "uuid": "f67c72c0-85b1-4bfb-9a1c-44ef98fed1b9", "comment": "Malware payload (ArkeiStealer)", "value": "02fb1ed84ab8b6c45237db782b25a98d3b8e57c8", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847139, "uuid": "d1c14a4c-58e0-4b02-80ab-28440120fe7f", "comment": "Malware payload (ArkeiStealer)", "value": "ff027778e45e2d6c02968e812b6760f59671b8ddf6c7924b314a7ac198fd821c1b6db157a20a5212674f1ef900e86bf2", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847139, "uuid": "8b44b467-f7f6-4cdd-ad7a-4ab841d24bc0", "value": "T1178533419F11D245ED3A2331A8394F6B6750FC2FA1840FA7129DB8C69EF36420F656DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847139, "uuid": "134a8d8f-5eaa-4b33-8997-e1f9ff284c13", "value": "79b3362178937bf9559741c46bb9e035", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847139, "uuid": "15a3d183-389d-4a2b-84d8-c86f9738dc50", "value": "24576:YIm5cDoTeKr3MWeIcHIm9CLrJjCR67P0ngMlU5v0eh3ict6XyQ4YHDsRoiv3g76H:jMcmKtgrs87+goyvT76XyNtQmk7ijp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654847139, "uuid": "dba7f456-0a8d-443f-bfee-280b3cfea5a9", "value": 1737480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654847139, "uuid": "76174874-cda3-4a44-b8e4-4d33ef958e95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847139, "uuid": "30cc1ab8-b443-4678-8e03-0f390e379d41", "value": "c21d6944cc1e7140d365c0ce01faef915aeb203c61ad8d5601884fce8976668f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b919e4b6-e89c-11ec-93bb-42010a9c0043", "comment": "Malware payload (Blackmoon)", "timestamp": 1654852035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654852035, "uuid": "65f39d4f-a94a-4b4b-bcff-95b78985d7bc", "comment": "Malware payload (Blackmoon)", "value": "6365f947d965447156dcfbc83eca1144", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654852035, "uuid": "37306510-db5c-4883-84e0-9f74c56f4439", "comment": "Malware payload (Blackmoon)", "value": "c2fe0fa56ca102953cfed9c707471b535ab37ce0abaa3f6cd643a365caeb0689", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654852035, "uuid": "e4b9fa8f-cd3a-43cb-86b4-a0204d6a490f", "comment": "Malware payload (Blackmoon)", "value": "0623f72fe90f1ebe74a70a4244020e78e58d9334", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654852035, "uuid": "59a5febb-dfe2-40ab-90da-d3807d423e48", "comment": "Malware payload (Blackmoon)", "value": "62ccef1d67c225500823459c8439363f21b28cb8cf1b584025eae0d554c18b63bbd76f286e3616bb340e8c5360f5cd3a", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654852035, "uuid": "df0141e1-f958-4b45-9c85-8698098f1141", "value": "T16793E5212850AC43D445B8B1CC4AD6B90119FC678CA659C77EC87F1FFF3A9E6EA24247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654852035, "uuid": "cdc873e0-1955-4a8d-a699-fdc1e0b60d3b", "value": "5aa4961d52269fdfe36625d570cdf12a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654852035, "uuid": "c080cf27-03d7-4e7a-a697-2cda236f48a4", "value": "768:ORzKthV/GLRYbMUZhj4oORQwjB7mJs/y8VQwjB7mJs/y8:YK/cYb7UoOOcBZFScBZF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654852035, "uuid": "e75fd322-1cec-468f-89cf-8cc3c26315cb", "value": 90112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654852035, "uuid": "3b53fe25-edd4-4509-b938-c5648352cca7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654852035, "uuid": "45092994-f6e0-4f83-a8cf-055881d420cb", "value": "wemote.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5bd7d89-e8be-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654866713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654866713, "uuid": "191bec9f-2c09-422a-b43a-9e3c0c179199", "comment": "Malware payload", "value": "d0df65ab1c0329c8def7d508a3d931b9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654866713, "uuid": "053456cd-0072-4a2e-a734-b0f8d61afc35", "comment": "Malware payload", "value": "c45c0a75b482ae7a12ea2deb21ed4838a463ec89f373ac03b4d988c5c4fb34fc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654866713, "uuid": "a11853fa-bbbb-431f-8eed-b346469b746a", "comment": "Malware payload", "value": "8b49efd4f207bc46d754b9b52de299894562c8bb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654866713, "uuid": "ec58c4eb-b0ea-48dc-872d-9b26cea27686", "comment": "Malware payload", "value": "2623471bc0843de83f24cb270422560bd7e88bef4523535c58ea7ff3ff7e5d9402a9ca55b89922f1c797b2fd07d20dcb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654866713, "uuid": "6ac1eb73-81ba-4919-b7f5-9bbcb56bd4ea", "value": "T1EB15225709D5CCBEF2E12C384E25ED5CFABA27F4D9902D60A7C5B28E1890C5146BC9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654866713, "uuid": "ba3372d3-5d40-46ff-8836-080e75cede26", "value": "1ed36086a033ad21e511c7142d590016", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654866713, "uuid": "529ba17a-b5b6-4401-af5c-93f4d2a9305a", "value": "24576:pDs+vSdTh3qBZY+6k4tH+ZmQ3pdUV2hh:pTSdTM7Y+6k4tvQ5B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654866713, "uuid": "86fa4ce1-eeba-43d2-a421-b79090e5beed", "value": 903168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654866713, "uuid": "d207aa97-1cd9-4997-b786-cf2c3419361c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654866713, "uuid": "065ee850-7b2e-4572-b7a3-0715fa34e38c", "value": "c45c0a75b482ae7a12ea2deb21ed4838a463ec89f373ac03b4d988c5c4fb34fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83b3117c-e8c0-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1654867408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654867408, "uuid": "11bf799f-fdb3-435a-9b66-6263359a97be", "comment": "Malware payload (Loki)", "value": "8295f6904ebea59312d89c6fb684841e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654867408, "uuid": "2901df65-ed38-43f1-a26e-840b5a4c02e1", "comment": "Malware payload (Loki)", "value": "c4666f0926b1a9ab75dc98b3c3c7352f0c45cd3273a7c9eb7e5248a272264677", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654867408, "uuid": "b8df28ef-353a-49c3-88c1-661531ba9e36", "comment": "Malware payload (Loki)", "value": "667c84f3bbfa64e53916d649e64094431769f98a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654867408, "uuid": "46b4bb49-33e6-45f7-a91e-27b3d7b99e3c", "comment": "Malware payload (Loki)", "value": "421aa538c351632c9a657f304cb747354d29223c52ce7743e7a9715fbab3a9ec4c978789e2ed0ba60b7cfdd1ad98f63f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654867408, "uuid": "c79289cf-e86d-4e6e-98cf-b8ed57c3fe9d", "value": "T1EFD4E01A7545E64EC51A8633C9DA1C1053B2AE57072BD70B6487338E9E1F3DBCF0A2DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654867408, "uuid": "a9a07759-ff7a-4fdf-a1e1-5d4393c12037", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654867408, "uuid": "40dac927-25f4-43cf-b44c-aaa45ec4dd84", "value": "12288:DCjtGSo359q6qg/E61EJ5LBw4ieoc2zk3Lmi9/tlIIuOSfIWU/l:dfqgBQ7iJy3LT9/zu7fjUd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654867408, "uuid": "b201cc5a-2609-4c5f-9fa0-5b4ede69f807", "value": 616448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654867408, "uuid": "c6e7fb55-ce76-46d9-b8a8-f69a27b1b2d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654867408, "uuid": "6d37ad01-29c9-4162-893f-8cf1bff456bf", "value": "New Quotes.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "031377cc-e8dc-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654879218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654879218, "uuid": "2da44e0a-d421-4f74-925e-bddddb034743", "comment": "Malware payload", "value": "fd6d04a2defb91f6df6d9643bc1223ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654879218, "uuid": "d0be3f61-d411-4224-94b3-bd9611a585e9", "comment": "Malware payload", "value": "c51289e307622f241b5f0791254f8985c2b3218c8bd4ae3bf5ec1b9bc0ebfcdf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654879218, "uuid": "e946e1b9-b43b-4352-9467-81e949217e84", "comment": "Malware payload", "value": "727275995ff1e0d20358c86b00d10406d4a24a8d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654879218, "uuid": "aaaac6a7-bdad-49df-9974-dc19d6fc3117", "comment": "Malware payload", "value": "8d6f930ebc434da723054e63fbbb1eade8a4bf00a7fcf4d77db32d087e959a034604dc23d22c7915335f5187fd3692ae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654879218, "uuid": "b2e1434b-1ac4-4535-b50e-42d1dd490336", "value": "T17563080AF9829B01D4DA36BAFE8E114933536BBAE3FD7102DD205F6027C65DB0B76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654879218, "uuid": "c5cf31b4-49da-4394-b167-0830c6a4d75e", "value": "1536:7l4n8chbBq10KoKDKqKTKMK+CTrD1sglTrRGqQrllWJiDuY10WnKcl:7srKoKDKqKTKMK9TrJsglTrRGk0uY1PL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654879218, "uuid": "c09e7db1-7598-43c2-a9c9-0052ddfd15c2", "value": 68304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654879218, "uuid": "69573242-1e1e-4129-a773-db56fc912fba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654879218, "uuid": "55c8a7f6-6849-421c-8388-3a2a8a4fdbc2", "value": "fd6d04a2defb91f6df6d9643bc1223ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d4cb8ad-e8d2-11ec-93bb-42010a9c0043", "comment": "Malware payload (Quakbot)", "timestamp": 1654875101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654875101, "uuid": "78106e57-34ca-464c-9901-62256967b16f", "comment": "Malware payload (Quakbot)", "value": "69745b6ffdd8f388c631ff8acb49d08c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654875101, "uuid": "40e1c04f-bc8c-46a4-a322-9d9215c2f538", "comment": "Malware payload (Quakbot)", "value": "c5b23bf681112d440475eb0120be15207265d715a3b0f932e63d9d07d248ffe7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654875101, "uuid": "e48878d5-c9b8-4932-8cd1-d7830af99187", "comment": "Malware payload (Quakbot)", "value": "85a9f55ba2eded1ac0b80c720d9c2e7f3b534ad6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654875101, "uuid": "c7bbafe1-0aa9-4032-b2aa-f41d251c1622", "comment": "Malware payload (Quakbot)", "value": "1875d8eb878155a6ee3520a43ef4560d653b3431f19e76cdbba69684577f03f6723102eddb0290ce6d57127b6d2d2452", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654875101, "uuid": "b187c363-5df0-4f3c-bbd0-80b9a2b49e4a", "value": "T1F925B062B3904C37C163263D9C6B7764A92ABE112E3859C72FF81F4C4F356917B252A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654875101, "uuid": "ae6bb063-6f96-45d5-b24b-4dbcc11532f2", "value": "20989e3840429c9a803f6f380c7c63b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654875101, "uuid": "949afcf9-891d-4049-90a3-8d139837cbd7", "value": "24576:UFsIvAexp4zV2Kk546oeKg/EVgKHy5Iy5:2tGM8DS555", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654875101, "uuid": "6543998e-af18-48d6-b6f5-1c4d1a4638fd", "value": 992256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654875101, "uuid": "a8f1f6df-93eb-4ff0-b186-3976a47f5e98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654875101, "uuid": "cd0428e1-2f1f-434f-be8a-9aa43088c063", "value": "QUAKQUAK.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a23cca4e-e897-11ec-93bb-42010a9c0043", "comment": "Malware payload (CoinMiner)", "timestamp": 1654849850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849850, "uuid": "7bfdc7ec-2e09-451a-baa5-6fb5c3f3e589", "comment": "Malware payload (CoinMiner)", "value": "18887475d2211fed916078c0454e599e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849850, "uuid": "b6e30c7a-ac4b-4a3c-ba79-63e16990dee5", "comment": "Malware payload (CoinMiner)", "value": "c75fdfe8b519b4d33a5ba92127da6e08170010b1446fa855191936497421c260", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849850, "uuid": "0af8e691-2cad-4647-b6cf-678d071b9c4e", "comment": "Malware payload (CoinMiner)", "value": "56cd22aeef30f683ad0d2cc041706194cf3def97", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849850, "uuid": "0bdd5a4c-6194-40f4-8416-f71c88c6a890", "comment": "Malware payload (CoinMiner)", "value": "3328d5e356691b71c388b5ab65d12dc0d267344c8aea15dcbc47439ca2ff1b0574e53e2ec4d6eb6f79c946cfcd61c3fa", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849850, "uuid": "6befd0b6-c476-46aa-a64e-50d52d970f4c", "value": "T1C0B512000A8F6C5FD893BD399B70DE9B80F21E245D1B8532B9A13D69BBF664335612C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849850, "uuid": "ab937127-c4d3-42bb-b8e1-ad6fbbecdf80", "value": "b500cd27f2d6aaa1b9cb12ef098f77c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849850, "uuid": "5d1376db-b793-4096-b755-1cb9d734dab9", "value": "49152:DvsGJWR17dGx9re8F2rRTv4scjpjnXrxZymKWR:gGAwre80rRDFctjNZymKi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654849850, "uuid": "9acc0163-3ed5-4888-abd2-058191124373", "value": 2332160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654849850, "uuid": "ea4bef06-8047-48a7-994f-01f5e6614582", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849850, "uuid": "127b2924-04d6-45b1-bd6b-075fd33886d9", "value": "XMR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f51bc239-e8c3-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1654868887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654868887, "uuid": "f4e52eb5-149c-469d-8f7c-f26c78d434ed", "comment": "Malware payload (RedLineStealer)", "value": "a278203d44c4fb98972f6db7c366a92e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654868887, "uuid": "66028662-483d-4611-8055-a401f6bcbd86", "comment": "Malware payload (RedLineStealer)", "value": "c7ac25825a843f18b18ac2824d143d2c00a032e6f5036da405370ca20b9d877b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654868887, "uuid": "fad2e2ec-1425-4d96-9a40-accf96d530a3", "comment": "Malware payload (RedLineStealer)", "value": "60ce26291c7c2d51a4908fba2ded78366706e1a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654868887, "uuid": "24927dc3-08f8-40d7-8369-b094813b75c1", "comment": "Malware payload (RedLineStealer)", "value": "9e49f38c227c05f8fae8092e13209791be72d204671c25ef759aebc2230581acd331e0b64874cb5667b611d68c43ecaf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654868887, "uuid": "7a1ae830-3adc-4129-80b4-8a5dc8ce1703", "value": "T1512622735365018AD1E1CC389637BEE171F71F9A9B89A8B5D995BAC128334E4E323D03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654868887, "uuid": "22717528-5760-4277-a489-8824a4dd9261", "value": "172750858dcc0719eed08c952858023c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654868887, "uuid": "b074e8b2-c5c1-45b5-bc4a-c86f5f083812", "value": "98304:QCgK6jeHJBysKI0kDP9HwTzdFcEOr9pc8j/QyudCg0P/:Qj6SulCTzdmEOZVhudW/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654868887, "uuid": "7d2100bb-a869-48ac-938f-146787af9dd4", "value": 4498944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654868887, "uuid": "21f7e29e-8c34-45d8-ac86-8026e91e050b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654868887, "uuid": "d9f20266-b502-4827-865d-39631f4241b8", "value": "c7ac25825a843f18b18ac2824d143d2c00a032e6f5036.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4a63f9a-e866-11ec-93bb-42010a9c0043", "comment": "Malware payload (XFilesStealer)", "timestamp": 1654828916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654828916, "uuid": "00354c5f-46c3-4a76-953f-49e8b6c0df4f", "comment": "Malware payload (XFilesStealer)", "value": "1d97942727236d2e88c8b6f5356f3d2b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654828916, "uuid": "d7666af2-c122-4111-bf82-ab765b05ffca", "comment": "Malware payload (XFilesStealer)", "value": "c7ccd6379627a10943964b592a5f38764ae1d0d0d39d17760940871fb3cd2958", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654828916, "uuid": "ab0b0886-a9b5-4d79-93d2-e9b8af3062a5", "comment": "Malware payload (XFilesStealer)", "value": "33e4ceb88f1da0ee6aed8388a1384827f0e2de95", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654828916, "uuid": "3615ea3b-df0d-45e5-ad30-3ac7694f9049", "comment": "Malware payload (XFilesStealer)", "value": "8a6dad6dc73f50a4d0949352bc2b1c843e515f22b9afa058830ae912a5549bd2146b39798b6fe6edf57346a2ba3424d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654828916, "uuid": "c3b252c8-2e2c-42a4-af06-4936977c4b54", "value": "T1B7236C4037D8C136E2FD4BB4ACF3A2458679D6276903CA5D6CC815EA2B13BC596036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654828916, "uuid": "98fde78f-3085-4edf-9dc0-72b807f6a618", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654828916, "uuid": "25fb72bd-4342-4af9-a50a-d15bbf95d360", "value": "768:UAUR8bIL+Cyq+DiPNsKU89yI//ica8Ybhge6lkNYZavEgK/JzZVc6KN:UPIeFrTopzbO/k3nkJzZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654828916, "uuid": "6360494e-57a0-4928-8bfb-47782aadc8a3", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654828916, "uuid": "9eb74202-77c9-4684-81c5-e91c370edcbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654828916, "uuid": "6755fee8-da9e-4b28-b419-48cff53b65e1", "value": "1d97942727236d2e88c8b6f5356f3d2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2e7cedd-e8de-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654880372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654880372, "uuid": "1e4c8832-2e34-4db1-851f-8371c4517440", "comment": "Malware payload (Mirai)", "value": "f8e9c71716d89b612625437c7fb1176c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654880372, "uuid": "d818b69b-73b5-4628-80f9-cb8d3544687d", "comment": "Malware payload (Mirai)", "value": "c84969098cf4648d517f35b7363115ad947d9ab2ff351d8147385bb5983a320f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654880372, "uuid": "381c3672-86e3-40ab-90a4-0742797cdafb", "comment": "Malware payload (Mirai)", "value": "646bf40b359c9838bdf7f21969ebc0c4138aac1a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654880372, "uuid": "530c6cb7-7a02-409a-9eee-369e831cee71", "comment": "Malware payload (Mirai)", "value": "973b68c0fb92ffb327ca5196dd8902d929c00fdc8dcd4e8e8fac43a62d55279dc0b69b59f135185bd7dc7d01ac04dc28", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654880372, "uuid": "c5f7199d-9185-44a3-a044-c426a804beb8", "value": "T1D1043D46A6409B13C1D7177AFAAF02463322AB64D3DB730699186FB43F87A5E0E53706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654880372, "uuid": "7a8e409d-64c1-4003-b620-4976c199ade8", "value": "3072:x/d6B5cAwW/HvMCBTkjG0aa4p6ts+S3XsHTJDwGiJoq9r4H1M/9Ep8y7FcmOWWSq:Fd6P/3tkK0aa4p6ts+SHaTZSuq9r4VMB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654880372, "uuid": "fb63f85e-c54a-4fbb-a92d-e8d3f5a22e82", "value": 178246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654880372, "uuid": "a8f427e1-d54e-41b0-94ed-afd73a2ad495", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654880372, "uuid": "9621e205-1d11-47bb-a806-ee8a3647175a", "value": "f8e9c71716d89b612625437c7fb1176c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8cc99b0-e8a7-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654856867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654856867, "uuid": "335e121a-a54f-4955-98c1-acebe056f885", "comment": "Malware payload", "value": "83ed5b7f8b6ca244c54b53da0e173cc7", "object_relation": "md5", "Tag": [ { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654856867, "uuid": "12e82d06-b0e7-4c78-abd1-31fd7a5dc35a", "comment": "Malware payload", "value": "c901bad1777ca42bea4f6d6f4673cd2bb1452ae0273c8ab10450000fe0e7cd8d", "object_relation": "sha256", "Tag": [ { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654856867, "uuid": "cf79dcef-e24e-49d9-94d5-ae3e4ce08524", "comment": "Malware payload", "value": "c40c4a5acd37cd8d3138dd6c6307ed9e691427fe", "object_relation": "sha1", "Tag": [ { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654856867, "uuid": "4d16b8da-3f63-4fc8-bfb8-c97a8fef440b", "comment": "Malware payload", "value": "82a35bfc76d24c68142f235667f92f656840df6a15a71f39bca4d613e0f6eff07bf6e5bc4d77e8b3b5eb947fe80354ed", "object_relation": "sha3-384", "Tag": [ { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654856867, "uuid": "6ce7a9d3-7366-404f-bc60-c45bedde92aa", "value": "T1CEA16E694FF7A3C1CF994A40473B7C5801187C1926229DE2C40BB4ED52C8ADAA4B6742", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654856867, "uuid": "3332a6f4-1ee7-4bf2-bea6-7dbda5213c1f", "value": "96:nUPR1+oT5FiozzQ5sV2zp+5KBO2ysTPC5lalb4Uhb2B68+cRfG:nUPHtz0uV2FOsmql5tQQcRG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654856867, "uuid": "16ea0057-abf3-4953-a65b-abfaaedff4d0", "value": 4897, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654856867, "uuid": "d14c9c6a-20d0-42ef-ba24-7bd4bb77ab23", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654856867, "uuid": "4920d5ae-2f7f-49ef-9980-dea384fd29e4", "value": "LoadingUpdate.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67391c57-e8cb-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654872084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654872084, "uuid": "7318dff5-9695-4da5-9ed3-f906f5885699", "comment": "Malware payload (Heodo)", "value": "d9ce33d5ea15497f532dce9750b5ed15", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654872084, "uuid": "428882d6-51d2-4e88-a00c-006434c5e094", "comment": "Malware payload (Heodo)", "value": "c9a8054fe6f83d6b0bd0fd858deac0e9e88bbdffa655fed169229d523762b786", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654872084, "uuid": "af3afb88-2c9b-4d29-9533-275e6a3a6df2", "comment": "Malware payload (Heodo)", "value": "bfe6b4211b044921e45c3dc851fdb1365478397c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654872084, "uuid": "104f4978-a82f-437c-9fc6-7dcef5fc087d", "comment": "Malware payload (Heodo)", "value": "e4de45921c09e0969c2dbf46b29e15613f35be2925f1024375f9188489e98a112298665c1e5933da052db6686ef8ef7c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654872084, "uuid": "542c611b-f36b-494a-a300-7aa711503255", "value": "T1DBB4140573F43066E46B4D3C859E190FE7E67A074BB5D1CA239082AE3BB364279B9F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654872084, "uuid": "34bde812-3af9-4a55-9879-d71c9e270300", "value": "b71031ac72c27db547b44e7ae017554b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654872084, "uuid": "27d556ce-5bcd-4714-b59e-660dc051506f", "value": "6144:TkzytaJpnASmmaNGQ7DYMT1atZNtpTKIEHzgLAcKhIepZn6kdRphRUQP7LwW1:oytafAS/aNPwHb0cKeep5h/uQgW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654872084, "uuid": "e2027923-3049-4b9d-8cb7-cba01d58032f", "value": 504320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654872084, "uuid": "d5481180-6f69-4c7e-aade-cdd35f5e488d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654872084, "uuid": "5c22c10b-4a30-424b-8f6c-f11acbf2476a", "value": "d9ce33d5ea15497f532dce9750b5ed15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae7eb7e4-e897-11ec-93bb-42010a9c0043", "comment": "Malware payload (CoinMiner)", "timestamp": 1654849870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849870, "uuid": "a3e69a8a-450c-4690-9a71-fb33b71e5e7b", "comment": "Malware payload (CoinMiner)", "value": "9437babddd3e3f9a581b77741b5474d9", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849870, "uuid": "b3d7c2ab-ce79-445b-ab9d-2e0949c62be5", "comment": "Malware payload (CoinMiner)", "value": "c9dc3e97705675448f6af2c7a417faa79c1efa3ef3d428c4b87a9f196e1fccf3", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849870, "uuid": "935b2646-0abb-47f0-bf51-e4c87a0837c1", "comment": "Malware payload (CoinMiner)", "value": "00cecfbd2fb22353b7580c9f6dfd2802b14bc34f", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849870, "uuid": "f15c8565-d706-4722-9403-fc393f80d3e6", "comment": "Malware payload (CoinMiner)", "value": "9824bbc87f7a8e14db84e4a3780d67610b8b18780b2857329c504894c1b9608ef02d729af9181de4de63e7071d82e045", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849870, "uuid": "a07da315-c46c-42a5-8a1b-6d1b325cfbf8", "value": "T178C42340DB548C54F97B1432F4AB8D04FBE0B122630F9D3D37A6A65E9C5906D8F9CE8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849870, "uuid": "38764601-3e0e-4b2e-b3b2-795442890006", "value": "4ce1662ab74b6fd55a91e4291647e4f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849870, "uuid": "12fdab7c-4bc6-470c-b191-cffba0e322de", "value": "12288:2zPqtm2dTniKX38cU860YypHs33/oQsEAY/kd0dhMM4R4LU:2Dqtjbiw38cc0JpHsANUkdyhF64LU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654849870, "uuid": "ba880f94-45e5-40fe-93e6-75d3bd2be5c6", "value": 558080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654849870, "uuid": "6d36756e-5e91-4d04-a401-c88725ee91ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849870, "uuid": "222b904e-1dc1-42ee-b4f7-b6fee858711c", "value": "ZD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88a1cf98-e901-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654895333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654895333, "uuid": "ee714316-5ca6-44bd-9d39-9478040a8015", "comment": "Malware payload", "value": "37cd50a97dcd52efd5b2523775a4eedc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654895333, "uuid": "b6aa3c8c-15e0-489d-af7f-4cf214944891", "comment": "Malware payload", "value": "c9dc4618239acbc4729065a72edc42dcb15cf93029bc8920ed95948ec0021053", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654895333, "uuid": "5df567e7-0b3c-41fb-ae43-5a78fe55c5fa", "comment": "Malware payload", "value": "4f7809e551d38d84d649d1392bbf9ee66e030bb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654895333, "uuid": "ec273d90-827d-496f-b349-32b31c4ab5a3", "comment": "Malware payload", "value": "e00b4ac68c027ca22e35055ba303a6c563570866be86ae5c8eabb2566e4b18894e3b199e41877f8d7a19711453cdd501", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654895333, "uuid": "3aba888e-eb9b-4ed4-91d2-075e0e2a10c5", "value": "T152B4140573F47066D46B4D3C849E1A0FE7E67A074BB5D1CA239082AE3BB364279B9F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654895333, "uuid": "341e7dc6-e989-4291-9e10-e4e5932653d0", "value": "b71031ac72c27db547b44e7ae017554b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654895333, "uuid": "94f7afb7-d085-40c2-80b7-1c5204963bfe", "value": "6144:TkzytaJpnASmmaNGQ7DYMT1atZNtpTKIEHzQLAcKhIepZn6kdRphRUQP7LwW1:oytafAS/aNPwHb0cKeep5h/uQgW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654895333, "uuid": "c2b5ab43-7fbb-4a15-bd4f-7c8d867f78cb", "value": 504320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654895333, "uuid": "80b4b7bf-4e7a-4417-b169-fc3e416c047f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654895333, "uuid": "a07c1981-9348-4cf9-8acf-2f10a16d47ed", "value": "37cd50a97dcd52efd5b2523775a4eedc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1951078-e8a0-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654853714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654853714, "uuid": "73aecb2d-128a-40b9-9aeb-4adca49d73a7", "comment": "Malware payload (Heodo)", "value": "387b59930c0cbd20f411158ed9192e91", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654853714, "uuid": "c9522d2d-9848-4f53-8b15-d21c60707362", "comment": "Malware payload (Heodo)", "value": "ca586ef748e4bde04d92056f28bd5545af3648c107930f789c3c8b218b169691", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654853714, "uuid": "52a8cb15-8080-4337-abd0-a25bb5fccfb8", "comment": "Malware payload (Heodo)", "value": "173dea6d0b7d58126243ecfbb742e69be1b9dddc", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654853714, "uuid": "39dd25f7-7c49-46d5-a2fa-9cc7d462724c", "comment": "Malware payload (Heodo)", "value": "08074a2b1f2a5a0acca83659764be08a90d766872f1f0ab28c0f6056047dd2553e8295a4987f9eb2ee94ce1e14a5f1e4", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654853714, "uuid": "8ea8c496-48b7-4f9e-b68f-fb0ddc433e3a", "value": "T15CC48E0772F1B5B8D205C0344A4EE532A736B9CD1422EE5F26E1D6302FEA9A21F7E55C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654853714, "uuid": "a88eb9eb-4325-487a-887c-ca4163a04319", "value": "1c5c45f819ffed1f8a226b23fc12dfaa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654853714, "uuid": "2593bb6e-5b52-4bec-acd0-1deb8a7162c7", "value": "12288:yocc2tri1Ut9aa2lI1ZrmNQo3A17bDRRySLhqcsI9HdFFlsQzTM5i:yocc21t9aaLowpDDySL8cf9bui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654853714, "uuid": "e09587ee-aff9-40da-9000-e9443ad541d7", "value": 591360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654853714, "uuid": "a5a973c1-81f6-415b-95de-fd8fd7ea6926", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654853714, "uuid": "fb80f3a6-6ec5-4033-9f6e-f8b7e0e3679b", "value": "387b59930c0cbd20f411158ed9192e91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ff4ca19-e8ac-11ec-93bb-42010a9c0043", "comment": "Malware payload (SilentBuilder)", "timestamp": 1654858704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654858704, "uuid": "3827d9a7-9ff7-42c1-8a9f-b0bae32f2e9f", "comment": "Malware payload (SilentBuilder)", "value": "266984527d39cdb60d9cc0c4d7683aa7", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654858704, "uuid": "655cbe79-d05f-4899-8ce2-70999131c87f", "comment": "Malware payload (SilentBuilder)", "value": "ca800f4812c2558e8dfc323a1c88d012949c4603479fc6830cd41f7ef7d62924", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654858704, "uuid": "4d54b5a9-04e6-4a0d-9d0f-805827bf766b", "comment": "Malware payload (SilentBuilder)", "value": "6dbc537b5b4a50412feb05cdb15b314e5656d193", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654858704, "uuid": "0a9a366d-3f19-4836-9ad0-fdbe0498259f", "comment": "Malware payload (SilentBuilder)", "value": "3e239b8e208b19ba551331108053f795990f4f1fd0b6e991a8e4734abc945e6b4395719d0eab1bda3c6a7553e86bd754", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654858704, "uuid": "94ad4461-8f6b-4982-89db-6f27ace9f6e4", "value": "T188532856BA5AD81DF915873548D74BAAA323FC314FAB0B832269B3106FFC8A0561714F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654858704, "uuid": "0679a2f3-8c7e-475d-90ad-38234282e45a", "value": "1536:NpKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg/DOJiA6Cv/UGLI36yOAcODW:rKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654858704, "uuid": "c09e3bf1-b4bb-45ba-8136-4edb74000440", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654858704, "uuid": "fefc3d18-aaad-400a-9e55-bc38dea5cbae", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654858704, "uuid": "077b68f4-5887-4285-916f-e52a4b85b126", "value": "ND255492584111901FBT.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1c75968-e8b3-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654861928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861928, "uuid": "ba90c06b-ef9f-455b-a33d-f9950f6e1fe3", "comment": "Malware payload (Mirai)", "value": "5dc22eee779221d0eea43e54562a680f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861928, "uuid": "9555dcea-fcf1-4ea8-8079-0b3e17ea2932", "comment": "Malware payload (Mirai)", "value": "caaa6fffe6c961b3105aaf087ece3fd4699d942a734b0c23249cfbe280107d49", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861928, "uuid": "6d6f08dc-38a8-4179-9c75-42eaa051f7cc", "comment": "Malware payload (Mirai)", "value": "7815239dab3016e1ab391be61f8750890058c96d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861928, "uuid": "ae14a385-c547-4c2b-9df2-eb9ac20fb53c", "comment": "Malware payload (Mirai)", "value": "d4460ddc38df97223088fa2fe3cf70703aa56614d50ac6be72dd6e8cdea95e95b7244b4a5fb5ebe3d2c45a57b7a078de", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654861928, "uuid": "612282ba-c573-40aa-a0c6-7d0024ccb613", "value": "T129C2E191D3E5C5ECE4AEB1B5D8AB7B0A0654E81C805917BD1FC021378EB2B3A5728367", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654861928, "uuid": "4c6eafcc-a0e2-40e5-8fcf-d52991fd3999", "value": "768:jiN21srd6Xd1GDMmmIKtRca4In/6ZzZMQrbV1WhvIufnbcuyD7UHQRjG:Y56X2DMKal/6ZlM0VEwCnouy8Hyi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654861928, "uuid": "29e0a07c-4b97-4085-814c-fcb31b3d8fad", "value": 28244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654861928, "uuid": "3da703b4-db84-42e8-a2d2-fe2347744275", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654861928, "uuid": "0f564bbf-697f-4c18-9b40-b72650774bd1", "value": "vailon.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ed60847-e8ac-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654858837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654858837, "uuid": "1bde433a-7857-4c39-a7db-4cc45022c653", "comment": "Malware payload", "value": "a3496561709e839c765c464d69eace94", "object_relation": "md5", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "E98346", "colour": "#6FDB7E", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654858837, "uuid": "e569fe19-552c-4d05-8e29-ccd1df90b77a", "comment": "Malware payload", "value": "cb1120370791c6f6e53aaf96b9f4468c1e26802028535c2265db245771fa8812", "object_relation": "sha256", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "E98346", "colour": "#6FDB7E", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654858837, "uuid": "ad8be4a2-3702-44f9-a35c-f0fa3394e4a4", "comment": "Malware payload", "value": "946f41f7a4ad4f47f62e14f2809bd3d771701a17", "object_relation": "sha1", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "E98346", "colour": "#6FDB7E", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654858837, "uuid": "abb9ea5a-9042-4a9c-811c-5abeb1b2c731", "comment": "Malware payload", "value": "2963c1cc917c26b209ae9133a1879f933ceb416cb9396f0170e8f6920fc28180c18e341b1156f3d105f1221d963642e6", "object_relation": "sha3-384", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "E98346", "colour": "#6FDB7E", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654858837, "uuid": "ac604b93-c0bd-4ad0-be90-07807cfc2981", "value": "T18F2182BAE21C510CC8EF9E3A5A2B66927133859C6A4E2B4EEE803474781A419B631D65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654858837, "uuid": "0a55d6d6-5947-4834-bd00-4a046e8df051", "value": "24:L6Lbg9+FH70CpU6xVg/KHZuB3fePM50w5z8muy967+KH6m/:L6LG+/pV2xfp+wVuwzKH6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654858837, "uuid": "2ee82b77-733e-4882-aede-ea08c6e7bd19", "value": 1123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654858837, "uuid": "78edd766-0a72-4ac3-b702-7fe0b522e6cf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654858837, "uuid": "b95dba22-2746-4505-99b9-a714ddcf72c8", "value": "F2110872171.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3952f135-e880-11ec-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1654839795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654839795, "uuid": "0fb2ba47-c860-482b-b970-6cc819a24548", "comment": "Malware payload (RemcosRAT)", "value": "f467569ce83e75322923426ca2c71c48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654839795, "uuid": "2fa83f9e-cc6a-4472-b16e-d884a4ca91ad", "comment": "Malware payload (RemcosRAT)", "value": "cbb9b2dfe4df8e3221cfaba1311afff6070fa898f03a64fe0fba4811a9531032", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654839795, "uuid": "e5332466-341e-4f97-a8bb-5a7585b94ea8", "comment": "Malware payload (RemcosRAT)", "value": "66693814b69f9edbb1ce877f82a948f198626380", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654839795, "uuid": "f0dcff3f-ec3b-4a11-9d6a-524f44f3fa4f", "comment": "Malware payload (RemcosRAT)", "value": "04d50fd78126deb437136cf26095071c8e98d58cfbe2c70d87225baf0d0a1ec1db7a232222534975053dbc36e71c88ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654839795, "uuid": "c763ece5-f500-4e6a-8254-0bb18e7c91e9", "value": "T1B9659D62B152C832C3620A38DC376BF8556ABE15ED2468872AF13D6CFF757617437282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654839795, "uuid": "235c914d-9819-4aa9-a66a-f7f07064bab9", "value": "66ebe8b38da518dd5e3cdb7bfad8bde7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654839795, "uuid": "ade5cd11-ceb9-402a-9c62-999a3b951048", "value": "24576:Og/2082AZjjVzLh5eZO0rq8PS+C5zONkMsTWDaX:OULAZjrI/BDa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654839795, "uuid": "25e6177c-f771-4f7d-82a6-c9185aba3230", "value": 1475072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654839795, "uuid": "23c0d5bf-feb8-4fca-a4e9-3fa5fd9a7072", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654839795, "uuid": "2bea3c5d-6991-4755-9ea7-84483834aab3", "value": "Novi popis narudzbi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7177e7a-e8f7-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654891143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654891143, "uuid": "1d25eb87-66b3-4608-a65b-9c407ed231c4", "comment": "Malware payload", "value": "ccd45fd7136d6c54e31d1703164fa855", "object_relation": "md5", "Tag": [ { "name": "a10", "colour": "#5CE516", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Exotic Lily", "colour": "#C6DF5A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654891143, "uuid": "472bcb6e-614e-45a4-b04b-0323648b693f", "comment": "Malware payload", "value": "ccde5e528a8da994b3cd96a988023acd16a78a9cea4fe5dc1b41d9a72890a995", "object_relation": "sha256", "Tag": [ { "name": "a10", "colour": "#5CE516", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Exotic Lily", "colour": "#C6DF5A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654891143, "uuid": "a09b0ce9-2ddf-40a2-bd03-82b78082c8cb", "comment": "Malware payload", "value": "e71645b6a0d82b0c3a1c7326e07140a8333229b3", "object_relation": "sha1", "Tag": [ { "name": "a10", "colour": "#5CE516", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Exotic Lily", "colour": "#C6DF5A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654891143, "uuid": "da9f47f2-00cc-4333-9280-2d8ecfc1bb69", "comment": "Malware payload", "value": "2458b6ae253ba19980871fbf138dfa4706e4528d6f069fc3e558a775528b823339ed06e26bdd49ce0111fd872a8f45ab", "object_relation": "sha3-384", "Tag": [ { "name": "a10", "colour": "#5CE516", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Exotic Lily", "colour": "#C6DF5A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654891143, "uuid": "f8a4b9b5-44d1-42fe-abb4-2e320b1aa111", "value": "T10565B027765FB7A8C45E72F78C1189AF7781E8C0802B945E7C8A67D1F443318AE785E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654891143, "uuid": "b277266a-2cb5-430c-9dd1-ec1dd4e5ae8b", "value": "ef82e136b21279e5e60a607f738fdf96", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654891143, "uuid": "2e79d027-6da1-4e9c-80cc-01eaa10f1fd9", "value": "24576:4zML9AWrsduXKKYIRccazwOEe+k8fNLHKZNj2WCoEFj9x:4zM5PrsEXKdwOPP8fN+/j2cEV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654891143, "uuid": "3001915e-ce82-411e-b0d6-2a9be95ef3c9", "value": 1500160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654891143, "uuid": "03afb383-a087-454b-b2b3-5979cc37a6ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654891143, "uuid": "618a2668-cca7-48b7-9461-20d98854ae56", "value": "download.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56754591-e8ac-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654858742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654858742, "uuid": "beea24aa-4c54-41f0-998f-c3325f5b4fec", "comment": "Malware payload (Heodo)", "value": "64b48b2c4dd5698ee5591ff3c43ce927", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654858742, "uuid": "713f64ef-58de-4a7c-a2b6-4f9fb1a74f07", "comment": "Malware payload (Heodo)", "value": "ce1c588c166a2451aa4ca289ce0d35b859fb7af3be89ba2f8c7da3cdfb18ebe5", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654858742, "uuid": "7eec242f-3b0a-413c-b70c-167ab187d378", "comment": "Malware payload (Heodo)", "value": "6f4a095692eb6a9cec0a7dfdd605c6a33cbb6b66", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654858742, "uuid": "23d83f55-0929-44da-a5b3-ac07a6f42f5f", "comment": "Malware payload (Heodo)", "value": "9a0440b295bb4b2016fabf7f5fe7061bf913f969270bae712bd796c504a3f41bc54eef6afeb424843bdf085f58e99842", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654858742, "uuid": "43a37ec3-3e65-4826-8f71-e5399d234d67", "value": "T107F4D43EFF51E8E9F8439230814A9170B124BC2D8271797E3648FD64BD72698EB2DE15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654858742, "uuid": "345c7da6-5deb-426f-961e-4b5ded0e149c", "value": "98dfbb430035f9300f4be2418dab914b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654858742, "uuid": "e61630a3-0de8-4d5c-a78e-398d843280f9", "value": "12288:yFbnmV9v3WtGWt4T/humzyMSoGGKqh2tiDek/bPUkf80pG4:yFbO9v3WtVt4T/huKyMJJKq4Qb/Ikf84", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654858742, "uuid": "80307e5d-abfe-42e0-aa1d-4ac180fe6b0c", "value": 743350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654858742, "uuid": "9dff2b14-b409-4ba3-b7ee-bab6bfc2edcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654858742, "uuid": "72c8dfbc-1392-480f-8b27-886b83b4acb5", "value": "bL38jUbXmYJNFMMXsi3ONFALaMb7Kbu.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3552352-e88e-11ec-93bb-42010a9c0043", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1654846093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846093, "uuid": "9793d613-d502-4930-86fc-ab2234f9563a", "comment": "Malware payload (ArkeiStealer)", "value": "1e6bfd562db3a0a51c59aeedb966ed1a", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846093, "uuid": "b8664eb3-0331-4aa5-a3e5-f0501d436abb", "comment": "Malware payload (ArkeiStealer)", "value": "ced636a857dd593663e9fe7439ac12c765051392a7b25daa499a1e7e378c013d", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846093, "uuid": "85b5ac07-35fb-4436-a54b-7e37d7f2adbc", "comment": "Malware payload (ArkeiStealer)", "value": "186150d0ddb96449eb04cec8105e7bb76b5ab386", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846093, "uuid": "e1ec1629-5d21-40d2-b1d4-43da14e92f64", "comment": "Malware payload (ArkeiStealer)", "value": "3945d29dc4342fd31237279b4bbe6870c98ed485bba2f390d563c49eaa9df6ac6e536a91b19d85c02bfcdacfd04d0577", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846093, "uuid": "0ad6aa8b-1c09-4bc2-8f18-d3d0b4c0c74a", "value": "T17E640120B7F1C833D0425A3228F56652DA7879426331A95B7BC8077DAF712D1367B3E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846093, "uuid": "09f46673-726a-430a-8ae8-63c7fc9bc906", "value": "68b9ee776a6ebea9667401088dda2b91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846093, "uuid": "0e662e38-bd50-4f19-8ba3-593466cd4612", "value": "3072:FjRATbxZHlrPmbM2nOS6rQFY864b26GUYkWZILK/TReuIm+7EuaLe6o5b5QQ0gOV:b+xZHlrPXe6TnqLgRXIB7IyHQQ0gPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654846093, "uuid": "097117d3-ce22-4763-a94f-b610c1e01a93", "value": 316928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654846093, "uuid": "4bb9cfbb-bd9d-4913-a40f-fe42415af19d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846093, "uuid": "26eac5a1-adc2-4705-bb8a-c630157c1a42", "value": "ced636a857dd593663e9fe7439ac12c765051392a7b25daa499a1e7e378c013d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53637d85-e891-11ec-93bb-42010a9c0043", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1654847140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847140, "uuid": "ce71becc-f349-4378-bfc8-507c48f0cc3a", "comment": "Malware payload (ArkeiStealer)", "value": "2ffde889be6fa3c1e4f2f6a218cf8a1e", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847140, "uuid": "2fb84620-7dbb-4bd4-ba56-70962c50df2a", "comment": "Malware payload (ArkeiStealer)", "value": "cf2a9a23fe444cf73084e201311e785dea3d6dbfd2fa77027ab8895995d47700", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847140, "uuid": "2a83f005-21c2-4560-a917-db355d8d0f7b", "comment": "Malware payload (ArkeiStealer)", "value": "7a1f8008bd8b4097eb74fbff4948f8ab58ac4655", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847140, "uuid": "daf74d5a-6a8a-43e2-bc06-8fd1c523cee6", "comment": "Malware payload (ArkeiStealer)", "value": "0bc3d2a0b78e88f628bc91e8d8bccfe7e634446df57c97c5889f1f1c1aa75a5e34c0ca78d602b9488d35a208ce1e7bd0", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847140, "uuid": "7c6ba5f3-1974-429e-885a-166dffa1c1d4", "value": "T1FD95334AD20D63A9CC3193B9C5A38D624719FCA762591217376CBF40DEB7B036E43AC8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847140, "uuid": "ef053831-139f-4107-8bfb-582ba93e76cc", "value": "79b3362178937bf9559741c46bb9e035", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847140, "uuid": "6686e486-696a-4a42-b754-54082c6f1da4", "value": "49152:ctx3kC2aGu7ua8gh0ghxjC2uutJnVUJzM:H/uKy0gPdnmt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654847140, "uuid": "283bffa1-da94-4773-ae27-2256fe8554e8", "value": 1934336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654847140, "uuid": "cb98ca66-f416-4e62-b6a9-218959167603", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847140, "uuid": "3b44e6fb-9404-4345-b825-ad5444ea8858", "value": "cf2a9a23fe444cf73084e201311e785dea3d6dbfd2fa77027ab8895995d47700", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c05434a5-e8b2-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654861497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861497, "uuid": "bc560c53-ac57-4bab-a6b1-8474e4b5134a", "comment": "Malware payload", "value": "dd0bf713e2872c94a70133537a1eb260", "object_relation": "md5", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861497, "uuid": "124f8cd0-c1ae-46bf-a210-57a5723ba603", "comment": "Malware payload", "value": "cf93f18f7fff4079e365a6625588ed227438386efb408493e7e6fda468b0c946", "object_relation": "sha256", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861497, "uuid": "d8788875-a77e-41d6-bc02-637806318591", "comment": "Malware payload", "value": "91255a88eafc04d00423a867f70ce6022a4ad20c", "object_relation": "sha1", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861497, "uuid": "a0b13882-c9f6-4e90-92b3-b22c3ce4e3f2", "comment": "Malware payload", "value": "718ea7641071a6880fe872ad779956c31fa23b79124a0bf0b25d219e37a4a85c5db0160a2391130915666789e03be775", "object_relation": "sha3-384", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654861497, "uuid": "2157be26-82c8-4eeb-8e0c-6e07319198bb", "value": "T195F2F1906C85EC1A4CF5117EE86810E338905E326A864FD40BD775BDB8DCAF21B7AC91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654861497, "uuid": "793a62af-ff90-464c-a611-72e925b011f4", "value": "768:bfucXykthcz5uHnd9AceSjO2zNXDmOsUGX2T46Idtzpq1KaAE2CJmRcyC:bGVktFHdOhSi4NrNT4hd1pqQEHJmRc7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654861497, "uuid": "7aa2d4d1-49f6-4fa0-9288-30c4a770bf83", "value": 35888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654861497, "uuid": "b5f88a14-b19d-4043-8461-ad5847c916bc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654861497, "uuid": "ffbee78c-926c-4995-ad67-44c83b14336b", "value": "Nachricht 4993393719.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a224065e-e8e1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654881632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654881632, "uuid": "664bcf9f-fd3f-4082-8ec7-c276b470f878", "comment": "Malware payload (Mirai)", "value": "ff4fa29f69160e6d7d719e9c50383f1b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654881632, "uuid": "8c54cfe3-bf8b-41dd-8b46-5d3ea7733494", "comment": "Malware payload (Mirai)", "value": "cfa642c87140b32006ccddfda75128226c91f5b733229f40fa252821e0277977", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654881632, "uuid": "a6fcae96-85d3-4616-9081-3a9f246c75fc", "comment": "Malware payload (Mirai)", "value": "e137b9a4c71af60021eaa5caf6266974f741a6ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654881632, "uuid": "8927fcff-d7d7-46a0-867c-a8bc9b9f56a3", "comment": "Malware payload (Mirai)", "value": "11e99729cd28acfff8bda3322ae39523dab4f43c54d014474ae786de345f6b1bcf3393a035458f6d08dfb1cb61d0f4d7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654881632, "uuid": "52d774f0-6498-4d89-aa3a-3f550c9dfada", "value": "T1C14301219E6DB903A4A8423EFBEDCEE36B920F7A861E30B18768C154F0D14515DFBC95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654881632, "uuid": "91b3311f-c432-4089-a580-01ae6699a4af", "value": "1536:Dpwd4VmGhBPHomK2QE8jIAUoAjN5/Lg9skfXE:DOCmGhJHxK2QEYIAcLy8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654881632, "uuid": "ae4463e7-4ec6-4b2e-b47d-c7dd837d14e9", "value": 56056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654881632, "uuid": "45d00edb-cf43-4e6d-9053-f21efe60e15b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654881632, "uuid": "bfde0c1d-67a6-4041-94ef-9a749e20570a", "value": "ff4fa29f69160e6d7d719e9c50383f1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a20d751d-e8e4-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1654882921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654882921, "uuid": "bd126538-0374-435a-974c-2c795e339a56", "comment": "Malware payload (RedLineStealer)", "value": "ca33fec46476f8b933d518e5b80f2292", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654882921, "uuid": "bf16232c-200b-4d0a-89c2-b4a9e8c421c7", "comment": "Malware payload (RedLineStealer)", "value": "cfcd348313cae67c169897bd5ccaa8c7cdf1f99b4776cf942d587eca6e94004b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654882921, "uuid": "9b5bf1cd-01d6-4d4e-9b51-fb9fae0bef12", "comment": "Malware payload (RedLineStealer)", "value": "157ddcf827ce62433a0dba6b752e937eb42ac1a8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654882921, "uuid": "4f27d322-f619-4737-bf60-eb1c8857edaf", "comment": "Malware payload (RedLineStealer)", "value": "5331298f4ba390ebb005d770dc07e73e7ecd0a44cdb15d11516fd08eeaaef533864bc0e43d2d3ede68a93260dc9eb9a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654882921, "uuid": "5b6f39f5-d456-4478-b708-da9f94973da7", "value": "T191640210B3F1D833E7E38A308890E6A29A367C3141B549C7B758877D2F6569127BE3B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654882921, "uuid": "11258235-6b52-4a56-9b25-a784b85cddf5", "value": "1436c045ba5c1a8b146943d159fa9855", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654882921, "uuid": "23f6b4d1-9860-4d80-bae5-b6a823eb1c11", "value": "6144:eBzullY+9k7WZvaQjvg4AH/gSRWeboc9huIwI9tKsF4:etuHY+9kqZv1s4ygSRWebbVf8sa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654882921, "uuid": "550bf804-0462-44db-9bc0-0112f1ccb6c3", "value": 311296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654882921, "uuid": "2028b04d-6f46-4768-98d2-85ce8f50febf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654882921, "uuid": "80ea3617-db6d-4c6a-a203-382fe289a298", "value": "ca33fec46476f8b933d518e5b80f2292", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "760daac3-e8aa-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654857936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857936, "uuid": "7f8b0782-9434-48ce-93f9-5088c468f865", "comment": "Malware payload (Formbook)", "value": "d4fb3af72cac67572aae9a16bb859795", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857936, "uuid": "74c0230f-45b9-462a-b0ca-e89f6e16a99d", "comment": "Malware payload (Formbook)", "value": "d16928ea116bf3bfb6f3b51c833fd52a540e645ba60ef8842b4750cdd33080bb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857936, "uuid": "c324c3ae-4b42-4720-aef7-56138f7c3c87", "comment": "Malware payload (Formbook)", "value": "ed16248d49b44663536e8d65581210cf9899000f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857936, "uuid": "3e4be917-a8eb-4854-947b-df311ac7d1c8", "comment": "Malware payload (Formbook)", "value": "5f67447ca2a85d6f6ce499e670fcb21a3177eade6d49b2604e4020f6d4a202cb3cefded2b2b1526b89024bcdc2320860", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857936, "uuid": "ba1a1bbd-1df5-4d36-b843-705d7732b3ab", "value": "T1EED4F1F1EFF6B8A1E1143073B098502C27E39E4EDC66DA2ED15BF11A25572D225E1E0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857936, "uuid": "ce3292ce-7ffd-4259-9861-3de7a7bd0ff3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857936, "uuid": "afef7aa5-b56c-437a-a243-23c94b77b619", "value": "12288:jt1I9qvAUvPObPMoDQVWTBtuat7g8C9XBe8YemD4:jt1IgQPTiMzl9OBB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654857936, "uuid": "f336ea85-de35-43a0-b200-94d195d30fa7", "value": 637440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654857936, "uuid": "abf6836b-a613-4920-aac5-33d7204d6ed0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857936, "uuid": "da44498a-9254-4c81-8d88-fe1c8c378938", "value": "d4fb3af72cac67572aae9a16bb859795", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d592c1f-e872-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654833843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654833843, "uuid": "c864fd5b-4135-43e1-bcdd-e27291855ab9", "comment": "Malware payload (Heodo)", "value": "908a395ba5f7dbbf6dc6bd04e9e8cbe1", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654833843, "uuid": "fe14539a-6f55-467a-834b-760aa408e8d5", "comment": "Malware payload (Heodo)", "value": "d1cdaa79971b9cbcb4b0f61a9ff2ad4e21fc38b7d5d52b199c6917f6739db59f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654833843, "uuid": "7f6efffd-02ea-4250-a6f8-9cdbc27e7c59", "comment": "Malware payload (Heodo)", "value": "41100fad51b4a500e9472ccb539176eb788b1c20", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654833843, "uuid": "adf4d889-051c-4d4b-a7fd-5baa215edb48", "comment": "Malware payload (Heodo)", "value": "dd786e04e459f784a0e8f208e8bf6e9d05ae5fccd12e214c76a9f99948329dd79af7a772212bc879a08ca4d4a68452d0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654833843, "uuid": "68873962-ff5a-47ae-8dea-d85ed7352e5f", "value": "T1ACE4A29DFF02C5C0E53761B2989C98D844683D1E5100AEB53489BE763B76BA2CE87C37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654833843, "uuid": "8e74157d-fe3e-49ac-a667-87eb90d3f2d6", "value": "3107f7451b0e16fdcd17c5b464d06e23", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654833843, "uuid": "0ce6ec62-d11c-4586-a604-d95149e0a1dc", "value": "6144:HiwEnJyVLryVLryVLryVLryVLryVLryVLGLO8yMZodxz51dPRHh+u392986Ugn:CoYYYYYY6a8S91d5Yu3w+6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654833843, "uuid": "4eb07614-8cd6-4980-8c78-f3805006c2fb", "value": 661504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654833843, "uuid": "25a29b9c-f184-436c-bae3-93154b455a8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654833843, "uuid": "31c2ce73-7bb3-44f0-b0ec-3e48929a5627", "value": "908a395ba5f7dbbf6dc6bd04e9e8cbe1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f6a2d46-e8b6-11ec-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1654863052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654863052, "uuid": "5289a68d-b82d-4210-9c76-2d13cb7a9d87", "comment": "Malware payload (AveMariaRAT)", "value": "39a26a71d19c66d1df3f2e2569ded3c3", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654863052, "uuid": "4af0b0db-3e52-4c08-a79a-44269a37e13c", "comment": "Malware payload (AveMariaRAT)", "value": "d1cecc9f276ba68092c54d7cb7cef3612374e6fa73e20f1fa15ed79f58c8ace7", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654863052, "uuid": "f9d29adb-fb0a-4765-8598-b8b3a49dea7b", "comment": "Malware payload (AveMariaRAT)", "value": "49a4a428ed912c1a07f752aaa407be4f7bf9100e", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654863052, "uuid": "5eb17058-b2f3-4da6-a03e-7927d366ffa2", "comment": "Malware payload (AveMariaRAT)", "value": "977cfc0a740e8a3d57c29e2188dd17de1a5ef0563608518d9ad09780164b8983e37e5c0585714db0ac413a61241cf832", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654863052, "uuid": "3764e69b-1907-4c93-967e-e8a1bf82fbeb", "value": "T14E05F12371BCC0E1F56E3EF00A1A07119AB42D964639F51BDA4F7DCAEABB653C0154C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654863052, "uuid": "e53a14a3-15db-47f0-ab4f-e39cea2b43fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654863052, "uuid": "c2d8b7d1-ef77-4f28-8721-3f0d8cb2f088", "value": "12288:fd9C8+jXbW9qT9q04cQxqreNb5YbgNkfVRCc5LaIASaldf+UqA:fdlCXKOn4wCN1YbnCcsSal5WA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654863052, "uuid": "428c2233-fc7f-43af-b62a-b860196c5db5", "value": 826368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654863052, "uuid": "b09e6c3d-8e9d-465f-91a6-11bf7877a27e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654863052, "uuid": "8e40bafa-fc1d-45b1-81e4-192b600e6557", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa29e35f-e898-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654850292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654850292, "uuid": "f6b1e719-5cfb-4a92-ae3e-72dcf96b5656", "comment": "Malware payload", "value": "631ae38e1c478ec94582f3e4cc54b2bb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654850292, "uuid": "e2383f6f-0021-4234-a14f-4a6745618f6a", "comment": "Malware payload", "value": "d2b413e685594b5727f16365e463f518772078580b1e34ff7aad2b2ac986f127", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654850292, "uuid": "1eef13af-d18b-4ac9-84be-add86a109fc8", "comment": "Malware payload", "value": "da21b270cca8405eb6bca3e8a5178f677a8a7021", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654850292, "uuid": "7d969e07-00c6-4a97-b65a-384f225d7db9", "comment": "Malware payload", "value": "d172019e122ab3e30ac3e0f3b7715e8e9b4668d7f236a49f2063f972c92277a973769c66a593ebed3cbd87945c5569a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654850292, "uuid": "c9f8bdbf-e73f-4cd8-9f72-c45f138cf1eb", "value": "T193C533C275849C43E78542709FBAE9D9DD27B209AFE49E0B2B08E837B40637176DD853", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654850292, "uuid": "6f9be787-c400-4979-94b2-75c1a5708bd6", "value": "57e98d9a5a72c8d7ad8fb7a6a58b3daf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654850292, "uuid": "84c9677f-6b84-4d5c-97e7-549c81ae535a", "value": "49152:NbDC5usKIyWCep4EZMndf4Fw1EFWNovEnM7zAcyZpP4Q7Sxy:NPC8DQfjandfkAEMivEnrc2luc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654850292, "uuid": "3676017d-9d17-42de-a945-4bcb8952448c", "value": 2566488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654850292, "uuid": "ecb09949-4d64-4a2c-b429-fc03ca5e2896", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654850292, "uuid": "b5bdb76f-15cd-49bf-921c-fbd8e912b570", "value": "631ae38e1c478ec94582f3e4cc54b2bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ff8a204-e863-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654827431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654827431, "uuid": "1539456a-bb5f-41c2-94da-7d2849662a84", "comment": "Malware payload (Mirai)", "value": "b84181a0a8cb11577284c2c92d0e14ea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654827431, "uuid": "69d01e3b-3a68-4b34-81f7-250d2a7c15a9", "comment": "Malware payload (Mirai)", "value": "d37b491854799b50083c25a6652b0e48ee27902c9edb9fee413e22af8b2b6709", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654827431, "uuid": "5a710ec8-7841-4d66-89a8-0e41136cc522", "comment": "Malware payload (Mirai)", "value": "d12ddff0ca2c36172ec6d50640b070a04f1be6a6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654827431, "uuid": "391b2ef1-bcff-4777-be10-4896b6cdf317", "comment": "Malware payload (Mirai)", "value": "ef7fa9d1f4f6b6abc3c0365b6d1513e013a84cbee86a9bfd409bb2b5d5f5d8a0b5a4d7bfabeadc627d5dd04fc9fd50dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654827431, "uuid": "a494bcd2-bb2f-4f64-a427-cffcd4d23b63", "value": "T154B3AE9BF70B66A0C86147F407C75BED2F2332129E5B99E77D1E293E58351CE090A392", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654827431, "uuid": "58eefa75-a07f-4475-a0a8-c9b0f02f1731", "value": "1536:OuucyKF7jd7hlhh06Trs0/8S93IqgdMZSTRCPoT5VfMhNgN/LW+:qcFjb/66TQ0/vhIBa8Nf5VfMhNgNq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654827431, "uuid": "f3e8e5e0-1bae-4793-8bfe-99d28b374788", "value": 116000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654827431, "uuid": "4f23f6a2-ac45-4b7e-8562-d1d9883a896d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654827431, "uuid": "d0421420-2108-4b88-876a-f7b55fde9e02", "value": "b84181a0a8cb11577284c2c92d0e14ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2363f119-e8b2-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654861233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861233, "uuid": "ce43b4b0-25f9-428d-b69a-931e2d311f3c", "comment": "Malware payload (Formbook)", "value": "8dd2c132fae6a1eb7020e996d3c97a85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861233, "uuid": "b82ab39a-6967-46f6-b3c3-8a8b711e501c", "comment": "Malware payload (Formbook)", "value": "d42635fa9af66acdb25d8cbf9e7317f7ab9ef89a7aa32c8676536c8c3a9f4637", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861233, "uuid": "94885847-a096-4840-b1ee-6eb78d8c2958", "comment": "Malware payload (Formbook)", "value": "daf38a45a53e79e743615706561095315d483117", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861233, "uuid": "6daf8815-8899-45b6-a519-0f1f6db23312", "comment": "Malware payload (Formbook)", "value": "f3e7476b3c30925894be5eba12ee2687530ac667bc31e6b917d7b6ed0bcadd7aa05f950f4921820dd728c0b68eab87b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654861233, "uuid": "e4c286ae-e744-41be-bfa1-94d8b1567192", "value": "T1FB74E0257194E827EBD276386FD0EAB8A3319C4E1C42854367F83F9F3AFE6039511256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654861233, "uuid": "418cf33a-2188-4e28-b2a6-719a9362054f", "value": "dd1742eadfc6df18ded3c26ae64ad610", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654861233, "uuid": "2d3bb4e9-5d11-469c-bc00-510616d743ba", "value": "6144:WbgILA1zg0+CbzgfVlQNEV9PBDy1KjQkLf:aLAD+2g9lQNWRBW6b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654861233, "uuid": "80de7e90-2b86-40c4-bd1f-5d58509ce12f", "value": 370441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654861233, "uuid": "32f04f90-19da-48fd-a214-2884bd6d4cee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654861233, "uuid": "b21865d8-37be-48f0-893b-95a7dccd5a2f", "value": "MT103.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5c3d99d-e8e4-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654882954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654882954, "uuid": "0499b752-2b45-4c78-8a88-e8f93906324e", "comment": "Malware payload (Heodo)", "value": "2c1869e085aa3c7b1906ce4ece2c537c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654882954, "uuid": "5cba1bd7-178f-488b-a68b-10351e856cf6", "comment": "Malware payload (Heodo)", "value": "d4478a772047ae63ab8847f989f1dcf1e3f897887337fe166be29f8dd74ec88f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654882954, "uuid": "db6cc475-3267-4d88-b6e8-a3f7a96184a7", "comment": "Malware payload (Heodo)", "value": "fcc44f685cebb2578ea6e64cd43f165461e27f18", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654882954, "uuid": "8d9fd7b2-0da1-4cc3-be10-b80a7ba1be0f", "comment": "Malware payload (Heodo)", "value": "908c2dfdbc753101bf8c4dcce14e1bd0474b28105fdb88ae83b76aa3ae3a3e3a219ef6264f8c3dc56c2983d73d525bac", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654882954, "uuid": "9282f286-e553-4e1c-ad54-e83db09d0800", "value": "T1DBB4140573F43066E46B4D3C859E190FE7E67A074BB5D1CA239082AE3BB364279B9F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654882954, "uuid": "647d7f57-0c8d-4885-b3e2-2210a2db0cd7", "value": "b71031ac72c27db547b44e7ae017554b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654882954, "uuid": "7d3c35b9-60e8-4764-944d-a190427ff697", "value": "6144:TkzytaJpnASmmaNGQ7DYMT1atZNtpTKIEHzzLAcKhIepZn6kdRphRUQP7LwW1:oytafAS/aNPwHbTcKeep5h/uQgW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654882954, "uuid": "6a046d36-4e2f-44c3-b8da-8ac0e04d7f3c", "value": 504320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654882954, "uuid": "1c610cab-8cc4-4292-8e42-1be5464d64c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654882954, "uuid": "44a65a39-ee5e-4701-978f-ed9153ea95eb", "value": "2c1869e085aa3c7b1906ce4ece2c537c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d10f048b-e8e1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654881711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654881711, "uuid": "46e24ef8-844d-4581-9cb7-2f7f66149b04", "comment": "Malware payload (Mirai)", "value": "4639cf9283c919478d331667807e264b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654881711, "uuid": "e5a0ac8a-dc30-4ce8-8515-562873a6be67", "comment": "Malware payload (Mirai)", "value": "d495f580c3e30f47515567c07624374d3e40bd67fc2edf37ede6ee179e032154", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654881711, "uuid": "6ac3a0ba-f9f5-4b76-91dd-2f72bc8b9c94", "comment": "Malware payload (Mirai)", "value": "f327b7790693d9bb38c4473c5cb09c425fcfe067", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654881711, "uuid": "e79f1931-e1ac-48b6-a5a3-1910edf0c3e3", "comment": "Malware payload (Mirai)", "value": "5d5682d80021b265c0adcb4261a23f22390ef350f64952fe4f95e8d809b25f3358ba1c92c6d25f29a68546c832f992c6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654881711, "uuid": "bd14297b-f640-47e7-a127-cabe9be29eb5", "value": "T1BE73BF72C068EFE8E1510674A9A1C9784B13F50512272DF2CEC5859AA50BAFCFB1D3F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654881711, "uuid": "2413957d-b189-4f0f-bc4a-4e54b46fa6bf", "value": "1536:3aa/AnRkhO1NlejVHVkwtC/74Hkifs31JoWWNHYsYCs:33lO1NlejMHUdf+1+DHYsY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654881711, "uuid": "06d97d5c-4257-4a12-9266-3a1ae6690f6a", "value": 78836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654881711, "uuid": "a9a1148f-a307-4834-8106-2a9c0bb21fb6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654881711, "uuid": "ff2f35d1-b350-4377-8eb4-82d39029e027", "value": "4639cf9283c919478d331667807e264b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e505d571-e88e-11ec-93bb-42010a9c0043", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1654846096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846096, "uuid": "c495b51d-839f-47a6-8aaf-0417e8784e9e", "comment": "Malware payload (ArkeiStealer)", "value": "b0b6b154c4d051aad99d04e3f18a3eb2", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846096, "uuid": "496b19c7-228c-4c1f-882a-79d3fc243a4b", "comment": "Malware payload (ArkeiStealer)", "value": "d5a26234e372c9a32c304821f7a4084135c47ffbda225c5025d091623c4fd1be", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846096, "uuid": "fc321015-8e76-41a7-93ed-4aefe61dcb07", "comment": "Malware payload (ArkeiStealer)", "value": "de8bf7682cd992ae63aeb093a3c45b2318f8b5fa", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846096, "uuid": "7ae887d5-0d44-47d6-8e1a-139a677a0f95", "comment": "Malware payload (ArkeiStealer)", "value": "df6e1f304d2bdf904a7bd2d344f764707c713c43eb456697cd33bf64d1532efa9a1f20b56afa34750d1c522df57a5aea", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846096, "uuid": "dd961f1b-9061-4eea-b0ad-9f237c09e9d6", "value": "T1AFC52C135A8B0E75DDC27BB461CB533B9734EE30CA2A9B7FF608C53599632C5681A702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846096, "uuid": "2ae03294-f615-4031-88cc-cedb506b5813", "value": "5dd6748a8bf8c3a3d51aac89447af978", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846096, "uuid": "81df9b33-b65f-453b-86f0-073d74c51438", "value": "24576:VLASDPMrcE/v4oZN8v9jWmh9pE4i6My4tIXYZ5/vcCgQNBUhr1LT2KNdd7BjuQ5f:VLASDPMrcY/CdN3i6l4tIXY/ChxJaE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654846096, "uuid": "b899bd35-6d8f-440a-a9ae-0219b521e2d5", "value": 2518703, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654846096, "uuid": "63588eb9-2f6c-48f0-a948-ab5d0a63484f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846096, "uuid": "0f3b5daa-46d7-4398-86a2-20429f6072da", "value": "d5a26234e372c9a32c304821f7a4084135c47ffbda225c5025d091623c4fd1be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b549056-e8d2-11ec-93bb-42010a9c0043", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1654875151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654875151, "uuid": "3339cbcd-1515-4027-ab56-5f52c2307a21", "comment": "Malware payload (ArkeiStealer)", "value": "36ccd5068fda51e2c45e4bde8d5f1b6b", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654875151, "uuid": "9b1dc9eb-6795-4dd5-b25e-c2bb677f206c", "comment": "Malware payload (ArkeiStealer)", "value": "d5b4a3de08883d7b31720d491f7884adc3a2de15751b1019290ea456829439e9", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654875151, "uuid": "0958254c-456b-4c37-befe-e9458429298d", "comment": "Malware payload (ArkeiStealer)", "value": "6bdb859221b49af2fde6b756a8e215943e55554c", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654875151, "uuid": "daa0bb32-d652-49e3-9b86-7c78e14e5546", "comment": "Malware payload (ArkeiStealer)", "value": "92fd5c1fdd58c4b551fa7794f46c787bcd43b47609327f8b1fc948dda8fdc356874d89947a58876f71c541ace4bcfe83", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654875151, "uuid": "b9337067-d3af-4e16-825e-c354ef263f92", "value": "T102C51A135A8B0E75DDC27BB4A1CB633B9734EE30CA269B7FF609C53599532C4681A702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654875151, "uuid": "213e975c-382f-45a8-8dee-a5182628922d", "value": "ded04cbec414252b14476348fc5550ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654875151, "uuid": "5df9d565-150b-4d0c-8558-cf8a3183b1a4", "value": "24576:KE4d3A/8fzenezF9ySTbhZs5/WanGmMJv5y8r7oK9pu/NnHsLlrPEuQ5p3h3n1zE:KE4d3A/8fzenezF9R/GVch/AEpu3E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654875151, "uuid": "e4363081-28f3-47ab-b415-4828eb59509e", "value": 2537151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654875151, "uuid": "68e5c76a-ca33-4037-b9a5-09768773f867", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654875151, "uuid": "7ebfad4c-7238-4b62-a4c9-5e6ff9b1ff3d", "value": "update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a44656fe-e8c4-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654869180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654869180, "uuid": "09c1237e-d0d3-4de2-9a0f-c10c5c6ee523", "comment": "Malware payload", "value": "a7c517aef81be65c751fcea2fbba6474", "object_relation": "md5", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654869180, "uuid": "33d3ae56-4664-4748-b475-520dab3f2945", "comment": "Malware payload", "value": "d5cc78b0a45b9ce07db8cf80f8007a97b8aadddf7a8acb2dbe4a4754378c252e", "object_relation": "sha256", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654869180, "uuid": "a2782cb7-398e-4a31-aa07-e4a20f82dfdc", "comment": "Malware payload", "value": "40b0e093f3caed222f71101a156b19e5d08ad872", "object_relation": "sha1", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654869180, "uuid": "22913264-31c1-498f-a7d5-28de096b9bd0", "comment": "Malware payload", "value": "5695a61d0705ea31e3dcdc5fca7bea156734a417066cf16b319970c27e138908c9d44f192559b5be7dccdadf830e51be", "object_relation": "sha3-384", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654869180, "uuid": "eea3dc8c-294a-4a43-8456-3c683a610bc6", "value": "T1CEF2F114E20399FADD4BACFAD589623B9E7C87DCA853EFC117471C004B45FF96828888", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654869180, "uuid": "b977ab66-9292-42f6-8eb1-81349b44cb3c", "value": "768:kB5SeW1jHqprgRZ5Wt+40qsmNyF7Mi7jPffnFabqovm:k5SlKpQ5IFPsm6Ii7TAOou", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654869180, "uuid": "842273bc-9975-4e96-b865-8610897b6bd6", "value": 35878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654869180, "uuid": "c99b1bef-ee76-41b6-803e-ba39a74fe314", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654869180, "uuid": "18cbe70a-929e-4949-ba46-55cca09e77ce", "value": "MAIL_1321616208.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6638e4e-e88e-11ec-93bb-42010a9c0043", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1654846098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846098, "uuid": "7a0b2ace-53bd-4e18-9a5d-5b95557f5288", "comment": "Malware payload (ArkeiStealer)", "value": "4a43fb790423a23ab5c2faf0fb1efe88", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846098, "uuid": "aa5073ad-399c-4c42-b58a-59b8f655c979", "comment": "Malware payload (ArkeiStealer)", "value": "d6f9cc1f29795601c08853a237f18a86f041a02359028360f74dfeeb87800c98", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846098, "uuid": "d5513a66-e600-41c7-a09e-83d40d052221", "comment": "Malware payload (ArkeiStealer)", "value": "1f7a60bbc21848bb1836387e10d6bbe3f5a45faa", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846098, "uuid": "b8b9501e-9424-4257-8d94-805565266fd1", "comment": "Malware payload (ArkeiStealer)", "value": "a2d784129bfa29fe208d2607f165e025f1dbe6e0947925b5f544f6d477625f326b40ce0aa7331caf9cfcc2c697ac7f96", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846098, "uuid": "545826f6-2a0e-48bb-a827-0e7d324b257c", "value": "T1AFC52B135A8B0E75DDC27BB4A1CB633B9734ED30CA2A9B7FF609C53559532C4681AB02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846098, "uuid": "25969ab2-11a1-4bb2-a106-0fa4caf1a3d9", "value": "5dd6748a8bf8c3a3d51aac89447af978", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846098, "uuid": "1fe6b954-6de5-4ef7-b035-2e7073382dc1", "value": "49152:GAN0mRQJEjZr7IcNIMWth/f4rLergjcL9:GAN0mRQJEjZr7LIMWz/w/gt9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654846098, "uuid": "2e41217e-c20f-4458-9977-b28abe2b72ee", "value": 2557936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654846098, "uuid": "441b3869-67f9-4ab0-ba76-07acf8dd1094", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846098, "uuid": "e8b3a522-9e71-4432-b2cc-6d7cf1a4a2f9", "value": "d6f9cc1f29795601c08853a237f18a86f041a02359028360f74dfeeb87800c98", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6c414ed-e857-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654822369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654822369, "uuid": "96fdb8f0-c842-44e7-9246-5ff9b74e55a3", "comment": "Malware payload (Formbook)", "value": "f5169efb02307050ef6930f6e882ab30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654822369, "uuid": "154bbabd-75f9-4f7c-9d29-6f0e5da364d0", "comment": "Malware payload (Formbook)", "value": "d83599951f0fb9e7a4abd8208db2e5e09c29e7d6cc249bb02359a95811b8a0a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654822369, "uuid": "f795b16c-eb35-405c-b6ee-78b8d43e09aa", "comment": "Malware payload (Formbook)", "value": "82699ecd168db64151e331e26eac5fe6ca31eed5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654822369, "uuid": "6eae1e8c-a1f7-4ef1-ace9-ddac3cd7e6e5", "comment": "Malware payload (Formbook)", "value": "123fe5071f645fe0b5290a4c8ac0c9807bf64aef3ec70cc5d73d267833935a1fda6da89a9fe96905a773b547e276442e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654822369, "uuid": "709c9f67-eab7-423d-904f-e8f02236b4d8", "value": "T18B7312E2B616DDD8DC164BF20C76966000675E4C88A9950D30EE3F3F77B335328A6D6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654822369, "uuid": "fdd65cc6-9784-4275-ba15-39f65c6b1d9a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654822369, "uuid": "4fa58b16-fd75-43b4-8c21-b3dfde0577d0", "value": "768:jM89/6pSU2Ip4jBqltCF0AxEjenoB69+Fxh:QK/6pSFHBWAxEjc+Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654822369, "uuid": "f2c2d31a-3a2f-4020-86d9-c9617579af1d", "value": 76288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654822369, "uuid": "32c6aabe-7170-4a31-abe5-86f62ab7e1fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654822369, "uuid": "4d56d580-1490-4c61-8a12-ab35c5210c33", "value": "MT103_Ref0012938008767 Confirmation transfer Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e0d1091-e8e4-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1654882699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654882699, "uuid": "312810f5-bc56-4f2d-acc8-588ed2a37733", "comment": "Malware payload (RedLineStealer)", "value": "21aacda43d74ba1dd51b29b02227cb75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654882699, "uuid": "010d46bf-7e13-4e0b-9c55-76c963b23619", "comment": "Malware payload (RedLineStealer)", "value": "d94d4ffe996eab88f6583a75791e95a81508a25eab9608b397755e2051960acd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654882699, "uuid": "2acce65d-ef36-4e3c-8b39-748d828e68f2", "comment": "Malware payload (RedLineStealer)", "value": "19d2f2346369b8458cff95ac0afb7f1d0f1645b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654882699, "uuid": "d67dcb93-1d12-4e2e-ae6d-d2a09f781f56", "comment": "Malware payload (RedLineStealer)", "value": "bbbdd1f322063a7d9f460b22c7d2a689d932221202cd8710f462a69bdc341e11159d9d6587344483715e04d2af7dbd14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654882699, "uuid": "eb6c6a5b-5d86-4312-9fd0-a5952a645e83", "value": "T126F47B8913E9F81AF33F2AF1D648F980C3A151C795E2BB5A40D582D267722D47BE11B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654882699, "uuid": "ad30cb79-3b1e-49ca-a3a5-84c2dbc35a5b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654882699, "uuid": "4fd4f605-cc4f-4a01-b809-697bfb8a9d85", "value": "12288:FANDE+T7Ov4Ok+/s7cfMdZzq4xkBLmUxkZVlXkQZKOO:j+TKjZsoeZzrxkBLI3ZKO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654882699, "uuid": "e26da831-2c87-4931-98c7-f5c03aa3e436", "value": 724992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654882699, "uuid": "e66b1677-edb9-4105-bb71-f7cd553412ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654882699, "uuid": "40670031-e4d7-4d56-a034-853f0785f2dd", "value": "D94D4FFE996EAB88F6583A75791E95A81508A25EAB960.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87b948d9-e8aa-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1654857966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857966, "uuid": "68806fb3-1ac6-4e0b-9508-f3c93da4c617", "comment": "Malware payload (Loki)", "value": "67b1398b1f213e375c2932136c0063dd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857966, "uuid": "0d9dd22a-0997-41a0-9acd-e32a28edc6a4", "comment": "Malware payload (Loki)", "value": "dbb440e8d5227ff860349e78fbfb3eb81110b6de241ca2f913863051576a33e7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857966, "uuid": "af98739c-1dc9-435b-9365-8370dbeed977", "comment": "Malware payload (Loki)", "value": "c264b2ac97d439f47b20810f2dc78c8de270adbc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857966, "uuid": "b3eb4659-42b3-4e4a-a994-2439ba1de8bd", "comment": "Malware payload (Loki)", "value": "3f913fa51b415a13224f634b470d88dae9671ff43e0c573a4dc01e6c71243dc46d59aa0775e6dd8e1b2809743e8fa6de", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857966, "uuid": "71912945-db9f-4129-b244-73dc218a26d6", "value": "T16BB4125133E82357C76643B02E960B02D3B8CA2E67BDE70E494552CE8DCB7D24B1679B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857966, "uuid": "a7b4e54d-4518-45da-a4e1-2edf0d5de4a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857966, "uuid": "af085503-1ae3-45cc-bfc8-1529d0640552", "value": "6144:0q9qbTvrpTa9qy3wGR6+i3bMdDFnd017LMpqiQe46psnIEm+aUHCRjp5oykc:59qbxY6+i3o7dUA8U5SIE3Ha3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654857966, "uuid": "693f0d18-d50a-4cf3-84b5-cfaa148a0232", "value": 498176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654857966, "uuid": "593402b1-4f3c-4a20-af26-48a9bcbc9b24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857966, "uuid": "7b75d787-d510-4a8a-8244-7255c5888fbb", "value": "67b1398b1f213e375c2932136c0063dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "483984ab-e8a9-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1654857430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857430, "uuid": "3d04daad-0f66-4eb7-871c-e9fb47a42eac", "comment": "Malware payload (GuLoader)", "value": "f596762141304e01c74812d1f8634efd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857430, "uuid": "f67ce92e-e6c0-45bb-820e-8d8cfb411743", "comment": "Malware payload (GuLoader)", "value": "dc226bbd9a65576734dbea2bc18c596f6997bfc90715dc0ef21b7d867a9ac4ac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857430, "uuid": "80161d4f-5d8b-4d9a-948b-2f9849f44e26", "comment": "Malware payload (GuLoader)", "value": "5eac75c7595e75d5d0b9c36b0072b0471a4353df", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857430, "uuid": "a73d50e1-8dcb-421a-990d-2adb4591b630", "comment": "Malware payload (GuLoader)", "value": "dcdbe4e6c15aee4aeda58a0eda1d06725fe3808bf54e9bbcc4d30457563fcbba4c2d05feb6584a0a52387b67fd1abee9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857430, "uuid": "377b6e9b-10eb-421a-937f-171dd6b9c62c", "value": "T15283E101A7A0C463F9E28B311D3F27378FFADD21186496174B906A1D3D76682DA1F7E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857430, "uuid": "2f96b466-4cfa-4fa0-9099-9cd650a88a11", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857430, "uuid": "faad866d-5647-4f10-a4ee-0b509cdd3c0c", "value": "1536:dq3tMhXvFvWKBRMQQ8pSuVYbfea8mWDpY2UpvuBu1TIO2XxHavkHTGM6Qe5io:o3yddvw8pSuVYbmjmW1XUpvuo9u8vkKD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654857430, "uuid": "6fe09141-1c24-473e-9ff6-9a9c8ae427f4", "value": 87422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654857430, "uuid": "2921b58f-f5ec-4033-96d8-6d73d457ccf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857430, "uuid": "d0e8cbb0-2dd5-4c26-bc5f-615427af849a", "value": "f596762141304e01c74812d1f8634efd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6daae85-e8d2-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654875278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654875278, "uuid": "16a966f8-94ea-402a-a878-5bcdcc6d38ff", "comment": "Malware payload", "value": "982cc7460f96e3e3eed60e0fb628911d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654875278, "uuid": "fd8ec2f6-3df4-4464-b0fa-90488fb5b1f5", "comment": "Malware payload", "value": "dc34d2624db773785052270584f2ae135db3e6f36df70a3ee84250284ff471d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654875278, "uuid": "af036b01-64ad-4259-b89c-828da49ad4ce", "comment": "Malware payload", "value": "a45b6d83425b8649fff38ddbe02e1fcdea83a4c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654875278, "uuid": "c6a2b021-6993-49b2-b3f8-b5a9b095703e", "comment": "Malware payload", "value": "7726de4b245081f101a89ff2da47f51499cf1288fb958ce1b27343ab89e42fc186ad9f87c86b74351baf302127025eed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654875278, "uuid": "ee8f777b-2ade-4ca2-9b37-bc00b02c6dd3", "value": "T13C163312E1FC847CE39BE33201916A78ED99D94FC7B31E95B22737F0ADA9A16C11485C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654875278, "uuid": "7bf5782e-2730-46a6-9a81-3ca0a4204a9c", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654875278, "uuid": "672dba7a-8ad5-4e3d-aa9b-38222b39863e", "value": "98304:+wbmORUG3ik9F+ARm90423zJAkglbygWcXidYnCVLO:N3f9+ARa0423zJYbyGSdYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654875278, "uuid": "29f09030-39db-4c1f-8fdd-401f9fa0caf1", "value": 4223488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654875278, "uuid": "177d22e4-f496-4f8f-87ac-2daca53406e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654875278, "uuid": "a4a96d1f-514b-439b-b578-c05ae7de5a17", "value": "IWZIGORQJ3CF0H77JUYD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb30d77a-e8a2-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654854643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654854643, "uuid": "fd94425e-55c2-418e-8c54-5baa81bff0f7", "comment": "Malware payload", "value": "c32df55f386c4cc721021f6ad979ed51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654854643, "uuid": "636eeb2e-cb84-4062-9ea1-888192f2e5eb", "comment": "Malware payload", "value": "dc438d79044c282523a9fcff2f948561ef04581f55e4d6ff5807fae03b4bc7ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654854643, "uuid": "a21c61d5-9bc9-4eba-b5cb-e6c16564c4c3", "comment": "Malware payload", "value": "5b35bb82f36949b278dc7dcb067f20092cadd2c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654854643, "uuid": "38100cec-70de-46e6-b652-dc607a008f87", "comment": "Malware payload", "value": "270abf38e853b365ae593fc1547ce7af68642ff4be579de9c1a3936f7c6dd6e89fd663459c3cb6284b8224e07fc5c08e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654854643, "uuid": "b46d6a6e-861c-49aa-86e9-d36088603953", "value": "T15CB1A40E95540893E8AFCFFB0AB7EA0C2DB4352036124375062B4CCEBEF47257445B8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654854643, "uuid": "c3649938-01dd-44be-9839-12db0182594d", "value": "157531becf28d6f7d1f7c1afdcb57488", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654854643, "uuid": "8ca61626-7932-4c8a-816d-37301940ae85", "value": "48:qvS5qtxVdpL+7O+ZpwmayfhGDMQd2WdO+ZUI3ION2/ndNw:CSqfdw7O+jwRdO+1n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654854643, "uuid": "25097506-c6be-415a-8d1e-7a8a0a7f5ea2", "value": 5120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654854643, "uuid": "6eb030fc-88a4-4429-ae73-82287ff1c852", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654854643, "uuid": "21a8b2df-7e73-43c9-be13-94ace9556168", "value": "SecuriteInfo.com.Variant.Razy.633639.23250.20567", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f83a7fb6-e867-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654829378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654829378, "uuid": "709e6b5d-d69a-438c-b4e2-633084cbcd81", "comment": "Malware payload", "value": "4bab17e7830fd268e6fd55019225fb5b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654829378, "uuid": "accfd489-df97-421f-9222-0d540e0776fd", "comment": "Malware payload", "value": "dc5ec959e5d0ab6407101376d7ad4a1130d92676af55bedf637c43e2ddd3fec7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654829378, "uuid": "29a71c66-320b-4c21-b8d4-caa5f5e55c2c", "comment": "Malware payload", "value": "393c883ce5a0b66939917374360340753b0644ae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654829378, "uuid": "332b5bee-f287-411d-8adb-261f411697da", "comment": "Malware payload", "value": "286a03b5cc6f3ffed30da894ea650fc59244b5202d4eb62e1c26fda7ac245aa3b9b19316530f8eb7fd80445ed3fd702a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654829378, "uuid": "d010601d-b657-406f-83d0-a5a713b07ccd", "value": "T12912A8245BA84333D9B6C730797E97A3F234F32329528F4F09E542165DC6A4DA68E734", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654829378, "uuid": "b19e19f3-984c-4caf-a736-e4c46badd85c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654829378, "uuid": "3f2aaff7-f7f7-4b4a-8550-fa89c351c975", "value": "96:Gmn0Ta3DwhTQOIWCH3vYgg/rB0lb9n9Q3Yl/klRckG/OGkCzNt:GgzUTnKYhaljQ3Yl/YGhD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654829378, "uuid": "3c6225fa-88e2-40bf-a3ea-ac64dc65a9a7", "value": 9728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654829378, "uuid": "411b5419-4987-4362-a528-3670302290da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654829378, "uuid": "bd65d8a9-6816-4add-a331-d6712fe4e5b9", "value": "4bab17e7830fd268e6fd55019225fb5b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bfcd642-e8a9-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1654857328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857328, "uuid": "e0158423-b5f2-40d8-be7e-93afb065119e", "comment": "Malware payload (Loki)", "value": "eb571b16ca61b89c6aa9e5f1e208c77b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857328, "uuid": "be611ec2-3b35-4ea8-8430-03ee7ea8e3a6", "comment": "Malware payload (Loki)", "value": "dd08331b11c8c472c99d125a13ce11834752368fc327b17118fae6691b79edd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857328, "uuid": "51e73aad-2907-4a4f-8adb-0919ebe0c2f0", "comment": "Malware payload (Loki)", "value": "5b5487c0043cfb126374b4b7638ce8e9ac25d708", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857328, "uuid": "9cd1db50-60cf-4d9e-acf5-fc22f5a25f4e", "comment": "Malware payload (Loki)", "value": "c27026b69901352431123001b59747c284a206780f0d559cd585b99fb6c57a76bb9188d6a885dd632333fc73cd36426e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857328, "uuid": "21b6ced7-92ef-40af-83a6-5e42f841ae75", "value": "T1AD558D1133FC5E1BD2DF9776A432491947F2F806A3B6E78F6908B6EA2C5371089017A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857328, "uuid": "6211d97f-077f-4c17-b01a-9a55d8665776", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857328, "uuid": "22b8a66f-4ac4-4f8e-b7d7-e5134b64fe9c", "value": "24576:UP49NsOJ+BQhb6Z6sKrlIuFRgaoaPC63a+LDUN3R97phvBCKXabdj:5bsPQ96EJtYNnvBCKKxj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654857328, "uuid": "bc951c6c-18b8-429c-9783-d1ed3cf1678d", "value": 1287168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654857328, "uuid": "5d88ace2-da63-4e92-ae8d-f6cef87bf3f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857328, "uuid": "a3c06119-28ba-4dbf-b61c-adce5209c6c1", "value": "New Contract.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e0695b1-e8e1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654881598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654881598, "uuid": "8d96fafe-9b77-4520-810a-c17af37f5a26", "comment": "Malware payload (Mirai)", "value": "ad66835611ad313ca51bb9214a02220a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654881598, "uuid": "af7a6506-5128-4067-8018-4e04c952435b", "comment": "Malware payload (Mirai)", "value": "dd16720f9082c438a69072562df1ffc70e78d1fc5e86abb0f15f083efbc471f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654881598, "uuid": "93f8cfb3-0cbe-46a6-a0c3-a74c4914054e", "comment": "Malware payload (Mirai)", "value": "4d8dde693d2d16003bf2a74262940dbe83c700f7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654881598, "uuid": "6e56c787-4378-461d-a216-994c49a76fed", "comment": "Malware payload (Mirai)", "value": "3bad19325327f793b8f96c9969d33e118507ebc59b39b7b78d669c7343bc48d3c2ea3d762e67b431f70f8d4a6b312a1b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654881598, "uuid": "6b759b0d-d211-43a9-8600-b1760c502730", "value": "T1DE934A21A9392F27D0D0A57B21F78384B2F6221E26B4854D7D720E4FFF146406E5B6FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654881598, "uuid": "4c8a9c2b-b643-4fdd-a4cc-c447ea31e42f", "value": "1536:uEpJ8gIP6YJZ8Dxpm+KFSszvQhcwBBEJ24Ru2s6vA/cx8Ss:uUHY+KkqY1HEJ2EtvAVv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654881598, "uuid": "ada538be-c693-460d-885a-1103cb20f496", "value": 88976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654881598, "uuid": "4c40e2a9-770e-4a6e-b137-44450ff106a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654881598, "uuid": "a7f5ef2b-1a77-48b0-8200-cce0ef2e4aa9", "value": "ad66835611ad313ca51bb9214a02220a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a5ee4d6-e897-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654849702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849702, "uuid": "1e499fe0-d4d6-43ac-9792-7f8137ae41ef", "comment": "Malware payload", "value": "b5c73db8e70d6f46ad9b693f3ce060d2", "object_relation": "md5", "Tag": [ { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849702, "uuid": "47a6cd88-57ed-4bf7-b91f-f047f8fb90b5", "comment": "Malware payload", "value": "dd23fdb05c78a10acc716ba234925a658f80b45eaca7d08ba045c67ca977827d", "object_relation": "sha256", "Tag": [ { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849702, "uuid": "d583a1d7-c4e8-44ee-94f5-51e0ad33538b", "comment": "Malware payload", "value": "ff5ce3b5d4f5cad313aaebdd5885e0a0ca0f3924", "object_relation": "sha1", "Tag": [ { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849702, "uuid": "056b5c7a-e6f4-4b9f-9004-eb5ca086109e", "comment": "Malware payload", "value": "46fd0d28bd51483bf3cd63fa4e2f9ff2976e12b49e7b5add59edd604c676fb01feb27dad0557054f8d775bfbaa5ac341", "object_relation": "sha3-384", "Tag": [ { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849702, "uuid": "c285a2b2-1eb5-4f4a-b8de-bce8a8bdd07a", "value": "T13F949DD2F3810CD7E31AAE7D81E96662B930B4A7C724DAEF554441860E5A3E4A43D33F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849702, "uuid": "1363bda2-38ab-4293-ba6d-938c0a182b81", "value": "63b6cae92df6bed6826785cc5d2617ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849702, "uuid": "6584e74f-0107-4f3e-8c45-4f977e0c5609", "value": "12288:f52ir7q/yKWRHGhPYDpRAsY4qUIHuzl9r:fI6qYAADp9Y4qUIHWld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654849702, "uuid": "6850caf5-59dd-47e6-b425-9ae000804f9c", "value": 431840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654849702, "uuid": "ea2b8014-73c9-4e32-ad69-f5207e6ffa7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849702, "uuid": "303eff42-3ca4-4ac4-8522-07d9c47b9dfb", "value": "lflxdlwo.sys", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ce90a83-e854-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654820877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654820877, "uuid": "16fc4110-2ab3-4cfe-ab9d-d87ea35d99a0", "comment": "Malware payload", "value": "0c5664e73781fe50bded8a37d91cd23a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654820877, "uuid": "25862787-d9be-40b9-8fd4-3172693b1b72", "comment": "Malware payload", "value": "de0029185915c1004a1c93951c79bbea89354ffc17edea5d14a27a511cb16170", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654820877, "uuid": "cbd7d691-acb0-42f3-a766-e3985019ea86", "comment": "Malware payload", "value": "c2bb9473dba4792f1006db03cf787b9a12b55821", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654820877, "uuid": "84bfae1f-8788-4346-b981-c46df5a25a65", "comment": "Malware payload", "value": "8e5345466a8f826f196dba74547bac11c2da9ae527fc10116d96f58ab293663e30ad32891f84b4406baab0b37bb15a57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654820877, "uuid": "0a759853-e35e-4205-9d54-6902117a2a3f", "value": "T1E14739A522D820D6F567F1B459175B13DFE0B01B272D6AA77898C6C03F41EA12BFCB42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654820877, "uuid": "f2cb1da9-f3ba-45aa-a0e8-310f2260d152", "value": "6220b823389972c94017b608ef082d6e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654820877, "uuid": "aceb740c-4329-4f7a-841d-2ea68e2b4f17", "value": "196608:IbuzpoLmS8yAJpTvBYekYFO52J12czV2v:NzpoLmS8yAdGpcz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654820877, "uuid": "d7fdbfc0-65c4-4476-9ac2-793c45ca95c1", "value": 25720320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654820877, "uuid": "9916064f-efc4-4a5a-b23c-58d49f2204d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654820877, "uuid": "307da6ef-a97b-4d17-b277-1759915f5d91", "value": "main.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c8b043a-e8b1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654860900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654860900, "uuid": "c2527cac-3eb9-4ce9-8e8c-99151d079623", "comment": "Malware payload (Formbook)", "value": "301d150778adc32c2fcaaadd488cf105", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654860900, "uuid": "166b5307-aad4-484d-9b76-dbd3d503603d", "comment": "Malware payload (Formbook)", "value": "df31462e3ed93e9fdb107362badde97dd90aaf956286b41d0d91e330eba91c91", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654860900, "uuid": "870d4c01-8063-4152-b1ae-37ee50610c7c", "comment": "Malware payload (Formbook)", "value": "b7da947c01be7aa9db1411886f961b8108a61dac", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654860900, "uuid": "ead38a45-936d-4e23-a8c3-2a27270b0d40", "comment": "Malware payload (Formbook)", "value": "0f126270fdcc155abaed32253ce8af01ae16b69e96a165175a070369cb949834c4f02fc3d1c7bbb0b5db75dc6dcb8eab", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654860900, "uuid": "ea716ac8-c2b3-4873-a8c0-c872ecee317d", "value": "T159C4336A0D1F7D29796B2CAF094AE89C3E0C6B91245DD724278CFB1B1B7C930979C0D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654860900, "uuid": "6f7aabe3-fae6-435b-8867-bb96105ae9de", "value": "12288:fSYeh7GBII0nFVu5i+kqsoAGD7UVyxznmCXd4MFWVJJVPwR:aYC7GBII557sotPUUxlNjFWjJVPwR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654860900, "uuid": "15ab2286-d161-499b-8474-caca8e05e061", "value": 592778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654860900, "uuid": "d41fea95-fdfb-4edd-9c8a-24cd62929feb", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654860900, "uuid": "ae982f11-a149-4939-85e0-a42c5817be31", "value": "Purchase Order doc.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6f1a79f-e8a2-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1654854636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654854636, "uuid": "9013c160-d03d-4119-9442-bcd8e6e28a36", "comment": "Malware payload (GuLoader)", "value": "8f2787bafdb50c0c477a4a2fa717a474", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654854636, "uuid": "5f370e70-a1eb-40fc-84c1-069b4c1daa69", "comment": "Malware payload (GuLoader)", "value": "e04033093b5bff43ebd263d4441080a18973cff867a6704ead1ceab1cf6f7103", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654854636, "uuid": "9fd09a7f-81b1-42ec-82a0-504690b2dc63", "comment": "Malware payload (GuLoader)", "value": "87bbd89b26185b7202127098d1f80dc2fb63eada", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654854636, "uuid": "7f870412-87e0-4f0c-af6f-5fad8987b701", "comment": "Malware payload (GuLoader)", "value": "e88ffc4cbc7baf15a8ddca939fddec4cbc2758ef9cdf89bb29d89682d40b9de5a562df53856796aa3981d858ced4ad3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654854636, "uuid": "137a4c0c-763e-45d0-8899-f5a037734716", "value": "T12F64E113B9449527C83E8B30C4B7DFA147F2BE116A5E5E2F278437583EB31D39A0A625", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654854636, "uuid": "cc410bd1-81c1-49c3-bdec-984946a03d89", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654854636, "uuid": "d1cccdd5-9a00-484b-b324-32091628981c", "value": "6144:rbE/HUyscQZVfFt4jPvLvvadeJyqGydVlb6T:rbe1QJmjHrvxRvlb6T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654854636, "uuid": "57336337-9075-46f2-b46b-2a5c2d1b1d8c", "value": 324372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654854636, "uuid": "72cbbe1b-6cdc-4269-89cf-a6396acbac2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654854636, "uuid": "307f132b-ccf9-4c4e-a3ca-0782c8765382", "value": "SecuriteInfo.com.Gen.Variant.Nemesis.7975.28991.13809", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "013d50e3-e8d4-11ec-93bb-42010a9c0043", "comment": "Malware payload (njrat)", "timestamp": 1654875779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654875779, "uuid": "1f2ce547-f49b-4be8-b9ad-ced4f71fa1f3", "comment": "Malware payload (njrat)", "value": "8e1ec83741f5ca5e07024841d05ca5d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654875779, "uuid": "df479301-dc92-4f65-989e-f7d5a84175a7", "comment": "Malware payload (njrat)", "value": "e0652f5006eae91054efb1cc8945e3df842fdc93e029518fc9f9e3dee58dd2a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654875779, "uuid": "f2e665cb-e720-41ea-8323-0a5b506bf462", "comment": "Malware payload (njrat)", "value": "bded6b28e2c0574781d533e9578528c8b4340b84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654875779, "uuid": "d0d24781-b322-4857-83a8-c11bbfc9613e", "comment": "Malware payload (njrat)", "value": "012378f6600bf11aaafd13ed29857f542c39050dfa4ce73ddb5c2107699c2bb31dfa5902f3cec6a48c0b496d1067463b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654875779, "uuid": "ee4020bf-e5c9-4f17-9f61-2de1d7e3bd1d", "value": "T17E353391D5B48239F84BADFC1833DA9AA74E630763167937419FC118498DC3E2887CAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654875779, "uuid": "f5af03bb-88bf-4105-ab45-faad2e9ec4cb", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654875779, "uuid": "729ff88f-ae7b-4999-9501-04c5af8a539e", "value": "24576:E9dS20oXi6s9b9ohtgHFGtcwvX4LwmJhggr3tvMl7rAHFSCfJzcZdH:EUoXbs95YztkLwmJhggrJMRMHFIZd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654875779, "uuid": "c7a77724-cb85-4d80-9d8c-f364c2c58335", "value": 1129984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654875779, "uuid": "2f04c8c0-b85c-47a4-9214-dcec77edf39a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654875779, "uuid": "d126f9ad-38c6-4e64-b12e-270491bcf37d", "value": "E0652F5006EAE91054EFB1CC8945E3DF842FDC93E0295.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "909425e1-e891-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654847243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847243, "uuid": "253df36d-375a-4760-b19b-d85cf0bf1313", "comment": "Malware payload (Heodo)", "value": "7296dae526902a45210ac5a6188d3911", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847243, "uuid": "32b0ba8b-29bc-4679-8176-f5b5432c2aec", "comment": "Malware payload (Heodo)", "value": "e0ad5ea028fe3913042444decfc80134ffa87759cdde9075dbd29b2b11c026e3", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847243, "uuid": "c7a4c153-7b36-43b4-b272-0eb1756b7cc9", "comment": "Malware payload (Heodo)", "value": "f8952936453d040da9a62713961d4fff38929fe6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847243, "uuid": "6749621d-06d4-4ba7-8320-3ceb8d3eb2a8", "comment": "Malware payload (Heodo)", "value": "b6b9442145ec9ec78ad2435961edf90603ca2064dfa9c4f10ab9f46ca653616e39f26f9d5f2ba4cb9fde304f149a73af", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847243, "uuid": "33b2a3d0-a665-4b11-94dd-24da293cef4c", "value": "T1CBF4D43EFF51E8E9F8439230814A9170B124BC2D8271797E3648FD64BD72698EB2DE15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847243, "uuid": "a60b81de-c71a-41c5-830f-6a423e4f5e40", "value": "98dfbb430035f9300f4be2418dab914b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847243, "uuid": "3dbed3bc-0430-4352-a708-42ec9e21cbfe", "value": "12288:yFbnmV9v3WtGWt4T/humzyMSoGGbqh2tiDek/bPUkf80pG4:yFbO9v3WtVt4T/huKyMJJbq4Qb/Ikf84", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654847243, "uuid": "080ff11e-bef7-4c6f-8a4e-967f65c25ad0", "value": 743350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654847243, "uuid": "a56eb306-64b1-4d1f-9a11-5afdae8c70eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847243, "uuid": "d40dd53a-d216-47f9-8127-ed4637d48dda", "value": "6kOjfhv5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f09a0755-e8a2-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1654854706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654854706, "uuid": "bf90808e-f6bb-4f76-906b-67091c236084", "comment": "Malware payload (Loki)", "value": "91679b905ca64c35020601fa64cacb93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654854706, "uuid": "152cd313-f94d-47e8-85f9-ef423c4e192d", "comment": "Malware payload (Loki)", "value": "e2716a711f6bb22d2ff77e0da881b24d16b554bc081b6a7d11d23027d4a47670", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654854706, "uuid": "80b3305b-309b-49fe-8c95-1565f4f25417", "comment": "Malware payload (Loki)", "value": "42bdafca9f7f5dc37a9820f746dec937058b9aa2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654854706, "uuid": "faadb122-ee68-4dee-9420-31c62f3bedbb", "comment": "Malware payload (Loki)", "value": "96fd98f43afb18381e9798cd6920b1787d40cb82c861cbee46cf4968749bb4d08d47655ce140ae9537a6155c22891844", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654854706, "uuid": "00859559-582c-4772-92b9-9119f207903f", "value": "T144D4E05A7609A54EC40B8633C9DA1D1497A29D87272BD70B7587328D8E0F3EFCE0A1D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654854706, "uuid": "303f118b-cd39-4664-a981-d705a5166474", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654854706, "uuid": "f8f5b8b7-05ed-4342-b562-7f3e67718b86", "value": "12288:kfc2e7F1l2D9qE+Y/2AgqaSnX9xZjwzfUit3a4:6B++gvyzZEwitK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654854706, "uuid": "f19f48ef-b707-4c73-bebb-06ceeef2ae6d", "value": 604160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654854706, "uuid": "6e2070a8-6696-4579-895b-d6c72ec69ca3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654854706, "uuid": "587254fb-ab4d-4948-afe0-555c7d84150b", "value": "Payment Slip copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97d9aaa1-e8a0-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654853698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654853698, "uuid": "cdc6bced-4c3c-4808-a167-85507e65c0da", "comment": "Malware payload (Mirai)", "value": "5d65ea62a9c59b5f69152c559e56f65e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654853698, "uuid": "4530b767-b906-4880-b7dc-4197fb08f85f", "comment": "Malware payload (Mirai)", "value": "e3b6ae965b59d809155d5400b55c22fbbf25f28eb4b0b6c0a27da5798a48b746", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654853698, "uuid": "e653158f-4f08-4620-8445-fdb32cbb5538", "comment": "Malware payload (Mirai)", "value": "c3d1482f70308a9256c7fa8232f3a4a3da5c4324", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654853698, "uuid": "a8b12818-cce1-4fbc-bd0b-04cf89f38e57", "comment": "Malware payload (Mirai)", "value": "864d3234deb44c6f14972028e2b75e8544124a255836e12475bd2c47e76b71bb821dc703d5fc712c1b6cc32abf6a77f4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654853698, "uuid": "4a53b157-140d-497f-b20d-145db592190a", "value": "T125732A02B6694A47F4471DB02E3F1FE153AEEED122F5B2C5794FDA0A8275D32104AE9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654853698, "uuid": "383b0a17-ec77-4af9-8e59-c121328728d6", "value": "768:Uayb3IClU2FeSXIFGXSRqGSUktWEdcdeTKKl4MbGHFfH+p38r7CrQDrVBpMh+Agh:qpl/IfjAWk8345i2p38SOIN+RGIybXXK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654853698, "uuid": "e221a4f3-8d01-472c-ba21-754ca7d29083", "value": 76492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654853698, "uuid": "ad9019e3-f8b0-4513-95cb-1ff089096af4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654853698, "uuid": "62898d6b-e374-4594-822d-8d62db60382d", "value": "5d65ea62a9c59b5f69152c559e56f65e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8e2ff84-e8e8-11ec-93bb-42010a9c0043", "comment": "Malware payload (njrat)", "timestamp": 1654884757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654884757, "uuid": "be9b1819-3a64-4ef7-8641-197e504d5f16", "comment": "Malware payload (njrat)", "value": "311dd29e19b6777c6d3443ad1571c7a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654884757, "uuid": "27d59343-bd2f-4477-9d19-0ac567337952", "comment": "Malware payload (njrat)", "value": "e3c8e66188c83c50326a1fee642e7b80d2a1ef4e624e1a8738a468a9695d3717", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654884757, "uuid": "d99b5b51-0ac9-4b84-8a1b-fca3ef6d6b97", "comment": "Malware payload (njrat)", "value": "95db552d4949714221295ff7fb0ee8b1d5806850", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654884757, "uuid": "fd62bb02-0cc7-4cc8-bf51-428fe9ad8649", "comment": "Malware payload (njrat)", "value": "c69ead643086abbf4fe9a8b74c30b0250c6872638caf27bc19918aa5ac9f62f637e6278fc08e73f742885dbceb8b289e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654884757, "uuid": "d905d85c-1eb8-4468-9302-47486084eb45", "value": "T13E032A4D7FE18168C5FD057B06B2D41207BAE04F6E23D91E8EF564AA37632C08B54AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654884757, "uuid": "7905da2f-4683-4c66-988c-c2094a522cf8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654884757, "uuid": "1c407d11-bc13-4346-87ee-c5d544ce6bfa", "value": "384:KI0KMizdNjnBhFbJ8ycPlXP/3w6EWjrAF+rMRTyN/0L+EcoinblneHQM3epzXhNA:R0gNlLJfcPlX31EQrM+rMRa8NufOft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654884757, "uuid": "81874ff6-6b52-48b7-b5f2-a4073f0b8421", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654884757, "uuid": "7383ef25-b188-4f23-93fa-4b8820b29a7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654884757, "uuid": "be8a8be1-106f-4230-b6a2-05178c08585a", "value": "311dd29e19b6777c6d3443ad1571c7a6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8a74896-e902-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654895843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654895843, "uuid": "d90e798b-b52c-4f74-8b9b-76594c44c512", "comment": "Malware payload (Mirai)", "value": "8a66eaaf6f04014c531c6ad188f5c807", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654895843, "uuid": "43820921-462a-4c18-a6b1-b5c96ea1552a", "comment": "Malware payload (Mirai)", "value": "e5ce6ece058b08bc0f73116db67bfdeea893131dea6d4c7539ac8ce465ce27cb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654895843, "uuid": "ea6fb999-644f-450a-b287-2da9a877f176", "comment": "Malware payload (Mirai)", "value": "45ab543ab79ae9257d7eca11500111a22b161bd7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654895843, "uuid": "778a3bf0-9202-4965-a7d3-6e6c7221f880", "comment": "Malware payload (Mirai)", "value": "a458fc92bdeb7ebea45b6a84d2f5e2a9fdc01f077d86ff4f7f08f982c0321470d78987cfb02c1544f631640ac5244187", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654895843, "uuid": "a9a028d7-a3cb-4eff-a4bb-4072cf251a3a", "value": "T168539E68D4B5AE98CE524274BA14CD390B239484A1D33EF7D65583B2A05BAFCB815FF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654895843, "uuid": "39bce42e-8638-486d-81e5-5f1efd371ea1", "value": "1536:jawILaNLiaVKosjxVp+xwLbI3mv+bPbQ938FCHuE6:jvILaNLiaexVpDLe+KQ938FLr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654895843, "uuid": "8cf58787-0999-4e54-b079-af594b99b629", "value": 64176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654895843, "uuid": "f8704d20-f930-4ec6-9c5e-71bae5727a59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654895843, "uuid": "89715d9a-5efb-4e24-b608-9b386d3ab7e2", "value": "8a66eaaf6f04014c531c6ad188f5c807", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f98e6634-e87f-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654839688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654839688, "uuid": "2aef92be-598c-4f7a-9019-af6bacb4e3d9", "comment": "Malware payload (AgentTesla)", "value": "3ff4e43d782270103ce1c3fcee337ca8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654839688, "uuid": "65cf980c-07d9-4148-b86b-5c57727ceb6a", "comment": "Malware payload (AgentTesla)", "value": "e78f84e434722b0640aebab530c3d978e8777e5a8ec9dd71da53dd87f6e71e5c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654839688, "uuid": "53cdfb0a-4e68-4ee1-8a55-e63d097896fa", "comment": "Malware payload (AgentTesla)", "value": "3db45ec07fd7e18e9cb12a008ff739c9e3d0b484", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654839688, "uuid": "73774d06-0ba7-4710-9e4e-32d7aa985804", "comment": "Malware payload (AgentTesla)", "value": "a082427e29f6540bcc6cd4cbbfef278dbeafbceeae4182fd198245be0f17f3476359ff2281dab55325110e4e1b660080", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654839688, "uuid": "601daeae-cc38-4532-9019-c6662010fd78", "value": "T11273A214B293D567D0665E338DEAC6EC3731FC01AD65831B3085737E2EBAA90CE52792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654839688, "uuid": "f4422014-21ac-43d3-9955-3b39301463ec", "value": "768:j71i20mqnFzdJdwpPd+vR0XBZkUTsyz80cjo:nEoqnFdzwpPd+Gsksyz88", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654839688, "uuid": "a18b723b-c8c8-4fbb-84c4-e0d17f1821d0", "value": 79872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654839688, "uuid": "21394229-d3e0-46d0-9386-0d6412501c0d", "value": "application/vnd.ms-powerpoint", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654839688, "uuid": "5bf2ef7b-f4b9-42b4-9af5-38dedce03deb", "value": "Swift Copy_MT103_pdf.ppa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41f294bb-e8e6-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654883618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654883618, "uuid": "6191ea2d-0771-499b-9012-62f7aa6efbdc", "comment": "Malware payload", "value": "5dabe12587fe8a00defe796fbc10f44d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654883618, "uuid": "29975b4b-31ba-4f01-bd50-45b9bf1f4bf9", "comment": "Malware payload", "value": "e7bebacfd1f9b8da56abd31cdae5be1fd29246d2761439cb8a07993e0d16441c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654883618, "uuid": "91dcbf35-9d5d-4b4e-b34e-c19c2e981ec1", "comment": "Malware payload", "value": "3eabb5ac2f1c55fc6c6cb52c8f275e2b3173c940", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654883618, "uuid": "7ee34bff-8d2a-4834-baa0-78ca98047413", "comment": "Malware payload", "value": "566f76a0101e0fd5e1abd2f7acbe54c3bb9888d8dac8c17c877d6a4dbfc3d1c6a272efbf3c7441462fd478d29b68a2e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654883618, "uuid": "a9a46715-1c8c-4cde-9b5f-c0b6ebf9e1f4", "value": "T1AE23F143E6C979EAE068A0785C5F2C646FCCD73972D08375F8D1377A6EA0A070B2D619", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654883618, "uuid": "4140dfdf-9518-4fe3-8544-23a55dd5e2a7", "value": "a50e815adb2cfe3e58d388c791946db8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654883618, "uuid": "68f40823-24ec-49f2-a214-259f82381159", "value": "768:Upm7BcEKNvBcvL6VeRNL1a6ZO4PTPz+o+CKr3zQ4NuVVWgP4+zCM2zrIZrnbcuyW:UpfEKNCj6VoJl9Go5K7s4Nu3oanouy8d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654883618, "uuid": "b84af04f-8c0b-46af-aa21-cb51db4561f6", "value": 49152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654883618, "uuid": "50740135-c556-4d34-9a75-fffb2750e465", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654883618, "uuid": "1613dd7d-0dbc-4a3a-8269-a05e715a6169", "value": "DumpedB64Str-B64Decoded.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba50271e-e895-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654849031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849031, "uuid": "aa251ef5-7cf9-490e-8fcb-1eb254e725b5", "comment": "Malware payload (Heodo)", "value": "b1557fd67782e655074949804589a1f8", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849031, "uuid": "36b6723e-fd28-41e3-ad7d-842854e5576b", "comment": "Malware payload (Heodo)", "value": "e7c624571c71db0836fca922f2bb495176de65e03fea2e4434778a6de65512b6", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849031, "uuid": "91bf26a0-3f32-4b20-9976-d0a9e698dfa7", "comment": "Malware payload (Heodo)", "value": "b025ba8181a41db0678c4cbad0102b97d26b9f4e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849031, "uuid": "6bb9a883-fc08-45ed-bf08-ad1a520ac112", "comment": "Malware payload (Heodo)", "value": "c796ac042de529f077d945dffb2486616726472d04e1fe6a4abeb8911b7200dec2a24bf77fafc36a9b72812e5254dfe5", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849031, "uuid": "491169d4-6631-4fc8-852d-79359eff5d1c", "value": "T177F4D42FFF51E8E9F9439234814A9570B124BC1C8271797E3248FE60BD72698EB2DE15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849031, "uuid": "34e16ea6-91e4-473f-bbb4-796c856a5080", "value": "98dfbb430035f9300f4be2418dab914b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849031, "uuid": "1e7973a5-b087-41e6-b5e1-45b14db2fb1c", "value": "12288:LFbnmV9v3WtGWt4T/homzyMSoGGUmuDqkRFuEEqp+V+kf80pG4:LFbO9v3WtVt4T/hoKyMJJUBDqysY+0k1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654849031, "uuid": "6bdf05e4-6bc6-4e84-8539-fae928b62fc6", "value": 747446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654849031, "uuid": "242adad6-12db-4257-951b-b9d8bbd587c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849031, "uuid": "80ba54db-3016-41cc-9b9d-2fce4f3d9cbe", "value": "Q4OBZFQPVY.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57233042-e8cb-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654872057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654872057, "uuid": "f37ecc46-2d64-4532-ae35-1fae1e6097e9", "comment": "Malware payload (Heodo)", "value": "9d12cfa5c3cf226de6a99f1d10d6865c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654872057, "uuid": "d3339c5e-40d3-431c-8dfc-8c5271d44d57", "comment": "Malware payload (Heodo)", "value": "e7e0b14a60ad3f82e8eae1411c6426c1d930445138c56065a1486d0ef9ca7b00", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654872057, "uuid": "d50a8f1b-784f-4ee2-aa41-6fafba4aa7f8", "comment": "Malware payload (Heodo)", "value": "88e99c782f031b871905986f2542b9bf9c0b5e2b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654872057, "uuid": "ad6fa809-3c7f-4134-979e-b5b086742691", "comment": "Malware payload (Heodo)", "value": "da84feaf74a8692a0f91fb58c94fa1a540c058be86e0639afd3fc231a67c2ea6dc901954717666effe8189269a6db24b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654872057, "uuid": "fb3c74c7-192f-45db-89fc-3f2603d1ed6d", "value": "T14DB4140573F43066D46B4D3C859E190FE7E67A074BB5D1CA239082AE3BB364279B9F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654872057, "uuid": "d35a90e2-869e-4b79-aeeb-c095fe549c2e", "value": "b71031ac72c27db547b44e7ae017554b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654872057, "uuid": "9d39593f-26ac-4559-8daa-50dab3d82c7a", "value": "6144:TkzytaJpnASmmaNGQ7DYMT1atZNtpTKIEHzRLAcKhIepZn6kdRphRUQP7LwW1:oytafAS/aNPwHbNcKeep5h/uQgW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654872057, "uuid": "5fdda700-fbb6-49af-87e8-d5f654f94258", "value": 504320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654872057, "uuid": "afca31de-72c7-4255-bf60-fd1eadc629d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654872057, "uuid": "e7a6729e-0082-4157-a594-4386a0d220ee", "value": "9d12cfa5c3cf226de6a99f1d10d6865c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba33af16-e89b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654851608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654851608, "uuid": "c3b473be-a94b-46fd-b2aa-9b5b93106ad4", "comment": "Malware payload (Mirai)", "value": "bda5a5016bac3cebc0d7fd3446557849", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654851608, "uuid": "6f8d4811-feab-43d4-8cf5-fb225e51274b", "comment": "Malware payload (Mirai)", "value": "e8b8e6f2b3787d127bf59d67826fbc8583e293cf3f4ad209d1bc32c995b5b595", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654851608, "uuid": "2cc7b1ec-e0a3-474c-ac80-dccad31beff1", "comment": "Malware payload (Mirai)", "value": "11bc9df225af0691b09cef00c5831d1155b2e79a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654851608, "uuid": "472084b1-8b29-4001-a693-85c28195cefb", "comment": "Malware payload (Mirai)", "value": "184e024ddd226d05e5153d91876a32bffa9b8574225494bd8a618aa26064fedd20a2e9741092ab998c141c37f54b5504", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654851608, "uuid": "fbfd4ac4-390a-4f2c-9018-abee9a5b4342", "value": "T16BE35B46FA818B13C4D527B7BA9F42493322A758D3DB33068D186FB43FC669E4E67105", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654851608, "uuid": "26ca00b7-e2f9-4b71-b9c1-4b49ebf1937a", "value": "3072:qjFk0ex43LPKgpe1ue4kECklTEez4RlfKfpbqQk/7o4TM/9HcGxcDdF9:qjFk0egRsyTRz4RlfKBbo7oEM/9RI9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654851608, "uuid": "24c49b51-9084-4a87-b713-93a7202e7d10", "value": 153720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654851608, "uuid": "cbf6d183-ed0d-480e-b139-46fa842c70ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654851608, "uuid": "52ad4d15-1f05-4e68-aa70-55e80e686bc6", "value": "apep.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfa7d31c-e8c3-11ec-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1654868851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654868851, "uuid": "ea8315dc-80d7-4c8d-b17e-d9223cf619f0", "comment": "Malware payload (RemcosRAT)", "value": "c3310a7b94acc181e08f0419c7bbd827", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654868851, "uuid": "58735471-2aaf-4f2b-81b3-d5492d18f32b", "comment": "Malware payload (RemcosRAT)", "value": "e9c44a24d73e15b4e10c7dc45524bbc711ca1ba72981d3b09a53e37c4c76fc8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654868851, "uuid": "fb994a1f-f6e9-4182-8dc0-1c23f5568a5b", "comment": "Malware payload (RemcosRAT)", "value": "aed79ea6687dc8a9ca68ddb982e4ddd6154a26e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654868851, "uuid": "55da4752-cfa1-4a59-9dbb-5b9c81f809b4", "comment": "Malware payload (RemcosRAT)", "value": "621a0a82344b5fc2769a51153e280e5a53c65c52084ae48c706ba39bb5c0d35224b33f48496017e5ec4dc7dab8a0d241", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654868851, "uuid": "c066c300-0bc8-453d-9c19-25621ac20a5c", "value": "T1C025E190A6D190A7CDE85E377A1BEE304F127EFCA118856532DC3D9F74FAAB31144292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654868851, "uuid": "502c21f2-d427-4777-9522-7bf392706f19", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654868851, "uuid": "79f0007d-3a75-4f7d-993a-47dc9946643d", "value": "24576:JY3MMMMMMMMMMMuMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMr:23MMMMMMMMMMMuMMMMMMMMMMMMMMMMMm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654868851, "uuid": "e323b674-c4f0-4512-b171-83a08db0e1d6", "value": 1010877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654868851, "uuid": "e71ff49e-3cb5-4ba0-80af-f3a56d0fcc05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654868851, "uuid": "93836fef-645a-422c-a8f4-54305d72c5f6", "value": "PT. Meidoh - RFQ_PRODUCTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc786b87-e895-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654849035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849035, "uuid": "7a055e1e-c23e-457c-8841-b2cc71dc940a", "comment": "Malware payload (Heodo)", "value": "2baa26ff5b5c1e668b62310a412ca1ce", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849035, "uuid": "bffa010e-8154-427c-8524-4433748f7388", "comment": "Malware payload (Heodo)", "value": "eb5cb146a9803546c06f37f2b0479f9fe3ae3b4b965e3585d5e567a241f35cb5", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849035, "uuid": "29553b66-4ce4-4254-be12-86634f36c32f", "comment": "Malware payload (Heodo)", "value": "9103a6558bf3cc8c5f77cc381239101380d93da4", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849035, "uuid": "cc511906-6974-4e9d-8078-099698d2bf9d", "comment": "Malware payload (Heodo)", "value": "268c8a894bf4457ef59d167badec605907035067c2b3115424588475315cc4048e9e0b8cef485576919c9da39d2877d2", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849035, "uuid": "ebd99dd7-7865-42db-b3e6-654d07f532a6", "value": "T1C1F4D42FFF51E8E9F9439234814A9570B124BC1C8271797E3248FE60BD72698EB2DE15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849035, "uuid": "ef8b360c-38c0-4a35-b3d6-dbd464c38203", "value": "98dfbb430035f9300f4be2418dab914b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849035, "uuid": "dd2d2ce2-154a-4d66-8c54-707b67657f54", "value": "12288:LFbnmV9v3WtGWt4T/homzyMSoGGZmuDqkRFuEEqp+V+kf80pG4:LFbO9v3WtVt4T/hoKyMJJZBDqysY+0k1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654849035, "uuid": "a74dae13-c588-45ef-af38-cfc80767a0ad", "value": 747446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654849035, "uuid": "4bb54ef6-5583-44b8-91de-65f13cd97d3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849035, "uuid": "8c0bf5ba-c22e-4576-a77b-58a5dc01b7b0", "value": "YtjK.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11d977f4-e868-11ec-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1654829421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654829421, "uuid": "ad24f656-8dbe-44b3-8068-5ae9df21fe8d", "comment": "Malware payload (AsyncRAT)", "value": "bafd06402af7598fff2b1261e5bf4623", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654829421, "uuid": "b99733e3-a75f-489f-8c75-cd268b78f3cf", "comment": "Malware payload (AsyncRAT)", "value": "ec9b999f8c8dcf73e5de8e8d1266d51f5cd832607cf385f5665da697b5125008", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654829421, "uuid": "64b4fc4f-a08f-4abf-893d-34383e8d4c9e", "comment": "Malware payload (AsyncRAT)", "value": "4b8da7bebc7e23ee15267dd3162119d7b4fabb23", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654829421, "uuid": "d67c1ec7-df76-48ec-97bb-eb3047eef756", "comment": "Malware payload (AsyncRAT)", "value": "6dbeb89be76b9798ac4e2d05d49b702da6572ae15e6b277e98c359dd13974c3cee809814200007ffef582e8b404e00af", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654829421, "uuid": "7f801483-4a84-4393-8f11-b5f6f919975a", "value": "T13C232B003BE9C12BF2BE5F7898F26145467AF6632603D54E2CC441DB5623FC69A42AFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654829421, "uuid": "786bfb45-dc32-4e4f-8f53-f150f79e5299", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654829421, "uuid": "9069bbd9-74ea-4d4f-a2c3-de31c3f17892", "value": "768:/uwCfTg46YbWUn8jjmo2qrzIDTiAAAAbOPIjzjbwgj3iYkauP82isBDZix:/uwCfTgp/2MV3j3b3jSY1uk2vdix", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654829421, "uuid": "9ff04d83-971d-4c66-9094-362c5df0ae92", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654829421, "uuid": "a23476aa-37a8-4679-906d-6fcb5bd51d52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654829421, "uuid": "8c210b09-2117-4f1c-95a4-e63e342004e6", "value": "bafd06402af7598fff2b1261e5bf4623", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b5f7ef9-e8ae-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654859475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654859475, "uuid": "6279c683-3386-4871-b7e4-551ec9a04824", "comment": "Malware payload (Formbook)", "value": "9bba6ccbcedc51921dfadf960bf0ac5e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654859475, "uuid": "2da3b36e-f176-497d-8769-e0512f11d27c", "comment": "Malware payload (Formbook)", "value": "ee925720846115b5138f5e1b612b653c8cc912243561d2d3fc750da09b05fb41", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654859475, "uuid": "57025642-ade3-48a3-8d50-8d1148dc8026", "comment": "Malware payload (Formbook)", "value": "4fb56041fedccc62c5f7c09e8711a5697c1a06b8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654859475, "uuid": "c1e2f0ed-7205-4ddb-86f5-91fef7bae5f9", "comment": "Malware payload (Formbook)", "value": "ecbce4162403c60046cbe87e52e71a5f714133d9f8329277cc940a9fdb4713f28f38949add6c5a88d25774199e70ed32", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654859475, "uuid": "eaa3b228-fb90-4ecc-b461-705a402c93cb", "value": "T1AA34123324E229F7D283853245B277FAF77A619A53232A414B280F7DAD72AD7061E1D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654859475, "uuid": "bd7d46c5-becf-4341-b07f-d0f6e9f81624", "value": "55f3dfd13c0557d3e32bcbc604441dd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654859475, "uuid": "117cfbad-37f1-4de7-b35a-052ea8021677", "value": "6144:qGEFYFAOC5wYMXBZ3L2Q26PCZsJmsdUDc1ep4vK/L:CjPzwRPmLI1i4qL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654859475, "uuid": "f62c0a50-5230-46e7-9d30-cabc2acb29dc", "value": 238595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654859475, "uuid": "12b23cb4-76a0-4a1b-88ff-4fc17ee0be78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654859475, "uuid": "96491ce9-d70f-493c-a92a-228aff4d5aec", "value": "9bba6ccbcedc51921dfadf960bf0ac5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12cb6403-e911-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654902008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654902008, "uuid": "f975f059-2082-4acd-960e-ea2ec1212e65", "comment": "Malware payload", "value": "153167ff7fd884720219bc140c53925f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654902008, "uuid": "8ce3029d-8b98-4b18-998b-3a9353e92b28", "comment": "Malware payload", "value": "ee970a6dc94173ab3002ed36a46ee58910061222b0e7e135776e7815fc5c403a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654902008, "uuid": "1caaa4ee-0a13-46f3-943c-c9d33a27366f", "comment": "Malware payload", "value": "a79153cc0dc34efb1273d9908cb8bc52dabfec22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654902008, "uuid": "7a7ce1f0-475c-41f1-82cd-be84aff58690", "comment": "Malware payload", "value": "8faa4c57914104f35c17dc0d1c7e5db671801eadef410809bcfe38e4b2f6d1a86fc0fe41abaa2a24edeaa66fdb363dce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654902008, "uuid": "12689fe6-9fa3-4014-851e-c346d0b5d18d", "value": "T160B4140573F43066D46B4D3C859E1A0FE7E67A074BB5D1CA239082AE3BB364279B9F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654902008, "uuid": "2fd7e09c-7909-495d-8dc1-23518107fcf2", "value": "b71031ac72c27db547b44e7ae017554b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654902008, "uuid": "2136dbf1-0068-4d18-ae14-8f7aec2ee610", "value": "6144:TkzytaJpnASmmaNGQ7DYMT1atZNtpTKIEHzmLAcKhIepZn6kdRphRUQP7LwW1:oytafAS/aNPwHbCcKeep5h/uQgW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654902008, "uuid": "5354e027-f51a-4c6b-80dc-177fd5133f29", "value": 504320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654902008, "uuid": "6b27c35a-8c4e-4f81-ad79-5f93fa4bd9ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654902008, "uuid": "d4f0e982-3407-4511-87ab-87ef9afc6a13", "value": "153167ff7fd884720219bc140c53925f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c8ae2dd-e8d5-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654876361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654876361, "uuid": "c859e245-0ab9-41dc-89e3-468294ca5717", "comment": "Malware payload (Formbook)", "value": "764593ffcba7ff6547d6aa75425f62ee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654876361, "uuid": "bd449f22-d52d-47d1-8c5c-f2a160b872b4", "comment": "Malware payload (Formbook)", "value": "eeb925601fdf3c1d3155c01e836017ee29a9b1342b5c4d084839424aaee41a6a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654876361, "uuid": "d4603890-70ac-460b-9b52-dedaee3d496d", "comment": "Malware payload (Formbook)", "value": "35b5ec52c484482566bd0a58e1de5c7c60420c3e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654876361, "uuid": "497a6c95-7b98-40fa-82c0-fa40760fc4a1", "comment": "Malware payload (Formbook)", "value": "cc0ed94f457adde51e10c808b40281ada7bd434abb74dcdbeac45ff7cca2bf1bcb568df6475e892dfa1604902fcac5ff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654876361, "uuid": "9643933c-b5b4-414a-9a61-c66c9a1e3f28", "value": "T1F3F40128326C16A8C76A87761576C210533D3A16E62ED70D79E3B4CD1CF37814B1ABEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654876361, "uuid": "510e8071-ace9-47a4-8e46-e2ca81b06eda", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654876361, "uuid": "dbd1ab7a-04ed-4fa3-8c9f-c46c98931d3c", "value": "12288:7I6SIcd1Aa47x5+QURK0T2rxF7QQGMVuLQrGEtONqN8ab0lPzORuO5P5Jzz2qYgt:8z097xkQsK06rxp/VmEcNiaaR/FHS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654876361, "uuid": "1f4bd7df-c2af-47c0-af92-22559da97576", "value": 754688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654876361, "uuid": "61027375-46b1-4def-bb9a-2bf21b993563", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654876361, "uuid": "da3f7f21-05fe-48db-8ab6-cf18d9360867", "value": "764593ffcba7ff6547d6aa75425f62ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8955b662-e860-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654826186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654826186, "uuid": "4fbfa82c-4474-4b73-8c83-f40ec068fcde", "comment": "Malware payload (AgentTesla)", "value": "2ee420bce87603829fe7ee3268a8461e", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654826186, "uuid": "786104b5-75cf-498f-bf5e-cfc4632c51ee", "comment": "Malware payload (AgentTesla)", "value": "f148ae9882394ba9914ad7938329261f9b575e4dd613b347ca9b4b006e7ecd49", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654826186, "uuid": "f3611c66-3a15-4e0d-90c0-77e1511b2992", "comment": "Malware payload (AgentTesla)", "value": "b4b4a08f8ad285e91a1940a70db3d030c54674e2", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654826186, "uuid": "71482c4a-8bdd-4ed1-91e8-99fee4fdfac4", "comment": "Malware payload (AgentTesla)", "value": "7fb3d3fea50744f9235b700955a835f7d57fcdfb527910c0d30b55fb9c419fd81c4b5949342ed2894cb50f53180310cc", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654826186, "uuid": "718a0bb8-d368-4896-a246-fbe93df70fb2", "value": "T1E47423572C678F172040B956A25FC76E5631F15B3822E28E214D9CB3ECFB39505AEE13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654826186, "uuid": "f85e1f7a-07ba-47f9-b223-d0e55d4d5c99", "value": "6144:fX+nWeUD6xsxFXoCjr0xycfhrKqh6oqD/NyZ+ZXohcRZ0fKKGU3tu+/ZyT6QFH:v+WeUuiX9cx/fxfh6hD/AAXz0fCU9u+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654826186, "uuid": "d84b8959-fc87-4b7f-8a2d-716eb7242563", "value": 360109, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654826186, "uuid": "7ba1b400-da1d-4135-83f6-91b02a64fbae", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654826186, "uuid": "61046a0a-6998-4c26-80a2-048e2f0589a3", "value": "DDC payment.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "535719e3-e8aa-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654857878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857878, "uuid": "0147453a-5bd1-49da-a683-951cf27f2344", "comment": "Malware payload (Mirai)", "value": "71ebf2fe1c451f5b72493cfe35c84a20", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857878, "uuid": "3098cf53-cf08-449d-9cd7-06a14ecf8afe", "comment": "Malware payload (Mirai)", "value": "f171d37d08211b13ab3c115ae1b154af93ba107dccfcf68f561ca480fc0c9c82", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857878, "uuid": "4e12065b-295a-489e-b913-2f5de96ed4db", "comment": "Malware payload (Mirai)", "value": "ee7c1fe49b9a3690925bb3c5355a07767c966a7c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654857878, "uuid": "66fb7124-28ec-4e09-b1a0-dcffe8e3d86c", "comment": "Malware payload (Mirai)", "value": "04d6d5742efdea85147fb945b32c4098417ce62f708b94e5b1be2b15e50491cac54457eeada328056d8b99fdc7f6fa2f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857878, "uuid": "6cc68365-7fc2-426b-8d06-8e153d81fc84", "value": "T1C1F2F13AC0898397DDB2513523AD0FE21C121B07EC66FD7DA5887E934541336B253ADB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857878, "uuid": "f696159e-2271-4b65-981f-4140d8434968", "value": "768:L4NHucPbtquKSaX6nFVxqIUYNfEOI45uDIy3iJgGlzDpuW4:cNHucEQlnFVLUDOI6uWVEW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654857878, "uuid": "1830ffc1-41e8-41ac-8422-909a1b0fe68a", "value": 37116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654857878, "uuid": "9cd0793f-b70e-4c31-8b44-88b4b0b4ea9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654857878, "uuid": "78a9b1d6-9ccf-4645-ab9a-2cf9887d7a1f", "value": "71ebf2fe1c451f5b72493cfe35c84a20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cef7da99-e8a5-11ec-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1654855938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654855938, "uuid": "5c9ea6de-8e43-43d4-b67c-f68e6e52437f", "comment": "Malware payload (AsyncRAT)", "value": "705cbf22c26185fd553cf3f8a16cc431", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654855938, "uuid": "a0d4edb7-1e3c-4ea3-a5a0-d004f80a5f6e", "comment": "Malware payload (AsyncRAT)", "value": "f2af7880140f73ea795fd7a090d47f57fdf838af8b149a7dc8373582a213f361", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654855938, "uuid": "60aae179-ca34-447d-911f-9f7d7782abca", "comment": "Malware payload (AsyncRAT)", "value": "480a1186359a7b0ec7e1e17f2a1f2c6d1922a9a4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654855938, "uuid": "f8dab3a8-59b1-4880-a525-d86c42a1f950", "comment": "Malware payload (AsyncRAT)", "value": "b76fba202acfac8e9dcea48dafe2848ee7241553b495f378a53506258e67846f335106d0b6887c0bb010324db8889dd5", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654855938, "uuid": "d987a1a8-960d-4a81-9299-9e97b0daeef1", "value": "T195C4D01A7655EA8EC0468A33C5D61C1053A29EA3572BE34B70C7339E9D1F7EFCE09186", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654855938, "uuid": "429f0460-4ed0-4311-999a-6b72bf700344", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654855938, "uuid": "6e58ff35-3426-4a61-bf4f-bb3b5477ce44", "value": "12288:vbm8bOsp9qt/T1NrY3SyEXY8u96Sgt1T+gW3udQtpAQHO:te7Uiyb96SW9m3x33H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654855938, "uuid": "cead5dbe-b47b-4cd9-8c47-b0b769267d01", "value": 548352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654855938, "uuid": "26eaca63-67ee-431c-9c0b-1a5944edfbf0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654855938, "uuid": "04cc0b8b-aa05-40f7-9fa5-43b08a586e4b", "value": "hesaphareketi-01,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0768868-e898-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654850276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654850276, "uuid": "51dfac43-db4e-4800-bea6-501604180661", "comment": "Malware payload (Heodo)", "value": "003bac949090cd5f06c603fe11eb3fb7", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654850276, "uuid": "23d75095-a3fb-4a9d-a848-164d74ce0f15", "comment": "Malware payload (Heodo)", "value": "f35a6b822b1cd88cd25db29768dc0621b9a957906397f97eb0168f73c08c462c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654850276, "uuid": "92069ee3-52a9-4a14-9aec-b645bc9ddce4", "comment": "Malware payload (Heodo)", "value": "f65aaea886dc05e4e1eb576ba3eab014ee995e6f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654850276, "uuid": "17a1dc7c-3168-41e8-8395-22983a6b6b24", "comment": "Malware payload (Heodo)", "value": "d0f2fc0d9cba59a9d695462e10a78b34b6558228070a7a6988a002c0c64da6ef525c6592c6b38b571cc134568db226f6", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654850276, "uuid": "7642efb6-fbc9-4629-81ee-6e237f304f81", "value": "T1A504026DD14C06DDD611137CACE90F3392FCF980A0262B5BBB70A6774BA4B96DB5B900", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654850276, "uuid": "1f8297c4-791c-41bc-baec-fc431d3aedb9", "value": "70e266113c1f28d1a5ed37642718e2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654850276, "uuid": "fc0b97b7-74bb-4a81-a509-4724ce8a224b", "value": "3072:rpjfRFcO4J8FYMh1PAzu8GmeR8dk5pL/rRn/02QBgjVcoe5Uy5i6zNL4ZNgzPKcQ:rRJWW6u8QKkXzN/09gjV/eey5/NsAziz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654850276, "uuid": "b8f2c66c-3e51-42b7-9108-4584f374bafc", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654850276, "uuid": "1233cb2c-fc90-4ad7-8fc8-e312df25205b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654850276, "uuid": "290d35ef-622d-4d5c-8e69-1773c67f1300", "value": "003bac949090cd5f06c603fe11eb3fb7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acd44296-e8de-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654880362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654880362, "uuid": "5e22e0b2-b991-41d6-82a6-88ff1227a5f7", "comment": "Malware payload", "value": "9cf1ab7d03daf5d63134bc8efc0934b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654880362, "uuid": "f2facf50-9e76-4ed4-8680-2237e2e733dc", "comment": "Malware payload", "value": "f37a76c03f173f5d8a17e890fd2057bad39643e69e68ce9794d597e4540245bd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654880362, "uuid": "f3f95235-ce78-4a74-9670-9673269ae2fe", "comment": "Malware payload", "value": "78c36d4d382e3ca72bc856258e765b3ba2645430", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654880362, "uuid": "6c28143b-f38f-48c3-a226-dbd400fc1862", "comment": "Malware payload", "value": "eb1158264ddcba9dd2164a389b5f16b2b9979278c6436e51fbb5bdb3b14e5592fd5267c2235b32147bb5ea05f51b23aa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654880362, "uuid": "71cc66c4-029d-4dc3-8c85-43a7faa8a83d", "value": "T130933E8A7F903FBFD81ECC3341A4DA06129C990962A57FB66F78E408B64711E59D3C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654880362, "uuid": "cd13b5d0-5bd6-4eb9-aa99-6213bf32a9b4", "value": "768:POZomzuAApJI7TCkajHtvorDG9EQ29UTLHCLbDrcnk9bAb+PsEl3d:pmzHAxjHlo/G9E9RbDrmAkb+PsEl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654880362, "uuid": "dbd83cf1-f71f-4540-ac2c-3fa6fa2741e6", "value": 92572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654880362, "uuid": "8c78fb12-7dcc-409e-bf14-0e06f8ed229a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654880362, "uuid": "43cdbcd5-aec1-42df-938e-bf07dd860a28", "value": "9cf1ab7d03daf5d63134bc8efc0934b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddde8e14-e8a0-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654853815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654853815, "uuid": "1e7f6521-d947-40f7-81f4-d826bf0dadd1", "comment": "Malware payload (Mirai)", "value": "c17655749551a21fb2ca3b6bc5879662", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654853815, "uuid": "cd44d397-3565-4f50-8708-83b1d8b206af", "comment": "Malware payload (Mirai)", "value": "f38741cb74edb85375ba7a450b75e33aaea7ee46cb11e7c505cea5344a30b3a6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654853815, "uuid": "32ddd1c9-5375-4fc1-9cb6-4eda5391ee4c", "comment": "Malware payload (Mirai)", "value": "9a0138ead8836017194d52c3294aea99a052e549", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654853815, "uuid": "5d7b7e88-a277-4ece-82d7-5a4de96ea5ee", "comment": "Malware payload (Mirai)", "value": "b97bf8d9254a8dd09394a7a574feafda0a9cee57d00a566e5c9d129dc4a4efd4f9d848d9d391021f186d76e9c9ec6fd4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654853815, "uuid": "d1a6e1c7-d26d-4e67-92b0-fd2a0c641bae", "value": "T176A3C34A6F215FF7E8AFDC3749D81B06158D550A26A83F767930D824F38A24B19E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654853815, "uuid": "5d5fa271-23bf-4035-bf26-fb2aeba185bd", "value": "1536:JBqk2Ci9ZFQk9xt8sIP1dISWRdH+VdmCgv5fIhZMYmflX3nn:JBqk2CqDQK/8/PgjHpQhyn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654853815, "uuid": "00179bae-929d-48c6-91b7-69bd662ff9fb", "value": 102100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654853815, "uuid": "3a4d9442-f2a6-4f15-9359-c918271ff3ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654853815, "uuid": "ed49c009-8cf5-4fd0-9da6-c7e3f031b0d8", "value": "c17655749551a21fb2ca3b6bc5879662", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1c556a7-e87f-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654839648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654839648, "uuid": "8042e38c-9895-44c7-9783-289159ed1b11", "comment": "Malware payload (Formbook)", "value": "9a89a19a5945bf5641733d3caa314cf3", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654839648, "uuid": "cc739cf7-2023-4530-8929-711e549e4803", "comment": "Malware payload (Formbook)", "value": "f3f3556f632a2175c3cd0798a9c2aa93d98624b1dce5cf582f120b2c1709c942", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654839648, "uuid": "0a98d91c-8eb2-42fd-9e05-86f6d8deac55", "comment": "Malware payload (Formbook)", "value": "dca3e4a50ca956120b9d27c1c46514511418435b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654839648, "uuid": "c80d5fee-eba9-417d-a1e2-1b9260448c16", "comment": "Malware payload (Formbook)", "value": "d9320f635c727f1b490daa939bcd102bcc3fcae2f8f140e554160545b4d4226182bde884dafc8ec7e0b13a171e47e843", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654839648, "uuid": "3e5acf69-d0e4-4281-90fe-1e4941121506", "value": "T1928422463BAE4397EAF38BB12F20F4622722FC555785D7928321715EEA78312F3514B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654839648, "uuid": "a4e59369-979c-45e5-adee-28c3765af0f4", "value": "6144:uz2yv0UKnYaU95CdIki4MfL51m/jV5dHRk6CzDbPyDyeXpV+6xld5FMwI6XsGL/q:U2yvOnYl5CficVrxkNzDbfeXj+6xbHXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654839648, "uuid": "c1d4a975-8460-43f8-8cdc-81991f242611", "value": 388728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654839648, "uuid": "d841b766-6e55-4283-bb88-c5cedacfdd0b", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654839648, "uuid": "7ba374c8-6b05-4b84-9fa3-ff850433a0f8", "value": "Drawing06102022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2879b9e-e8a7-11ec-93bb-42010a9c0043", "comment": "Malware payload (XFilesStealer)", "timestamp": 1654856829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654856829, "uuid": "28faec0e-3a7a-4eed-8cd4-dfeac740bdf0", "comment": "Malware payload (XFilesStealer)", "value": "529db29a472d2612452bbbff08462410", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654856829, "uuid": "2bb49b17-40b0-406d-a69e-65fa486fb547", "comment": "Malware payload (XFilesStealer)", "value": "f5bb4fe0d4f2f4aaf604140cb41dbca8c8b7baee8229998a956be12ce5d01408", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654856829, "uuid": "c9706714-6490-4feb-a9ee-0f1eac4c0ed9", "comment": "Malware payload (XFilesStealer)", "value": "bc2fc79e89a0fc10d56b059a78cbd3eb210e5cd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654856829, "uuid": "fe4e663d-8d15-48b9-a142-3bea49adc2ee", "comment": "Malware payload (XFilesStealer)", "value": "bfeb5738b7b60f41a2b1ab70d12f25b18fe8c56eade2841490fd5aec71d3931e167d9bb23139dc17d5cfe9767141f0d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654856829, "uuid": "c2654749-3fc9-479a-980a-28989bd309c2", "value": "T179B36FE38D4449E4DC4C2F71913A0C2152277E26BCF9F59CBC9A79E12BF71C06A26D26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654856829, "uuid": "bc05bb47-5151-4ca9-87d4-c7e33709ccfb", "value": "1536:lzWaXtAEq0n7ukYuzpnaUFMi45Fu9nDuIZ//OXn5oFJY7OlzyVBIbxG5ffOMSvr0:RW8AyLvii45CRhqiq5dp3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654856829, "uuid": "dadfbfc6-8ae5-45c1-b812-f422761925ae", "value": 107520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654856829, "uuid": "50886039-89f6-40e1-8842-7c747cfca4fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654856829, "uuid": "bd95c30e-d172-411f-b6f3-9bb8337bc6b8", "value": "529db29a472d2612452bbbff08462410", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e057773-e891-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654847239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847239, "uuid": "0b5c9739-ea4d-4412-9f9b-88ae1f0a1cab", "comment": "Malware payload (Heodo)", "value": "332cfbe5834fbe9e09486923bd1f6082", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847239, "uuid": "4f7edec3-054d-4e72-bccc-3381cce3e036", "comment": "Malware payload (Heodo)", "value": "f63248cbad1daa330b9043569230184e5142217962602b0a6fd2de894d125198", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847239, "uuid": "9cd284a8-83df-494b-9d64-a81bcb16b2d2", "comment": "Malware payload (Heodo)", "value": "88e0c62ecf99a719d747424d4c96c55f1dae98b7", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654847239, "uuid": "793d9a03-c7a6-4289-8a0e-c4001e44cb74", "comment": "Malware payload (Heodo)", "value": "c25f1608da1b88e9240f34caa45478c61aa9368fc78b424686dd4cdcb401e3d21558b3e52d4f38f274646d47c3def6a8", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847239, "uuid": "c3e0b78c-5133-4f08-a16f-8958dfec6440", "value": "T138F4D43EFF51E8E9F8439230814A9170B124BC2D8271797E3648FD64BD72698EB2DE15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847239, "uuid": "06c7ed0d-c07e-4380-8fb4-95cfd69f1613", "value": "98dfbb430035f9300f4be2418dab914b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847239, "uuid": "e53ee43d-3a04-4f76-aff6-949da40a4f8a", "value": "12288:yFbnmV9v3WtGWt4T/humzyMSoGGYqh2tiDek/bPUkf80pG4:yFbO9v3WtVt4T/huKyMJJYq4Qb/Ikf84", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654847239, "uuid": "88c04226-c790-48f9-b8ac-97cc0670a8eb", "value": 743350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654847239, "uuid": "eba577c6-0b72-4307-93fe-4fec2c556924", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654847239, "uuid": "c830aa38-22fd-4e4e-b2e0-caaca4074f30", "value": "j8cEKF1m.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7efaf7b2-e8de-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654880285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654880285, "uuid": "41a0b688-2dd7-4d61-8def-9ea7b2279775", "comment": "Malware payload (Mirai)", "value": "1bf5e49946075bee3f27f28384d7bc20", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654880285, "uuid": "feb87e0f-7c4d-420a-8cd9-b0c9413c82e1", "comment": "Malware payload (Mirai)", "value": "f6975a7dd46f4da899b30fd9108b3005d5802916e008525adf162392cac92aef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654880285, "uuid": "7e8e6e4b-777e-4504-aa23-6a3315181bf9", "comment": "Malware payload (Mirai)", "value": "437b00c098f37820ea3d4abb7b5b34c03665f476", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654880285, "uuid": "60e54c2c-33bd-4c0b-9b84-54d472a7814a", "comment": "Malware payload (Mirai)", "value": "c279635253e05dbb22c9f192a4d0f593c556455ddfa82e26105f2abcd4979fd3af685ec538e0a4fffaed62021b7f61a4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654880285, "uuid": "75040b90-d968-4959-bbbb-2bec3a8f772e", "value": "T1BE730B56F8419B12C5D012BBFE1D418E33131FB8F2EE32029E18AF317BDAA594E6B551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654880285, "uuid": "aa9a5d60-9c57-4591-816f-4d80148d32b8", "value": "1536:J+nTdF1XweAxY1IWEhtOPaJbzpkxpZq5UZBOvfSOL/0YIvyccyd7r:KdF1XweAxY1IWE6PaJXp5UZBaT0hbV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654880285, "uuid": "f2cfb7c0-8676-4758-81b4-f411a6342052", "value": 74660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654880285, "uuid": "8cb3840b-42e7-4ddc-a28d-e37e4a43fbcd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654880285, "uuid": "0be0e079-cd00-41c1-ae4a-44531c7105a9", "value": "1bf5e49946075bee3f27f28384d7bc20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cea681af-e88f-11ec-93bb-42010a9c0043", "comment": "Malware payload (Quakbot)", "timestamp": 1654846488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846488, "uuid": "79e225c9-8c63-4a04-9635-0766f4aed2b8", "comment": "Malware payload (Quakbot)", "value": "339f11439f310a49ed0fc472b525f9d4", "object_relation": "md5", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846488, "uuid": "acc2ac11-2949-4552-a718-c4bf059fb3b1", "comment": "Malware payload (Quakbot)", "value": "f69a98d9d3851aa7bcdfc2ea6bce41fe8ce5ab654974dd9eaa037c074a0af235", "object_relation": "sha256", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846488, "uuid": "ee2e810d-b3b2-4186-bd52-633d141ae5a1", "comment": "Malware payload (Quakbot)", "value": "9397b57ad8d97204d3537362229a1c853887f4f8", "object_relation": "sha1", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654846488, "uuid": "85556fdf-726a-4bc2-b479-35fcb777429e", "comment": "Malware payload (Quakbot)", "value": "d49b3a5db40d253eea05854ac69e256b655b683045661572f3f670a750441f653f95fadc8df4bdd118428ac069d00ebb", "object_relation": "sha3-384", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846488, "uuid": "f207480b-a557-4c4d-a71d-d9b5183c0ff9", "value": "T16E15AF22B7A14C36D66326789C5B776898377E103E3698C62BE41E4C5F392813B77393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846488, "uuid": "dad2bd29-6562-48a2-a2ea-6cf825e22ac3", "value": "604c8306a7e8d6c50871d1512977aee6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846488, "uuid": "a3310326-1a5e-41a1-85e5-9415aefd6186", "value": "12288:G/5LbHbLlLfD49n3Z+ejd4ulI54lNvI1I4+MyvgulFMyvgulR:yhjbxfD83XjDlgyvI1Iuy5Qy5f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654846488, "uuid": "0d9a17dc-fb89-48ec-b053-9e054d0b58f3", "value": 878421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654846488, "uuid": "3cc8e8d8-e310-43a4-b809-24695f7cbaca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654846488, "uuid": "339e0b8d-81cb-477f-8b3e-e3a16f717b2d", "value": "f69a98d9d3851aa7bcdfc2ea6bce41fe8ce5ab654974dd9eaa037c074a0af235", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f32674c-e8a0-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1654853683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654853683, "uuid": "947b85de-ddcc-49ca-9f01-5dd3c1af4420", "comment": "Malware payload (Loki)", "value": "97651cb53947e32c557a1cd213b6da99", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654853683, "uuid": "87fd467f-cc9e-4a87-b3f3-d0d1ae60d327", "comment": "Malware payload (Loki)", "value": "f75b494b1bdab80e6296e480608b5f36267eb3903aba5c3c6250c8f4a48e8bcc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654853683, "uuid": "0f929db6-ca9a-4ea1-8f62-38c230a83866", "comment": "Malware payload (Loki)", "value": "bd9ff5a0f91508acaa55c65435aa49baafbef40b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654853683, "uuid": "17087714-8854-4b39-b185-55c8f9952478", "comment": "Malware payload (Loki)", "value": "051d60e712d3812fe18c7c80a1b7553f21153a3492c1f21ce1819b6224591f14dafd3e0895f6b1d4b774a1581a75a50e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654853683, "uuid": "290fc6bd-fd0d-4d54-8138-8b665af713af", "value": "T16AD4224038B90497E3BB42B91C131002CAA156735DB9FE1FAA417FCBA78F3C65A5E913", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654853683, "uuid": "2a8e8267-0127-45af-838c-d4610f853b35", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654853683, "uuid": "1f1f599c-3aba-47b0-a9f8-99fd66bf4912", "value": "12288:Ibx9C8+jXbW9qz9q0ftKsbHG4hObDVmXOdzK1Vo0waiyX0kaXgWD+0Zizc:KlCXKenftnwbDQ4K00waiyX0kapD+0Z9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654853683, "uuid": "e7afcd93-6c18-49d2-a128-604f51761f42", "value": 635392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654853683, "uuid": "28b6a23f-532d-4d24-987a-0ef493d27094", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654853683, "uuid": "78ff296a-3933-4bd4-a69a-5a52b125885a", "value": "97651cb53947e32c557a1cd213b6da99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7699b076-e8b3-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654861802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861802, "uuid": "fa5af085-df8c-4ba2-978c-a662f16c6fd3", "comment": "Malware payload (Mirai)", "value": "f7a1be10f6a1b5e07c6274ba86f97473", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861802, "uuid": "8700be27-c098-4811-96ee-6726f1500ee6", "comment": "Malware payload (Mirai)", "value": "f9be5ab135840f879edc0f840a14cb46c352b28df2b5b432845dd7f43ba201ef", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861802, "uuid": "32fbbaaa-67ac-413b-b8cb-dd6e204bc38f", "comment": "Malware payload (Mirai)", "value": "08fe928ace6a1d0fc0a14d1f690cc70d9e182106", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861802, "uuid": "71274f6c-9ff7-4688-80ff-d7af8e9a78e7", "comment": "Malware payload (Mirai)", "value": "74b95d9598c6b304638b258808503dbf3bd3c3d9181a844b44bf89280dfdba9070af9f8b3c57393935f61b2056e6ac74", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654861802, "uuid": "7d6f3e60-2d86-4d27-bc8b-aa4410660054", "value": "T143B2D007D9666A70D2318D39AFA84F4231E78FB892FA309111141BBCB77990B3CF594D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654861802, "uuid": "77a08788-e03c-4a2c-90b2-7ba4aeed3861", "value": "384:bf4J++J1n5+rF4RzPvhGEbJYzQ0DkZFEmTop3Y880NXmAsbQRJaANIsL1hymdGUv:bfgJ1I499YztKFToGYXmxECAjL1s3UoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654861802, "uuid": "7f2b5d2c-6177-49b9-afa0-69c37a5f68f1", "value": 24568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654861802, "uuid": "1f74583a-28f7-4305-94cd-6a480b1a6b69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654861802, "uuid": "8ee7c633-a83a-4726-9015-544b36e2cf64", "value": "sora.arm-20220610-1150", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5ad8473-e8ca-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654871787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654871787, "uuid": "00e73e84-a13d-4d3b-b939-1c6b2c285333", "comment": "Malware payload", "value": "586f740d0ec662889f7a439376d97e47", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654871787, "uuid": "79739874-0fba-4596-adea-64a44b058305", "comment": "Malware payload", "value": "fbea88b9e89f7e66a554a96115a0fd37d0126d8d3cd6d1978421f5b88f291475", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654871787, "uuid": "30347a34-1653-4bc1-a27b-7ca95eee91bd", "comment": "Malware payload", "value": "9ea767fde917fdab1d2e06e2076ad784e13d6186", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654871787, "uuid": "31f104b9-bf57-4b52-a118-9d13b64ea063", "comment": "Malware payload", "value": "1d30a5f8f9a88cb8be6716066b17ae6442f035712bcba41bbf36c14d5916e140f641bed73e6441c6daa9276d3a63199f", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654871787, "uuid": "998b65fb-ad3b-4964-95b2-e702cf537ca4", "value": "T1F68422907F82DFDBC083F6B686DB16603655DC2DA39517C62376FA630CB9F022E5901A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654871787, "uuid": "be10be5b-3f9e-4346-889c-728ac4e68603", "value": "6144:hjbnfziJGr3mzNFdGm2zJudAQzm0mv0TyUkISlSqrxqdXX4c5Z+qD:lbfGJGrWdGDQAQzQvnUkISlSqrUdXXvx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654871787, "uuid": "6442a4e5-bb81-4df4-8db6-26af5011a2a3", "value": 388856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654871787, "uuid": "90eb8c6e-d956-46dd-a7b8-d49b9793995f", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654871787, "uuid": "79768044-62d8-481d-9772-d7ced01179d0", "value": "NEW REQUIREMENT..xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bae7dccc-e89b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654851609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654851609, "uuid": "119271ce-f9b0-4bfe-be67-e877cc1ec5c7", "comment": "Malware payload (Mirai)", "value": "8fdc0795d1c3ea78b8e15c4203511ec7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654851609, "uuid": "4d4002bc-35ec-44bd-81a1-1eadfed715c6", "comment": "Malware payload (Mirai)", "value": "fbf47b9a532d926ccec8eb8de760a78c8baf6a9b6787d687bbae9b56b9e69898", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654851609, "uuid": "67ed898c-abbb-47a3-b90c-6d6832e6425d", "comment": "Malware payload (Mirai)", "value": "144d586c1ae885d6887575d72d08d1fdd9a3af2d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654851609, "uuid": "4470ee1d-5830-4177-b1b1-23b7863cbfc6", "comment": "Malware payload (Mirai)", "value": "3ff02a8a4957782acbee52431ee29a8f600650dedb11002bba36dfbc1480d1c8c636d8ab901aa6e64987fda8c7baa1b6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654851609, "uuid": "d1fca62c-fed8-4be1-a5c9-7ba38fd4a24e", "value": "T1DF733B56BCD5CA12CAC453B7FB2E419C332663D8D2DE3307AE146F2426CA92E1E77185", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654851609, "uuid": "9ccbaada-7fd9-4ec6-9332-f46527de977e", "value": "1536:i7P4WTIWCDr2HvB8BYI6tPRTej/NHrikmy+MRDRZIBKGmejVIni8X:i7QWTIqF5R6zNWknHRPIQGrjVV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654851609, "uuid": "a9148727-d278-4b23-a29a-9d57db3591d4", "value": 76968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654851609, "uuid": "d1302aac-640b-4ae5-9d7c-e5a9ff925767", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654851609, "uuid": "18a7127a-085a-4b5b-966e-f76639c8ff61", "value": "apep.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4082a8f-e8b3-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654861932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861932, "uuid": "29b52beb-6fae-4e6c-98d2-bd13da1070bf", "comment": "Malware payload (Mirai)", "value": "9be6b3cfd31db33e92c428cc16511580", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861932, "uuid": "9b191410-83b3-4079-a989-e3f357a847a2", "comment": "Malware payload (Mirai)", "value": "fc9b4d2df2894518ad84fb870c0aa68294681a0a80abcae1f30afd0be723682e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861932, "uuid": "acc1a1f9-ca61-43c7-8960-8b2c28da849e", "comment": "Malware payload (Mirai)", "value": "229632f73fbf3e7888631275974c560646eb03b4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654861932, "uuid": "ab0ff849-d7a8-437a-97f1-726d6f921e32", "comment": "Malware payload (Mirai)", "value": "f867954c7ae2a3b7d61befa26b4e6fbe604234ed406aa8d371da50186c740f9ba6e2174d291d31e5b8cdaa8c381ff8c8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654861932, "uuid": "20bfe25c-1309-4326-80c0-3ba6c3a586df", "value": "T1B633F129BD96A7F388516C3272AB80CA851F8BB5F14FBC3150669B700FC65452DFC603", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654861932, "uuid": "2e341a3d-c2d9-4edd-98ad-12078da05072", "value": "1536:vJOvxLXhP8ak0H0MEMagL0Ah6DyuBCa08:hKxLXhJtHBagL0h8N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654861932, "uuid": "df304ec9-3b43-431c-94a8-ecca06e6fedc", "value": 52748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654861932, "uuid": "e6659bd8-d951-4fd7-9064-84c0136e2b00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654861932, "uuid": "c24dd9c1-f238-49b1-a460-c49084a8fbc7", "value": "vailon.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68115b72-e8a4-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654855335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654855335, "uuid": "40572ab5-f39d-4ac3-a787-24bb475415ff", "comment": "Malware payload (Mirai)", "value": "5dc1a59ec63f3b8cb2294ffa0f7b1ab9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654855335, "uuid": "9f8ca56f-5fe4-4eae-bd86-9c9b4f02d79e", "comment": "Malware payload (Mirai)", "value": "fcf4ba79c8b66b60f94defbb7f9a6507049d10f7972098149756f1c0d00f5398", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654855335, "uuid": "c6b03b8e-8ba8-41be-89b7-cea99921c9d6", "comment": "Malware payload (Mirai)", "value": "642ab4d86a45c25d9319bdf04a3bc3533ee9b24f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654855335, "uuid": "b006f0c8-e656-4bcd-962d-ea25d468e726", "comment": "Malware payload (Mirai)", "value": "bc56fc51781b893f93a5288953aab5906f3bbae087ade5745c899c5bfe022f63bbbb421a5e054c8bb91f09e950b33880", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654855335, "uuid": "1e2ad8be-eca5-4bd4-98fe-14c7e7878206", "value": "T130835B3AED3A3A13C1E0653F12B70760B3E6534E65E8861E7D620E6CFF41994222757B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654855335, "uuid": "c2b14f19-c162-47da-a09a-b312f1dffa9b", "value": "1536:CY0P5Ut8s6mtvUQ4MxnkTtvTh+d/OeoiWJI0wuOSWE4gx/aG/8yachqXi:rtx5vPu1+keoiWJI0wuOSWE4gxX/A/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654855335, "uuid": "fca2c985-9aca-45a8-a04e-128db017c359", "value": 84748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654855335, "uuid": "97100e26-e4fb-4d4a-b8f1-f44fe6363f0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654855335, "uuid": "cc9f929a-b98f-4d96-ac39-5c7b736ee1d0", "value": "5dc1a59ec63f3b8cb2294ffa0f7b1ab9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e25fa400-e8ed-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1654886894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654886894, "uuid": "f9685ae0-26e1-4916-982a-f8e9e68f5b1e", "comment": "Malware payload (RedLineStealer)", "value": "24fc0c24f365fe54a4a50c537a2a549a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654886894, "uuid": "0e9a0e8d-6096-4a5f-bbf9-8d90bfe28f1c", "comment": "Malware payload (RedLineStealer)", "value": "fdc93ccdfeae161c3137c8e433aa788702cc6bcddcb8419dd02b75e8239da16c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654886894, "uuid": "8e38f813-30a8-4432-83e4-a454434c10d6", "comment": "Malware payload (RedLineStealer)", "value": "19c6b4c3e2190c93d547382c8d5fb69b9bcdee5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654886894, "uuid": "e53c17ee-1c61-44fd-83a4-17ad59fbceb1", "comment": "Malware payload (RedLineStealer)", "value": "3fa726cef7245bace705308b856676fad37174a95ff0a5a4030146eabc01a4b5c58d80ea6b38e710040ccb47da9b2ba6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654886894, "uuid": "e3bdf449-aa12-46f7-a60c-2d6d999f7382", "value": "T179A35C3077DC9F19EAFD1A7564B3011443F1E08B9092FB4A4EC4A4E61F67B82592AEF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654886894, "uuid": "b19e6320-6abd-41be-a2d8-c5219d6d8b89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654886894, "uuid": "5a7a90f8-3d90-4407-b2ab-9ec9d20b4009", "value": "1536:6907VZ8lglbG6jejoigI+yYLB3UicrMFW08UAiqumbfcxv0ujXyyed1GtQulgS6Z:/fQwY+ciRWjUA57C0ujyzdrH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654886894, "uuid": "50703421-4bf9-48f4-9c31-281a8c808edc", "value": 98816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654886894, "uuid": "f8762786-7d70-4371-850f-a879864bc9a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654886894, "uuid": "5a43b629-4c72-42ca-9560-128d5b4b854a", "value": "FDC93CCDFEAE161C3137C8E433AA788702CC6BCDDCB84.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83da6f78-e876-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654835625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654835625, "uuid": "05e22eb8-56f8-498f-9f50-c83edc13569d", "comment": "Malware payload (Formbook)", "value": "e2c8c5cd1683dcfa47f0ba6a15913847", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654835625, "uuid": "a6c341ee-5b0c-44d0-817e-5b7a7f508e37", "comment": "Malware payload (Formbook)", "value": "fe208b7ee1a6c57548a9c39f76fe674ac9e7a0130f88242269b4a102969cd6fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654835625, "uuid": "f2ca9852-6725-4bba-b47e-cab56201f840", "comment": "Malware payload (Formbook)", "value": "1c33cb9cfa88b3ebfdddd365316419b08cbdd75b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654835625, "uuid": "cfc594ea-c12a-4432-b090-b64f04077f45", "comment": "Malware payload (Formbook)", "value": "fa707349beefffa2e07a5866694173f7ab84881e1b30d4c246e1da05a4e64852d98996895dd06e7f93ee7c47544a3df7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654835625, "uuid": "ca386a12-16c3-49ea-b2f7-01d09e44b419", "value": "T10914D902338881E9D42B077AA6CE4AB5E1294C173C75FC1F75353EA767B0AC845E6DAC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654835625, "uuid": "8f68df0a-cf0a-4dec-bf76-2e56e07fee81", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654835625, "uuid": "95949855-ab19-4f31-91b2-d0b048c3be1d", "value": "3072:dsSALppRZwFiyc594RWDZ7E0e4Oum0at:dsSg/isyc594RWDZZbOum0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654835625, "uuid": "199d23f4-0f08-4897-b125-475b4fff981f", "value": 193536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654835625, "uuid": "8eda75ff-3d4e-464b-8072-4f56aa709da6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654835625, "uuid": "7fc78975-942f-4714-8229-ba3ff81b4616", "value": "06-10-22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f990c480-e8ae-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654859875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654859875, "uuid": "3964b9ff-a585-4703-b0c6-9ab04ddf2225", "comment": "Malware payload", "value": "b35f258ff6622d52dba24aa5e399a352", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654859875, "uuid": "36314119-d0e6-4146-a0f7-c96737059a98", "comment": "Malware payload", "value": "fe3abc294d945ace78272df022a4431b103aae3d5406608af11bb0b68da3e240", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654859875, "uuid": "63fb5924-e333-44f2-b82d-95667dc25195", "comment": "Malware payload", "value": "8ebb433005b71033e1af12915409dd87735ebd18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654859875, "uuid": "566edaec-74a0-49e5-9054-986db5dc736f", "comment": "Malware payload", "value": "75cc7c42b8630995ae48b3cc0e8317618f23b2429d74ee6ca83643390b1d5618d536303a0ad1940e3362301af7903e0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654859875, "uuid": "904dbacc-c1a2-45a7-aaf6-df0d1eb71f42", "value": "T1F7149BF36BD8C8EEDB586234F3421E1703516DEC68D6A63D1FDE7A29C530A6960F8520", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654859875, "uuid": "80d09591-56de-4a7c-a20d-2c5e1bf35d5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654859875, "uuid": "3df81877-bbb3-428d-8697-44d4d817f255", "value": "768:qfqehp6kELfJSCChd7ntnR+iEiiiM8n8nsoGGTdjt+++Gvx/bb2exNEzAlgql33K:YXWSjwTOfhhGo8r2PYBU4cIS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654859875, "uuid": "f98a4804-3090-46fc-9d5f-7246db205eaa", "value": 199680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654859875, "uuid": "342826a7-92f5-4ac9-87e6-cdda046d30e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654859875, "uuid": "d4b7746d-f723-4eea-9a24-76939340cc13", "value": "MT0012037.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ebe9415-e880-11ec-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1654839751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654839751, "uuid": "4319c094-517d-4823-bb0d-2171e20951b4", "comment": "Malware payload (NanoCore)", "value": "56a024758d02a75b7a9f90c462c69eb7", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654839751, "uuid": "2e29b7d1-f4c2-4fb9-a937-45cfb8414731", "comment": "Malware payload (NanoCore)", "value": "ff40381a1e884c68392a1a524961d7faf7d9be5685ed158d77557e5f6228990a", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654839751, "uuid": "0f1bff30-55b0-425d-8604-ca0a598ded0c", "comment": "Malware payload (NanoCore)", "value": "ddc3dc719e3ac70880723a8c5358a49300ccc229", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654839751, "uuid": "8b62b568-19da-4a46-9aee-3b3ebe617380", "comment": "Malware payload (NanoCore)", "value": "5b38b315faf5bbd4616c390b5c656072c6fe292198806b54c7f9c9c700f4c28dc42efdd8ab8a033f0e3a36cbf92ef886", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654839751, "uuid": "2af7239e-80f2-49b6-b03f-e3e5bae37c82", "value": "T116E42355AD5260F0E14F1137A04A8215093D7F9C3DCFE90B3AA9CA39DF6EBA94252E0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654839751, "uuid": "d5de0d58-a10d-40ec-8beb-df71588a7b41", "value": "12288:5KvIW2A1bJDlKHLt1DLma4C4AapS05RV0ljSbUZoRpu0/Bt+7:uIW2CbJDls1DLvDmpv0lGwZoHuiBs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654839751, "uuid": "43ff371c-3dcb-40ee-a78a-4d3c6f20e8fa", "value": 677104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654839751, "uuid": "456804f3-8bc4-4ec2-a99e-3c13cfe1d5f2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654839751, "uuid": "ada26960-3d97-4360-a976-607cb57e1910", "value": "RECEIPT.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a863cffd-e897-11ec-93bb-42010a9c0043", "comment": "Malware payload (CoinMiner)", "timestamp": 1654849860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849860, "uuid": "52aa1474-4b2b-42b9-b89d-bd03f134d3e7", "comment": "Malware payload (CoinMiner)", "value": "7c07266496fcba5f280ec57d5aab3905", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849860, "uuid": "da116e69-936a-48f6-a793-b111f38f2af7", "comment": "Malware payload (CoinMiner)", "value": "ffb1e6c2921b1f86e5061f2ad55dd0b613da3b8abba2877b4db8aa351fbaed28", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849860, "uuid": "ef772bd8-d70b-4993-bbd6-d29dcd8ed9c5", "comment": "Malware payload (CoinMiner)", "value": "c8f30f0a2d9e465714e8ddbfddbb865879789009", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654849860, "uuid": "130bb850-db79-4994-86db-7a72d6cad8d1", "comment": "Malware payload (CoinMiner)", "value": "d6715cc12118799883a9e6a4e606ae378e71352e2b581570bad1f8f0207dbf7918c2da8dd3d89839d998df69f8859c62", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849860, "uuid": "62b04f07-4721-45f3-8fe6-2e4697a1be0d", "value": "T11FC633260AAFAD5BDC83FD3D4F11CE0B89F20D220A5745A275D63C25B7B1183B5522EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849860, "uuid": "d4f08492-e8fe-474c-bd65-485f36164dce", "value": "0dc6c5e06e22bd9f0c79c55ec1c09b01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849860, "uuid": "284f7c9f-7633-456c-88ce-db187351261b", "value": "196608:LuU/09UHASZds3J5hFpCyuuN3ArHd/OPYpTd8QhrgEyp:L90iHASX+DAyuo3AdOPYp6QhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654849860, "uuid": "adf8f5b4-6b74-4290-9769-2580e1c3fa27", "value": 11766272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654849860, "uuid": "fc3c2404-1103-4369-953d-a91105e4b399", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654849860, "uuid": "d59ddce8-f429-4aff-a215-0d6c4b169642", "value": "RVN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }