{ "Event": { "published": true, "date": "2021-08-23", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-08-23", "timestamp": 1629763381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "aee982f1-3032-4091-85b2-ecde6a3cb351", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a266c8c-0429-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629733619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629733619, "uuid": "01447b0a-1ab5-4f89-9fc6-aea45cc17282", "comment": "Malware payload (Formbook)", "value": "4f9bae274183d2340e7d0cf1d0a37b88", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629733619, "uuid": "93ed4670-f361-4175-a5d2-2b4eea94f755", "comment": "Malware payload (Formbook)", "value": "001a2541de77dc468f7986948da56b03dad2f57c59b77142451bd4c9bef8f8d0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629733619, "uuid": "ae4d36d1-2e36-4da6-b590-64c273f812c0", "comment": "Malware payload (Formbook)", "value": "6cb3bbb7d3f97eeabbc986639cf44d2a98cd0f79", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629733619, "uuid": "70bda578-e0f0-4a80-b07a-2fdc466420c3", "comment": "Malware payload (Formbook)", "value": "52b68c1fe6216a4831fd0a40aa7ea13ede311fc40117628e49342752626729a18cdf88967172ee9e4d0ab551ad9a3678", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629733619, "uuid": "f670069b-f1bd-4c05-b205-a8628edc5428", "value": "T14315183C19B91637D1B9C365EBE48423F258985FB411AE696CDE03A7030BA8735C727E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629733619, "uuid": "9ec81b6b-9b52-4b95-9281-28f7ca8e425d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629733619, "uuid": "c61ecc47-fd09-4449-ab31-fc376d4cddf2", "value": "12288:40MJ6kMPOoKnl6F+XXjLQjDLUaKZs52XQtNnOJBI+kVUWOOf40R:40MyQogLQ/nKjgtNnOJB4ZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629733619, "uuid": "42dc1bbe-510e-429f-8948-2f1cf84a1cdd", "value": 957440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629733619, "uuid": "e51f11f5-83d4-48d4-97f9-595a25fb2c5a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629733619, "uuid": "10e390b9-5d58-4ed3-8d15-cc8f11e1daf2", "value": "4f9bae274183d2340e7d0cf1d0a37b88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0ab0c1b-03bc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629687003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629687003, "uuid": "57061422-0650-4531-bad8-eb60fce868dc", "comment": "Malware payload (Mirai)", "value": "e4768e9c759ceab7781dd01496490319", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629687003, "uuid": "f48d3466-808c-41a9-b746-f8039a76bf63", "comment": "Malware payload (Mirai)", "value": "013327712a301edef71546608469bfffbe0efebba0235b5e919120998949a632", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629687003, "uuid": "a34fcd68-8bfe-4fb6-a073-6c595df17f7c", "comment": "Malware payload (Mirai)", "value": "e5fff8304d77a9bf0f2a744ad01a363054e422a1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629687003, "uuid": "1873ca96-9c96-406e-90c5-8052a3b7b9c1", "comment": "Malware payload (Mirai)", "value": "16293b58ae8ce81fdbb339f10e92d60553a8272ef91395f8e5d804ee33214860a55b965c82c9cbf1fea1891cd3e34d52", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629687003, "uuid": "7251db0d-903f-46a9-93aa-c1c75150c58e", "value": "T1BE43023C1213BD219D718DB1DEE7DB5509EC6FB8B53EE4B285B4497A2DC1C8029A409F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629687003, "uuid": "a82d6ac4-9c6c-49da-9dfd-2509a61190a3", "value": "768:gUp+tV2jefwtobs6ItuI40HRFCKr2ZjZL9q3UELF4dvBt7k3nXVbpdXXdi:gUItVYtJ6c4yFC02ZwLevwnJXdi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629687003, "uuid": "344f0668-9607-46c6-bc84-7a2b03721151", "value": 55676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629687003, "uuid": "dbd33e69-8284-4876-ab7b-a79e5a7598b0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629687003, "uuid": "4c05236c-c8f4-4304-98a0-a123384ad8a1", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "535ee9f9-0449-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629747351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629747351, "uuid": "ae617951-727a-4d26-8a67-d7f1d7ddcf79", "comment": "Malware payload (RaccoonStealer)", "value": "fedfc63ae1bd30ead2e439734b1e6ff2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629747351, "uuid": "9c927565-ce09-4b70-9807-ad97b4660a2a", "comment": "Malware payload (RaccoonStealer)", "value": "01d7dce654258b590fbbc580522d18a4d3079900c0d936ace386c7d22c759de6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629747351, "uuid": "be2dfab2-d271-4407-b9a5-b22d8e8b0623", "comment": "Malware payload (RaccoonStealer)", "value": "5349334d8e68bff3bf66799fa9a0a08c22dd4f30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629747351, "uuid": "f8a172c7-47f6-42ee-b1a8-92f826859dad", "comment": "Malware payload (RaccoonStealer)", "value": "f8b0e1683adffd782d043b55d6ed03a41abae1ac6212e8415cf42ea265d9b0815e429f37ae138d828dadf813640ab35c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629747351, "uuid": "02fe61e7-3281-4250-9825-6a0ae5a7342b", "value": "T1B8B4D030ABA0C035E1F712F8547A83BDA83A7AB15B7040CF93D51AEE56346E9AC31757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629747351, "uuid": "2ebdccab-96e9-4728-b24d-071e3a7cf265", "value": "ab6a8b01372d51e7fed6c22dcfc42852", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629747351, "uuid": "96e8b63b-5883-4658-972d-64a61a366ef5", "value": "12288:ytvMluDHDy+JZ9OpwaDzfKNGzYwnKGHV5dpyGKMU1OF6z4tQ8Nca5:RuDHg2afeEYe5lpyNIO4tQfa5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629747351, "uuid": "bbd98b04-7e1c-4772-9c68-e17a143be368", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629747351, "uuid": "2b66654f-f38c-43e3-b383-72c6c441f55c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629747351, "uuid": "fa1513d3-15e0-44e6-b65d-1fec2ee7f6a7", "value": "fedfc63ae1bd30ead2e439734b1e6ff2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "159d84d9-0409-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629719760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629719760, "uuid": "d491963d-0297-49de-beb1-ef4982f2029c", "comment": "Malware payload (AgentTesla)", "value": "b144a9d65fd4fc3eed89bcd87907cdff", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629719760, "uuid": "07823e4e-a7e9-464c-8c62-1bc9623627db", "comment": "Malware payload (AgentTesla)", "value": "03827146b3835a93b52673fd4c76cea67a0981139063894683817572a0dd6c27", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629719760, "uuid": "7cc3d35e-9bbf-4b45-9482-87bda4d7123a", "comment": "Malware payload (AgentTesla)", "value": "2bd95092517e2e24caf95d23d2a6970dc5c97f56", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629719760, "uuid": "579ebf6a-2757-4163-8753-53e1ce5ac59c", "comment": "Malware payload (AgentTesla)", "value": "69fb25168e7ead5b81f84919d810b948190e02731fbc6e767f1d05b7a00aa6241631c169afe5ce0e56e1a079d23f37de", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629719760, "uuid": "38ac0399-1068-41d7-be50-5861da464bd9", "value": "T17A05063D19B91637D1B5C365EBE58423F148986FB405AE69ACDE03A7030BA9335C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629719760, "uuid": "3613af2c-792a-4735-b58f-4157c738fc41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629719760, "uuid": "84e5bf70-6043-4508-9ca7-1d94b0c90271", "value": "12288:R/2OvODIYIMcePtRZnLctm8M5YqmoTz/BUHxzBhPj6AzXbLpNoR2uKEBN:R/2DDIwceVR5cO5ZmYIx1h+CcRT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629719760, "uuid": "a65ecd1f-ab4c-4e6c-bbba-6fd692c93b3d", "value": 851456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629719760, "uuid": "e08da667-789d-4012-ba7b-33802612e4da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629719760, "uuid": "9952c513-6609-4149-893d-f85f7a77a7c5", "value": "draft0012021062007360004_558.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "018bc1f3-043b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629741201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741201, "uuid": "6dae3e17-8311-4a96-aaad-5a58b0f441a3", "comment": "Malware payload (Smoke Loader)", "value": "a4fe313256e5477d41af77aa45c65f20", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741201, "uuid": "b83e75cc-5352-4b82-930e-d6d0b5ee8f50", "comment": "Malware payload (Smoke Loader)", "value": "04b094e1e2f34f1382df94fa610e9e74a74e6a73c8b755285a70f60da73b392d", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741201, "uuid": "7726ed99-179c-4dad-a65f-d50a1a0c2892", "comment": "Malware payload (Smoke Loader)", "value": "1b4fba305c0a667058b0f805425797245a5851eb", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741201, "uuid": "2825e723-c572-4b57-b73d-c108c05b21a7", "comment": "Malware payload (Smoke Loader)", "value": "dbe679b6240510201d832455c813520a7be6797bb477d7f84f5110356acff2fc411aff9917742877d126a7c09d286c68", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741201, "uuid": "dd6afacd-570f-4e0a-8005-65964a0f9ea3", "value": "T12F547C30ABA1C035F1F711F455B683B8A93A7AB16B7450CB93D52AEE16346E4EC30B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741201, "uuid": "39d8479f-c3cf-4fb3-8ec0-fd8f8cd2bec1", "value": "5c06a288f07d43206aca52d5d94444b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741201, "uuid": "61d2460e-f2a7-4b16-b5ff-2e5d64a56748", "value": "6144:oM/h4ZNWiadxDfDxeypXM2RgaKPsr9zsC:Th0NzC5fxpXMWgaD9z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629741201, "uuid": "1230613b-fe9f-4847-852a-91772ab61c48", "value": 280576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629741201, "uuid": "f62473a8-b2b3-404b-ab26-8fe51ce19622", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741201, "uuid": "afa6fd5e-a2a9-43b4-b151-ac9d60107e49", "value": "a4fe313256e5477d41af77aa45c65f20.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0971371c-03df-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629701701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701701, "uuid": "00ff49a5-9f54-4eb8-99af-b75475f337fd", "comment": "Malware payload (Mirai)", "value": "d55a5402d439ebc7a28944bdace067cc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701701, "uuid": "2ae0a2fb-a96a-4e0d-a785-89545bd90bb9", "comment": "Malware payload (Mirai)", "value": "04e0d29123475b8b7d33f610c09ba4ece70ee83c0db691cdcaebdb29cd7f8639", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701701, "uuid": "db27be37-c789-41d8-9185-5dec3c0f39aa", "comment": "Malware payload (Mirai)", "value": "ca66c6949a44a4ef9a36c812de712e569403e64f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701701, "uuid": "2085f463-7100-4900-8609-8a5c6b17a92c", "comment": "Malware payload (Mirai)", "value": "05c81da235b97e8c0fd2a698d1ad9c9ac71cbefd0b626f7555d1419fdae8805837cae28f392880f066c67f8304ec9026", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701701, "uuid": "5e7fb5cb-f43e-442b-b765-afdb58388ef9", "value": "T12C33F141E08798A58B308D72547649F9788CABFFD17D7B8713402FA699E315A43FEC42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701701, "uuid": "205fa163-7718-4013-9dc3-549fb0da8a13", "value": "768:+wMw2Ijkj6go0GcDKScWHXkmt6JC68LxImiC7p8YgcL5RUKxSRYHNCd59q3UELl+:EVIwemGu5XkmSCZxIvwDT7HNZLk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629701701, "uuid": "344d79b2-d8f5-47fc-886a-d392994af659", "value": 51152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629701701, "uuid": "45c606e6-72f0-445f-8481-31ccc2f0e8dd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701701, "uuid": "8e65d3fe-a9be-472f-be30-b87eb0203515", "value": "d55a5402d439ebc7a28944bdace067cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa00b7a2-03de-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1629701675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701675, "uuid": "ab2f5bb3-45a4-4688-b63c-15c2948e3c38", "comment": "Malware payload (Gafgyt)", "value": "5ce5d00d902c6b5dafaad42873b5ce23", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701675, "uuid": "52168ff9-396b-4a09-bd03-bf796eb91935", "comment": "Malware payload (Gafgyt)", "value": "04f8aa21721e6a53674d65c0ee2ddbb1d8069ef94ccafa8d0cd7184cf203b1b5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701675, "uuid": "42ea3334-4233-44ae-a48f-d1f20879fea7", "comment": "Malware payload (Gafgyt)", "value": "1dc83c64b6cf337b018f9d4146fd60c97e823407", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701675, "uuid": "038b8576-b6a2-4c61-bfd3-b61d9c47274f", "comment": "Malware payload (Gafgyt)", "value": "a2146ed56f5bf118eefa5c598ab4629a1f57b1a190ead2d5dd7f374f3aae452a7b0027287ad4aefe26e60cf444f70ead", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701675, "uuid": "81fba710-4469-4cce-9dd0-b8c15dfbe26b", "value": "T1B3A3093B7B130E23C0CA547112E30732ABB5D6D538F94797B9E06DAC6F16A843816BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701675, "uuid": "664101f1-a1cb-4951-bfaa-2c62cae567ce", "value": "1536:sc1/Ji1VN8yaqtaCl5Xthp679l5M4htcmEqFoIjrEfm15:dANzaq4CXLUHcmEqFoIvEfm15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629701675, "uuid": "dc0bce53-d26c-4069-9556-d79aa8c4e674", "value": 101566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629701675, "uuid": "7867633c-5d03-4d96-9227-d0486519401e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701675, "uuid": "a77b5872-a6bb-4ed4-8d0f-35a4356b777e", "value": "5ce5d00d902c6b5dafaad42873b5ce23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75c13a4d-041f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AZORult)", "timestamp": 1629729370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729370, "uuid": "f3d43492-da3d-4de0-b094-fa1210ba8fe8", "comment": "Malware payload (AZORult)", "value": "a918211103e537e1f2c1911e92f9c60e", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729370, "uuid": "333de7f3-365f-439b-99e6-9b3f3a598324", "comment": "Malware payload (AZORult)", "value": "0513d6e3f5cdc7c35b5df04607d49cd4079adf90992a28c9b8e61281f53f81d0", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729370, "uuid": "fa5c5ca3-dc38-4c6f-b8ee-a9f112494315", "comment": "Malware payload (AZORult)", "value": "bb3388b5502c21cf47abf6f636f5229dcf887084", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729370, "uuid": "b06923a5-951b-471e-bd58-7d4b17bef641", "comment": "Malware payload (AZORult)", "value": "6a234a53020d44598e75fc2af7447d6d43d4e0d08a3672472e272c3ed812836de638b69baf48eb45ec9662eb9cca9720", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729370, "uuid": "3d8f89f0-19c2-4abf-92ff-019685d85a4e", "value": "T1DE03D6ADD4570A988F85EBB85B1B2F85119C7A6CF3849572337C973823D2D3AA01393C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729370, "uuid": "068f4929-441a-4cb4-8370-02d0a2b2e0d3", "value": "384:jRE+6GCmLcxQEBRb+ETvQafqG0kjUXF1pNNZDPDdUpKYBv3QeoqOea3xhNIflUjS:WeCmbqB7Xfdup94yiN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629729370, "uuid": "5806cf39-42bb-467d-a2df-ac50a3957607", "value": 38810, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629729370, "uuid": "4cb54c1b-0f16-4fee-b3c2-2500d911a57c", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729370, "uuid": "b8dc7855-49ad-4748-a4e9-5c4b63e8fb67", "value": "galvanized23 2.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "861594d7-0419-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1629726821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629726821, "uuid": "281ee2c0-0b87-47bb-8d4f-974ca0385287", "comment": "Malware payload (NanoCore)", "value": "ec17ed5e0507376a8911679402331d3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629726821, "uuid": "522466fc-01ad-45a3-837a-a365136f13ce", "comment": "Malware payload (NanoCore)", "value": "06b6408d6cf040b5a1106c80515811f4b6d3dfd43722b71f2adafece755c2832", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629726821, "uuid": "1cad6dd1-508f-4ed8-b2b2-50d274b8d614", "comment": "Malware payload (NanoCore)", "value": "2fb2fee0a8c3e351737cc246397ca3923629e246", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629726821, "uuid": "0490d40b-591f-4079-a3db-7386e620c12e", "comment": "Malware payload (NanoCore)", "value": "398106c498aec8b160bd905eaa0f3626b893297e9828dd445462bed6973bdde3fa31d82aa1d07f0a31dfe30708813296", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629726821, "uuid": "7023a109-98d2-4f5e-84af-bcd3ce1a725d", "value": "T1EE0549483B90B19FD427C9338B674C30A66164ABD68BD303D013D2ADE95D2B7DF185AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629726821, "uuid": "7cca84e8-76fa-49f3-b34d-98f99e520624", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629726821, "uuid": "f93f4a78-82bd-4f9f-b9e9-ecd7e55cf905", "value": "12288:e8Kn+g0WThnmsfog/CeqHiaSvGRkZ6EVpl5nHf81OgBLX3OOPoKSoNm/ev/xV6Be:e8KEWxdh/CFCaqGRk0EVpzn/8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629726821, "uuid": "0ce34664-a4fb-46c2-a274-39df350eb101", "value": 856576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629726821, "uuid": "dad4c9ff-e2c2-4905-b074-7507fb67dc51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629726821, "uuid": "0e1d1dec-ad80-479d-9edc-7ee129209b1c", "value": "PROFORMA INVOICE 20210823.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "678f2f69-0445-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629745667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629745667, "uuid": "b5e8c254-e67a-4009-9dd3-31d4400bce6a", "comment": "Malware payload (AgentTesla)", "value": "3ca87d704392649bdfd2e0e50c2cca35", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629745667, "uuid": "baa34f6a-d620-4ff9-9cd2-a5648c7fffdc", "comment": "Malware payload (AgentTesla)", "value": "06c48a7afff810fd70a5e3214495f52b0794d7893fed5761565867982e287a61", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629745667, "uuid": "4576d857-5e36-4ca8-a0fa-2563e9a55177", "comment": "Malware payload (AgentTesla)", "value": "5219cf0cf8acad15e250b2e24dc4ad6cefd5976e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629745667, "uuid": "4761ef8d-06a8-4d78-a4e5-3c40acbdf802", "comment": "Malware payload (AgentTesla)", "value": "d03a5501e46276259a6ae16213d8d888ae669be77adbb681cfdf2f3023e142ca285d051d3d204b8faf254fa393f3dc1a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629745667, "uuid": "47782b65-7c8e-4d04-86e2-8d308986ffaf", "value": "T1F734123AA3FD862BE0C492B8923D799A51349CB4194F1973DF207A2D443B9D77CD0B1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629745667, "uuid": "1a2a33e4-a4ce-478f-8d7e-7848f84504bc", "value": "6ef74f7b87fa15b6df54d064a5b8ef31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629745667, "uuid": "1f59e444-b67f-4139-aff1-25aa50a87856", "value": "6144:GIqtBV8Qj3vShVl7zf1saQa0q095DaMKcqPfWeNjQ:GjBV83l7zfy9a0qgW9fWeRQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629745667, "uuid": "eddade73-504c-4bef-a7f5-8ae15429e9a2", "value": 240014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629745667, "uuid": "d3867b40-90f0-4bce-91a3-a09406f25606", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629745667, "uuid": "e75b88aa-f5c2-45a4-b450-a0b9c18a5d74", "value": "3ca87d704392649bdfd2e0e50c2cca35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9da0a24e-0457-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Tofsee)", "timestamp": 1629753489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629753489, "uuid": "dddc50dd-bfff-41e4-a693-c0e0641a992d", "comment": "Malware payload (Tofsee)", "value": "3a4cab2f910f68aae472460c37591ceb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629753489, "uuid": "2ce91a20-53fd-45a7-b252-93c9335996e8", "comment": "Malware payload (Tofsee)", "value": "07056777e640806a058f582772f441ff608ff7b1f8bd69d20943acf35b266a2d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629753489, "uuid": "623059af-2563-458e-adf9-b2a91d4888a5", "comment": "Malware payload (Tofsee)", "value": "d225e7b9bb6e74075557751adc6a50b7daf88acb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629753489, "uuid": "8cdd925a-b09e-49f8-94d0-d90c505715b4", "comment": "Malware payload (Tofsee)", "value": "c390c7eb17444712cb4a0bcdfc203652e617811a1e5b1f0be1b38c144292b556161fbea81e5bca00871df1ee28c19594", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629753489, "uuid": "9b44b8c4-473a-4046-9976-5795a57f2dc7", "value": "T1B3547C30AB91C034E5F712F855BA83BCB53A7AB16B7450CB52D52AED46386E4EC30747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629753489, "uuid": "4af1d852-03b1-4cc4-8d9c-751b96dba1ff", "value": "4dcb3c3a3fe5e134dd41266130cc79d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629753489, "uuid": "d425bef8-c731-4fb5-8992-c6f50a332440", "value": "6144:0h014fDmXj3h62LkuxkZhY9KJKfmc2zDJrKP27iWL4CqLK:x1aDmzR6h+cwm3zDYO/L5q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629753489, "uuid": "2186c5a9-b698-4bb2-b17c-6ec2571d6283", "value": 280064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629753489, "uuid": "e5a6d686-27f1-4f63-9e5c-c8d228f01408", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629753489, "uuid": "77d4c142-031d-41a8-9a4d-c58ad980c403", "value": "3a4cab2f910f68aae472460c37591ceb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e0cff4e-03dd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AZORult)", "timestamp": 1629701037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701037, "uuid": "35aa62d8-dd9c-4921-a67c-9e6af52e24d1", "comment": "Malware payload (AZORult)", "value": "040026c9c18e8dc7ffc73f3790dbdf3b", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701037, "uuid": "22afed7b-f6f4-4e7f-be77-833d6cebfa8f", "comment": "Malware payload (AZORult)", "value": "0768f66b3f6ee8f9f32520837cee96da8d725c789d82ba16771bbad740b737ee", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701037, "uuid": "c1425bf7-a56d-4241-8e16-0f5d1c8f64bd", "comment": "Malware payload (AZORult)", "value": "70716c50c283b59eb9fd3137c68f9ff8a8824f56", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701037, "uuid": "f5d7e22a-b110-4ba7-87dd-41b72aa5fde5", "comment": "Malware payload (AZORult)", "value": "355d46c7b6d422cac95560aa0ee9c7ef3e603db5f73c5ea5a9baeb5ccece164e0f8d29f7ea271087f39aaf392d79fde8", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701037, "uuid": "a963b885-0407-4464-9498-b932c947c763", "value": "T14EA47C003BE86A6FE239D67B6B43813143B346CBE5D6D784C940D2AD39713709A4EA5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701037, "uuid": "a1b7f289-103c-4453-9fee-8a7c52d2470e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701037, "uuid": "4e417bbf-9774-4daa-9b1d-26f4f5dc238a", "value": "6144:FVqsmrB3at+7T8md3+VwWNcFbka2WxRH7YnB+EpXdf3Fs0qwjloU:eVNGEFbka2EYnBrdf3FXqwjl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629701037, "uuid": "8d9560ac-d59a-483b-8243-e4d32c4714c5", "value": 466944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629701037, "uuid": "c0a83928-21f2-445f-9a32-a2a0178bf961", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701037, "uuid": "41a3d31f-b675-4e5b-8390-c3d6f42e75e5", "value": "Pi Request.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67dbb273-03de-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629701430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701430, "uuid": "b150e584-bf2e-48b2-9ba9-371220e4c31f", "comment": "Malware payload (AgentTesla)", "value": "b1102e24ca361a26a17bf93439c24971", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701430, "uuid": "292d8bf1-dd91-4478-a91e-9e80b9aabab9", "comment": "Malware payload (AgentTesla)", "value": "08368034a5fe8b7969c7111148a2b8f0e218996845220a9554828c3d7f2c454a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701430, "uuid": "aa728922-79b4-4a66-a402-10ea0e9a4b3c", "comment": "Malware payload (AgentTesla)", "value": "37024a3141a55c9a75ce66fab83df7b65703b0be", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701430, "uuid": "61ef34f2-def4-4207-b995-195e89160d42", "comment": "Malware payload (AgentTesla)", "value": "c0c6eed2426c4e2e73fe4a1935ea0ae1e985836063bd05635af2627a33999c9d6049a0d281b3aaec515b3ae9daaa053b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701430, "uuid": "af2cc3f7-3202-4bbb-8c89-f513acd04eef", "value": "T17E1502397FA4BD8EC51B1D7A0972A810A7F4C2721A0BE307ADE20AED565DFCD4E412D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701430, "uuid": "aaddea4c-bec2-4011-801c-131fc8b3dfec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701430, "uuid": "86753088-a5e6-4b2c-8f1d-8c1e72b2125e", "value": "12288:rqwZC1YUtOAZi9703J7Rhq6NjQCsaFvb1qDaN4NKTDvFFgIIlp40UpNi/gDtqGOr:rqySkAZPFhqANsUy+DvNMBUpLDtM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629701430, "uuid": "a224d259-1d16-4933-ab15-1d3c770796b1", "value": 930816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629701430, "uuid": "c572ba3b-d3cc-4610-8fc0-e32203ec27de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701430, "uuid": "79dcf5a1-3199-4e19-be88-2815549208ba", "value": "Ref 0180066743.XLSx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89b7a22e-03e1-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629702775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702775, "uuid": "6d482719-3a6f-4bbb-93a8-5552f9469065", "comment": "Malware payload", "value": "552214190703ccaffba4c222ca4cd779", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702775, "uuid": "48c2d465-638a-4f8a-93fb-5b0eaf170a93", "comment": "Malware payload", "value": "090afb48c7e4d1e1275ecaf8da8a802a6384a0241b92a4ea2e01b599a4c9f9d0", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702775, "uuid": "777f9524-ad05-43ba-ac00-78847c8f5fab", "comment": "Malware payload", "value": "b93492865afe4ccfb27ae046f5d03cc60b62c6af", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702775, "uuid": "63b3581c-d7a2-4731-bd53-05b2c9507eee", "comment": "Malware payload", "value": "a435f3c1540f651836b61028dcacf367482e7871b92578c2f818def15bc56adfd0d14677d01f9fd5f7e0e973717b9c05", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702775, "uuid": "f7151e54-cc71-44f8-8e78-58f39612ac31", "value": "T14B225C28D512B817D216087CE16583F4E31F9023BA52FD3A1454B2DE5BA13D34BDEEEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702775, "uuid": "e57e9247-57a3-4863-b3a5-8f540cc560b9", "value": "192:ScIMmtP12G/bWvsq2VwOPvrdlJFOyX3SR:SPXjmx2KOHjJFlnG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629702775, "uuid": "d6b73a0f-0a0e-44b5-9cc1-a27a025ceebe", "value": 10354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629702775, "uuid": "0611c0a6-af7c-4d49-99af-87c7728b33e2", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702775, "uuid": "a710f4c2-a0ea-434c-9d0e-30b74a572525", "value": "Bank Details.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08f08989-0458-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629753669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629753669, "uuid": "ff5cec30-17a0-4571-a8f8-ad0a78877bb5", "comment": "Malware payload (RedLineStealer)", "value": "1ae2b2e82ec990567ebca7424a660f66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629753669, "uuid": "881bcee7-1e1e-4b0d-b352-6444e65316f6", "comment": "Malware payload (RedLineStealer)", "value": "0954164e42a0578363f45d2723ab7415c2ce02cfad63a1a2ecf2daa506f8dfc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629753669, "uuid": "5bcf8ab9-94e8-4c0b-9540-0a07e297e88a", "comment": "Malware payload (RedLineStealer)", "value": "b0c695ee99184d3f5d74a3a5bcdf0a026a462f99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629753669, "uuid": "495af817-02eb-4384-9c72-5ffbdbbac055", "comment": "Malware payload (RedLineStealer)", "value": "72ec4a9b8f5de365e6ea13242bb5a8d53e77d9d260630f794f917b767d107f99b404beaa098087d19709a2215d277fe3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629753669, "uuid": "7acb3dbf-f037-4903-88fb-ddae5ae775d4", "value": "T108B52325647FC46A41A3EFE22CCC58BBD999D9B7644C353302A4D31BCB52B98DE0B0B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629753669, "uuid": "4d0f2308-76ac-43b2-a632-64028a256a0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629753669, "uuid": "f0d75a9f-6e32-4f36-a469-e9ee2fa2d9fe", "value": "12288:ok+4qOhzuSz0MAKpAFc7SlJBxdoQaTUywiu6HuXfqJ4Sl6Ul4Z4OITv64LPoKqU2:CJArnqUZxoh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629753669, "uuid": "0317409b-7673-48ef-a9a6-8abaa41d2d5d", "value": 2377728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629753669, "uuid": "4fe63aab-e28a-4db3-87e1-6d90480d19c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629753669, "uuid": "7b99962b-b00b-48c6-b72f-3c05b2ad84ce", "value": "1AE2B2E82EC990567EBCA7424A660F66.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ac23a0c-0409-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gozi)", "timestamp": 1629719903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629719903, "uuid": "bd4afe4a-1ae5-4a7c-9b9e-2304fb95e5d3", "comment": "Malware payload (Gozi)", "value": "454908e620c33ca3e631a6334e8b1ff1", "object_relation": "md5", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629719903, "uuid": "5f17e63d-b10d-496f-87a1-1ef135cf7b06", "comment": "Malware payload (Gozi)", "value": "0a3bc15ceb80f700d80b7d651ff378cf407c239f3e513e3bc9bd854f82f7e22c", "object_relation": "sha256", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629719903, "uuid": "99edf20b-9c82-42a1-a8ba-985a3384dd64", "comment": "Malware payload (Gozi)", "value": "50f292391060ff4d772a4fd695f9eba8432a8fd8", "object_relation": "sha1", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629719903, "uuid": "c52da209-ac7a-4fb0-af36-79fde1c6aa2c", "comment": "Malware payload (Gozi)", "value": "4cdb2e34193a46078be9e3d42d1491f111d4a22c2f5c23bda700878428c2409427022edc93b3742f370d73504b3a657e", "object_relation": "sha3-384", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629719903, "uuid": "7e1e5978-295d-4f0e-bd36-a34491159845", "value": "T185C49D12B791E024E9B952788F75D9D8AA2D38215B3850CF39E13B9F0E396E39D35343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629719903, "uuid": "aedb3fdc-75d9-4089-8813-dd9022094378", "value": "12994b2554048ef1e6f7b4dd1e874109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629719903, "uuid": "e69b6404-8492-4778-8e8f-5f001be7f16f", "value": "12288:rqru80paIRPWxvFzhzFIko/IcYrIAfDE0cb1Yklllll/lllll7K10QUNI0H:rs0IIFWx9zlFIko/DY8kcbHlllll/llH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629719903, "uuid": "3be00cbf-a9bc-4ffe-b6df-f3c37d665d8d", "value": 557056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629719903, "uuid": "90dab9dc-4379-42b9-875b-5ec37d82b37a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629719903, "uuid": "344d0de5-a767-4a80-aa84-56ff7d826654", "value": "61238cfcc2441.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb26073d-03d9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629699422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629699422, "uuid": "04acf7a1-0451-4ce6-aebd-6804b36a13c3", "comment": "Malware payload (AgentTesla)", "value": "e9c65e0da29b2894050a9c1e25e66764", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629699422, "uuid": "42c26d81-d581-4c2e-870e-71b87dee4495", "comment": "Malware payload (AgentTesla)", "value": "0aee4e28fcaa8811684d3fac7e05d62276530b2ca506554132b82cb741de743b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629699422, "uuid": "ae0505f6-b2ba-4a66-b224-1aa345653e2d", "comment": "Malware payload (AgentTesla)", "value": "4949672fc6b13bb480b434a6511e3a584950ce11", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629699422, "uuid": "1220dbb2-a91e-4655-b904-9823fa571ccf", "comment": "Malware payload (AgentTesla)", "value": "98b80940d7b14caa9e0520bf36e54db251408924b608db6104eb43c9f44755b65a08163bdc96ad53ff6f14d446e6b7cb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629699422, "uuid": "84709833-9ba9-4fb2-93e8-5d5cd2bc792b", "value": "T1DD1518263250B16EC423C536B6574C6092FD6CB7B24EC242B4C3A2BD6A1CB77DE161B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629699422, "uuid": "2d0850f4-8ad3-4932-b910-e0e7f06d9b47", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629699422, "uuid": "e17d1ac5-467b-42cf-b54e-8fd3b78a5165", "value": "12288:b5RKvREn6wGApz6ITKREICW231WHW2tNHQK2SbcIkvMqfCkHOCbDEkHIAYTlYqNr:b5RKREnemBTER3Hl20MvM+/jToA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629699422, "uuid": "ad526dfd-be1f-491c-b60a-43b988a8b570", "value": 911872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629699422, "uuid": "757bf6b5-d06c-49ee-b1f1-8ab63a9801cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629699422, "uuid": "78e795d1-d268-493d-bc5b-f19e50484ca3", "value": "Wire transfer slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50c6e9eb-03d6-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629697955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629697955, "uuid": "99344742-152f-4833-bbe4-dfc18cf4b4e8", "comment": "Malware payload", "value": "6ab04ef5438ed6c6e37a781e7e0f310d", "object_relation": "md5", "Tag": [ { "name": "39.104.77.83", "colour": "#928B7E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629697955, "uuid": "0ff0ceb0-8567-459a-963b-df1ca6cc15e6", "comment": "Malware payload", "value": "0bd3c4700677ac918391442acbdcc67a5dcd09a22b3cb32dda659a42569deb56", "object_relation": "sha256", "Tag": [ { "name": "39.104.77.83", "colour": "#928B7E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629697955, "uuid": "b02c8062-db6a-4cc3-bde2-b77b621a2aeb", "comment": "Malware payload", "value": "97ba914c596069a802544246129ab50e801afbe4", "object_relation": "sha1", "Tag": [ { "name": "39.104.77.83", "colour": "#928B7E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629697955, "uuid": "fae92220-a14f-44cd-ba14-2f758ec4d245", "comment": "Malware payload", "value": "31a61d975181f6ae39ee9acac469591c1fbc4c9b960e46961a9de3bd3338c77b18f9bba60c6da7524f5ce01311e4314f", "object_relation": "sha3-384", "Tag": [ { "name": "39.104.77.83", "colour": "#928B7E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629697955, "uuid": "53c6f748-d582-47cf-babe-cff700ade5bd", "value": "T15111C4A95E880335E36F8C4440991E07CFEDE139302D78D3F5DA0E0E241ACA578E51F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629697955, "uuid": "1bb87220-a42f-403c-8a66-03e206d8168d", "value": "24:ponglUP4IZ/aFVINJPSgDJ7/H+VofrFhl851V7KUgfrBxqiC:p9OPbZypgDBP+OfrC5TPYnC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629697955, "uuid": "378126c6-70c7-4579-84e5-6d9209ba4608", "value": 1023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629697955, "uuid": "620d067e-81ec-4017-94c4-5b244206850c", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629697955, "uuid": "1f035b71-69eb-41d9-b57e-93e572c0229d", "value": "ps1_3.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8ac2632-041c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629728248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629728248, "uuid": "0a4e2059-03f7-425a-afef-c3043e306bde", "comment": "Malware payload (SnakeKeylogger)", "value": "5cfc8818a6a0c1c682d4878a3ce688fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629728248, "uuid": "23c61c62-627d-4601-aead-14f380494a99", "comment": "Malware payload (SnakeKeylogger)", "value": "0d5f2e241e3ecf6b098f65d0c5f85dd560ed0c31f1043c6206261c0f11545399", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629728248, "uuid": "de9fc74e-f978-46da-8c45-171280aab29f", "comment": "Malware payload (SnakeKeylogger)", "value": "23938631deb9e44eb4a7ebadda29b519c0e35f4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629728248, "uuid": "5b0292eb-12b1-4503-b214-f528c59bdbfb", "comment": "Malware payload (SnakeKeylogger)", "value": "b40ce7d9f93192d2591c7311fe6965ae51806f8f2e0a8f83333b8eb757e7d55c5b63b8a44777047aa4acb7ed9b4fc43e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629728248, "uuid": "44e869e5-4d73-471a-8c47-c8301906bd5f", "value": "T16C946A003B98AA2BF535E6776B57813283B24AC7E1D1D754C940D37E7A31370AE49A8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629728248, "uuid": "b1d61dce-b1a8-4629-a9c6-70ca0d871311", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629728248, "uuid": "184574a8-9699-4f32-a1f2-4732bf8c1aa8", "value": "6144:oIpynJXPdlwkpsod/xMTcH5W/RBXxLSE72QhBJvwc/y+/FnOUaIPZTynWn:oIpy9PnwXgHQth13wcK+9nhp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629728248, "uuid": "4a1b6880-de90-498f-aae1-b6ae8c2404b2", "value": 440832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629728248, "uuid": "31d29071-9a6b-4490-909e-93506cb684cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629728248, "uuid": "5109b6bf-8a1b-4a18-be7e-97081710471d", "value": "Proforma Invoice -no3526457h.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "136dda46-043d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1629742090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742090, "uuid": "3133494c-daaf-46ef-a14c-be0b1a784f99", "comment": "Malware payload (TrickBot)", "value": "17e1144809435bdf3a0960acb7cf3627", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742090, "uuid": "0aad70b7-b209-4999-aa55-f5a6348d65bc", "comment": "Malware payload (TrickBot)", "value": "0dd6adc7f40fac5c8268853f41a248996fc4554f227bf6486e5261e506b0c876", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742090, "uuid": "1675be37-56e6-476b-95d0-c40b948b8ec1", "comment": "Malware payload (TrickBot)", "value": "29709b45e647ed65588c10cb06b8c4893d0d7877", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742090, "uuid": "aabf0462-58b2-4797-bea6-723512af2979", "comment": "Malware payload (TrickBot)", "value": "15d2e8b441f903162beef80aa02e197b1dd48eaa32d871d428616836651b7ba9b50e0775d179e6009782cdc342531027", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742090, "uuid": "cb17b78b-f443-4fc0-9c12-34f9d5a21ebc", "value": "T14B0519D0634CCA7FD6C33130F3A61633D2538B4E1AAB919BEB58F59AA86E5467413307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742090, "uuid": "c7b427a1-4e22-4dae-8376-cc6b742b9fa9", "value": "884c251bdbb51e23564add248435ff5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742090, "uuid": "4f818720-8db3-4833-bee5-733a1ccb0215", "value": "12288:QFuLe4nHJm79H5j51MKd3GydYLMcOCWvnJi7:QFF4nHJoXZbnJc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629742090, "uuid": "4f267dfb-709c-44d3-8d13-291d22dbd49d", "value": 839733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629742090, "uuid": "b5082f20-2a44-4af0-a107-0acb3b9bf6d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742090, "uuid": "ce125ecd-d0b1-479d-a2a9-84e288c8254f", "value": "17e1144809435bdf3a0960acb7cf3627.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3c4ce7d-0424-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629731702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629731702, "uuid": "31264242-cd9c-41ed-a80e-93de8de01918", "comment": "Malware payload (Formbook)", "value": "e7278e4270bfc7d81c87afa4c561af69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629731702, "uuid": "8ffe7299-5f6a-44cf-8bf7-3efca3e5e66f", "comment": "Malware payload (Formbook)", "value": "0ea373a09883cb6339962ddab7b1ad826710111758ffb711fb7f126cc7d33ea5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629731702, "uuid": "fd3abda3-ae43-47bc-9423-2d754c34a45d", "comment": "Malware payload (Formbook)", "value": "5c54b02e1b1322d0a40a2d07f20a37f4b3ed1c54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629731702, "uuid": "d5f86553-c6cb-49cd-be78-378ca085036c", "comment": "Malware payload (Formbook)", "value": "5b1c5fcda8b0e06d86f3e1db80818e2ed5874b1c866d0d5ce6e1396c17ec5fc5ee285cd4628abadf12d4db089d54ea1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629731702, "uuid": "b5e9dccd-006b-41e8-8f94-578af0e0d1d9", "value": "T133F401097341FA4FC92FCEBA98155C50E7E1E6355317EB16AC9322F84A8E7958F012A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629731702, "uuid": "231439c2-a517-4a39-9af1-cf005542c2f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629731702, "uuid": "4b62e209-410c-4454-b3ac-943a1e287d7d", "value": "12288:XbrzobZ3wou69XVvJ//H0ZMnC3dcmRKy80OObZmPmbEAuBe0984e41URRDAt:XbobZ3huGRJ//I13nEjpNmbEAu7veU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629731702, "uuid": "6e394b4b-ae0a-4674-a02c-88b9c03029eb", "value": 727040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629731702, "uuid": "455659de-bb9b-48cd-9a1b-15c442b8aba3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629731702, "uuid": "e6a9b6ba-a579-4d79-ade7-2c1785db4744", "value": "Required Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "849c6c3b-0419-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629726818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629726818, "uuid": "8e03764f-5f62-4051-9d9c-44d0561a9e2d", "comment": "Malware payload", "value": "b12fe4ad0fa9fac41bcad24d51b00efb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629726818, "uuid": "bb31e9ff-0883-4243-a4ae-93e23c0fbbbf", "comment": "Malware payload", "value": "0ec3b86cae10f9d806fbb5ec5432f587108b04f5bc52d131cf07e3b791cc2eab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629726818, "uuid": "23c2c7a6-4620-4706-ba96-e95fa6661f06", "comment": "Malware payload", "value": "1688afe7267f0744b4dcf6d76742aaa599bf798a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629726818, "uuid": "d2f0c9a0-fec7-48bb-b896-0b2207835cef", "comment": "Malware payload", "value": "e617ae28131b42a5da8194b9c57407fa986c312e4b8ad3ca52e793fcdf7cb3eb0d91344d7c825eda75d29ab01ae27ba6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629726818, "uuid": "f93f17b0-4ca4-45ae-aac8-2ca54786f40c", "value": "T10CC4E101B9C588B2D6721D31593EAA21583DBD300F34DA8F73D47A6D9A722C1E732B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629726818, "uuid": "641bef31-d8fb-4e32-b492-eaa3d3182e1a", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629726818, "uuid": "ad1bcd69-d249-4c0d-8a04-f1bf88672c2c", "value": "12288:PRZ+IoG/n9IQxW3OBse9QibSJeJGltEWZxU/x2K641qM5/rm7mhB:H2G/nvxW3Wk0SJOWyxkvM5/a7O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629726818, "uuid": "e3319484-866c-4313-8b67-36701d6dd1e9", "value": 568242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629726818, "uuid": "ddcf06b9-f1dc-4b22-a011-f70234baa2eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629726818, "uuid": "95127289-50f5-4993-8735-92bef10bca4a", "value": "Brazil Enquiry-Contratos.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d3b3279-03e5-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629704391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629704391, "uuid": "a49592f0-5b89-4b0e-a29f-a91f31bbb50e", "comment": "Malware payload", "value": "504d3c19d9721fa65e8b72b66bec00e5", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629704391, "uuid": "7357a57b-1245-417a-a299-e3ee827f8525", "comment": "Malware payload", "value": "0f445558df4103ac24d165c3fa8b6529613f28eaf1d4125970be21154de8b58c", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629704391, "uuid": "e6e0b800-2b7d-4428-bde9-e7df85ec87a5", "comment": "Malware payload", "value": "745260436f8dd487d8c761dfa346fdc8c081ce69", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629704391, "uuid": "a34c9f9a-3436-4a53-ac85-1ca8b95919ab", "comment": "Malware payload", "value": "cc783a3bf883b20d9e930c47ba7e42b975c63fc6489198870a7d4298a7022dde2527aa41c3de7973cf61b64f5a0d928b", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629704391, "uuid": "136c0e1d-8eaf-4ce1-be5e-944242d3a49b", "value": "T18C92C02DC462F574E3363D3684C88663C564B99CC107CD1EAD18F1BF6789B8A07D92D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629704391, "uuid": "bcfb329e-695a-4b90-812f-8b06775ba833", "value": "384:AKlLphgCuJVCAUnLVmzzb38c7GO3LEi/unkGuFEWPKJQITMaTHHz:AKlFhgXVCXV6zbMc7L3QiUkr+WySIgmT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629704391, "uuid": "2cef8235-15d3-4315-bab3-9b80113c951b", "value": 20862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629704391, "uuid": "4c21a61f-5001-434b-9de1-0779009608db", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629704391, "uuid": "3b0237e6-87cd-4757-8d02-ee354fea1840", "value": "PO52899031.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a71a341-03c4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Amadey)", "timestamp": 1629690321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629690321, "uuid": "8c04eb54-efe1-420f-914a-cdeb2e2326c9", "comment": "Malware payload (Amadey)", "value": "b029a2ecad997a261c4745131b72d4b6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629690321, "uuid": "3660d596-24b1-4593-953e-a675d8edf4c8", "comment": "Malware payload (Amadey)", "value": "0f5855a1d913aa4e43c39b76c1146f82ab68587b9d4843fcb45e78c1195f1cdb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629690321, "uuid": "a19a4df4-9dad-41ab-bb44-8b285901e2f9", "comment": "Malware payload (Amadey)", "value": "54250fcd94af3c2532b9375dfac6d1f9478adf1b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629690321, "uuid": "46e75c5f-bcb3-430c-9120-c7c037bec665", "comment": "Malware payload (Amadey)", "value": "f98a968f19cbf0fa9302ee48f9c9ba61d346724d59bcca600dfa0a4a2cf2a7a166c1b695b0e07563813c570cdd3bedb8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629690321, "uuid": "8418c25d-4b48-4392-a788-6f1266a44973", "value": "T175648D30ABA1C034F5F712F855B682B9A93A7AB06B3450CF53D51AEE46346E5EC3074B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629690321, "uuid": "3078ca9d-757b-4ae4-99e9-073d10f04cf6", "value": "5827762c5e305a46b906c568e5639655", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629690321, "uuid": "2b79916b-473d-43a5-a651-c8d127bf419a", "value": "6144:K4djUdsxizAxF6Kf8pU/Vy0/9bycBwQiek78MsDH3wr:VIsxsATlf8gy0/NyciRIMsD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629690321, "uuid": "11aaef39-49ec-47fb-b568-d131317349e8", "value": 329728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629690321, "uuid": "d98ba306-bff9-4879-a030-d013cc6569cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629690321, "uuid": "fc16a276-ef02-4578-abbe-64d85eeb5712", "value": "b029a2ecad997a261c4745131b72d4b6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a6b2636-03e4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629703984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629703984, "uuid": "e0b32799-428d-4648-9858-7232e6b5e416", "comment": "Malware payload (AgentTesla)", "value": "8634f2c58106bd31cf1d4b5d83eac7a8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629703984, "uuid": "4f77efc7-c706-42c5-8bca-9ef32f428768", "comment": "Malware payload (AgentTesla)", "value": "0fceee98f76ff9e22faad6db7f78262ad98f3ba577012bee4e3b42cfc7c077b8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629703984, "uuid": "628c0bea-1ba2-4fda-81e9-986182fe9aa7", "comment": "Malware payload (AgentTesla)", "value": "44cd38f234c754266b7d1698dcb01be9d44c5e60", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629703984, "uuid": "0c8256b5-9d25-4e2c-b742-4a628918af4b", "comment": "Malware payload (AgentTesla)", "value": "29e55a09423c394f8b63920fd01bda387e932e0136b77ed3a927a778387412491f6a89e2cc0c4739e47ee09ad377c442", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629703984, "uuid": "ae2ca6ac-5e77-4601-9b90-40e828e9a2f3", "value": "T10C25603C1BB92667D065D63EABD18617F04096DB3411AA5764CA0FA7B302AC2F7C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629703984, "uuid": "8b9a22b4-da20-44bc-be6d-7b14b63cc21a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629703984, "uuid": "b58476ef-b17a-4814-99bc-b9f1fafeba9d", "value": "12288:5Y0Dc9F3nC0Py3gAh/EJbjJEKJdeiFm1r59fDspVHTpKwLuEgvgXLuc4hYD1fRLX:AT09fIpFT0wqEgzFhO5RKuX40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629703984, "uuid": "a5af3540-beb6-491d-bad1-edad42b0d48f", "value": 987136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629703984, "uuid": "3b495d00-fb73-4115-b71b-c1b3b7321ec4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629703984, "uuid": "16f6321c-c152-4995-87e1-a46e032e9e9f", "value": "uT6m8uOncqxR9qm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a35a290a-03bd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629687356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629687356, "uuid": "3cd2634d-2b79-49aa-ba49-d295e0fc2f82", "comment": "Malware payload (AgentTesla)", "value": "a581855966f06fe4eae3cd4feb652f60", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629687356, "uuid": "73ac9913-3aae-4916-b397-a34e36553d21", "comment": "Malware payload (AgentTesla)", "value": "10009ada67cf6221f55a69d63be3add3302c539f64eeb8fa524cf034308830f1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629687356, "uuid": "a0367617-70e7-449a-97e5-0555a871c6a9", "comment": "Malware payload (AgentTesla)", "value": "89673bf9a97e78b58637eb447cf25da740027542", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629687356, "uuid": "f357c4a2-5e06-4124-a666-6294ed820c59", "comment": "Malware payload (AgentTesla)", "value": "b0fe10c4e7e5593075606fcc2d466ed75632d07e4f85d895676a1f3fe8149060d13debf87a72c9e94c14f6a3a8e25fd1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629687356, "uuid": "183fe869-edf4-49be-9b8a-b7e1ccc395ca", "value": "T1E3F449483790B09FD423C9339B575D30E66164ABE78BD343D013D2ADA91D2B6DF086AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629687356, "uuid": "4e7aaf7f-8f69-49ce-8e05-8a0fcc22dbaf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629687356, "uuid": "356fe0b3-ab6a-4de4-927f-f7d4c520ddfd", "value": "12288:WzkT94a4wvEfh5kpAgc8SkLjc4EKs/c4MiT56o/DXegpUneaOsqAL2qh6sehTF3B:mkSwvEp0ABhYc4b74MiTYAp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629687356, "uuid": "e801be29-3531-467e-913c-77b5ab314349", "value": 727552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629687356, "uuid": "560e7615-25d3-4432-9451-f0d5caf52417", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629687356, "uuid": "064a98ae-c133-4f81-9120-01e77badf83b", "value": "Request for quote.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47727547-042c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629734876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629734876, "uuid": "0fc78ef7-5bce-4071-b7b2-b652c943fd0e", "comment": "Malware payload (Formbook)", "value": "3f79af5c415898c279c6d5f76e8dd710", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629734876, "uuid": "e517d649-38a5-45c1-b348-5f37f0625c54", "comment": "Malware payload (Formbook)", "value": "10a451fc1e7687549d6e116dd5ff984f3468de4dcc6e1494ed16c6c501668eb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629734876, "uuid": "0f96fe02-7664-4850-9541-74c86d8b58e9", "comment": "Malware payload (Formbook)", "value": "6d633461533eca9413ef699b7e68d245261a88c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629734876, "uuid": "608ed95c-d7fe-4407-8b02-f41959d9684b", "comment": "Malware payload (Formbook)", "value": "14cf7e0710a1b98cdaeb2b936f74c7717b332fa4731d65eb65dc85ab4805506a42d0732fd0abbc72bfc73a309036cbc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629734876, "uuid": "158bb19f-995b-494f-afb3-b7e9a7612041", "value": "T13D340205072CCA9AD034047A985D58EB32752FF629FF15FF97A0B0A25678ED0A6D0BD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629734876, "uuid": "6d050f96-bd4e-4c0d-96ed-02fcb8db7c9d", "value": "6ef74f7b87fa15b6df54d064a5b8ef31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629734876, "uuid": "5e0e5c3c-13f9-4fec-b3ad-7ebda93b1604", "value": "3072:J/CB+xwnznIlX2jo4mDEdGhVbRryF/vo8QHGCcBil1LY6G+WaF9M6XxcaG7:JXWzWXYrmD4GhVbRMoGBicxcMYC7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629734876, "uuid": "c3966797-0d5f-4f71-a808-4c5690cf02fb", "value": 233794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629734876, "uuid": "985f7837-4c7b-47e7-8d97-2a8e8ceb8f1e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629734876, "uuid": "33cfb9ea-7eb1-4845-ba63-adcfda183616", "value": "Fatura - Ex#35175382.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "642db03e-03eb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629707007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629707007, "uuid": "a58e133e-3489-4fbf-abd6-73d29fead19f", "comment": "Malware payload (RemcosRAT)", "value": "db43d988d8398e4e90556d54c08a2be6", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629707007, "uuid": "7970576b-d869-42f4-9310-5e79bef7f078", "comment": "Malware payload (RemcosRAT)", "value": "129dd1cec99453a49200c0801272e5aa5d4495c58779f902b8785df14e79dd0e", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629707007, "uuid": "b55e4f13-2d34-4818-a0f1-c81296dd4aae", "comment": "Malware payload (RemcosRAT)", "value": "89d5796f0f2e30e2b3129e86f7ea0febcdaef7d1", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629707007, "uuid": "e1f96094-a403-4381-80d4-1caa11d017fd", "comment": "Malware payload (RemcosRAT)", "value": "444b3591ef02d01f679133d0ab40cb9af2835d5f2ec1fb10a3dbbe83a876e2e4df40faaafdad9b2ff28e9d8db796c7db", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629707007, "uuid": "c4ae9478-0d27-420b-a2da-039362b09a52", "value": "T1B6358F31F2921837D6222539DD5BE7AA5B39FE40292CBDC62FA51C5C9F353803826367", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629707007, "uuid": "6d7c2391-86c0-42b0-b852-b859f790cf54", "value": "12288:PnCFpZeB7uGHKKaWU8drn/1iNyhpyv0oM+6yRXOuDvrq8EU0th6gG1t:PnWpBGHK4Um1dXq0oXec959n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629707007, "uuid": "04d9198c-1dd1-4ffa-936b-62772fe75920", "value": 1150976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629707007, "uuid": "9cb0e4ee-33ed-4750-bd32-b7c844523c0c", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629707007, "uuid": "ca357892-24e1-43e0-b6e6-c996d1e84202", "value": "RFQ_EW14416 des neuen Auftrags,pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1958729-03dd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629701151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701151, "uuid": "8fab0495-c9a0-4153-9a65-518a0187d945", "comment": "Malware payload (Formbook)", "value": "dbac9d9bd8c475d5d62cc69209ff4d92", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701151, "uuid": "64fe4fcb-a097-4432-b8a4-f814f392158e", "comment": "Malware payload (Formbook)", "value": "12ce6adbd6da928e954da05cd0363c9298538503bfa7a7778110bfa87514adf6", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701151, "uuid": "5f940b9b-5ae0-4a39-beeb-9bdc27f984d7", "comment": "Malware payload (Formbook)", "value": "d4d68c09666a7760f024f6af52922680dd8bc820", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701151, "uuid": "1038ca7b-bfe8-417a-a223-784663dd0c5e", "comment": "Malware payload (Formbook)", "value": "89fa1961b16767045cbf6d685230cad07434e927e77a7d6d8edb7f7ea36abdebce14a0793952f4249d468a116b34d8a0", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701151, "uuid": "16d1f03e-f42f-4cbf-a58c-1a9725d87df7", "value": "T1A775084B746B5392C50F1AF018EBB52CD2687C8940DC19CA4C6296DF3C609EED395EAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701151, "uuid": "c00dff8d-d00e-4263-a0ce-8ed83ae99abb", "value": "1536:SNFXMFDRYYYYYYYYYa2YYOYdn9Rhf9t8WYdkUNFfKUdn9Rhf9t8WYYYxYIYYYdkq:99", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629701151, "uuid": "d77581aa-bb05-4b30-a294-cfa2925c57d9", "value": 1672937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629701151, "uuid": "7ae6bcd8-445d-4dee-b7bd-249584bdbe0c", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701151, "uuid": "d87f2b43-6af8-48d9-b10c-4abf3f4d06f7", "value": "RFQ Ref_00 - 081821.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40107a22-0403-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629717254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717254, "uuid": "2f62b250-3bfa-4647-86b9-3c8f737a990f", "comment": "Malware payload (SnakeKeylogger)", "value": "c3932f4e17c3577befc40c611499828b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717254, "uuid": "da8da277-3b5c-4641-9456-096d0f2e02ca", "comment": "Malware payload (SnakeKeylogger)", "value": "1327964aa365924a320d99bdd9fe774b46c76d9b16eaa4873e067a7d4413fa83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717254, "uuid": "1d9017bf-13d7-4143-80a5-01e9cfd42666", "comment": "Malware payload (SnakeKeylogger)", "value": "cd8241d02f93980489800072f1b1663759be0075", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717254, "uuid": "c2597c8c-334f-4b47-b9ce-2d4fa31e154f", "comment": "Malware payload (SnakeKeylogger)", "value": "fe2b08132c6fa6dcd7998bd7e34942f74fff9df4380c687fb50393324e55004b246c9f2d094fc7ff8e2c7369bd8916f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717254, "uuid": "7b33de1a-7264-492a-808f-a5dd906ecbc2", "value": "T19DE4BEB171E78A96F11F8A742538BD5403B131F3A9C699391B16614ACFEDE983F4820F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717254, "uuid": "1c5235a2-6ff7-403b-b8f6-d968cc709b93", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717254, "uuid": "0604d593-d3ea-4743-a97e-a4de7e0085c9", "value": "12288:T3uSFd9ZlUzfyNac3dI98FuccKBuxT5JOEPpBja:CSFd9+aa+dI98FuxHPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629717254, "uuid": "da829750-140c-4aad-b12e-7042badb8d5a", "value": 692736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629717254, "uuid": "0dfd1a66-f718-4dd7-ba9a-8fac13d6f5a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717254, "uuid": "a88c052c-1564-40de-9313-cd2416095d59", "value": "MACHINE SPECIFICATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ad55d99-03fb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1629713836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629713836, "uuid": "1a2eacf4-0437-47e6-9bfe-f0ed11325e26", "comment": "Malware payload (AveMariaRAT)", "value": "13385b79506993ea47687aeb8f64f3b8", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629713836, "uuid": "01aecfc5-764f-435f-b762-3d42f93803bd", "comment": "Malware payload (AveMariaRAT)", "value": "1430490e98890154380a156e19dc99e32ef9a5c95fcd14d30469f444812772ca", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629713836, "uuid": "044bd95a-b632-421f-9b84-8910fecd246c", "comment": "Malware payload (AveMariaRAT)", "value": "a269d076d60979a70b432f01b914dbdb6523a1bc", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629713836, "uuid": "64ecf51b-3362-47fe-aba8-19ffdd16a0ba", "comment": "Malware payload (AveMariaRAT)", "value": "a1ad438494ffdf62b1c6ad5cc19a9d53b83a71ffe29982abf96a44e33c344075f5adff8c77bad0be16d095609a114ad0", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629713836, "uuid": "092dc2a7-9819-4da9-abc8-a398a9e8f51e", "value": "T123E412057FC8EB8EC67F4E379D60242087F4D4761B52E3195CC627FA2A4DB858A2439B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629713836, "uuid": "97fd8626-d401-4ffb-a2b6-028a2923f39b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629713836, "uuid": "05ee8846-ee2d-4ddf-aa48-dae489448131", "value": "12288:RFUHcP/5GJ4RiRvvivAKL7P5Fkn1Y/U+TrIjJBT3wV6Vt+4z0gEV9xCkYhgBJ:RFUktcvi4Kv501R+Tr+AV6/70n5CI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629713836, "uuid": "2365ba83-91b6-49f1-9eee-adc9088e07ec", "value": 719360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629713836, "uuid": "3bc9b2d3-33da-468e-8d85-fdbce172506d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629713836, "uuid": "7efe51cf-66df-4172-991c-af2fc1922a9d", "value": "DOC_098765678.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35857cf3-0454-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629752026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629752026, "uuid": "f3b77444-0e98-43a7-9f9a-2caeb3d0479b", "comment": "Malware payload", "value": "0afb31c3e6018c85df11d2a25a581079", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629752026, "uuid": "94ce449f-ba56-4835-8cdc-6321d2f10728", "comment": "Malware payload", "value": "146519fa04a20f7588d3ecac58bf5bd9f6061c17a9a246bd7bfadfd8ee8d818e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629752026, "uuid": "ec5710ae-d483-4075-8d68-d0b7f9fadfe8", "comment": "Malware payload", "value": "b8459e1f0a719c0adae628b0f1336837b3a5c9f5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629752026, "uuid": "d3c9ef64-963a-46fa-a1b8-84c0d181e297", "comment": "Malware payload", "value": "79e88f11c3fb9aabd50f806e679704ce1a7efe083def9b8a77fa37e348a8f141a7b4dded0e2c3a2d247c733dc0da09b8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629752026, "uuid": "814cef0a-cb84-495e-ab72-9aa12e9e7cac", "value": "T1D655E93815F43937E1B9C339DEE4482BE6D4B45BB211AA6670DF13674342A42B89327F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629752026, "uuid": "6e0682cf-b6ee-450c-993a-4ef11786e9bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629752026, "uuid": "b62ec124-9504-4a57-a72f-91e0bdf80f1b", "value": "24576:wc8WlocycWzNeuMH4weVFnEnHHpaOkrZIUdXcPbRxYRqClAXSMP:ebweVBoMIUkRqAh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629752026, "uuid": "9c4d24f4-c5dc-465b-854d-04a26a244fa9", "value": 1372160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629752026, "uuid": "8d8ab312-b6c7-4ffe-8984-7f5c69d1097e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629752026, "uuid": "ba8b1599-3f89-4bbe-a206-a09d90df3e02", "value": "0afb31c3e6018c85df11d2a25a581079", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e70b35d-03a7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Amadey)", "timestamp": 1629677738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629677738, "uuid": "98f83073-bd70-4d1f-88f1-bab3aa0d2388", "comment": "Malware payload (Amadey)", "value": "15ec7577ee3ae8faaf21e42f168b3513", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629677738, "uuid": "d86d26b2-3f1d-48cf-9836-ae7e0fb2dbec", "comment": "Malware payload (Amadey)", "value": "156f593887f7c9fe2e4d888c88a3b895eed52c4795fe48db6ecc0696b54ffb49", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629677738, "uuid": "a77baadb-8742-4140-b692-cdee0d74e3e3", "comment": "Malware payload (Amadey)", "value": "49327277c9fca515f7a4e95be824ba355004d469", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629677738, "uuid": "5c32a0b1-153b-4e4d-9a3c-b86df5dfdc36", "comment": "Malware payload (Amadey)", "value": "df2da6bf7bcd74c0867aa71d217a5b8d9999a4e8367ea3038816afc3ba916ec1fe8da47dd229ca3620066a2311574e1b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629677738, "uuid": "50663ac9-e54c-4a77-a587-2ae7e14d176c", "value": "T1CC549E30ABA0C035F5B752F459B583B8B9397AB1AB3490CF63D116EA16346E8DC30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629677738, "uuid": "9e75f1b1-a765-45d5-91fc-c78b492c30a7", "value": "0651d9dcd3efcdffaff927d730c581e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629677738, "uuid": "fc96f526-7156-4263-8a1e-f42716637a51", "value": "6144:ZJfygNzA//V2cdMxh0Rk0yxGrvERHUr74z0OiE+rgeJ:bzN0HV2Vxh0+VGrvER24z0jEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629677738, "uuid": "6c21b252-533c-4ec0-a141-41ced3a59b2e", "value": 290304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629677738, "uuid": "a7c0ca8e-20e9-4cc9-8e2c-dcbfc837a6ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629677738, "uuid": "67f22228-c22b-4887-bbc7-6245f6e5c87f", "value": "156f593887f7c9fe2e4d888c88a3b895eed52c4795fe4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ee54410-043e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629742673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742673, "uuid": "b2f6f402-c6d1-4193-93d1-d8ef8616958d", "comment": "Malware payload (AgentTesla)", "value": "d61e2bca2c69bac7c76cee87763ceda4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742673, "uuid": "666033b9-28e3-4311-bcbc-7f235ebf388f", "comment": "Malware payload (AgentTesla)", "value": "15a5b08b916245fd666e172d308831ef96e4c68b63c9a0c57aa9b83519ebbf35", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742673, "uuid": "591d0f92-5e79-4026-9f2f-865c9bd0ac5a", "comment": "Malware payload (AgentTesla)", "value": "27e65b93321224f683cab483fb136427795662be", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742673, "uuid": "3b532d7e-a880-4af6-a3e3-5fc7b4d2f38a", "comment": "Malware payload (AgentTesla)", "value": "f8067be75aee913650268eedaeecb7ade782c01206cf700cf07649fee519af0bd4ccbe59aa4b62e0d52a19d6882c0497", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742673, "uuid": "cded9a79-3f0c-485d-bc29-382c7588f4ae", "value": "T1F4D4E7012AFC541AE0A1F0375B17CD27466F298FD2F0C681954AF96FA933AB24B5C5CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742673, "uuid": "fd16afe4-d242-4907-9d99-2309c314d59d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742673, "uuid": "6d9b29bf-37e4-4df4-a770-a40333918128", "value": "12288:bIpywOCHkg02/xsRGkKpesqC+n7isASP6:SHkISRGkKyCQH5i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629742673, "uuid": "615e8cd2-3af0-4c44-9680-ed96ea988757", "value": 607744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629742673, "uuid": "dacb2df9-e211-4cca-ba5c-bef70be7d7ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742673, "uuid": "154fc566-ac82-4939-a555-469e44322598", "value": "TT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5688b504-044b-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629748216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629748216, "uuid": "8c619a63-d865-49ca-bc0e-a1e3e324e98f", "comment": "Malware payload", "value": "264bfd159c2a87324fbf85d14a421802", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629748216, "uuid": "5c4fcfd4-7907-4a7b-948d-d1cc45fda92a", "comment": "Malware payload", "value": "1618dcdf8e1300e53b57a5579299b14ad0033f04fe5abed32c7c4b1bc01e187d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629748216, "uuid": "72d6878f-4d9d-4f2e-9ef5-b2c3a8dbc203", "comment": "Malware payload", "value": "cd29a9eedcad652b59064e6ce828ddeda048e99f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629748216, "uuid": "2f26a37c-61e8-4af2-a4a7-2c0d6e66a207", "comment": "Malware payload", "value": "b6a7b0a45fdf13322ff7c91512d90b1d3bedb8793d3f24c77266f12602b209d6eae71025f7e8a989ee84e5762d0e035a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629748216, "uuid": "f05fa27e-d4e6-4275-b720-45f185bb825c", "value": "T1C3A4CF30ABA1C035E1F651F855BA837CB93A7AB16B3440CF53E566E916386E4EC3074B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629748216, "uuid": "d30bb935-747b-4e25-bfa6-677617e55909", "value": "fc0498b1146c20d46fc85d16ea8a2b68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629748216, "uuid": "96abe43e-88a5-4c7c-80e0-f69e8ebe3970", "value": "6144:+e1f4pZv6XcRDpNZg26W2he3b5coWSwOdcpMsZKqe9a8Mlz+/V/QLGEifTHmcr6I:NfgZiMRDtg265heNJxrWZ7hCz7THwc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629748216, "uuid": "51bc589e-143c-403b-bcdb-e98f99c9f08d", "value": 466944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629748216, "uuid": "59b9223f-2497-4b55-a0fc-fe437d132093", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629748216, "uuid": "30099e8e-a352-4509-94f2-50d051ff15f9", "value": "264bfd159c2a87324fbf85d14a421802", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f3f66e0-03df-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629701711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701711, "uuid": "faf87da0-1eb6-4268-98f1-e563b7edaecf", "comment": "Malware payload (AgentTesla)", "value": "6a682b613ffff135cf642e175b8f08cf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701711, "uuid": "68c954c3-47b7-4d2e-a2c8-f8377ec2b75f", "comment": "Malware payload (AgentTesla)", "value": "165f0afe580d4a460e37cf00e6d36fdbec0404559a7c2aa1ad58340473a8d528", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701711, "uuid": "f8ebaacf-e2b1-4595-92b6-9765b3ad1c5f", "comment": "Malware payload (AgentTesla)", "value": "41ec0171a70f98ac69fe4a2c4838ae98ac193d97", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701711, "uuid": "e5e65b50-f9f2-47df-8a2e-13ca00c75cae", "comment": "Malware payload (AgentTesla)", "value": "72821e551e7227a5c532ba6252994c73d0aa3a9f0d0bec06400d5d8282443287770543353d2a2eec7208bca131052366", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701711, "uuid": "c1660cc6-7ea4-48e8-923a-85a178efa1d1", "value": "T160D43342B822E92699DBD812F77AAFB518E2C0EE35153E0C7E874F4CE4EC752940719D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701711, "uuid": "af3aadeb-3434-4f95-9138-561b61695f2f", "value": "12288:eTGq/VB2JI0BsysmtL7eN0w5/TAu592U7Udq6aqS/+14:AGAibGysmNm9TAu59sz4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629701711, "uuid": "98f85b41-cf09-42e7-bd0a-44f7c8d7fd38", "value": 625234, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629701711, "uuid": "41a646ac-e959-4230-bf10-35ec08b0274a", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701711, "uuid": "7412d6f1-a36f-44c4-8bc7-f14be1e8369c", "value": "SFOWIK25-pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19e5ec49-043b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629741242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741242, "uuid": "0ad47983-3cde-40c1-8e01-911ee6eecd36", "comment": "Malware payload (AgentTesla)", "value": "ef91a695fc5aef7d5c6630fd4e6b5a4f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741242, "uuid": "6f37e40b-14ff-461d-83e2-c95f5270da09", "comment": "Malware payload (AgentTesla)", "value": "16a5798db6638e9ff43f3cddeeec26ee68c9294637d2c32ef8440f967dcff243", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741242, "uuid": "c1053669-25dc-4256-a968-3bfa2cc32ec8", "comment": "Malware payload (AgentTesla)", "value": "36e11a1a53a68ac4eb081240062954854897ffbf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741242, "uuid": "8f3f8dc9-a65b-45d6-8110-d8542695e9f0", "comment": "Malware payload (AgentTesla)", "value": "d737cce0cb11c6265dfe9d3ad017817a3e1c00deed5c1ce21a921e8094c039da6ddcf7a5d165ad4f365256b779733f1e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741242, "uuid": "31acd49e-b74d-446a-bc99-1bf13c4804ef", "value": "T1B405F53D1AF91237D1B5C365EBE58423F149985FB410AE6A6CDE07A7030BA9734C722E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741242, "uuid": "4ae61f9c-b4f3-4496-8b53-4ddfd4366add", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741242, "uuid": "cf29b485-b3eb-4bb1-8158-e0ebef7876b6", "value": "12288:9gv5ecCggsMSvFIAqdI8dxgd8c6whSnvIM5XYS9G8AEeU/YNXCvg/6D:ZsMkT1nMkWIGL90U/u7/6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629741242, "uuid": "a2e6c959-3d73-44ed-b94b-fec639bdd569", "value": 872448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629741242, "uuid": "877ec340-ca16-4a70-8268-e9f0af625f73", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741242, "uuid": "3ff22808-0937-4daa-a01d-cde2987bd9dd", "value": "Orden de cotizaci\u00f3n.xlsx______________________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7842f8f-03de-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1629701644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701644, "uuid": "76c4ef4b-6521-4b6d-bd48-cf4cc4da0321", "comment": "Malware payload (Gafgyt)", "value": "9de53aecd6062ac0897c5269d6c471f6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701644, "uuid": "b4079cae-04a4-4b79-9ae7-c57a05a02179", "comment": "Malware payload (Gafgyt)", "value": "1738a5f0a7adda72e843d9c7f1b08c4e27d5e5656d49fbd26d439243812c49d7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701644, "uuid": "89bdef2a-5d70-461c-a6e9-615249b0c881", "comment": "Malware payload (Gafgyt)", "value": "93f33a4bf55b2dbe59d9722519fe83ca69924ffc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701644, "uuid": "38308095-dd7a-4f6d-b551-67189113bbc5", "comment": "Malware payload (Gafgyt)", "value": "73863dd129f14ed0565c281ee85e41da4f227bf1f1ea99ba9fa66230020f6d80a89ac9c77b3230232884300fad69d220", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701644, "uuid": "07d33836-7e23-49a1-bef2-6cfe39b791f6", "value": "T110C3B517BB618EB7C85FCE33099A4901208DE58612D96F6FB2B4DA6CE74B84F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701644, "uuid": "d5e05b7b-49a0-4246-9702-7250c97f4431", "value": "1536:WjeTXSJ6F+09YzvNZyoyCDf+wF8sTj2/Qh/pI679l5Mq0PU94JermW5jFz0CsTs7:WIHuT+wKRQRxCStrmW5jFz0DTsGk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629701644, "uuid": "b01f7537-4f9e-4d25-80fb-ac5731dc6f16", "value": 122462, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629701644, "uuid": "1eae158f-8af3-48b3-a5aa-95930300982f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701644, "uuid": "e350e579-5097-4fa5-b58b-ca2eed5d3fd5", "value": "9de53aecd6062ac0897c5269d6c471f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "880f472d-03de-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629701484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701484, "uuid": "9bd3c0f4-3d69-40c5-9a37-6bb7b5519f7c", "comment": "Malware payload (Dridex)", "value": "f0242add3e62b4bda6a1f3e38e98a73d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701484, "uuid": "b9ab760b-e6a0-443b-b555-a434dc4a4660", "comment": "Malware payload (Dridex)", "value": "18b60baa2088c1d38889054818f767eaa9098f1371b01e1fbbb6941395bbd85b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701484, "uuid": "98642189-5bb7-4731-8d32-9c540dcf1916", "comment": "Malware payload (Dridex)", "value": "857af8c917c75720e5787b372612ff1f15a3f7c0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701484, "uuid": "339dc408-2a0e-4560-ad88-54944409b875", "comment": "Malware payload (Dridex)", "value": "86f37c20ccacbd0c2c0938a0b86d81d1cebdccc0ebf22a272bdb4effe187d01b3734c30ebbf18ccec9e197c5b367acbc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701484, "uuid": "a8eee7d1-e33b-47ec-963e-76a2280b5153", "value": "T1FB14D049D25B23BBF9130074A8E276398613F9994785DB93FA41C97BE9D0EC24738363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701484, "uuid": "a7ea3daf-31b7-4329-a066-1042d8a88ceb", "value": "8fb9c33d660a73e17ccb39e76d1e6039", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701484, "uuid": "df87eec2-7d91-43bc-ab1e-df59b57d5653", "value": "3072:ZhYiCQXKgH7xFjsDlyk+AZ6cGdgwQDDu15/aE8t7grkVCuLnT:z7xFGlyfAZ5DDuLyTzT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629701484, "uuid": "aee3ba86-4eee-4814-8903-1c9cff2f22dc", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629701484, "uuid": "50f5537b-3122-418b-ae86-dd3f18bdadee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701484, "uuid": "c7708f3f-50d1-4f35-9657-3d9fab518a72", "value": "Pk52FX0q62R4XoO.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d7916c5-043a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1629740819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629740819, "uuid": "ec2ae8e3-305b-4713-882c-2a4dd0285372", "comment": "Malware payload (njrat)", "value": "313127fe0be0fa66f400ae7c798f779e", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629740819, "uuid": "00415a05-319f-4ef1-b513-8d450a58b8ee", "comment": "Malware payload (njrat)", "value": "18cd7de0cac9b4d2ef7e0078fff0f0263859799b0e5ed93a3bb1d50c2c324752", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629740819, "uuid": "f1412b1d-232d-4785-af9c-9319e910c05e", "comment": "Malware payload (njrat)", "value": "e25e51a5ee66f8cd18cb35830509fd95b62b4d40", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629740819, "uuid": "5fd3f4e9-63ff-40e6-bbbe-dbfafc9c049e", "comment": "Malware payload (njrat)", "value": "e68c876346a2739a65ac6927cfb7a11f76989a8ff3bc446ee8162dbe6213b2716f942b77d4e9a274637228b0dd1a053a", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629740819, "uuid": "06851c04-91f9-457d-84c8-a996f9cd6e3b", "value": "T104012B0B5D29CDDB0049F18202D34DEDC6604AA74F806E7A247479476CAD62F6DCCD87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629740819, "uuid": "61f625a5-8a39-42ca-acf0-32fd7b401754", "value": "12:0ChGF2MBNYMlXNoxAbOJk82cG2bwELPdg3Nfd+aaiTC:HgF2SNYMlXQXG2UE7kNEuC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629740819, "uuid": "fe3b6f7b-f13d-4ada-b239-5254196c5749", "value": 728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629740819, "uuid": "a7aaaf56-9772-45fb-9cb5-db0db9f04b9c", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629740819, "uuid": "c90c84ce-938e-4c88-afb1-21bdab480eb9", "value": "S0187365-Paid-Receipt.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f7ed957-03e1-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629702570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702570, "uuid": "b46cc8c3-fd39-467a-8b94-85865943bbc8", "comment": "Malware payload", "value": "2d74cdf4752fed6c703a0756abd65c18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702570, "uuid": "86b9e977-3c7b-44b1-82a2-823b2186b97e", "comment": "Malware payload", "value": "18ef72c85fdca7a10c9fc38ae007f755ab938c526f48079d9ada4b5e4ded4b9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702570, "uuid": "19bfccfb-7060-4740-87a5-ac260fc6fed1", "comment": "Malware payload", "value": "7ba159b78bdb0e019c17eb7949c688fd83986523", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702570, "uuid": "30baf10d-529d-47d2-8e3e-2900599f4734", "comment": "Malware payload", "value": "8d5b37e9614be908470e5678a144a0712911b111d1f5fffd66479c15c0330ca94a696b97e280afb270d10a29cb6dcd4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702570, "uuid": "083fd971-60ee-4cfe-a208-0663e93152de", "value": "T18415390661F37831CF92FFFB962542B15C407F50DA1779431AA1B8048A396A7FB2A4F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702570, "uuid": "7c314d7f-d713-4fae-8cec-546502b38e0e", "value": "294cc3722913504c95d229781103fe5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702570, "uuid": "65d16a5c-5b1a-41b5-95e3-936588037959", "value": "12288:F1JL2cht6G8ZeBIkTuuRRt+UrTzXqrWer2wGWHv:FfLQGoeBI9ubhfuaer2wGWHv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629702570, "uuid": "353276f1-0c85-4727-9d33-5eead3d748e2", "value": 903680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629702570, "uuid": "4f96fb2b-f7e9-4fb5-9937-d189c05d6b23", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702570, "uuid": "ad212273-d04e-4fe6-be83-6d2a34028dc8", "value": "Steinemann RFQ_EW1441677_0023pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bed9e33-03dd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1629701007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701007, "uuid": "eade76ab-e837-4a29-8a0d-5c6d828d648d", "comment": "Malware payload (DanaBot)", "value": "3906bd87156d29380e32e4aa14cdb61a", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701007, "uuid": "2be1abcd-adb5-43cd-a186-9a292c1265d0", "comment": "Malware payload (DanaBot)", "value": "199bbc42e66411fd345d097585df9bddba75ff75d0b927fc27d1259348f49793", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701007, "uuid": "a58e8a6c-e233-494c-863c-26d714d83aba", "comment": "Malware payload (DanaBot)", "value": "46bae4add1c9a9c1816a3b762d9dd13a5dd102b8", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701007, "uuid": "173542c7-04af-48e0-859f-9331ce56880a", "comment": "Malware payload (DanaBot)", "value": "d62aa54108c18ba92fe72a2cbe6242f216a60a586dc4d7f47469d6a0ee8eb23235b0d1c6605631b9c16d1dd4c6ee12ad", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701007, "uuid": "71fd6d75-c5f2-45d8-94b6-b37086036732", "value": "T1C6D4E0307AA0C034E1F312F859B6C7ACA9297E71EB3496CB62D526DE66346E4DC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701007, "uuid": "6a2bbb6f-b7eb-4a66-a1db-79b2fd8a0f92", "value": "290057969690a7d76b2c7d89d0ec8c78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701007, "uuid": "3784bf81-68de-4820-9b62-3b4447702fd9", "value": "12288:BR/Myxywm00uwkZLMWfc6CcCuG3jz7nWiYeA1wdtavtVPNZMFOi2:gyxywRe49C9uGnWiT3Ef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629701007, "uuid": "20561b02-2bb1-49bc-9c57-32d1f07de90f", "value": 627200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629701007, "uuid": "8e939672-5d83-4d78-afc3-47c7808ac55c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701007, "uuid": "d030d138-9f73-45fe-85ef-f2126981d0a7", "value": "3906bd87156d29380e32e4aa14cdb61a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c723f4e6-0425-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629732084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629732084, "uuid": "700a972a-059a-4075-b2db-7b7e05475342", "comment": "Malware payload (Dridex)", "value": "fcc4e3f10d677af49364574c390ce41b", "object_relation": "md5", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629732084, "uuid": "6850c5f3-d98b-4d78-80f4-7adf183a30fb", "comment": "Malware payload (Dridex)", "value": "19d58cd2a0cc6d73d21a49abe73938e161642e94fee443dde7a1edd7e13d4a3f", "object_relation": "sha256", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629732084, "uuid": "0c4afcaa-c59a-4fa2-afeb-e662d124ac74", "comment": "Malware payload (Dridex)", "value": "dc255291e63905f4f4676fe93004a76559b92188", "object_relation": "sha1", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629732084, "uuid": "ff520572-e3c5-48ea-abfc-5cedc16eb622", "comment": "Malware payload (Dridex)", "value": "d67d70d8776ef2b365c081d88f01a8aee959b6da1f385c01063d1c20e233742007213bd584cd7ab665925fc77496d592", "object_relation": "sha3-384", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629732084, "uuid": "9a174cef-b9f5-4bd6-83b4-3a51a876190e", "value": "T11C64122CC5F3D57ADE560CFF8DB915D2B3638A33C29249C5888572EC1E120794269EEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629732084, "uuid": "1dc9fa9f-0239-4bb7-a9af-b327977903e9", "value": "6144:oLbS9JkqbkFdhswz+TXO/J6t/VYfASkKTzZYwPMPFde/Qxx2u+OA+NT5AE:sSPkqQ3hMTX7ifASkKTzSwkPFduQx0un", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629732084, "uuid": "07191cf3-e3a2-4ed6-ae6f-7daa4c4202ae", "value": 331551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629732084, "uuid": "779cd22e-26b4-4099-9286-2d44ea12e798", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629732084, "uuid": "c9b2915b-904c-42f2-88e5-6dbcd07d32e6", "value": "Scan-5234419_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7562d6e8-045a-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629754710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629754710, "uuid": "27cf65dc-ed84-41e0-b2c4-24926dc333f7", "comment": "Malware payload", "value": "b99632441466d549415fd1030450fad3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629754710, "uuid": "3493f928-5f15-4aa1-9502-210dfc84e91e", "comment": "Malware payload", "value": "1a233cd70753a0c450148f0df3dc5881ef7b5bc7449a2da7da4bffa7f3d959b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629754710, "uuid": "a5c4c076-8ba3-4001-b2ff-dfe688f04f9e", "comment": "Malware payload", "value": "93b183bda957d92112b17b4b6e9c4f3e6f1a8ef9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629754710, "uuid": "0b3e9810-7d91-4251-81a9-e31433dd9e9c", "comment": "Malware payload", "value": "a3b2fe537b3810ca131175dd216764d2874b7e51091be81a20190996ceefedf5854a18c00a48a6faef5dfa175845cca5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629754710, "uuid": "17d17c99-e99b-4f02-aacd-c4276914747a", "value": "T1DB447C30AB91C034E5F711F845B683B8A93A7AB16B7450CF52D52AEE46387E5EC30787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629754710, "uuid": "1be19e32-7202-425a-9ceb-17bf7b5942b0", "value": "4dcb3c3a3fe5e134dd41266130cc79d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629754710, "uuid": "e25028d1-725e-4e18-9cca-3a95378b89b5", "value": "6144:h4Ep4+Kmej3P/w9ajxNogYIaCaRl4MLDiZyjEwm:Np7Km6f/r0Y+llLDwyAwm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629754710, "uuid": "85649f19-f5c6-4a2c-ab90-504de58cadd6", "value": 278528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629754710, "uuid": "f47fc9be-4f91-4d06-abb7-a0637ffa6ae8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629754710, "uuid": "eeea3623-4894-440c-9850-bf0bcafb5797", "value": "b99632441466d549415fd1030450fad3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b81c8821-040d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Cerberus)", "timestamp": 1629721751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629721751, "uuid": "5005d06c-0a08-4c0a-9689-9735086d7903", "comment": "Malware payload (Cerberus)", "value": "9e99e0232567b19ec3e1cf763cdc5ef0", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629721751, "uuid": "2c41d78d-ab9c-4f8a-ae16-229399fe9bb5", "comment": "Malware payload (Cerberus)", "value": "1ca86bc9060a5a18bc7125be12eeccf88f7a812480d351254b5e19e838536dbd", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629721751, "uuid": "a0f4d4b3-3edd-40c5-b69d-f3ccb9ecaa22", "comment": "Malware payload (Cerberus)", "value": "0cea6346cfeaebeec3153102d96db22d97e18748", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629721751, "uuid": "8e3056aa-5a06-495f-b447-0016050401b9", "comment": "Malware payload (Cerberus)", "value": "9b79b5a146876ed45fdaf306a5072389af65db8736d4458868f9bba80cb1232968d9518e27ac9467783fb52ca7c254e1", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629721751, "uuid": "2fcfcef5-f0c7-40c0-ad3c-441f5cb42663", "value": "T162F53356D393C51ECB1B837681937612B6B274ED82918CAD473B00965CFF9A09B0FCA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629721751, "uuid": "f81e94f0-71c8-45b2-9000-e44122e92bf9", "value": "98304:4j6d0uRnz7Z7K/Ktmfl6onLEKjPqFRuUm:4jiNz7xK/KtmooL7qXm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629721751, "uuid": "38cb622f-0b9d-4de9-a0ba-ed254153f563", "value": 3490205, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629721751, "uuid": "cfc3894c-6fcb-422b-afef-de14c14761b5", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629721751, "uuid": "f01b7016-cdb3-4b50-9745-0e61713dfcbd", "value": "AndroidG\u00fcncelleme.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c855a90e-03f1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629709752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629709752, "uuid": "2906b752-76f7-4348-8a47-57508ab8b51f", "comment": "Malware payload (Loki)", "value": "50c7ebc89793bd7c8ba93468efec11dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629709752, "uuid": "ebd334f5-647e-468b-8c0e-be9591a115e7", "comment": "Malware payload (Loki)", "value": "1d6fd54291eed895054d2c88063cadac20c03b9a806b6eaec65d8a5e20af560e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629709752, "uuid": "add5b661-baa0-448e-b916-c58216e7579e", "comment": "Malware payload (Loki)", "value": "803ac40bd7cc00447efc9dbf81012fe43d67c593", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629709752, "uuid": "71ff5a74-c95e-411b-a46e-21e12a44e685", "comment": "Malware payload (Loki)", "value": "41ecfb1eb9a34c7830cb697a406deebd2b5d5f0023f8cedf030f8bb369ea95447467892edb16e917887c144b34c76d93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629709752, "uuid": "6f25dc09-b907-45a2-bc9d-bcc21207830c", "value": "T170F4D43C19B91637D1B5C365EBE59423F148985FB400AEA9ACDE03A7430BA9735C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629709752, "uuid": "62beb55e-10c9-4544-869f-14aac61ebac0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629709752, "uuid": "33b2e46b-abfa-428d-a0d2-768c4e3daf8c", "value": "12288:shVsgnLAc4C+E/cZOJyx1jiiyWFbMx6JcnNCqtxY:shVpnM/E0dx1jiiyW6Xn8OxY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629709752, "uuid": "b8482574-04ee-488c-9b36-bd3b49dceb60", "value": 771584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629709752, "uuid": "825fdc20-6fdf-4647-a2c8-c9ac45403a28", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629709752, "uuid": "e9465e38-87a1-4e27-8654-b3013ca594c0", "value": "SecuriteInfo.com.Variant.Bulz.627351.21436.3623", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f02de0e4-043c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1629742031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742031, "uuid": "8eae0aa9-25a9-4979-9596-5d95b72de9aa", "comment": "Malware payload (NanoCore)", "value": "8280b726f595c9a7ebefc39dac6457f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742031, "uuid": "5f5c69d2-29f9-4657-afd8-f8dcc028a257", "comment": "Malware payload (NanoCore)", "value": "1e9a5e53f3059fcc0df42a4f6f504a4f7ad2e1ecd05f7c8cf0ca8bd7d197953a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742031, "uuid": "d45d776e-2992-4632-8f80-95af87c0b6f5", "comment": "Malware payload (NanoCore)", "value": "7b8a9c1a4463701300b347325f5b7cf196109f4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742031, "uuid": "9498fa0c-c7d1-47e6-81da-02f969915973", "comment": "Malware payload (NanoCore)", "value": "22279d908dd184e51353f9d796e7aa015c35908658ab0198914fcb5aa95f5c254772f379e333811e6c730016de047fbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742031, "uuid": "65769f1c-965d-408e-8873-7f69506f49b3", "value": "T15415073D1AF91237D1B5C365EBE58423F149985FB411AE6A6CDE03A7030BA9734C722E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742031, "uuid": "390c7400-5f9c-4478-a9c1-dedf6bf09947", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742031, "uuid": "0e7889e2-0874-4e8a-a5c3-eda67bdf3dc1", "value": "12288:cEM5uFJX7Z2Dhi5niNsjTiFy4K58LGnMHPO5YIuvWjjCWwV6abmGyQCeR:n7Z5niNTFa58cGUYIuvcWWObmGKeR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629742031, "uuid": "3d081aca-c77d-4da2-b7c2-19fedc26af98", "value": 882176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629742031, "uuid": "0dedb5f2-66a4-483f-b5b9-54719738ef33", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742031, "uuid": "8fb6d28d-c01b-4cb6-994d-d113dd2f2d29", "value": "8280b726f595c9a7ebefc39dac6457f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9fe9a1f-041f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629729565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729565, "uuid": "c1e1f7aa-2735-4675-bc6d-504fe0622415", "comment": "Malware payload (Dridex)", "value": "794af9acbf0cc5a7e5051425e539d5b0", "object_relation": "md5", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729565, "uuid": "d63bf3b3-2bee-4cbb-941c-560ba034ce4e", "comment": "Malware payload (Dridex)", "value": "1ed37727a59f134d0c9c13d643508ce54cc03bb084aa513be80ab757d898ddb2", "object_relation": "sha256", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729565, "uuid": "a92ca52f-728e-480f-a8f2-be0c45acb2ad", "comment": "Malware payload (Dridex)", "value": "9a42746dc136d545cb5e4afd8fd11b5cc0cf7ba6", "object_relation": "sha1", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729565, "uuid": "601f1bc7-37c6-4d3b-a37f-8163d6a26eef", "comment": "Malware payload (Dridex)", "value": "27acedf474acd8e62b279b457e7ff9801e0c3ed12b3fcc230d1facad6b5b8c4af02cbc8b253477a39f62baf79475d56f", "object_relation": "sha3-384", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729565, "uuid": "04aa80be-1fc2-457d-a0f3-02f3707ceb9d", "value": "T16504D191FF8B19B4F3C6133324387E6A5ABC5A097608C786FE60CA5191957B24A33737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729565, "uuid": "3811fe93-80b4-470c-9c10-aac985352fee", "value": "cad673980682609436f019e51b6d0592", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729565, "uuid": "80fe05ca-3390-414b-8594-d87ba30dbf5d", "value": "3072:ya3FHV3GsUEK4BRSjhvn0WUqqgfkNzQHAVCKdfzl5hL+Qz:y8dt3+0TqqgqNcef1L+Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629729565, "uuid": "16c37c6b-f26d-4af2-ad04-8f30bba6b954", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629729565, "uuid": "6a7897d4-238d-4223-bb41-569af4022005", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729565, "uuid": "5bd81853-1804-4f47-b11f-f287a69ebe78", "value": "25.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1abc995-0422-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Vjw0rm)", "timestamp": 1629730840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629730840, "uuid": "c654ab01-de04-435a-8b32-a4554d091f07", "comment": "Malware payload (Vjw0rm)", "value": "bd402a7b48f2b162736f4848c329792c", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629730840, "uuid": "9e13a5d8-4600-441f-9c98-cc2f7086b390", "comment": "Malware payload (Vjw0rm)", "value": "2013959396545e0d1c1a0c178544a778764ff12c4fba9a6637835a202cce979b", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629730840, "uuid": "75da7283-9667-4d0f-84d9-11ca92d10251", "comment": "Malware payload (Vjw0rm)", "value": "fc17278dbfe1e9d65a3b8f2cb8a972017eaf1cc6", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629730840, "uuid": "ae427d29-3b82-41b3-9e81-bc0b48068ff7", "comment": "Malware payload (Vjw0rm)", "value": "0e30c5125f3275348454b293eb0dc93f685e0690ac9e6349284a5f6a1f43c48e90491bab7f4f6784227a075a61ca42f7", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629730840, "uuid": "52337197-3de7-4542-bc38-c131beae2072", "value": "T152E31300C7402AA8E51900E1D839EFF7B5DB3C6BB3DE943CE9E76F59661480BE641B54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629730840, "uuid": "91785b1e-383f-489e-a395-44d8958c5bb4", "value": "3072:vAnBzB/sfK4/mNwKEoZ/4+TK8tA3uQr+22kj5Duor+rS:oB6K4mSKZC39r+6Duor+G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629730840, "uuid": "caccaf52-7876-46d9-90a0-aa8336cb7cf0", "value": 150676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629730840, "uuid": "27c0e50a-244f-46e0-a271-8712e6280b9f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629730840, "uuid": "7639e49f-d062-4305-9731-2a566204d4f7", "value": "SKM_C258201001130020005057.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bcd61de-03df-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629701705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701705, "uuid": "b48c9a0e-4236-4c3f-a383-52f50e110e85", "comment": "Malware payload (Formbook)", "value": "0849256c84ebe0dffd0f1e0912417dcc", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701705, "uuid": "95511d70-9fd8-43a2-95d0-6ca0dc165968", "comment": "Malware payload (Formbook)", "value": "2039b08ffd63c9ae1777249e96d3bb02226530e107869a969fc1eca2e3129bf7", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701705, "uuid": "0a8da518-d21d-46f8-9156-87478015fef8", "comment": "Malware payload (Formbook)", "value": "df0da4b891fa90dd487a6afb63be228fea5410d4", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701705, "uuid": "24dbdc68-506f-4cf2-aa09-a34a327075ce", "comment": "Malware payload (Formbook)", "value": "362357c8d90e16e4b3e0c7573e7ee31680ea6b6a906e9a1c5018be81e5f8bc4a4eccce4149ef0a9542a8a850197fced1", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701705, "uuid": "34bc10e9-b350-45ac-bf1b-afdb1d38029f", "value": "T18DA42313586E0A96D2A806FC56762E1B2050F39AB7E060F74A72AC6BFF34F5448718E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701705, "uuid": "e22b209b-5ba8-4db1-98f7-c50735d66656", "value": "12288:8w5pVdtPkYtINZS9bBMcuDsHA2krq+MxpTRLbMQ:8ShtwZ0lMcuQHARzSTRLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629701705, "uuid": "c5c576ab-2847-4164-bfd0-5228c8e40fb5", "value": 479377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629701705, "uuid": "06934404-56b5-4aab-9f1f-4a760795af94", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701705, "uuid": "75042be9-be16-450c-8d88-db64d23bdcc6", "value": "ORDER.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4a6b23e-0406-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629718819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629718819, "uuid": "6f194a14-d02e-4863-aa3c-1bf7d652969d", "comment": "Malware payload", "value": "c264d4535ce5c003faac1c7e9dbf6dd0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629718819, "uuid": "f34df8e9-dce5-4d0d-8e73-4d1bb2100e8b", "comment": "Malware payload", "value": "20b487f70123f2ca2448cf77199282e2b11847e58e2f02ebb21dcb3c4a4c11a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629718819, "uuid": "96c9cea3-c074-4dea-a883-35c3406b7ac9", "comment": "Malware payload", "value": "b820e5b616ba1f783efb735cbee5eb0b4c176738", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629718819, "uuid": "8f8227d5-f773-4e42-9155-70f3cf665228", "comment": "Malware payload", "value": "018d6765d04496c2bbb04b291902eeed30a99bc1172989975a40b2c8513ea8d73c588da4fa42913a0e3de9541069433b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629718819, "uuid": "41aa4b01-9e1f-4146-908c-b089ba42b186", "value": "T14C91D78BBB10D8F3E6E405B011DA443DA52DBD36CEF18411AB0DE52A215E7947CBD388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629718819, "uuid": "27db32c8-53e2-4065-9559-dd9195fb6e1d", "value": "be0c05fdaa9f5351299c879d293ebda8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629718819, "uuid": "8b154a80-2c7e-455f-9c38-df9a6c145006", "value": "48:Zvt1CmubFfItsZJ784GskTp8kXYcsyU/vC251W/:Z11RubF+sr7DGs0p0nvZ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629718819, "uuid": "8dca4ab8-7e28-411e-a545-efa4146216a7", "value": 4608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629718819, "uuid": "0f978af5-819d-45b6-ae21-32fba5957eb1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629718819, "uuid": "551be64c-3c36-411d-b5d1-541599ba9aae", "value": "PO082021.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ee8df75-0409-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629719883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629719883, "uuid": "9e93e1e9-2e8a-49d3-b09d-c35e3d2bf7b2", "comment": "Malware payload (Formbook)", "value": "b4a82fa3deda44790d510e551aa47100", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629719883, "uuid": "9c3cc199-5586-4c61-9983-afa3ca162f02", "comment": "Malware payload (Formbook)", "value": "21583b5c850ded9f371f4bf0c64a919c3d6411b3945b5e967c5f1a999eef42e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629719883, "uuid": "609d6ec2-21f0-48bc-88b4-004206d8ad3b", "comment": "Malware payload (Formbook)", "value": "6c6166a67994d05e796a436a1114ece3851deaf9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629719883, "uuid": "eaefefc3-fcbe-48d9-957c-4aa0672e1444", "comment": "Malware payload (Formbook)", "value": "f1944889306f6ed2b9dfc96d1a41dc32b85b3dc3e5498b3d88c63d8488c924562d8b8bff314a5ab471e8f7d37559fb03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629719883, "uuid": "d5eeea74-0916-4bcd-997e-f61ea6b81a4f", "value": "T11405F53D19B91637C1B5C355EBE59423F148986FB404AEAA6CCE03A7030BA9735C763E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629719883, "uuid": "f060a6b0-64bc-4fa2-b1b0-009ceacac108", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629719883, "uuid": "bf2ac119-634a-4bc2-9263-ea2f09826210", "value": "24576:fbv19vb8f36LYi/Gu21q0p+lrC7CGOge8:fnYpOGuKpkC7IgX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629719883, "uuid": "3e801383-1d09-4ba2-a739-0c12b0c9642c", "value": 855040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629719883, "uuid": "b9e7b398-31e3-4d3c-816a-661cf85c53e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629719883, "uuid": "77ff60c6-d21c-4270-9968-b85091a3ecbc", "value": "REMMITANCE COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da3572a5-0439-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629740706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629740706, "uuid": "abb75fa4-b3e7-4524-b900-1c8e5cc011d6", "comment": "Malware payload (AgentTesla)", "value": "9b7c9be2c5241491c51439797539c85d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629740706, "uuid": "fa7e13f4-e6be-4afa-a8ad-189d452bb502", "comment": "Malware payload (AgentTesla)", "value": "2228817b66d357f689cd5aff3ec92326329f3cf613d2cdc295f00d3fa75fa061", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629740706, "uuid": "a71d4ff5-9804-419e-91cb-9a91713dc2a8", "comment": "Malware payload (AgentTesla)", "value": "1c49e9b5e203b0fb70d61befeacdcee6f4706b66", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629740706, "uuid": "657c9acd-feb3-4ebd-9169-772f977b1911", "comment": "Malware payload (AgentTesla)", "value": "9ba8d875163a9a76dc3270e3718321ca1ff0693aa6a2b6583c9ac937f929dd00d1b22531a62f4864e97961d3d9e28ed9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629740706, "uuid": "46fa5ae5-8520-46ab-9131-874101f3dc88", "value": "T14D0218B8045C449AE6F3C962994AFE3503A2F9ABDBCB5A8133DCEA730B7F3231514144", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629740706, "uuid": "1dbaae2f-50b5-479a-9165-96b87470eea3", "value": "96:cMLLBGvc+m/7FybzKbA+lM6L05tRATn6wxryHExz:NBGc+M7FyvKbA+lG5tRAT1r3R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629740706, "uuid": "cbc540a1-e19c-4b94-8b24-989e716eefa8", "value": 8859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629740706, "uuid": "16f54bcb-f0d4-41ee-b2ee-fbaa233d4e5b", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629740706, "uuid": "2b1b11b4-f95e-4baa-a307-c4200905542d", "value": "invoice.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c8eb544-0427-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Amadey)", "timestamp": 1629732630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629732630, "uuid": "c66fb8c0-ec1e-45fb-bb1b-14681085baac", "comment": "Malware payload (Amadey)", "value": "880f6d866a7e200b0d95f1cd38817ee4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629732630, "uuid": "5c951414-10f0-4a2c-8351-779e2ae1c634", "comment": "Malware payload (Amadey)", "value": "226921e3bc7eaab8a476b393ff388103dc37e644ae410c4f5b5cc39e89f0b94b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629732630, "uuid": "b667de52-bfd8-4b31-bcef-5e3ee6865431", "comment": "Malware payload (Amadey)", "value": "520ee2a8def0c2566316fbae593cc3e41aa2460d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629732630, "uuid": "8d30ddf3-2258-42de-bca8-d17549ac465f", "comment": "Malware payload (Amadey)", "value": "93abdee2b16abd48999b735b907ea9bdd4c5c197d40c2cb045569dd2f7cb8b61bcc3df596af2cd815b4c12a773e62ee7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629732630, "uuid": "e27865bb-2340-4b9a-962f-2cbc4f61e559", "value": "T149649D30AB91C035E4B612F855BA83BCB93A7AB16B3550CF52D11AED1A386E5EC30747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629732630, "uuid": "7b24dd67-d58b-4a99-b0a9-cb81bdd6dd4a", "value": "3431c4d066a67bd4eed073be41b2ef83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629732630, "uuid": "ae61570e-5c93-4174-9f0e-2aa328359c35", "value": "6144:bEqo4UXl+z2iOQdDOa1uvbPcTlhtXCSU0HHGBbyzswxLBt:ho7lWlnFvuvbETlvFqZy4oBt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629732630, "uuid": "2716a002-87ee-4fb9-a209-6b5bc7ffff3b", "value": 327680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629732630, "uuid": "ceb7eab7-a98c-4544-a86a-d9e8e77f0f6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629732630, "uuid": "713cff78-1ff0-44eb-abff-3f6a5672ab90", "value": "880f6d866a7e200b0d95f1cd38817ee4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "645598a9-03dd-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629700994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700994, "uuid": "b80e5ad3-1ae0-477d-a58d-b9219c31a5be", "comment": "Malware payload", "value": "23cb1ac48faf5ee2c80b5ff5be3f6b80", "object_relation": "md5", "Tag": [ { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700994, "uuid": "a9ff0b29-d131-4767-8f94-a606db6ab17f", "comment": "Malware payload", "value": "24580071ea39ebde67c5ff8c2de3b166964fffed1e3d2964b1f1bee15958f7c1", "object_relation": "sha256", "Tag": [ { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700994, "uuid": "e361fdee-8524-4be3-8f51-d665eedae841", "comment": "Malware payload", "value": "d33f7ff5de1e3eedc8429662f743d9729a3bdf3d", "object_relation": "sha1", "Tag": [ { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700994, "uuid": "9d2e5736-352d-4e66-84dc-df8a90a26eca", "comment": "Malware payload", "value": "f7465188d5d1012711a59585047a846525a032acd9c1bed288d66820ea0b929e44b032bcb61819c6b6cbb00a5f2e675f", "object_relation": "sha3-384", "Tag": [ { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700994, "uuid": "e59cffaa-9688-4e69-8c3d-4d33008b37d1", "value": "T1C05423B6F2CD1C656249BDE360F3F479CD2194422773F122BF281ED697A0281D2A5F92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700994, "uuid": "720c33fb-b499-43bb-8908-ad1f122148f5", "value": "6144:O1r6BS2xilKYPLeGdct/XZh3LL1LnKHOJRi7WopE0x3+:82khlKYDeGdivZh3n1jyOiTKE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629700994, "uuid": "40eefdb0-c49d-4dde-a8a4-22391a1bd38e", "value": 286924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629700994, "uuid": "6c84ba16-f4ce-4226-9656-f7abdf96d0ea", "value": "application/x-xz", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700994, "uuid": "66d9f113-24ae-4421-85db-825e5953dc72", "value": "\u043f\u0435\u0440\u0435\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u044b.exe.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34dd4e12-043b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629741287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741287, "uuid": "ea7a37a6-435c-434a-b9d9-8bb3654deac3", "comment": "Malware payload (RedLineStealer)", "value": "2424d5850535817a5f382b2e510aaab9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741287, "uuid": "bb64c453-9219-45e6-bb29-8970ed7f34ee", "comment": "Malware payload (RedLineStealer)", "value": "258e71867219339212128905ae82205efb2a3a11edff805f22b15d18af9413c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741287, "uuid": "cd43b3c2-d790-4d8f-bede-21ad9131da7d", "comment": "Malware payload (RedLineStealer)", "value": "48327df28e2348c680388e64513907fdc74ffa0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741287, "uuid": "0bcc3436-032c-48db-9dff-7461c71d2abc", "comment": "Malware payload (RedLineStealer)", "value": "11cf77af647cc991b15b32d574b2a82f2022277ac170d79c4f9046bdbf6c0fc61b50bba41bfdcf4e4b61056ae0b0fae0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741287, "uuid": "49ffa891-5249-44f9-88f0-b85464133bdc", "value": "T1BCE4F030A7A2C038F5B601F855B583B9B53A7EB16B3450CB93D526EE1A382E5EC30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741287, "uuid": "3d9ca214-f596-4314-83ac-4f85d0500b83", "value": "47838eb3376cd956f1ad4ca3d2e871c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741287, "uuid": "11508e60-6c43-4781-b420-1f8b46754d1b", "value": "12288:OymopXMLUssLjxvgqfwqEplHfdYyYCgcCJ3pIyjAZxhkuQG:npXMIZwqEpl2yNrCwbp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629741287, "uuid": "22170a31-aeb7-4796-9763-6e47e90a04c8", "value": 658432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629741287, "uuid": "8e7f1019-1cc4-4684-bbc6-36a705ba6a14", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741287, "uuid": "23350f7b-fc60-46f6-b10a-57eff435bdde", "value": "2424d5850535817a5f382b2e510aaab9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e301aff-03f1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1629709654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629709654, "uuid": "94c91428-fbdc-4ef3-bc23-bdfa7146f8db", "comment": "Malware payload (GuLoader)", "value": "c2c790809328c92c0eec843aceb3be64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629709654, "uuid": "6db1274e-6573-4fca-8a22-9ae6b79d88de", "comment": "Malware payload (GuLoader)", "value": "25b1b9c09860911a5e932106bda457849099223f19ee11fca9076c47bb837a67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629709654, "uuid": "28489bd2-f742-479f-ae44-98bcc882448f", "comment": "Malware payload (GuLoader)", "value": "ded2b5d8e2b48b48d737a699ab371cc64ebef2d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629709654, "uuid": "449572fa-de81-4e71-94ca-2b6232a9a721", "comment": "Malware payload (GuLoader)", "value": "752cae84de54ebb7a835f24168c4a01a219f9ab471bfee0c780ea16760707ba546c22bdff0f061bde0bdddd12a756609", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629709654, "uuid": "bd6416e3-0de9-43e6-970a-56c2d0a56bab", "value": "T1C7248E81B641DF46FC45CDF018B36BA85B28E421ED42BB2BAC58DEB998745C02DC15FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629709654, "uuid": "07f974b7-f9b6-4448-936b-c59baef3f661", "value": "92f464fb5bf1afd7a6e32afbc57f027c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629709654, "uuid": "78dfb2ae-2759-4be6-8e6f-f01cf5d0e931", "value": "3072:7J9YTDiugdcmn11ziplBh1Owtl+JTo44/QI9:73ODiDdcSPipDNgu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629709654, "uuid": "056afe4f-7a8b-4a3d-ab65-15ff78b402e2", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629709654, "uuid": "639ca51e-0d29-42e7-b453-47cb411c54c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629709654, "uuid": "5f3f1195-ab00-489e-8116-d038f70d0094", "value": "DED2B5D8E2B48B48D737A699AB371CC64EBEF2D9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30553857-0461-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629757601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629757601, "uuid": "541495b5-46bf-4108-a2f0-a94cf38469b7", "comment": "Malware payload", "value": "f4c64387af7b3c31cf1447c4f4ae003b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629757601, "uuid": "c83c2c22-a607-4f5f-87ef-42a91f9bc9cd", "comment": "Malware payload", "value": "26a02495b38b2a19ae23687148232563ed9dceaf5c0a6eed4b55a19d8f8b4818", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629757601, "uuid": "db2be4fd-49cd-45fb-b764-910a05b25d15", "comment": "Malware payload", "value": "80c71eea8a34f0cc06f648551b9ed4ac63302107", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629757601, "uuid": "5c15e38a-8516-4913-a418-a53a2515aade", "comment": "Malware payload", "value": "6abfb669ad78e1c4b8da28f296b2826fbd1a7032578aeb9206d80cdfc955a597df9e3bb27cd789b06c576d72070932f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629757601, "uuid": "347fce41-25b4-4f18-81a8-622aef8b959d", "value": "T147762259E3B27670D4B70A7380A2211C0EB2AD5617E6BE552EBCF64F18322814C77B77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629757601, "uuid": "a24359db-44e9-435f-b4e7-b5648d28a1a1", "value": "196608:lFQAbyY5dux+RIMIeACZdjZ+hQqLgFppJDw7808n:lFQAbHox+RDjZcgbpJDw780", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629757601, "uuid": "3fe94e19-b6a0-4d09-b0c2-a50d0db160c3", "value": 7365120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629757601, "uuid": "cd69728d-35a7-4f2f-90e8-fba0403add24", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629757601, "uuid": "c18d8895-49e1-454a-9d9a-7fc75379224a", "value": "f4c64387af7b3c31cf1447c4f4ae003b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41dfab13-03be-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Amadey)", "timestamp": 1629687622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629687622, "uuid": "7afb0f33-dc02-49e4-b775-1c057fa5c2bd", "comment": "Malware payload (Amadey)", "value": "3176a9e835cc7bc05227443036f2a512", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629687622, "uuid": "9ecb187b-a898-4826-8039-9e2ddaf7cdf1", "comment": "Malware payload (Amadey)", "value": "2986b153f303df1a988cd38960bfa289c0e329f51b7d45bc96de8e100ebd6449", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629687622, "uuid": "dd64acff-352b-4f67-b535-03ee36b4fc93", "comment": "Malware payload (Amadey)", "value": "b08ac07244122702a9278e5149360dd8d65caa60", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629687622, "uuid": "47fb992e-04ad-4a04-b76a-cf598d73e71a", "comment": "Malware payload (Amadey)", "value": "13e28c7b0f89eafcba3e05b55732aa77aaa5647866475b4e815f832283f9fd9e54b74f966edadaed83de074622312f10", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629687622, "uuid": "d07a37c9-f36f-49cd-ba9f-862115cd78f9", "value": "T107649D30AAA0C039F5F712F456BAC3B8B9297A716B3490CF62C526EE52346E5DC30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629687622, "uuid": "5e9a9d35-005e-4f03-84ea-476c9930df26", "value": "9c389c805383f91f9d3af8e8d00217d7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629687622, "uuid": "b1ff6914-eeab-46f7-839b-54b54ca94079", "value": "6144:HdUOHyEzgM7J82wqsRucoVrs4Pg1dCMHzm07ZpPnV1Tbct5v:v/zv182PcoxBmVTm07nPnrTYv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629687622, "uuid": "05b5bbf7-c630-49a1-aab4-dc04702d782b", "value": 313344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629687622, "uuid": "d3e89f79-c62a-4e76-b078-0c54740bf7a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629687622, "uuid": "098ac355-8260-476f-9e7b-1589bcc08d1d", "value": "3176a9e835cc7bc05227443036f2a512.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c242f1d4-0420-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Cerberus)", "timestamp": 1629729928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729928, "uuid": "078e021d-13d6-40af-b263-a83321d89a50", "comment": "Malware payload (Cerberus)", "value": "700beb9999c245e961b8ad7483f3df2d", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729928, "uuid": "8f1e6f1f-7b51-4a47-9e35-189b92776689", "comment": "Malware payload (Cerberus)", "value": "2aec28011d9c414b88ae862806b9262655bd88088ea9113379b672e7d0eb80df", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729928, "uuid": "961f8d6d-3f53-42e0-b8c0-aa2309f7a0b0", "comment": "Malware payload (Cerberus)", "value": "e384e6b27ad71e764ecbe8afcb553d095c8a405d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729928, "uuid": "0922c973-d3d9-4d04-bf2d-85f72834414c", "comment": "Malware payload (Cerberus)", "value": "5e8f1639143ed34edb45d0a41b4a9076ec5074cdae6da747e9e39f25164b500cb50c4b3c8e4e9a996f148a6950b0a545", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729928, "uuid": "4d698303-de99-4c39-af1f-47210b1c83de", "value": "T1F7F53346BB818A0AC8279371C10750A7AB7C209DC7C9963F457851C328FBE95DB4AFF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729928, "uuid": "7d667dfc-d5c5-441a-909f-b257f981ea26", "value": "98304:/W1wBRH98slSUu5FmhCpYVabbXoEVDXotD77:/bBRH98SSUuXmmYVgoEVDotD77", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629729928, "uuid": "20602b83-1340-4672-9de6-a5b046b8cf42", "value": 3472472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629729928, "uuid": "95f5f7f4-5772-4d04-8e93-2a8d7afaf30b", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729928, "uuid": "3b4781e8-8806-4185-b63f-e4459fdd0e6a", "value": "Androidupdate.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15e5a251-0409-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gozi)", "timestamp": 1629719761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629719761, "uuid": "ea3f009f-5f2f-4c78-9996-b35bf038074a", "comment": "Malware payload (Gozi)", "value": "85eec686404e8d636c1d2e115f0a28a2", "object_relation": "md5", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629719761, "uuid": "000a010c-5d94-40ca-ab72-013c80d1a160", "comment": "Malware payload (Gozi)", "value": "2b674987c318c4e5e03820a97ec4f9d106c325a2fc57be7cba30b97a465ed87e", "object_relation": "sha256", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629719761, "uuid": "2312686a-7d52-414a-8ab9-763c04a91c0f", "comment": "Malware payload (Gozi)", "value": "f020c1c800bd8be6eac306aeaa57913c39551a8d", "object_relation": "sha1", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629719761, "uuid": "04a92b49-cdcc-4ef4-94ee-efa136f77f00", "comment": "Malware payload (Gozi)", "value": "88f5f43102b8c0eafccc4a5641ddb29814485136b264a3c61999ec98a7799c1d0ef11b3d4cf07eaaa92568389ce3deab", "object_relation": "sha3-384", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629719761, "uuid": "2f6dfa8a-507e-4048-b311-fdd0afd1fa81", "value": "T1FCD3FA377611CA8BE60B32358F83B9852229EC41BDF5CF363104B35DD97EA644D1AA36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629719761, "uuid": "6ab6be10-7cca-4b26-b47d-cad06e21b6bc", "value": "3072:NhlYkEIuPm3fNRZmbaoFhZhR0cixIHm09M9iSriG25PV:XlYkEIuPm3fNRZmbaoFhZhR0cixIHm0v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629719761, "uuid": "f868f894-5f2f-4048-a1ca-1ad81b5f29f9", "value": 130048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629719761, "uuid": "37e95878-55d5-4f97-8126-538b8d7de1c4", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629719761, "uuid": "8453fdf1-c286-4ba4-960f-73aa25cfb74f", "value": "211575 .xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e50f5634-0439-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Amadey)", "timestamp": 1629740724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629740724, "uuid": "27b5e234-58a5-4e8d-bb00-6db3bc87f925", "comment": "Malware payload (Amadey)", "value": "96a0ffaf542da15587db4f57735fe1ca", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629740724, "uuid": "0fe701ae-5dfa-4e63-aaf6-4707894e4ad6", "comment": "Malware payload (Amadey)", "value": "2bb08a4ce2a10c3865c985b5d346f174290c0189a963d768cfd6c9b63ad5e7a1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629740724, "uuid": "89ee2cc8-459b-4cff-93f5-725226a9b084", "comment": "Malware payload (Amadey)", "value": "025335013b89b69b0dc8408800f7edb58b5d1c0f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629740724, "uuid": "08fbbc5c-200b-4cde-ae1a-21acdbfd45ab", "comment": "Malware payload (Amadey)", "value": "4a091bc5ded8a034a461d325610e762ec5655578ac6d956997ef875bf3d9b5941885e12e34f7f3d1a26d4b214c689719", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629740724, "uuid": "20a4cfd7-f8f3-4e35-be23-5d2bdc8d98fc", "value": "T12964AE30ABA1C034E4F611F845B983BCA93A7AB16B3450CF93D52AEE16346E5EC31757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629740724, "uuid": "58273f0d-6956-4fae-9d48-b8c62cd7895d", "value": "9d905009ce289bf09ec9a9fc544fc23f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629740724, "uuid": "46103cd1-6ad7-4f71-9bc2-ab82c3702f7e", "value": "6144:Pg/f4CMQSapPb5k9R+0jdFY4+6TV0gN3safvY9j9DrtLQ0dZqDdaVbHMlNQI3F:UfTMpqPbatjdFZ+6h3rvY9jptb2aZHMB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629740724, "uuid": "4b352659-c186-4263-af1d-47ba9a973d67", "value": 327168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629740724, "uuid": "43eb6f9c-6ec2-4e7e-b6dc-9882a8ac0e8e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629740724, "uuid": "cde49ea3-ed80-4f99-9a10-0e0974be9a98", "value": "96a0ffaf542da15587db4f57735fe1ca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a350f3b-03e2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629703205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629703205, "uuid": "8a2c2c66-04c5-4bd8-b966-a5af196a6f91", "comment": "Malware payload (AgentTesla)", "value": "fa7300913e201d137d33ee3aaddc714f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629703205, "uuid": "cd9a42a5-92e8-4fcf-826b-583aba723b2d", "comment": "Malware payload (AgentTesla)", "value": "2d546e019a7996d4b0c3fd89606b6ec1ff2f43430743773d54f622a9ffc9c145", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629703205, "uuid": "c257c639-8f14-4ed2-b470-f7894cdf32b9", "comment": "Malware payload (AgentTesla)", "value": "0fc2c6389e5d80cfd768597fae67a8a93191551f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629703205, "uuid": "fd0f7c81-9073-4efb-b2d6-07e66eab4533", "comment": "Malware payload (AgentTesla)", "value": "416e6725c2076387733ffdfbc819551384305b89e29320078dcca5e8051c5bf8bd446ae05ba241a6ce8f4d242a375922", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629703205, "uuid": "c62132c2-3823-46a3-9071-db2505bcc5ee", "value": "T11815D5BC19B9B6279179C725EBE18817F0409C9F3111AD69E4EE63B7032EA5234C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629703205, "uuid": "414c7604-66c8-459d-8d90-8172c8b6f71a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629703205, "uuid": "687b2f07-a585-4a43-a36d-a60b3fa7f924", "value": "12288:9dADc9F3nC0Py3gAh1W/SzXwTWF5NhrYRAisbCiODWKJVLHgrzrkLJqO8DNSyH/:9cW/S1NrY3sbLA0rh3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629703205, "uuid": "d8e8489d-f9dc-41d4-ba28-9cb6eb118051", "value": 908288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629703205, "uuid": "8ae3c7dd-a4c2-4fa7-833d-9a541d71a355", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629703205, "uuid": "9e5c004f-7fa7-4a22-b5d9-31c9da370239", "value": "New Order Offer PO-8122021-753.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff03cdb2-042b-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629734755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629734755, "uuid": "4227e63e-40fc-4674-b23e-26a156e9b609", "comment": "Malware payload", "value": "35a42380778741b67e837f986921af92", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629734755, "uuid": "49ed5092-37b6-4134-b214-4c41f04097a5", "comment": "Malware payload", "value": "2d9add07bfabbbc80b9229af559136863866e2fc06e4e6e5903b626b2fb1e7e0", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629734755, "uuid": "af05f9e0-6f97-4d0f-b67c-c6cbb67627c5", "comment": "Malware payload", "value": "b409a88640b170ad3923cae4b51b2d2b8b9489f2", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629734755, "uuid": "a39ca8d5-1eb2-4342-bcaa-b194cd4d58f7", "comment": "Malware payload", "value": "00342c6847a51ab0b3961c30874b817455f66d5ed55411fe0936c139868fc7077e9bc935f88c410766d28dbf4cbf8f04", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629734755, "uuid": "a0109eb4-cbbd-4a83-931d-1239c39e3040", "value": "T1F915E11EBE808015F96390727871F9E9382D064C9602F5AF06F8AEC659F0D911F937EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629734755, "uuid": "e7f30eb0-334a-4fcf-9493-0da624e9964d", "value": "24576:XKlxe/kg8h1BHIoZnYFyllNsky+HLPEEST:Qt1IKplNny+rch", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629734755, "uuid": "84b735dd-1450-4238-a9c3-acd2d8a0f908", "value": 938714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629734755, "uuid": "fd169c2a-aabc-49e4-97e1-c6c27b9528fc", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629734755, "uuid": "6208f9ec-c251-4a7c-993f-5ec0b52e410b", "value": "7Clicker.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95fa5122-0403-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629717398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717398, "uuid": "7d5eee67-86d7-4628-b154-b90675568e97", "comment": "Malware payload (Formbook)", "value": "cb59ce116b6512e8cfebdfeb8c21c175", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717398, "uuid": "1706d057-0edd-4758-b0e9-92cd11d6f23b", "comment": "Malware payload (Formbook)", "value": "2dc07dd1ba98f6df9c4eb8c62a01a40217ec2f3982e3d362dd20b54c77c0417e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717398, "uuid": "b0885121-d4e1-48d8-8f6f-ffba2fbaa309", "comment": "Malware payload (Formbook)", "value": "e6ee1a4e3e006a18947c7301787fdf5bd510ba40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717398, "uuid": "dde00241-4c6d-446d-bfe6-8ecc05aa0cad", "comment": "Malware payload (Formbook)", "value": "c4906ff79e746d0e219fa1a3316ae24a398605d6511c839efc23b2aff6f7283123086af5607dd3a37b66be06bec31e2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717398, "uuid": "9b3d0eb5-032a-45fd-bcc9-2fc02adf9598", "value": "T1A2C4BF83619090A6C54148B0D4A1A3F56AF97D3863D59EB7A3D4B7FECE30AC2233D536", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717398, "uuid": "b9373030-0933-4fba-889f-c3e6bc3c0119", "value": "53c59b75f4f7c3e4cf3b5a4fc5238353", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717398, "uuid": "98007d8e-b3e7-4cfc-a0a4-9be86f53c6e9", "value": "12288:H4sAsq17oD626YBU+7Kngj/7HYlJvHDtN0QZx8:Hdk17o36YqNg77HYlJvZaQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629717398, "uuid": "bc7dde2b-702b-4a0a-8cee-8c028d962437", "value": 592271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629717398, "uuid": "bc68998c-2aeb-4f4f-8f26-055c870a5cbe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717398, "uuid": "f767a10c-49bc-4ceb-9cdc-401900f23668", "value": "DHL DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f08a1d5a-0429-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629733871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629733871, "uuid": "87644c57-b347-4a3b-9e62-84456cb075a8", "comment": "Malware payload (Dridex)", "value": "87d5d2e9bb63d1a530db36b5eac314a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629733871, "uuid": "beaa2ae9-34a5-40e9-8e36-a293b9bd2cb5", "comment": "Malware payload (Dridex)", "value": "2f50060e9db78c7416b9769fe6216a3e77249a82173a581c14d9db476db48dc0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629733871, "uuid": "420e0d4a-8a62-4fcc-aa3c-18f93bb79116", "comment": "Malware payload (Dridex)", "value": "2802bf645c633a53ef01bc33745df1d3d7fb3fbb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629733871, "uuid": "54e315e5-a94b-45ad-b2f0-fe010bee62ac", "comment": "Malware payload (Dridex)", "value": "c3e0d6dc23f61eec6b4bedcc0d2ee7f7d82c28ceffc06fa8522eee6e9c8b7837420e7e96a7f3573387e6d6ca36296a12", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629733871, "uuid": "9210126c-6cef-4e8a-93d6-83d22dc62704", "value": "T11D04DF02AC8E81E1FC32F57520671E3F26AE71195ED8DE95C0C6C9158CBB3CA59C2B78", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629733871, "uuid": "d8aed241-1e98-49cd-ba4a-4866f82b2679", "value": "01be7d9c189bda0da49084123a5363aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629733871, "uuid": "2a2c85ff-70d2-4357-b0a7-6a3712823907", "value": "3072:Xhd6lp2ffOeP3gv+i4W63iFfKfXM9mQltYwgO226+f33JjVQcY:X3fOeIv54W6SFKfc9me9v9/JjV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629733871, "uuid": "9226a398-f2d0-461a-9d62-a6d87e55b34f", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629733871, "uuid": "f0fac8d6-7b6b-4c3a-9a22-0912ed9b7bab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629733871, "uuid": "2a5303ca-9d04-4079-80da-c87986931fb1", "value": "87d5d2e9bb63d1a530db36b5eac314a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2bf286f-03c4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629690442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629690442, "uuid": "a688b1b0-7d77-4267-bc7f-9bfc43620630", "comment": "Malware payload (Mirai)", "value": "57e09d653c0c4d3f336829ecc5a1b8c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629690442, "uuid": "824b4e59-5dbe-408e-ab62-d9b210c0c22d", "comment": "Malware payload (Mirai)", "value": "2f5da7ddee1c9aa9bba1f3b685be1c83c7b0976157784052b1d20368b47271fc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629690442, "uuid": "64a45329-85bb-49b8-b92c-c6c01a7fc839", "comment": "Malware payload (Mirai)", "value": "1fc6d047c3fabbb31f9b4be6ff47be632a135284", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629690442, "uuid": "cd04a542-920d-4209-ae2e-67ddc23f128c", "comment": "Malware payload (Mirai)", "value": "de0ce87adb91a7d7527a8f4ec98840046ab2c53e159e5c296a6fe88b8d36e8d799ed9b7b5b6df759e0e11288a8f3fe37", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629690442, "uuid": "f0e20f7e-88f2-4a02-9576-4530f77faa1a", "value": "T10CD2D1BC370C51A9CC31A2B8928583E21DB21FB6A002ED3628A7D7578E51C247993FE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629690442, "uuid": "11013341-6285-4da6-ae0f-cee73377e448", "value": "768:fEVHeZqrgaTuNBzbAqmrt4+R+VtX3NkJgGlzDpbuR1Jn:Gzrgaehm2+EVHcVJud", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629690442, "uuid": "94263c81-e44a-4ad3-b1c5-a475f4e0e52e", "value": 30440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629690442, "uuid": "2565e31d-10b7-4e75-a7d5-8e45b0483154", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629690442, "uuid": "ebdaebf6-a76b-4212-8a89-b5eb8c844af3", "value": "57e09d653c0c4d3f336829ecc5a1b8c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62135b5b-03f3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629710439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629710439, "uuid": "43317a09-7fd2-415c-8806-9cc4e690b97d", "comment": "Malware payload (Loki)", "value": "2531e98686793280ac9d5db0bbfd3f98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629710439, "uuid": "e503365c-2ed0-4294-b548-2549e4958f54", "comment": "Malware payload (Loki)", "value": "311ca11d14e9405f1e6dbf0c61b7d57f85f35179b7ddef401238a2e2e0fd3b9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629710439, "uuid": "c66c33d2-1424-468d-8b41-13467d2ed70c", "comment": "Malware payload (Loki)", "value": "7c09109ca3f6d85f039bf9e5572c96b8b4fe90c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629710439, "uuid": "c23c3052-0093-4897-814c-a634a9f547fc", "comment": "Malware payload (Loki)", "value": "4cba96550bf3e5d0a4dba73904a9426720ee5a454413aa35fd992287a076d90bac945408d77dbb31115b9489b0e1f00f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629710439, "uuid": "46b7ff4d-267f-4a16-ba6e-a231bb8274a6", "value": "T182D4F1457300F68FC92FCE7A99516C1097E1A6760307EB52ECD325E89A8DB4A8F452F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629710439, "uuid": "9cb248d6-ed69-4a18-b68d-c267e1a7a184", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629710439, "uuid": "ae187ea8-c539-4455-acda-cf71016d8049", "value": "12288:LaVCScN44K/DIwekRhAYu4CIuTxVjO/DIp3zWAQswn58F7EEGoW:LaMvNm/7ekgYsIMkC3zlMUE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629710439, "uuid": "3f3690cb-0e05-4fc6-9650-d19d0f54f5a6", "value": 632832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629710439, "uuid": "727a0cf7-facf-4e94-bf2a-40aec699dde9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629710439, "uuid": "2050d211-97fc-4dfd-8b83-37de4109343e", "value": "P INV. 23-08-21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4946bc3c-03dd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1629700949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700949, "uuid": "5f06756e-1cab-4426-9af6-d07f76610637", "comment": "Malware payload (Gafgyt)", "value": "7c6f0e182084fa51d2e62eeb07152d59", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700949, "uuid": "e7c6a62b-0378-4f5e-98b1-56d7e9f19c36", "comment": "Malware payload (Gafgyt)", "value": "312cac9f468337a21a211d8235f0bc90e4990d156acf0ca334c94602c2ae9213", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700949, "uuid": "9ab62e4a-451e-42df-bf9a-507411b4e01c", "comment": "Malware payload (Gafgyt)", "value": "9a3600500daa00b0a64cf969a174953d5f1474a0", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700949, "uuid": "6ee0812f-6279-49d4-b42c-bda600bb977c", "comment": "Malware payload (Gafgyt)", "value": "d2a9fddbecf03ae798536bc8991ccb7c793ec72c19859bc618327efa4cfbdf0c93757ca9e8e20e253e8c4f9c1644c186", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700949, "uuid": "0e193099-2596-462e-9a48-f18f3c9907d7", "value": "T158935C37B551C67BC1C743B51BDBCE219863B4F91B72720A73D87DA92B228C91E19B01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700949, "uuid": "9136a30f-ab6e-4b9d-8a4b-5fdae6b66c81", "value": "1536:X7rQXomm7blsHK7tDK52cix5x+3ifn3S7Ur679l5M7yfvmCJHWoGjryZ3G5:rHmQbl/7y3ixLCifi7qyXmaHWoGvyZ3m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629700949, "uuid": "24d6ff74-db86-4ffe-9432-31f30a23cf74", "value": 91506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629700949, "uuid": "b9432c4b-50a4-472b-9a05-74c9cbf767d1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700949, "uuid": "c31e5e4c-e775-4ab3-a650-4d2db1984a31", "value": "7c6f0e182084fa51d2e62eeb07152d59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eedb83bf-03dd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629701227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701227, "uuid": "35c5d4a4-2b7e-46ce-a39c-156a36201239", "comment": "Malware payload (Formbook)", "value": "7ad7a7ae41b5f19f2d2d6c59bf43620c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701227, "uuid": "2eba0328-5922-4927-96f0-2013523aa7e0", "comment": "Malware payload (Formbook)", "value": "31390820ca940a19f0eeaed5b38b27f7cd78317adf40489882b3de038c2ad857", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701227, "uuid": "35092254-55d2-4edf-bc96-4576df328476", "comment": "Malware payload (Formbook)", "value": "b4edfec25ad5260e9a9dd4e9cda9bcf937367fe8", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701227, "uuid": "0e4bcd6c-2156-4135-b85d-5c2f4824ea8c", "comment": "Malware payload (Formbook)", "value": "c25d4e7cae7de4a3a41cb0bf489e88ae8bcf064466a06ec6451663df2c2d0071046fee96ac6b74f6881089b31f6e06fc", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701227, "uuid": "fc34288d-3316-4e89-8dc7-2f6a45fa2f35", "value": "T124D42312F1996A704AECFC8E6AFC8C576C8D0FE70B8472534C841DDCD9A29796182FB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701227, "uuid": "6595bcd3-cd4b-4c1b-bde9-173aa56ea019", "value": "12288:22JlO5RfW4y816oYKUZ/RUmfvaFlQrFqGv8660fmn8VqvO6M29S:22JluRfWI6oYBxR2FoFqGvZ60UOo9S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629701227, "uuid": "b4c87ea6-def4-4c0f-b471-7a3a49005284", "value": 637347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629701227, "uuid": "29b77824-7351-4f37-8b86-09a53ac139b3", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701227, "uuid": "41055d04-12cd-4159-80aa-8ea2dd67f303", "value": "11317693065_03162021.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ea5f2bd-0445-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629745679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629745679, "uuid": "7dee9429-d206-4143-86e8-3aa237a176b6", "comment": "Malware payload (AgentTesla)", "value": "95fe547bbaa4db499b9d04bf7843608b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629745679, "uuid": "cd1fdce9-b7fb-4edf-8cb1-2546db57816b", "comment": "Malware payload (AgentTesla)", "value": "31feccf3da6fc04933d3ae09ff786132b5690c7f60cc8482f54b968b50a131e2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629745679, "uuid": "355a31f9-9307-411b-a999-c383e3a62614", "comment": "Malware payload (AgentTesla)", "value": "6d468d435089495e8f6c1cb2a57179728d9d6129", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629745679, "uuid": "cdca092e-2814-44e3-8ffc-b95b2accdeb9", "comment": "Malware payload (AgentTesla)", "value": "1317de7be9b2faf127a20bf2524b430781fe60b66f3fca19de65ba2827c7bd02a1769c55a0f077b182da4b132c8e1445", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629745679, "uuid": "f2f9d74c-0662-4d6c-9988-ad494e1e24cd", "value": "T14A340241430D470AC37A60F6891A9DBE7BD67FB9181F48B78B527F86047A3F69600E72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629745679, "uuid": "ea8ebb79-f760-4fb6-96d0-49a610e42756", "value": "6ef74f7b87fa15b6df54d064a5b8ef31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629745679, "uuid": "f109c493-81f1-4b99-b96e-8a89bf58f17c", "value": "6144:0CRnvvhIRFKDPo2pPF6xhJEC4gxfAuGdQFgEnQkkMgES:0CJpIRF0ppFG/qcFlQkkMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629745679, "uuid": "0bb3b10f-94d5-4f10-850d-63c09d5c2d6d", "value": 240454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629745679, "uuid": "128b37ef-e3f9-4b97-aace-ac1ac032e201", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629745679, "uuid": "c4cdc59c-45f9-4d98-bc53-0771f0470091", "value": "95fe547bbaa4db499b9d04bf7843608b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0843be9b-03de-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629701269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701269, "uuid": "0c3eccc6-8ec2-4c71-8dca-851f0d3f7025", "comment": "Malware payload (RedLineStealer)", "value": "99c4ba446289edff9894301900fc5bea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701269, "uuid": "185bcccd-ff47-41ab-b333-ea397e5964ed", "comment": "Malware payload (RedLineStealer)", "value": "3238be50a645b7049ed3d7ab2b115cfbade1981cde7e4ce7721ed465e8bca4d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701269, "uuid": "c79ea471-42ee-43ac-ba43-e604a3a7adab", "comment": "Malware payload (RedLineStealer)", "value": "e8c151e48f5c21228826d4582b2e25c447af7bd9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701269, "uuid": "dd754dc3-7f5f-4f69-863c-023219231c55", "comment": "Malware payload (RedLineStealer)", "value": "e55ef94c089d727eb2edc3f4475e3735e8d93a538ea7a0d55c9bfed8583b5d5b0df3ceebf5e953e2eb620d267ab39888", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701269, "uuid": "3ce36a09-b34b-4123-a16c-f812fc209199", "value": "T1A015120B37E504B6E4B557B44AF2018726B2BD95AB3483DF175ED82E0E332A29277707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701269, "uuid": "069e2b39-57e6-491b-8f1d-ad738d3eddf5", "value": "013c74198fc6e42dcf33737d6c40c012", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701269, "uuid": "9a811b3c-42a5-42e1-95e0-f2b629da49f1", "value": "24576:nyLHuEU/Ve5SXJe8qXHgaKpr6gLUIpnK2ljS27vs:yLOgR3fgLPpyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629701269, "uuid": "1c2d8efc-ed5b-4a8d-a111-618661ad81b7", "value": 897623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629701269, "uuid": "57d8bee4-09b3-4eca-878e-705bbd5be14d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701269, "uuid": "05e5bd0a-dc20-47cf-80e9-645b5b3f2135", "value": "99c4ba446289edff9894301900fc5bea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c87bb991-03e9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1629706316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629706316, "uuid": "679b5cc0-642e-444f-84f3-f5b05baa5263", "comment": "Malware payload (AveMariaRAT)", "value": "d44a18b6d3fe40f861512bfba6b4e9e3", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629706316, "uuid": "6e577e5b-15e7-4279-89d0-785335ccf738", "comment": "Malware payload (AveMariaRAT)", "value": "323dc15959c4fb49f274d9024959d3cf256eb07ac2fcc0457f3cfe87277f5fad", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629706316, "uuid": "b437316f-c547-48ef-88ba-28efd62ff959", "comment": "Malware payload (AveMariaRAT)", "value": "b76ac759fa4ca8d93440ca4ee9979241e4eee925", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629706316, "uuid": "83b7ef71-7763-4e9d-a3a3-de1900375282", "comment": "Malware payload (AveMariaRAT)", "value": "9fc0d66fc990070d6c9c63d4171d6482278590e1313e90added9f10c4ed109fc05172aa95ab5eb87069687288e5b1500", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629706316, "uuid": "ec34bad1-f932-49c9-9a94-9ef23eac51f7", "value": "T12DF4DFAD3650BADFC917C976C9641C24EBA1B476430BE303A85326AD9E4DA87CF101F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629706316, "uuid": "42f592c3-fcca-44c8-aa24-a98fa9ac8137", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629706316, "uuid": "3a7bd3ea-9481-403c-91ff-0aca05bd12e7", "value": "12288:4lMos1TXLh8uArAmKsOp0j4e60EQ/OxDj52dhISV7L/GTjV52JpbMf6nGmMcUwP:4Co2LZArpLj2D1GIM+Tjv2H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629706316, "uuid": "b6b6558b-6780-4354-a46d-e96c1b329cd2", "value": 723456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629706316, "uuid": "57dbeeb8-e27b-4ab1-afce-8c45820eb48b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629706316, "uuid": "c68c4987-f23a-499e-858a-5f20ce0697f0", "value": "RHEEM PO # - KMBT-2308003202003-033201 \u0110\u01a1n h\u00e0ng Rheem Vietnam \u2013 20203.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cdb45d8-0431-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629736925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629736925, "uuid": "d87ec07a-1c9d-4ae0-94a6-36cfb3770b44", "comment": "Malware payload (RedLineStealer)", "value": "bd07a2728f0a5c4a971125e51830b459", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629736925, "uuid": "fc37c76a-a17c-40e4-a475-62ef81380fa2", "comment": "Malware payload (RedLineStealer)", "value": "3251aadd8eaff5a07bc0d59b09902d15d962cb83d8dd6ab9ab3fc5edd550ed22", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629736925, "uuid": "1c09ea25-6c5e-459f-83ce-6b7b930459c3", "comment": "Malware payload (RedLineStealer)", "value": "c600264ed42ecc69106ea463a4ca11094aa31519", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629736925, "uuid": "bf6e94b9-a3ca-4911-9a86-e1ea5d5fd034", "comment": "Malware payload (RedLineStealer)", "value": "f347c85b790f19d884b2a9a6de70c72f6d6691a170dd4c8f146deb996be41b7bb0fd2dc3e013462f8d3e446ba9cda98d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629736925, "uuid": "ee905886-f858-4c27-b483-1a25af4c69a9", "value": "T10C557D4162F84A06FAF29B34A4F38611EF37BD505A30C28F6225816C8E677D1DE647E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629736925, "uuid": "1ee12021-22ab-4f67-a2a7-5dea2c07613c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629736925, "uuid": "878173c0-3a04-4dfe-b5f8-840c16342a59", "value": "24576:GZWIO2Pix0ih5nK0ghpYMuV0alV0awzLHL:GcuihJgLYMX9n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629736925, "uuid": "def6a52f-e205-4783-b881-6cf167578963", "value": 1307312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629736925, "uuid": "c17f2542-9970-4dea-9901-199924a1685a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629736925, "uuid": "078ea90e-17b1-40b5-b62b-e4b6dda8f071", "value": "bd07a2728f0a5c4a971125e51830b459", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a42e7955-0441-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1629744051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629744051, "uuid": "1b39394d-3510-40d2-9b68-9315d4905a80", "comment": "Malware payload (NanoCore)", "value": "70ed4eb21284e9359cf11d375724f299", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629744051, "uuid": "5ac11c77-66e0-4f52-aa82-dc59c056657d", "comment": "Malware payload (NanoCore)", "value": "32b2890cadb4788ceb05b0629329dd55aa7554c7f72d61157f06e445bfe31029", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629744051, "uuid": "6d391b14-e8be-4cbb-a53d-74c093c8376c", "comment": "Malware payload (NanoCore)", "value": "aa0f38e343253c7bc308a23724597d5be7b3304f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629744051, "uuid": "70cfbf83-3701-4499-9329-c32b2bc4459a", "comment": "Malware payload (NanoCore)", "value": "64cb7fd3f4720a5d98346a22be4fe3a582c695b551df0bdbf234aa06470c3c06bdcca821923e36349ec51b2c9e7036ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629744051, "uuid": "45bb3f7d-29c6-4020-bf67-93088ec23f3f", "value": "T15C15063D1AF91637D1B5C365EBE58423F149985FB410AE6A6CDE03A7034BA8734C722E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629744051, "uuid": "d117c045-cf08-441c-8e52-e5f150aa0b0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629744051, "uuid": "034dfe82-68a6-4a69-8b76-edc4f0b6f8a6", "value": "12288:8gWbNXhv8crZdikDPfoclWp30RIIFob5OLmhjfwBc23tkF7L/IBiYCVcA0DDJDLh:+uKZdiIlWpE/FodOLyrukFId1DVDLh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629744051, "uuid": "19f7cc55-d46a-4f4e-8e6c-c731079e2314", "value": 886272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629744051, "uuid": "14498442-4cf6-4063-92bf-0a5d702bd990", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629744051, "uuid": "f4e08359-a3f0-4393-a502-d242d53a4524", "value": "70ed4eb21284e9359cf11d375724f299.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aab97de7-0401-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629716574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629716574, "uuid": "a8e7de20-ff40-41ac-9745-491548823b78", "comment": "Malware payload (AgentTesla)", "value": "84e539d0e5094c73f35406e7c41d1e06", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629716574, "uuid": "454be679-c704-4181-9ba5-2c5074077e94", "comment": "Malware payload (AgentTesla)", "value": "334435614155f28de81427a48cc890031157c346e30140a6e7b82e50a7abab43", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629716574, "uuid": "a4ed16bd-d812-45ad-87c4-5b150738049a", "comment": "Malware payload (AgentTesla)", "value": "a3b0671803eac88c26c5878d1dd7a966beeaf718", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629716574, "uuid": "7950d365-bcdf-47ef-ad38-3101c79969da", "comment": "Malware payload (AgentTesla)", "value": "6fd10163d91df7a484a6937b959609baa5f374921308c8c413dd44f16c025dc866594c0feb79d5ea0b78927d0f1cf283", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629716574, "uuid": "d227e058-2ea9-4a00-a432-09f0e370109e", "value": "T1092570381BB92667D165D63EABE18613F04096DF3411AA5764CA0F67B302AC2F7C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629716574, "uuid": "9c0faedc-cf42-4c64-b37d-d8d1cf674093", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629716574, "uuid": "72d5f9cf-227d-4037-86a2-9afcbd0f7e7b", "value": "12288:JWDc9F3nC0Py3gAhjEJbjJEKahqF5c7JHbxiFEtO9LeX5/YIEs/39R51S3efDzLu:SQ67t1zl9R51S3efDv4Xxc/j6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629716574, "uuid": "2bb59674-5921-42ac-ba8c-5484ade3d547", "value": 967680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629716574, "uuid": "adadd7a2-602a-408e-912a-1df9c029bf43", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629716574, "uuid": "4b2842dc-ceff-4c37-8fc1-32938f21616e", "value": "DOC-0036473846.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5671aaf-03de-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1629701667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701667, "uuid": "c5d087cc-9c4a-41c4-b564-31a6467d3d83", "comment": "Malware payload (Gafgyt)", "value": "d13f0674c8fe7d0a2bf2d26734366c89", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701667, "uuid": "940f587e-ed49-4cf4-95f1-2fc1fa013dc9", "comment": "Malware payload (Gafgyt)", "value": "33870a61ee7aeba0d8ee1dd18178795012e8e1fbe497cf510293cbe6e5f24982", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701667, "uuid": "8dbea05d-2412-4670-a147-60fcdd7a86e7", "comment": "Malware payload (Gafgyt)", "value": "9aa6ad241e06f2df13afbf3973fd51ed30ec8e03", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701667, "uuid": "b0be01c7-48b2-46f7-877c-60f0ed224ee4", "comment": "Malware payload (Gafgyt)", "value": "a7233817ba21a34d240e654832f853b9f0940163a965bc269597340e36382d2c9a43e7c2ca1e57d75feb2ad536638776", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701667, "uuid": "1d443889-7fde-44ed-97ba-5dbe3fccfa12", "value": "T134933A47771C0B63C49B59F12DFB2BF19769B9E112A26581A10DFFD40373AB02422FA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701667, "uuid": "60f060ed-b385-44d4-b3f7-8d50c6c518a0", "value": "1536:eQZ3vcjQBi+LAcjoBCwrv/+GcD679l5M4rumEqVoGj4GfWU5:eafcOUcjIVlrumEqVoG8GfWU5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629701667, "uuid": "0dd8e921-ed31-4c92-ab61-29028749a000", "value": 90087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629701667, "uuid": "11d5046b-7cc5-4c48-9aff-c1cb17a1ece8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701667, "uuid": "581c915a-b847-4e74-a802-0c649f9545a5", "value": "d13f0674c8fe7d0a2bf2d26734366c89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cab87028-0454-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629752276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629752276, "uuid": "971c2ecb-e7a4-4bb9-94e6-d61cd859e227", "comment": "Malware payload", "value": "577b5fbdcf47f70f4d17d87cc8a20550", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629752276, "uuid": "e5cd7c97-edc9-4c2f-b00a-e664894a8d2a", "comment": "Malware payload", "value": "33f0032493157313ad0c6adab971986df14022763e179997c495e039950d71d5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629752276, "uuid": "a9f7699b-13da-4ff1-a736-afa1d6ab42c3", "comment": "Malware payload", "value": "b471af6675d8d95a22525f21a4de5615836e41f7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629752276, "uuid": "2f182cf4-fdc0-46c0-b596-5bbd0b70cc0f", "comment": "Malware payload", "value": "ab8ad6ec9cb7e63ddb41d16a6b058bedd56ade58f8d73ede99e345e9cd0cac0f4a46d2e481f065cbdcbb8094045c6756", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629752276, "uuid": "bacde2ca-5631-45f1-9a66-76f899d0f776", "value": "T116550C3825B8393BE17AC33DDEE4481BF6D4B45B72116A16F0D613670703A06B993A7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629752276, "uuid": "2f0372e3-db07-4fdf-a94d-20792699c5bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629752276, "uuid": "87c205f0-8cfc-4cd2-b6e7-8fa8f764a4b3", "value": "24576:lFwGF4cCc2zHGz/EDdLFn3vh1f0kJ4heVYZsthFGl:niZBfvtJAe6qDFGl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629752276, "uuid": "79bd7323-1697-4419-a38d-4f436244fbf1", "value": 1343488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629752276, "uuid": "4f57557e-6ea4-4d0c-bf8e-bbae4b220d09", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629752276, "uuid": "9cfe2543-9f34-4caf-8d80-989b0debca6a", "value": "577b5fbdcf47f70f4d17d87cc8a20550", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "259b2357-043b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1629741262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741262, "uuid": "76099e11-deac-4bbe-9ad8-fbd14b6596f6", "comment": "Malware payload (TrickBot)", "value": "7769e1dd988ef09fd584ada0bf6083fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741262, "uuid": "7fbe42ed-0585-4ccb-a4f0-c6ec57653a5f", "comment": "Malware payload (TrickBot)", "value": "341186306bd4d9d32fa8e6cebaa58aba3756c9bfdc4d5bef3dd42acae7789fe8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741262, "uuid": "9a6b664d-9e7c-4960-a07c-1de3bec46901", "comment": "Malware payload (TrickBot)", "value": "10e2b3e1d1a3acb2f60bfa2b7a437e728ef30a7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741262, "uuid": "d8641167-ba3c-4c3c-914d-6c24aa7478f6", "comment": "Malware payload (TrickBot)", "value": "6471b23bd4e8c3f0d7d1dcb8bf8bc780b38ceeceaec2e3eefbdda54f932f0399e9dca3a3c9e82436929e409f435c0993", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741262, "uuid": "53e5b207-46c8-4122-adb7-a1d6817e88e1", "value": "T18C94E039B5F080B3E577023098F00B7AB6FAFC141B3197BB4B525B1D9C316B95922B5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741262, "uuid": "da10d871-ce51-4327-96db-be5e092422c4", "value": "a72f794c30711c44b7a2c83e9a1e7673", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741262, "uuid": "4f559db2-c9fe-4943-a161-69402ed1fac0", "value": "6144:9afI6X0INk6t7buuMcgUrRBIYG0CfARZgmaLb2jnI:sfXhk6JbMJMtZKTGjn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629741262, "uuid": "2280a15f-766d-4ab1-bdb0-389cc00d8061", "value": 425984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629741262, "uuid": "1ed2f81b-cbc6-4940-8630-c313d7dcf61b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741262, "uuid": "f67fb647-1626-4251-9e8d-b0f5a2a6206f", "value": "7769e1dd988ef09fd584ada0bf6083fb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36f0496a-041f-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629729265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729265, "uuid": "c2bb5088-ccf9-4c3e-9c69-663d15b345fc", "comment": "Malware payload", "value": "253bcdf182ccd2cbf321da95ff25b1a5", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729265, "uuid": "d54e6938-3a4d-495f-9b02-db7509a3f00b", "comment": "Malware payload", "value": "35492867a10198c197de29fe28e5563b0731ccfa725533a2e3ffc80fbed06a23", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729265, "uuid": "848cbb52-4020-421f-9dbf-516ae163e434", "comment": "Malware payload", "value": "a7f9fc997102d4294d47efa7d338d2236a9d33f7", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729265, "uuid": "13c45399-ebc9-4a28-ba1d-bc7e78e82625", "comment": "Malware payload", "value": "31f536cd09a7637c6fc1202b1ddc90e381fcc2786f868c153f1891d0701d317790a6563f8dd8a57d9997f792c7d4dffe", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729265, "uuid": "acd6ae57-4e2c-4993-919e-9e3decf84978", "value": "T1B9A50142F365E823C533C23666755222602ACD189E47FB97294AF77C6DFFD988E44AC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729265, "uuid": "430ab1d2-4e5e-402a-82ac-463f2b9e5452", "value": "49152:CqTRjVrh4WIrIW170EHuTPLE1ZZOpLv4tm+o5:CqDNIx17vOTT+28t85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629729265, "uuid": "6870b69d-c61c-47d3-9639-ebb05fe6831b", "value": 2111979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629729265, "uuid": "735b44da-e0ed-4bd6-8093-e5dc0f3307b2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729265, "uuid": "9302d918-7c19-4e50-a833-fb350e89f5e9", "value": "Download.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8810bc50-0416-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629725536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629725536, "uuid": "fdb51e82-0499-44b7-a069-d10505daccec", "comment": "Malware payload (AgentTesla)", "value": "7a0960a27010cda70121ba47b7b2d6f7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629725536, "uuid": "5eb1c7b5-5917-4974-82b8-c81a98f47510", "comment": "Malware payload (AgentTesla)", "value": "3589e6fd23656eb67b4329b2a2a7e60f9b7f5a09e2c9edb5031d05d6a25488b3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629725536, "uuid": "c39abc51-4462-4e55-a49d-b4807424b60c", "comment": "Malware payload (AgentTesla)", "value": "69ba3fd83ecbd8f177dcbd5fa94b791b8ab39d7b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629725536, "uuid": "857c873b-97ac-484d-be59-afff04dbad69", "comment": "Malware payload (AgentTesla)", "value": "49a4b7b64e26683b0f95b7d9d236e2003fbfb2a85f488905e8ffc2b1fa2328629fb36cdbf6226feb731ab4043a6f7357", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629725536, "uuid": "80a5415d-d758-4bba-b655-2e03ecd69f11", "value": "T14BF402463359F64FD55E8EBEAC416C20D7E1E2311207EB53AC8326EC5A8D75A8B052F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629725536, "uuid": "d954789b-0ce7-48d0-8d97-c06d7bd4a2cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629725536, "uuid": "771b3e18-d77e-4f08-9e13-85e28a21b4c8", "value": "12288:8eaVeHJCwClrja4eCFMY98ruQ7rxPmdG9FKLzY4App79Y4szLr/C5KP6bRAog+81:8+swCdr98rJrVFKvY4AL7BYCVAog+R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629725536, "uuid": "ad1f1534-3a2f-4076-964a-9c2719a60d88", "value": 730624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629725536, "uuid": "34c77ee5-e90a-41d7-b787-71bde37e0709", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629725536, "uuid": "96d5f1ee-9bab-49bc-82eb-1141c235c6e0", "value": "PO No. BDF -209103-004.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d7d6ac5-03d6-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629697949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629697949, "uuid": "d2074ca1-0e25-4f10-a30d-c87a86a535e6", "comment": "Malware payload", "value": "4b2fbfae525486bb25c3de686efb1eb1", "object_relation": "md5", "Tag": [ { "name": "39.104.77.83", "colour": "#928B7E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629697949, "uuid": "5f356e16-da3a-4110-a190-01b451bb243f", "comment": "Malware payload", "value": "358e86ce8a303ac1c96799b509f6b5e6bc5272e099100d9d3ee224f4116c6d80", "object_relation": "sha256", "Tag": [ { "name": "39.104.77.83", "colour": "#928B7E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629697949, "uuid": "c63032db-9484-4cf9-926c-7b5874e765f2", "comment": "Malware payload", "value": "118d06f6c7f7c8a1135e8bb0e9f05e1da7bdd5dc", "object_relation": "sha1", "Tag": [ { "name": "39.104.77.83", "colour": "#928B7E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629697949, "uuid": "3119d4d7-5998-452f-817f-5a39b27180b9", "comment": "Malware payload", "value": "f8fb458c9d8d7f1f4598de410a7193e11c2c2ec5abd5ed654b5d2d4efc718fc0d12b8e52b3a51dd05ad55dfe8459a590", "object_relation": "sha3-384", "Tag": [ { "name": "39.104.77.83", "colour": "#928B7E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629697949, "uuid": "dc47aeba-1ac5-40d0-90d2-2de181efa667", "value": "T137114F424D614458D4A9F9C297027EF1C0C117AA683D80F2A9FB3B7DA98F31C6C7A774", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629697949, "uuid": "ffad8ae2-3c67-414e-9418-97955bfebb25", "value": "24:y7HkVgunUa6P9z9OuefGQ3KSg2GkHyg7BcKeJ7ZZurAipFJEeeiHJ5oCQATpBPn:AEVgunaPN9OuefGQ3KkG2yg165Z0TpF5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629697949, "uuid": "f53c44aa-a504-408a-8c9a-4f36cc955b28", "value": 1102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629697949, "uuid": "3cab79e6-52b3-4725-844c-bbb75f304104", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629697949, "uuid": "0e0ba22c-5032-469f-8cff-ed266cb9b8c1", "value": "ps1_2.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8085225-03af-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629681405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629681405, "uuid": "d52380fb-6565-434e-bfc9-21fbdfc1bfc4", "comment": "Malware payload (Formbook)", "value": "e079f05837536051b8b3cfa9884a5ff7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629681405, "uuid": "804d6421-d833-437f-936d-68f022bcab4f", "comment": "Malware payload (Formbook)", "value": "35e50a9d07903f1987a19115dfecdea79cec0844a04883e47106a2969d496ee6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629681405, "uuid": "4692bf5f-cf1c-4a7d-9a57-d480acd8e23d", "comment": "Malware payload (Formbook)", "value": "cf1f565bf2fb23f78948329641f1eafe8a14c078", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629681405, "uuid": "d59585a9-f673-4b65-82b9-dcea8179f695", "comment": "Malware payload (Formbook)", "value": "dc915eb4e23378a72897425d2179dbd36160fd0d3c9deaaa4b96deb0c953bc59dd8f54f8e382aa35266a9771e17b3d0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629681405, "uuid": "75e1dd83-8ab3-4319-a83c-f1401c5d829b", "value": "T18405053C19B92637D1B5C365EBE49423F148985FB404EEA96CDE03A7134BA9734C722E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629681405, "uuid": "91ffb56c-3151-4572-a0ce-2cfdec873ab3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629681405, "uuid": "f430c972-ea20-455c-8613-8f58b008d8ab", "value": "12288:+jmuRRyzFy6YNsIHi3dwIMbHq2Aq19sJHO3mKCHcjQMCY2Y7FNNz+ETv:b86Y9HiNwIymqzsHHcjyYl7FNNaET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629681405, "uuid": "7556e56b-abba-4be1-831f-ede9b2faa012", "value": 867840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629681405, "uuid": "aeef3380-92e8-4f11-b97c-1674c685de51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629681405, "uuid": "bafe26de-3d54-42d1-8cc0-72f6cd41f48d", "value": "11317693065_03162021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf64294e-03df-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Amadey)", "timestamp": 1629702033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702033, "uuid": "46a6f5c6-5f5e-494b-84c2-44cea64fc08e", "comment": "Malware payload (Amadey)", "value": "ad1be676ae7990989d9f107778a18771", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702033, "uuid": "75f3e20c-5687-4781-b35c-e86ded845121", "comment": "Malware payload (Amadey)", "value": "360c061a7182082b34d86dd1bafabe6709102b52fe53f4ca357bfee053655d28", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702033, "uuid": "49da874a-4bb5-44f6-a15d-eff877b339de", "comment": "Malware payload (Amadey)", "value": "99f97e5ce495696d7ccae66ed9e970489d6cc834", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702033, "uuid": "1076bd20-d7fb-4c34-a44b-519100a77f39", "comment": "Malware payload (Amadey)", "value": "4140728ef5ab000ebbc310e0c64128ab25789ea2e70ca9821800aa977241fb329be4dad683d296c1a1cf2db85e2d6767", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702033, "uuid": "bee69bec-6781-45ac-a7a7-9f538d8aeb84", "value": "T16F649D30ABA1C034F5F712F859B583B8A93A7AB16B3450CF62D516EE0A346E5EC30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702033, "uuid": "a9b20890-32aa-451e-9347-064a2e54e078", "value": "4aded8f080ac4b6e892c4de31a213f2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702033, "uuid": "eef6c569-9d06-48df-92a7-4214cb7653d1", "value": "6144:u4sAiGgB/G1USdU/XQWc5cYEhV8vVnRLfhN7JAv12WJ:/Ng1G7dZWc5tEhqvVnRLJTQTJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629702033, "uuid": "0c5ab8b2-1fd3-494b-b559-b081db832e01", "value": 328704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629702033, "uuid": "5c9f2445-8323-43eb-9c28-9e7d732a3d15", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702033, "uuid": "234fdf4c-6e63-49b4-ab36-d0b5877ec964", "value": "ad1be676ae7990989d9f107778a18771.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eb446ac-03f1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629709655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629709655, "uuid": "fd5ad80a-e41a-4806-9894-060c8995bb5f", "comment": "Malware payload (AgentTesla)", "value": "a365ed966a7852458e597021a10e5348", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629709655, "uuid": "0f8d3d8b-67dd-49f7-a39e-69eba0b21c82", "comment": "Malware payload (AgentTesla)", "value": "366671ce28feae3d506440a494ed7b63716518eb9b3b08e52d3e1d06c3d73b04", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629709655, "uuid": "1d86d1b2-eb7c-4405-8151-92c294ed2dc3", "comment": "Malware payload (AgentTesla)", "value": "4f5faaab17be2d06c55ab82de1c08bd2823460c5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629709655, "uuid": "b59e9438-2d9e-4e8a-8d66-0cff8e367578", "comment": "Malware payload (AgentTesla)", "value": "9d730391efca0aad09270d3c2d0e41233ec68150c6c18f19c3ecef4dbbcc7b7f8e31d0eedf531a25393016251fec062b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629709655, "uuid": "3fd5d0ba-94d4-437c-9346-94749ee10755", "value": "T19615063D19F91637D1B5C355EBE58423F148885FB405AEAAACCE03A7034BA9735C722E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629709655, "uuid": "607639fd-1e3b-4c7a-89c7-ef722dc3bde2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629709655, "uuid": "a1c803ed-3c14-4e10-9928-3bd8d6b60c38", "value": "12288:m0cPQx+R+52NYn6023EXuSFJ1w86sD0pXq1zdytSXZj0zH37hn:mJPQsR+fn+xy+np6Cs4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629709655, "uuid": "905049ba-dcc1-4b90-93a1-11ebd8ac68f9", "value": 880128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629709655, "uuid": "30756910-af9e-4787-90e7-bbb7a061bb66", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629709655, "uuid": "1c2b5434-d129-421d-bcb2-3c914fdcec67", "value": "a365ed966a7852458e597021a10e5348", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d19d982c-03ef-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629708909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629708909, "uuid": "2f3281b7-98a2-4b03-866f-8fbb0a42d248", "comment": "Malware payload (Loki)", "value": "d64d6e211e21f9bc7f8bd2c68ea42b54", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629708909, "uuid": "44b21317-04c3-4da7-9d04-0fb84bf1480d", "comment": "Malware payload (Loki)", "value": "368a4dda90b399ae7d0ed91b5c8d1c9fd7cf90948cc6aaf808375381047896d5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629708909, "uuid": "834d4899-56fb-4f42-9065-a8f937aee1e7", "comment": "Malware payload (Loki)", "value": "b0499ed19ba61b819d77992e8ee96477a309d432", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629708909, "uuid": "df2916a8-c842-4c45-934d-489143c94f77", "comment": "Malware payload (Loki)", "value": "af54719b0645b84bc44b1ddd24a9e481931275582ba3c9ec7675c4fe62539d9ea0c98cbe8781f0d81f0a40e127959717", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629708909, "uuid": "83a09c4e-2598-4ac7-a597-2f15b6913eb6", "value": "T1C7B4C020B9C18032CA7338314775D5B15D6DAC306D209B9B97C8397A6F74683E63AB6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629708909, "uuid": "2cd91ee2-4f45-4274-891a-c85463d32d98", "value": "7e10d8f3c6a91a68257beb0c2e7d22cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629708909, "uuid": "841b77eb-0c8a-42a2-b7e8-2698f330e168", "value": "12288:2gxw+tZYaWvuEiz1molQXg4Pj3KEQPdHqaYiZp:REiz1mXg4Pj3KXFjYi/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629708909, "uuid": "b1ccf508-3b40-4d1c-a4a8-23cf5dfd7a10", "value": 526715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629708909, "uuid": "da90ba14-8374-4798-a529-4be28fc36e34", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629708909, "uuid": "38e5c9ac-e53a-4b17-b859-05987e693a36", "value": "d64d6e211e21f9bc7f8bd2c68ea42b54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daa48147-041d-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629728681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629728681, "uuid": "93e20e13-9eee-419b-bc87-ecdd44b7a359", "comment": "Malware payload", "value": "cad67481f146abf03470efb41c6cc315", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629728681, "uuid": "26ccfaac-c42e-483b-aeac-be7f577d9cd4", "comment": "Malware payload", "value": "374543465a02435ab5bd2e50e6b1ba0ac4463f5b1aeb300a7682333799509e5d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629728681, "uuid": "7df4e167-f251-43b2-9758-4e63c6d564e2", "comment": "Malware payload", "value": "a7cf63c74bcd3a2f0fc22af4942634853fb668b3", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629728681, "uuid": "a5ea12ef-2d2f-40e0-b6db-b5a93f2171d9", "comment": "Malware payload", "value": "1f1fd7331958f543add9b522e8d4b7c7f3d96193396b449b748da757bb0e9dcb828747a1a8d1de74055bd161d6165fc4", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629728681, "uuid": "f684cec3-f79d-4276-a2c0-1e70c014da15", "value": "T176A62202F388F91BC87B80321AB502765056CD7ECA06D6679959777EB8B7EC4CB887C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629728681, "uuid": "4b0d9257-7610-4563-80c6-ed734b35336f", "value": "196608:955EXeFcIfnfGUe76MpUsMX3wcK6xLG9N8UroltmLfNjO:LuXeF1ffk6Js8wh6xL2N8xtmb9O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629728681, "uuid": "aa3a91b0-88e6-49e3-a1e4-60015828dd17", "value": 9685645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629728681, "uuid": "b05ec34b-720b-4e7c-ba00-42b10015d6e9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629728681, "uuid": "0cd1a3b2-4856-462b-9163-eeef360e30af", "value": "Jewel Puzzle Match 3.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3838a0dc-0415-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1629724972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629724972, "uuid": "4e0cbc75-e158-44df-aa32-3707e56e994b", "comment": "Malware payload (AveMariaRAT)", "value": "00db430a07a7ebfe2dda4d10bffbde37", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629724972, "uuid": "1c6a1074-37fb-4444-a48a-b0137a961f8d", "comment": "Malware payload (AveMariaRAT)", "value": "38a7b50472d2fbc4d4d76ef0936ceafa31606153a36e7afa3d7952539dfa0c2f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629724972, "uuid": "2e11b8bd-5dfe-4b1d-870c-b7298871020f", "comment": "Malware payload (AveMariaRAT)", "value": "dcbbc675debc38a6f6f375ce7aaf7e6f2fdf4a8f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629724972, "uuid": "f6c36a7c-e6be-4b74-8ee0-ddad905ef2a9", "comment": "Malware payload (AveMariaRAT)", "value": "ac0180aae8d23b98396395bb47d37bad6a4db00e23ab085ff785fc95ec2142553d769872806e3d62b9c15fd66508acb9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629724972, "uuid": "7fc23b7b-836d-4caf-9446-64df1329854e", "value": "T1C5E402493748FB4FC1AECEBE99961C20D7E1E6360317DB476C8312E99A8D7558B003A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629724972, "uuid": "7ce5e278-1567-424a-85ae-4cf7d88256f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629724972, "uuid": "218d9f29-bbd1-48a8-99ec-6ad01e0f2b91", "value": "12288:ZofB7UNifyuwDeZmWPebPYrn/4u3ig/+iATBfhEt4hWHs/O:ZoZOifylEm4er0ngmihi8Bfha4M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629724972, "uuid": "961e94e8-a82d-4ff6-a064-4bbc3a7ce400", "value": 713728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629724972, "uuid": "b63383b9-fb9d-4be0-a71b-051e0d92889b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629724972, "uuid": "f7be3e24-4f06-4cb5-8965-499c26bf5ed0", "value": "00db430a07a7ebfe2dda4d10bffbde37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "452181e7-03dd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629700942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700942, "uuid": "e210ccdc-3449-4b1c-9bb0-e10bd06aea32", "comment": "Malware payload (Mirai)", "value": "1b1bf8da137b3e0b5f36adef8b604914", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700942, "uuid": "e5c5a6c2-4b73-43af-9bf0-0e57163a543b", "comment": "Malware payload (Mirai)", "value": "38ba02b25e5b378310b0ac9a29da068ba3829163b549ece0dc36009afb954d5e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700942, "uuid": "02b5138a-0525-47dc-ad8c-37b32e86636a", "comment": "Malware payload (Mirai)", "value": "656e3a2c75e7e3ab36b1557ceef575a6b91d6423", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700942, "uuid": "21f60703-dd6c-461f-8a22-b51f6fba8235", "comment": "Malware payload (Mirai)", "value": "deceea71eabb072fb7bcabb84cdff1bcbd5def254b50cecacb1f2178768ce555948d55124566b3c214c31939145fff0c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700942, "uuid": "f08e212f-628e-45d9-b57a-d8268f226cf2", "value": "T181731222FAD34780CFA47479C9FC49478416DEF5E0FE1C082596E6FC17DA46E29AD882", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700942, "uuid": "175744d9-1761-433c-b264-3925646e0e84", "value": "1536:UBJCPJL0V9etbS594Qmd+oBiQwLTVgXvNizDUtL:UeIMhS5Id+oBiQwLBgXvNiz4tL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629700942, "uuid": "038f96ca-4052-4058-9e0c-1c3cb08418c5", "value": 74416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629700942, "uuid": "690e4bf7-19dd-4c85-aae9-8c1febdbab49", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700942, "uuid": "f3477694-a2d8-4992-8425-b10f3aee4bac", "value": "1b1bf8da137b3e0b5f36adef8b604914", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6cd05c7-03f1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629709749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629709749, "uuid": "0dcbfba8-45cd-49e2-8e00-4fc9bcc84bc6", "comment": "Malware payload (Loki)", "value": "bcd3e420575492db9ee58c42b2032094", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629709749, "uuid": "ecb1923c-126d-47db-b986-5f71ae61bb32", "comment": "Malware payload (Loki)", "value": "38bc9d836ab63101c9eddcb9232e7c1ad227517701caf73f799ec07abdd4386b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629709749, "uuid": "10673e0b-4b4a-4354-afb0-5773872dcd46", "comment": "Malware payload (Loki)", "value": "3d31aace807806cfe8652f07e695b881ba0876e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629709749, "uuid": "81c7b8c0-4d80-4457-9861-6d5f87415662", "comment": "Malware payload (Loki)", "value": "12e8db97fa33015057dfaf450eeb086b37882cdbe4d72eb86381af91f802109b0b1634c202957a8705b65941090cf09c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629709749, "uuid": "09ddd66f-b466-4984-8696-25e8c07535cd", "value": "T1A2A38C23B1C0A717F0864D351896869936DAFE7D1E227A0F2FC63D7E1BF8A524931063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629709749, "uuid": "5b7552e9-9e93-4866-91aa-8fe7fad46e39", "value": "877d76f42120b733733986666dfbed46", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629709749, "uuid": "aed494fc-ab46-47a5-9d5f-d6d60d600dfd", "value": "1536:Y3AExAD534Dy5EqP6zW6X48mPTzJ5V0Le5xK:+xi4YmX48mP/+K5xK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629709749, "uuid": "c9a123fa-a599-4469-9751-292529ab2473", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629709749, "uuid": "8334b961-50e3-41d7-a1cf-0e7a4ecc0693", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629709749, "uuid": "f16b41c6-61a2-4b99-8ec6-bc040fadc673", "value": "SecuriteInfo.com.W32.AIDetect.malware2.27478.28846", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6448ad9-0419-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629726928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629726928, "uuid": "8e0175c0-2a76-424f-be88-cd2f830a0d79", "comment": "Malware payload (AgentTesla)", "value": "645c901f46908fd36d364e8dbe67067c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629726928, "uuid": "ccd6cfb8-82f8-4b12-8fe0-2b5256eee50b", "comment": "Malware payload (AgentTesla)", "value": "394691a936fa2ec8af94e414c3fd851de90ee309b386b38b7b3957b45d000e7b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629726928, "uuid": "43d0ae10-e2f1-4489-b610-971c5618a8cf", "comment": "Malware payload (AgentTesla)", "value": "21cef4956372d6c371fc0dd5adf54881bffab1c7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629726928, "uuid": "267eaee7-dbd8-4516-8420-3749986f4335", "comment": "Malware payload (AgentTesla)", "value": "050176cbf2779286c3f18f97cc7b43c395d57aa408595477ba88d5ee66a40a939f2a406a0aa1b714690aad9078184c26", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629726928, "uuid": "1c56e90c-fdef-4964-b387-01265e11a644", "value": "T14B254B143790B59FD526C9338B974D3096616CBBD6DBC307D003B2AD5A3D2B2EE091AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629726928, "uuid": "efcef202-fbe6-4262-b523-74be21f5e6ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629726928, "uuid": "d29ae509-8754-4f4e-a2ed-df852799c483", "value": "24576:iGyR93fzIOelOarkSq4Eq9c2VYJUEKlCW:g9AOa3q4b9YJUEKlCW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629726928, "uuid": "a08fa113-801b-4f69-abe2-99da4d8e96db", "value": 972288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629726928, "uuid": "5bd664e6-6514-4f48-bf95-a2204182371e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629726928, "uuid": "63179e2f-343c-4322-8293-fbbf9430a145", "value": "bank slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8288b505-03db-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629700186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700186, "uuid": "d3ffa651-4062-4c40-b58d-b1359165bcbf", "comment": "Malware payload (Mirai)", "value": "d32b324e9a663a7d19c4dcf751964230", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700186, "uuid": "d2f2c77e-20b9-40e6-855c-b47ed17fe162", "comment": "Malware payload (Mirai)", "value": "39f0132bf44ecd794d862b6c436e5a2b94dcf467b3f3888ebd3996404f6e8f17", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700186, "uuid": "850e9e7b-6bdb-4183-93c7-1ffdf0c216d2", "comment": "Malware payload (Mirai)", "value": "c05e76878a82c41fdbbe67351bce5696a5bd05d4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700186, "uuid": "bde9fc4e-3a0e-427b-af4c-7282763a156e", "comment": "Malware payload (Mirai)", "value": "60ce30b60046ee3f4dfd2f374aba4bacffb0ba1ae1e36bc8ad6899afa11477b9d0192e73179c19a41c7f7bcf91ebc974", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700186, "uuid": "701b4a44-a96a-4865-b282-a1776b90b328", "value": "T14623F16407110696ECBCD5B84A768B303ECCDB32A2458E4E65BFFAC659D71EC3646CC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700186, "uuid": "3c249827-2f29-42d2-a27a-2a3cb1292fb5", "value": "768:4vdCbvsA9feQoKHba97T/uq3oT2EvjOu8qx9nUaxYo1+4QJgGlzDpbuR1J4:4v8bvsIv+3WpylqMJok4QVJuW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629700186, "uuid": "d2ebbf56-c07e-479e-8d78-26ca99d289ef", "value": 48988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629700186, "uuid": "ac14b34c-8c1c-44ba-8f9c-e695209f5fdb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700186, "uuid": "4b8689f8-2993-4ebe-80b7-b0ce86b3b0a6", "value": "d32b324e9a663a7d19c4dcf751964230", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fff27b1-044c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629748715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629748715, "uuid": "e1000d3c-83f4-4e9a-9fe5-6d9737aaf1db", "comment": "Malware payload (RedLineStealer)", "value": "0defe1e926b2407ee4a292480d8ebf48", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629748715, "uuid": "21cd3136-2df4-48ed-b5f0-a9d34c6b53eb", "comment": "Malware payload (RedLineStealer)", "value": "3a45e96327700631693d230bbd9645588fde9f71c97f79fe57aedf62c1785f3b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629748715, "uuid": "d0947a58-7970-41db-b1f3-ff84cfbb0501", "comment": "Malware payload (RedLineStealer)", "value": "0c526abb9d066bbdaa2b3d566331c62ca70c2be1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629748715, "uuid": "d996f864-15f2-4e1d-b782-238cab383ee7", "comment": "Malware payload (RedLineStealer)", "value": "c9791392549806a496da117b649fb3da8a02ec9cf66e71b50a01d44d69d28de0aa88829d49d3fc308ea2eb0c6ef16c0b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629748715, "uuid": "42969f70-d100-46fa-96e0-2b5fae917851", "value": "T15BC512127684A988C6ACC7339CCE23B223BB9B8E1632D6DD6C4D22D81DD17916D353DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629748715, "uuid": "23625768-52b1-4f50-8a91-fff9883095c1", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629748715, "uuid": "e39f133e-87a4-4ffb-b6fe-9367f9506423", "value": "49152:BvnK6yhWGgXqcQ1IHBmvz8hjI5Z8DRT7h629X0+htP/5ANauUH:dnKzoFXqcySgv+jIkDdh6EthtCUH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629748715, "uuid": "1bb5299b-8770-4bf8-85e3-00312c562a67", "value": 2599240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629748715, "uuid": "6ce50d7f-ff03-4b19-a27d-4ccf559c76e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629748715, "uuid": "1cc19508-2f06-457b-81ca-106d0580a63e", "value": "0defe1e926b2407ee4a292480d8ebf48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7141ba20-0445-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629745684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629745684, "uuid": "81a2576a-2fdb-4ece-aadb-05f49363416d", "comment": "Malware payload (AgentTesla)", "value": "e249c3cf931a39ce861670aca977b737", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629745684, "uuid": "1b9b2173-9f1e-4abc-ba71-36fbc9207794", "comment": "Malware payload (AgentTesla)", "value": "3afa2f6a6fa28303c9fd4bc4f9c6f5c7ba36c0c58a8d161c106228a919d2d8ed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629745684, "uuid": "f2ef7137-a1d8-43cf-9184-50e91937df19", "comment": "Malware payload (AgentTesla)", "value": "254f502d0e9709f95bbe045a4516afef612ce9e7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629745684, "uuid": "e16be5b0-4f3e-497b-96e0-141aa9fc0d93", "comment": "Malware payload (AgentTesla)", "value": "1818fb2654910db310dff05b33f313a19e8c3baf4025040e3d61f4decb1cb19b4552729c430c17d1d4788ad259c2ca50", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629745684, "uuid": "7dea9778-cf82-4a7f-9ad5-7e7e087e2ae7", "value": "T1763402264BECCB77E88506B99AC8987833396FBDB16F183AEB05F119B171DC14C60635", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629745684, "uuid": "c07c4357-ff1b-4c48-8904-85db51a9a627", "value": "6ef74f7b87fa15b6df54d064a5b8ef31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629745684, "uuid": "58dd9a0e-b163-4401-b754-5899c7738347", "value": "6144:x9P+k59oF8WaZbzbFXKSh1KGhDwoNzgc/P/97gPiS:x8k9DWaZpXL1KWDwdId6V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629745684, "uuid": "10290e5c-ec8c-4d06-991f-eeb4872a3f85", "value": 240183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629745684, "uuid": "fb94dec5-1692-4701-afad-2e62515f6cce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629745684, "uuid": "56cacdfd-66b6-48f0-92bd-958726eb9fbe", "value": "e249c3cf931a39ce861670aca977b737", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b400e3d-03c6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629691047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629691047, "uuid": "9a3b6675-4481-4709-92f8-0892af4792ea", "comment": "Malware payload (Mirai)", "value": "5d7c39c04fc37d5abe9c53f79852203b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629691047, "uuid": "a80a9359-dd71-4b80-a093-bcff6ff1acd4", "comment": "Malware payload (Mirai)", "value": "3b319a4c3c93f49e8129381a3716de30c83810476ccca4722231f7dbccdaea63", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629691047, "uuid": "ee4814bf-0969-45fa-afc8-dfce5b60ee85", "comment": "Malware payload (Mirai)", "value": "e3524b21be836b30267048baed7b5816c170c39a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629691047, "uuid": "c402cc2b-fe9e-421a-a9d3-c4bb3b86cc1e", "comment": "Malware payload (Mirai)", "value": "fc104c2f83120ca06e34ea239fc1516f2ad06a4bb6f05ec616b9f2254f0649b3e471da4f2004c307f755b5a83ce9b2fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629691047, "uuid": "b2c0aeaa-e971-4df3-a98f-288b981fdf9c", "value": "T11DC2E130019439A1DAF001BCBDB4CACB63CA4278963F747018DD973899EF94D9A79D5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629691047, "uuid": "fdeec3a9-ae62-441b-a6dd-10012f3643b4", "value": "768:M+TX5ohK76ag8qCidYn4mgbDK/zmHMs3Uoze2:M+TahF6idFcKJzb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629691047, "uuid": "b4fab64c-bc30-4d79-8062-50e24ca00969", "value": 26860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629691047, "uuid": "b81b2621-4176-481a-8e45-1ea9e8c5f9fc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629691047, "uuid": "6fe7448e-f933-4d3a-9126-9e62e22751df", "value": "5d7c39c04fc37d5abe9c53f79852203b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff97a6a1-03de-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1629701684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701684, "uuid": "45d5d250-f1f1-4404-a62b-ac7d656787d7", "comment": "Malware payload (Gafgyt)", "value": "c024b83edbbf6bc051967d8c507f875d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701684, "uuid": "8cc9602f-6f3f-4fad-af94-137deebd7285", "comment": "Malware payload (Gafgyt)", "value": "3b9ae51a33f335bc7850715f88703d6778623e72d70939a5759ed51d2809358e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701684, "uuid": "24f7a88e-8c12-441c-9531-bbc4d80d2daa", "comment": "Malware payload (Gafgyt)", "value": "e4bfe8f40a130f646a6d8ebbaab6b4c887887fbd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701684, "uuid": "acd38a7f-057f-4b78-b361-c05927efca73", "comment": "Malware payload (Gafgyt)", "value": "902b7a06ffac44d44834493ac464ffbdaff90209b17f119618fb3570ea49aaa79d5bc11628f5c9e581c5d6bd58423cfd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701684, "uuid": "0b6ea0de-ba6a-434a-a512-03c68acedcae", "value": "T152832947A9A55F77C0C6AAB125EB59301B63E9D11F4F1B892038A6F4074F8CDB80EF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701684, "uuid": "6b6b8fb5-7340-456e-a676-f2eb33b438f1", "value": "1536:YEKju7anc9EcB+EsD61N8KyUcJSaRCQ679l5Ms5wdQewvhmrqVonLryfWJ5:dKVYAEsDGyBRy5wdUZmrqVonHyfWJ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629701684, "uuid": "549b6656-7fdb-415e-b53e-737f2d173341", "value": 85420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629701684, "uuid": "0de2ced5-f1b5-4689-9301-9c0946f6267e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701684, "uuid": "72e8de7a-15db-4497-a30b-f304fabd5722", "value": "c024b83edbbf6bc051967d8c507f875d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ba3bb7b-03d7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629698483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698483, "uuid": "87707f85-64be-49f9-af19-b24a29dfe1af", "comment": "Malware payload (Loki)", "value": "1c0f585d5c5879b218ea8ee531bd0e45", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698483, "uuid": "ee32a0c2-dae2-49c4-b137-be95f06ee90d", "comment": "Malware payload (Loki)", "value": "3ed985723d0585433f5c23fa34ea383d5e65c0165f60c0f706178f6ccd5862f5", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698483, "uuid": "0642de7a-f3f0-48a5-af17-ed99a8a55db5", "comment": "Malware payload (Loki)", "value": "52c27b84093b16f543c69ebf0c4d65737d5350ac", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698483, "uuid": "9bdec9cd-e341-45b7-9843-fbb114029f12", "comment": "Malware payload (Loki)", "value": "d4c2c67a683b619d9f16c8a78a67f718b7f326e15ebb559ba212f00e9e5b555314699ee55b79ab5b2495883a04df8be7", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629698483, "uuid": "c40c1ac7-72d0-4e7a-a394-0193e15e65a6", "value": "T17355127B27C89722D40D6339108D75645BDAFCA7770F5D8EAA4C3DA82134BA5EF802E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629698483, "uuid": "758b2a0c-a121-4b51-bac3-aa3f53802a11", "value": "24576:a4JlljbZc5/tDxxNjP3MQcVK3WJGo/Cgt2S4i+/IJXEZrMF2D:/lb+jdTjPnJOGU/pokU1MYD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629698483, "uuid": "d30a13ca-d228-4cbd-933a-56e225183f37", "value": 1353176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629698483, "uuid": "170b7d95-80a2-4cfa-8ca3-6799bd1ab6a5", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629698483, "uuid": "01e5f9dc-573a-4f1b-8490-596d8dc3d979", "value": "Bank Slip.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a941bc0-0404-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629717836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717836, "uuid": "d1162c1f-f480-4a4c-bcdd-cacb92399f30", "comment": "Malware payload (AgentTesla)", "value": "fe3ed7479a5aa704361999175c03f5b0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717836, "uuid": "95a8df6b-f5c1-4444-8a4f-b6d316b7b955", "comment": "Malware payload (AgentTesla)", "value": "3f5c564604f35defce8860339fccfc62c63338ff8b1283473294b0f7fe9ac84e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717836, "uuid": "3af90888-f4cd-4109-b2f8-903a701212b6", "comment": "Malware payload (AgentTesla)", "value": "a9b1c9c780e6a8bed0c2410c7280d4ac0aa8ea40", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717836, "uuid": "e2a2494f-af4f-49a7-bd5f-d9dc2328bcea", "comment": "Malware payload (AgentTesla)", "value": "1feebaff52f9e6db8f0dff4c3cb1e497c0ab8c6671de95e061622fab32b87aaa8bd94d6804c8b7b690fa1af9d7ac1944", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717836, "uuid": "ca43751d-f11d-491e-b5d2-712f554fea62", "value": "T154F4124A7689BB4FC16FCEB99D555C60E7F1E2350303EB466C8316E80A9E7818F152E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717836, "uuid": "0cb32e91-cc90-4870-a350-22ae3a12ca00", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717836, "uuid": "8402289f-91c2-442d-82d9-70b5167fcde5", "value": "12288:ANICRHTzbM9yHLnXGSq2p9l4vi14v0Lzh5ckjxOgOsnxOUymHQ86sEqUJHawKTF:6EknXGuD4viE0L9aSxNOmxOUymwMG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629717836, "uuid": "44d1e39c-12a8-47b0-8e4d-10d36030d21d", "value": 747008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629717836, "uuid": "1b7cf322-c8ff-442e-92b8-aeec79fbf304", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717836, "uuid": "037d0c1a-cdd6-4ebd-9189-38ae8fab64a4", "value": "Halkbank_Ekstre_20210823_073809_405251-PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb4c5a0f-0422-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629730856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629730856, "uuid": "d79e0647-74ae-4bcf-81f8-e332c5a3770d", "comment": "Malware payload (AgentTesla)", "value": "a5624bbc9d832c64c741a830c331f2ab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629730856, "uuid": "b545f8db-4e1f-494e-a8e6-844879a63ee2", "comment": "Malware payload (AgentTesla)", "value": "3ff22d53dcd6fdfdd65267fde69b10122c3c680d23334f2f9c6047768d823cfe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629730856, "uuid": "a2832b1f-538c-447a-8113-43c903051e74", "comment": "Malware payload (AgentTesla)", "value": "a7d4130248aa7e13cc0e51158f49ac3d71c44f30", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629730856, "uuid": "60b1e5c0-e985-4eb4-a76e-06ab3a07157c", "comment": "Malware payload (AgentTesla)", "value": "5a1fb1b18a6d752bb397f71815c4c37b7211b136be0c60f0f0fee437d9044bbda140e825a63f26b7ef5f2049d4cead17", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629730856, "uuid": "06ed90f4-90e2-4e16-bfb1-8b1d77c2d62c", "value": "T132D4BF72C91D74D6437F196A42213B12CCBCE25F893FF2197EC905A5B6366E8CF29290", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629730856, "uuid": "d31f7b86-9e21-4d3b-a17d-6ae2e30e6a88", "value": "12288:bYQe01sb9E9ctLEHGpZpbu4bnE2SABsiahWPjOd2DQyGpe1E+Km7bAP+e51:pp1sb9E9ctLEHGpZpyUE2ciahWBElJ9f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629730856, "uuid": "465b1b86-e420-4e0b-a4fb-d095b7b0da2f", "value": 609479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629730856, "uuid": "e986c58b-d7c3-4ec0-8212-6d887161044d", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629730856, "uuid": "91dc90fe-63fc-425c-85d7-8b3d497e141a", "value": "PURCHASE ORDER.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eddd06fa-0414-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629724847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629724847, "uuid": "2e6c1947-4b85-42d0-8e60-a2d03344c340", "comment": "Malware payload (RemcosRAT)", "value": "f0bb3fd79002b8dd5f40ef9aacf38cd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629724847, "uuid": "e499fd58-83cc-4d35-a98a-d21aa2aa1c1f", "comment": "Malware payload (RemcosRAT)", "value": "407bdeb963122e75909f496163bee7d260c8ec321ca6590325ce1682f05741dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629724847, "uuid": "0457e9b5-11c3-4642-a6fa-21a63ff31a1e", "comment": "Malware payload (RemcosRAT)", "value": "ee07dfda2c004d798e724f65b7e775c76078deb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629724847, "uuid": "b697f9a5-8a84-4df7-9de3-b13806f950b3", "comment": "Malware payload (RemcosRAT)", "value": "0ca26d2db5357ef06de3cb2bff4a61ea6d0dc0d9d139e8e9bfc1eda81d9103e939dd05fc9d5d31d8b6dad47fcf5b7db2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629724847, "uuid": "3525247f-e28d-4ccc-9fe2-2de037735c07", "value": "T1E32512453345FA8FD92E8D7999452C14E7F1E87A231BCB16ACC325E94E8F3858B012B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629724847, "uuid": "921eda44-0195-42ec-af4c-9f7d1031a822", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629724847, "uuid": "abb921b2-3d04-4faf-8d5c-04920557cc35", "value": "24576:/TJafQ0y+yjVNSBI85mp1hMVTzuXxfDOj6:rz0y+yB0BzohkzuBF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629724847, "uuid": "1de03130-be35-4236-850b-6537edc39594", "value": 982528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629724847, "uuid": "b3eebe28-176a-47ed-9ed7-50a7f228df86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629724847, "uuid": "28b1cf24-ee78-43c1-9b6a-584edde7e642", "value": "CONFIRM BANK DETAILS_pdf__________________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a57171f9-0403-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629717424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717424, "uuid": "393a2a97-c303-4a38-8a53-f123f5ff0400", "comment": "Malware payload", "value": "631c3aeeef5359d8420541c9079df483", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717424, "uuid": "017f89f7-5fd9-4906-8832-fdbe4119077d", "comment": "Malware payload", "value": "4178cc7e9ab81e4937c29fde8763d37d8f870841b011838ccfa822e08e1c81e4", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717424, "uuid": "6ab7342e-eae3-4094-b78c-efa1dfddc390", "comment": "Malware payload", "value": "89b573498f682549abe8fae94b43728596448118", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717424, "uuid": "c0eea790-3fe2-4ab7-9793-28d105832893", "comment": "Malware payload", "value": "938c1e34ff05be41cc4e99c4045d0e16353813f42543f2ad65d948ca9f1c9e56e7ad8f733608f78835348bfc69c5b2cc", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717424, "uuid": "48a23575-f3fb-4677-bcbc-a528694907d8", "value": "T1F00533B945800A79D7852973C7020DF334A7B82A6BB161A71EDDEC6CA217F1E5BB1D0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717424, "uuid": "c91b1219-81e3-4006-b569-6397e7b8ade1", "value": "24576:D1TjatNJSvTVrwxzSNpObrmZknZ7q5mZT/Z5/u455P:DBASFgW0rmZkp7T/f9/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629717424, "uuid": "669451ec-e74c-4742-83ea-808f481555be", "value": 863482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629717424, "uuid": "9400e1e5-c924-44d4-8804-4a0ed386113f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717424, "uuid": "c8f89475-de5d-437a-b155-5fb0bbd4cab0", "value": "PROFORMA INVOICE.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01e40ab7-041c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629727887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629727887, "uuid": "4dde9ef5-c4ab-4071-82ea-1716735d87ef", "comment": "Malware payload (Mirai)", "value": "05006eaf78d2483f9e514f96672c770b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629727887, "uuid": "02374624-6d3d-407a-b99b-a1e3a2821419", "comment": "Malware payload (Mirai)", "value": "419ab2079b49330c6374ba0f367e6f8b234ccad85ae12c9c876743ded76bb20f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629727887, "uuid": "e9d19b9f-d687-470b-881c-042bf45335e3", "comment": "Malware payload (Mirai)", "value": "346d1eb9ac55d15134c3509777a9070a92290036", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629727887, "uuid": "30757ede-29c8-47c8-af6e-d725e04c3cb0", "comment": "Malware payload (Mirai)", "value": "916f46adcb16720676088b0994494e6621bc7e4f3d1dc182e4ad5bf70b7c4c9af2255fdcfc46a0b9b3c2fa248cf47116", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629727887, "uuid": "9283555f-c722-417e-9409-8c861d81303f", "value": "T16C632A96BC819A02CAD412B6FE5F519E331623D9D2EA7207AD15AF2037CBD1B0E77241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629727887, "uuid": "361a28f0-c786-41f0-acd0-abb197cf81c7", "value": "1536:sWPKw0DX+CaF8wl82EFy+LJwq0E4qFDTFUI070R3tvH:sWzGX+n+2SninwBUxIvH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629727887, "uuid": "5051d4b3-8eb4-4c65-b545-615430a2897d", "value": 72004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629727887, "uuid": "cb1ad1c0-ed4d-4b0f-bfdd-8dfdc817e10f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629727887, "uuid": "aed14d9b-f919-4832-97a6-2fbfa1f748b0", "value": "05006eaf78d2483f9e514f96672c770b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b941d4b-03f6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629711636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629711636, "uuid": "d81790e1-8eee-485c-aa8d-477bf7f77c9f", "comment": "Malware payload (RedLineStealer)", "value": "a8274851ca11c3e4179dd9622aca3d20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629711636, "uuid": "0449bdea-1725-424a-b282-a1c9343005c1", "comment": "Malware payload (RedLineStealer)", "value": "419d84ea0cbca1b972ba8f64aae0256104c7b5c9fa1fb938674ede05864451db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629711636, "uuid": "f4171ac8-9db1-4c5f-b821-b543bf6718e5", "comment": "Malware payload (RedLineStealer)", "value": "9492bf94f67c04bb4a7ba7d6d0f75ac86279d23f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629711636, "uuid": "198aab42-0592-43f9-8834-0943b75a5aa7", "comment": "Malware payload (RedLineStealer)", "value": "c3a68d95ac7ea80645fa86514f4db13746362f043bf599c26236f3e5666a4e322bc637be62c693ac874434d78247e5f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629711636, "uuid": "9dac624a-9208-4048-b506-b4c23e4ea4ce", "value": "T1B0A32A3263ACC629F7BE0E3668701125C7F1E08F2401E75A5EC574EA1E76B826548BF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629711636, "uuid": "06f9c2d0-299d-4691-9185-24d01421de1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629711636, "uuid": "3142731e-5730-4254-8531-f3fbd5326442", "value": "1536:1o6aG7rCFisofMDCG4VoJHOMauhwhegbue7vRkuvNyWIsdVyetx5RE3G6WAaoigr:1dx3C6kfMugP3WulyydxNWNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629711636, "uuid": "1a3517a7-d22e-4d8a-9ebc-4e2fae8e1566", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629711636, "uuid": "d5431d77-00f5-451f-999d-6d015344cc08", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629711636, "uuid": "11482822-782e-4179-91c9-d3635df57298", "value": "a8274851ca11c3e4179dd9622aca3d20.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08f20b09-0412-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629723604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629723604, "uuid": "488ed674-56b6-45a7-951c-837e3abf4436", "comment": "Malware payload (Formbook)", "value": "4c98280b2873a76cc16f1c80b5ff8a4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629723604, "uuid": "59956c5f-97e9-4062-94d7-d6e17bee867c", "comment": "Malware payload (Formbook)", "value": "4307780f4d8e29477a0c018fe3a769fbc545bb54e14129319592271601599147", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629723604, "uuid": "8224d552-f6a1-4ad1-a5e1-e33e312722d8", "comment": "Malware payload (Formbook)", "value": "d4bec05ec9a527cbf02c5e88d7688268524260e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629723604, "uuid": "8b00bb0c-5a9f-4eca-aa86-10596ad4821d", "comment": "Malware payload (Formbook)", "value": "c65dfaca9c1f74c5af5c3b23498571a6f00fed433a42657f1bb62295bf5e1bd8baeb9bcf09425e712ef782deaa984a1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629723604, "uuid": "1407558a-a0f6-48df-aca0-76fcb39b0397", "value": "T160E401897754B28FD51ECE7A99216C20D7F199714327EB4A6C8322EC298E756CB013F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629723604, "uuid": "a5bb36bf-e2c5-4ddc-a7d1-7171b5cdd25d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629723604, "uuid": "b345d7da-fa63-482c-aeb1-3e818e661256", "value": "12288:L8Ypaf4abPHECEPWvcdnqmdDnX9YlDvuKCoDgyMjqjDyzpnsxZkHM3Oe/9s:LT1abvEVP4cdqmFX9YlDRDQqj+FnscHK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629723604, "uuid": "cee3a2c0-3a3e-4dba-a581-4572e4ad9214", "value": 718848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629723604, "uuid": "7541fe46-44bd-4ec6-be7e-190e21eafd4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629723604, "uuid": "989143fd-23f5-439f-8e1d-716be420d116", "value": "Confirmaci\u00a2n del n\u00a3mero de cuenta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "605612cd-03dd-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629700988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700988, "uuid": "ffc7ccc2-8499-494c-bc37-55e209eb54f2", "comment": "Malware payload", "value": "37c00a568eef6447fdd49dd5d1cf31b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700988, "uuid": "a5f6ace6-9cc9-4c50-b4cc-149123eede25", "comment": "Malware payload", "value": "431009140476d2a9ee3447afa4ab2dd654bc78c5196dcadc08316b00ecda90d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700988, "uuid": "c203825a-4d54-4c3e-8d73-6cd59eb3a63c", "comment": "Malware payload", "value": "08e37bf5db91e430545b2a965fef511b5405ad4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700988, "uuid": "c6c6964b-eff5-4a75-97f0-3b003a20913b", "comment": "Malware payload", "value": "32f4b33ae462c82fd4b0c8b0b87eee6a21f9abf02237f707c547bc082cb32d5163f146408a361ac71649542a1c9c4fcc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700988, "uuid": "37166a23-8185-4693-808f-fc16bebd9cf8", "value": "T16115F63C19B91637D1B9C365EBE08423F258985FB511EE696CDE03A7130BA8734C726E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700988, "uuid": "04feb5dd-5899-40c6-9e85-89e1506f5ddc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700988, "uuid": "5d3bb3b8-6777-4c2a-b4d2-79030e9288ad", "value": "12288:vLRpV9QC0hTclwOjLcK8JB9Wzl3XFKQy+7FMNyGKYP44lwxVlzo1MAYazPkJjKPi:vLRiC04vjLXB3VB7F4OWAVdo1bmei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629700988, "uuid": "4520c1c4-391c-42bb-b28b-d26228e58beb", "value": 888320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629700988, "uuid": "c7c0ea06-62a0-4e7b-94c8-23a53b020219", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700988, "uuid": "10bbc0d7-5d69-4b4f-85cc-6e4f453dd869", "value": "37c00a568eef6447fdd49dd5d1cf31b4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e137220c-03ff-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629715807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629715807, "uuid": "3d866730-aff4-4484-810b-20490b12a017", "comment": "Malware payload (Mirai)", "value": "117ced6896a1ed20217cb13675286c34", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629715807, "uuid": "0a76e4fb-b3a6-412b-8d18-0cc00cf95e58", "comment": "Malware payload (Mirai)", "value": "4392f260b4bf2636246b8f17445e7c253347b27e7be788cb98d42e44b630ec0c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629715807, "uuid": "17d1c26c-93b4-4546-bd44-2b614c43839e", "comment": "Malware payload (Mirai)", "value": "e11e58d11fdb0f6a9533916700a20bb5bfea0555", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629715807, "uuid": "32f1ab60-9e12-4a44-ad4f-62c083b5c011", "comment": "Malware payload (Mirai)", "value": "6b2bc40403e6d1b3298ff3f59b374b8bf0682e23083f075b7f4077de976529e89777f4bc06ac51cfd6ba5e077e896323", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629715807, "uuid": "ef828a26-373d-48a4-b4bc-52e76c22fef8", "value": "T108C2D0300A927B60C5B018319C28C7CA6B3726B5D1ACB4EA247507EC90DFA8F6579AD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629715807, "uuid": "dba197f0-5278-49a8-8cf8-4fa80577969d", "value": "768:eQaaX8dMsZUIj84/11d5PKBEVXjvI4MSkKMIys3UozbH:eQaaXP+Fj7t1KmFwSkvUzbH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629715807, "uuid": "7aba8a65-5efb-4264-8892-063a8d76f975", "value": 27928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629715807, "uuid": "56abe502-3121-4372-b990-94730b207775", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629715807, "uuid": "37ef02f3-c286-4009-af13-18882103eef2", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4560e8e4-03de-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629701372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701372, "uuid": "d74f944d-9a38-49be-b3f4-d3ffe6ce38b4", "comment": "Malware payload (RemcosRAT)", "value": "a971816d5dafc580f32f3f6481757f0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701372, "uuid": "0e9329d3-dbad-4d4f-a69f-33fa0b6214cf", "comment": "Malware payload (RemcosRAT)", "value": "43950f092deb41fbeea81df693331bd9328941abb3e3f27600a9d35b519eed3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701372, "uuid": "7f0e6d5e-27b4-4066-8d66-31b0c8827d74", "comment": "Malware payload (RemcosRAT)", "value": "f6fe675fde2e1b4386a0754c835e885efc489a46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701372, "uuid": "671fc5f4-6ceb-46b1-845b-afddfdb81259", "comment": "Malware payload (RemcosRAT)", "value": "2c7efa2912f809cb261005fceb3178f723cfcb539ba2cbdb48da4ebe85e22f4a7340a2885e9b0c1d94909cc0bdd93905", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701372, "uuid": "57bee4f8-f089-4942-b430-7cef79e2c4b4", "value": "T11B35E02F37E569D5C2598E36D36B069843F0826B1232F3AB49D41AF4CE1061F7A1F4E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701372, "uuid": "79810809-bd8c-40a6-83ec-51f04f4dad6b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701372, "uuid": "ac148a99-e067-4d79-9fc2-2c1d4fe95723", "value": "24576:2aMNg9vPvvvVvTRkTtvvkvvvPvvvnvvvPvvvYieaBcc2E5l6hKuz:2LNg9vPvvvVvT6TtvvkvvvPvvvnvvvPG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629701372, "uuid": "7cc61765-849c-4b48-b3c2-eaa72e9d4bcb", "value": 1121792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629701372, "uuid": "33fac6a8-3dc8-46af-b977-833be85a3d02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701372, "uuid": "bb6a1d59-6dce-4635-9d18-b854593fcf58", "value": "rfq-order required 00r42.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04281e26-0404-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629717583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717583, "uuid": "5022ed0d-74a9-49cc-97dd-a1ab79b4947f", "comment": "Malware payload (AgentTesla)", "value": "3b6f0c37b2b0226bc2517f1381b6ce45", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717583, "uuid": "347f07aa-5b31-4752-aac7-20ac05dd0dd1", "comment": "Malware payload (AgentTesla)", "value": "43c303987dba29c7b389decbd14357570637dcd0589ea7f4f6b6242c58075051", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717583, "uuid": "b7fe0f1b-bf24-45d8-93a1-f0c4b56598dd", "comment": "Malware payload (AgentTesla)", "value": "4e021e16205959abe5a36dd048e04dd8bf4d96ca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717583, "uuid": "b4eff766-abd4-4aa3-8d7b-ae64a7fb9e3d", "comment": "Malware payload (AgentTesla)", "value": "609b05585acd5b25dab9f16b41844d248f58eed3d21aacde845952878a3c57e90af9ece51dcf8382222a9fd2ae2e0535", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717583, "uuid": "a01d5208-5fab-4ec1-b219-0559d1b82955", "value": "T181F412593741BB8FC53F8EBADA112C5082B1F2710317E756BC8316F99A8D7968B052E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717583, "uuid": "5af3ddd0-2312-4471-bff6-db784882de45", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717583, "uuid": "f64a865d-816c-4421-a273-aec0da8d6e6b", "value": "12288:7GNYb/KSE2nbJCfQdp4i6lzY5Ell3PWcMVjy+HynHjU/Qfr4TadbbRtj:7WYb/KSEIocEDfWc8jzHADUoDAQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629717583, "uuid": "a688a547-f82a-474c-86a7-d6ac5de28f20", "value": 752128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629717583, "uuid": "90e717bd-3580-4276-99af-e7b0be88f31f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717583, "uuid": "1ef5b98b-0d13-4de0-b6cb-01acee934dd2", "value": "INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0634b504-0409-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629719734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629719734, "uuid": "83ca17ab-e175-4660-bd5e-d317b39803fc", "comment": "Malware payload (Loki)", "value": "36cf812d45e85445eb63c6ae69a7f9f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629719734, "uuid": "f92608fa-33d2-46eb-ae70-1f00af6ef1ec", "comment": "Malware payload (Loki)", "value": "44f8c0c161db4a9a5d46fb6de062027f97b38ac3ee86696cb69e906e836d348a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629719734, "uuid": "7bbacd06-bd11-435d-b0e0-fc146bdf0284", "comment": "Malware payload (Loki)", "value": "97c1ce531d30b920f037ef2863428e27af42074a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629719734, "uuid": "dfae09d7-d9c4-4fb1-9bfd-cbd6cc812926", "comment": "Malware payload (Loki)", "value": "2d8e0bd0721bf24d8ae08f056fac373a0ddef924fce11a9c1f42f53480912a4ba15a07a7646022de0373605917ec7877", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629719734, "uuid": "d9972334-a693-4eae-9efe-7a4702502552", "value": "T186F4D43D19F91637D1B5C355EBE49423F148986FB404AEAA6CDE03A7030BA9735C722E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629719734, "uuid": "ccbd67bf-92e7-42a7-97b3-0ab60373e259", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629719734, "uuid": "c1856bdd-f16d-49fb-ad65-a0af9117ae92", "value": "12288:2nvjq0Ne9PbHs+mKGombfToU6zUd5KPnGpd:2nvjq0Ne1LIKGhbfToURnZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629719734, "uuid": "21e03575-bc0b-45a7-98ba-f019dea20967", "value": 773120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629719734, "uuid": "eaab3654-b6c7-488e-bcdc-1c559e86b1f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629719734, "uuid": "6ecbdb24-0d6b-4e02-91e7-b4f97ad46a78", "value": "INV#202170607#SGNBM4809600#BL_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f3abf80-03dd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629700932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700932, "uuid": "2fa85f18-5277-4cde-a208-39c5e2aaced6", "comment": "Malware payload (Mirai)", "value": "12bb4e7424547894829d14d6cb46285b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700932, "uuid": "9113ef76-3687-4aa2-b942-55a7f07ee790", "comment": "Malware payload (Mirai)", "value": "4574f7fd2f5f42150e306ac8004b37d3fffd9abe8310547e846cff503c1c3420", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700932, "uuid": "33a0f15a-3e9a-466e-bbbe-764f511d5460", "comment": "Malware payload (Mirai)", "value": "a72e8b47b3a9df676756fe206a740bd5a637d6f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700932, "uuid": "756da54e-f9e6-47ef-a72f-149b7158679c", "comment": "Malware payload (Mirai)", "value": "bdd0afd0b17dadac4e811af01837ddbd09c9ec9493c8a434685e76568d4aee9f02e085f3c007ed349652f557088192dd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700932, "uuid": "3fe0ace7-804c-47a8-b27f-f79ab19403d6", "value": "T1A723F1A01748FF73E034993567A08FC6525727BAB0E76047DF0CB4E4AE5528B80AD6DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700932, "uuid": "3ccb4f50-b055-43a7-ad32-6324a5d758c6", "value": "768:v/ASkwic2njbfJykD1ILze/tzVCsGSGjTyV6+XLpaT0w3QX1jNocqdOa8s3Uoz6:nAKi3n3Pp/tJzGh6LpDvj2dNz6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629700932, "uuid": "8add6b8f-a6b7-4b4c-a121-6541de3cf65d", "value": 46764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629700932, "uuid": "71d0c014-abff-4a1f-86af-a8a7df2349bc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700932, "uuid": "db19a80f-ac8a-45a0-8f7b-599f5ef7f0d0", "value": "12bb4e7424547894829d14d6cb46285b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "017dd89b-03f1-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629709418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629709418, "uuid": "829010a1-a0b0-4001-b61e-7435015b0e89", "comment": "Malware payload", "value": "09abfa29639e1fbc96e093a45bfd905f", "object_relation": "md5", "Tag": [ { "name": "htm js phiser", "colour": "#55CE34", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629709418, "uuid": "3a2228ca-2e8a-4a50-b8cc-04b8acf7ebc6", "comment": "Malware payload", "value": "45e73a0e2e496c7140a131acec6ae3e709fcc1de7751702b2a5a86b788f6a733", "object_relation": "sha256", "Tag": [ { "name": "htm js phiser", "colour": "#55CE34", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629709418, "uuid": "8e46dc38-eb72-4aef-b36b-cd085f9f2653", "comment": "Malware payload", "value": "2cbe6117a1b19bf3b69592864ed1de96d9764b37", "object_relation": "sha1", "Tag": [ { "name": "htm js phiser", "colour": "#55CE34", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629709418, "uuid": "c2a37510-e444-4f32-9e61-4dba56757975", "comment": "Malware payload", "value": "6a42973bbc34571e32504b66aa20cbb26db435f2ea00da1f9627b14a22d7666e41058bfa15b530d5368e264328cc71ef", "object_relation": "sha3-384", "Tag": [ { "name": "htm js phiser", "colour": "#55CE34", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629709418, "uuid": "d67416c0-1f85-4d0f-bd89-32dede071063", "value": "T1EB316265E16F4C1FB302B17CA5432B516815C362CB0A1E487AF43DFB70ACF9499448DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629709418, "uuid": "d2a2a8a4-503f-4787-85e0-7a54c4fdd781", "value": "24:xdksqCnkWYEcofO9Sv2shiv2shiv2shiv2shpl+yWfG3iNEYicS59MuAFv9oU:xhqZW3hezezeze3vfBaH1Kd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629709418, "uuid": "a29f7a4e-fa4d-40cc-93ea-2f5ffd39ef38", "value": 1512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629709418, "uuid": "c4a04a33-27bc-4886-b10b-e9fd38510257", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629709418, "uuid": "5b9fe4e3-fac3-43d4-b87c-397b86870075", "value": "PFI_91551.htm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f1079f2-03e9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629706247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629706247, "uuid": "379fff29-9a73-4725-9222-077aeac7d7dd", "comment": "Malware payload (Loki)", "value": "fa5fe11f37318bf2793b5ffafe621345", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629706247, "uuid": "ce7e8966-7fb0-48f6-9e36-5703d647c8b5", "comment": "Malware payload (Loki)", "value": "467db49e07d592f97847aeb59d6b8c34df885c77ae573b1d149d0c055d861bbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629706247, "uuid": "d0eb0b64-73f7-48c0-a865-959051843414", "comment": "Malware payload (Loki)", "value": "6d2798dc94fadec0e00e5799e0b6b99e53b3e6e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629706247, "uuid": "dc55fd38-75be-428f-8c99-60bb4f3a68f5", "comment": "Malware payload (Loki)", "value": "e7c109b54fe844f3f8a77629daa21f208351f122e923e63e69659ae9336332ac732f8f574daf0c9c75b66b186fd7bf3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629706247, "uuid": "3d4cdf6f-6e38-440f-a090-3b4318e011a1", "value": "T184D4F1057385FA8FC52F8EBADD525C20E7E1E2361307DB53AC8310E9AA8D7854B512B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629706247, "uuid": "60b14461-2e94-4ecf-b675-29aa7a815d93", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629706247, "uuid": "9cc1f379-1d81-4ac2-a8a9-3482b973c60e", "value": "12288:/xqFwM8l4Ir85r6Wdtgy/wkMjfg4pO18+TyWAnXLwI5K+hp:Qf82N6Yd/SjE13TNq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629706247, "uuid": "0cb94b2c-e585-4d5a-8bf2-eb0b02db208b", "value": 636416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629706247, "uuid": "256c3b89-80fc-44b6-b573-e1f64a32c96b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629706247, "uuid": "c0325f8a-1802-47c5-86eb-dec82c0be8b0", "value": "?????PO340664.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4beb19a-03e0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629702525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702525, "uuid": "7083b565-8a62-4be6-9756-9d9601d15b44", "comment": "Malware payload (Loki)", "value": "84243049d06d0be786f560fe95392bc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702525, "uuid": "dfbffdce-46af-45f4-8f17-0451bc536dad", "comment": "Malware payload (Loki)", "value": "46a26fb39083f77a088365eded45839567dd33a1623ddb6440073dbf242c8811", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702525, "uuid": "5cd5feac-09bf-4dda-8d5b-b1c1efbe932f", "comment": "Malware payload (Loki)", "value": "3b27c60d0508a196d9be62b280b249fa40540838", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702525, "uuid": "a4dbc942-f722-4b90-8ebc-1e06d34777d7", "comment": "Malware payload (Loki)", "value": "192256c221cbd04398bf70ed85794fe5c12d4be55cd9c684bb1fb187667750a557906d3d832732f2e50a541017a8f9a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702525, "uuid": "c644f858-f711-4006-975f-df2ba65d6730", "value": "T13F340180B33D96B8F1BC31F54241587656290CB387AF04DBD746B72A6671683D4B23AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702525, "uuid": "253b1b24-bf93-4019-a468-12c9a879cd06", "value": "f86f9a1397ea2f648b8914df9ad78914", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702525, "uuid": "70c89f32-eef8-410a-8486-65c177782e59", "value": "6144:vo0Jz1zHG0QaZTbjPczio+TAOsbzRCXdrv0hNNE4:vo0Jpzm05HjPybCXKNW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629702525, "uuid": "797e69ee-004d-4c05-b0f7-2b3e388ad392", "value": 239152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629702525, "uuid": "5f0973fd-35b8-424a-8194-2b4200f0b841", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702525, "uuid": "5d488fae-9b3c-404a-ba22-aabeab5888c3", "value": "Updated Statement.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac1efd71-03e3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629703692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629703692, "uuid": "d868649b-aac2-42fc-ac43-4bb1dd44a09a", "comment": "Malware payload (Formbook)", "value": "5c7617ba8820219a117f47131fcddcc4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629703692, "uuid": "2ad8a458-22c4-40ea-9bdc-04e84b5a2b52", "comment": "Malware payload (Formbook)", "value": "47094b130d5a6db066b0274b1c0ba6723fa67bfd53aae9f95ffa7a1039fccf90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629703692, "uuid": "4e3196f7-652c-49f8-96b0-49b12b25cc48", "comment": "Malware payload (Formbook)", "value": "3646465b1663325064859afe99cbfc1991c142de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629703692, "uuid": "e820b187-8755-4ce6-87a2-39396fe82326", "comment": "Malware payload (Formbook)", "value": "25242785145f3aebd50fc3adb44bf47db5c49d4beb0a57899c9619937cd0dac123aecd261b75d952c09c26ca8551e45a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629703692, "uuid": "9c7d5f92-cd07-4487-888d-d83da3a66030", "value": "T126D4F1213189C871C1378A7A05E8DB65097D797B0BB21ACBB3D84F4D87B86C1AE71397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629703692, "uuid": "be276c93-e5ec-4c61-a1cf-e7e1e419bf6f", "value": "ff42c22be7db6fd997a1f31962592e30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629703692, "uuid": "2bcc8b3c-0179-4955-bdd0-b3716fd2baaf", "value": "12288:/U/Rmv+TmAXNsHTow86sUcZjE59mQjx4TiB0iVXI:/YmeeHTowHsPZjE9v4w0L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629703692, "uuid": "a0d8ac04-b7ca-4fe5-994a-d36cbddb8227", "value": 648704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629703692, "uuid": "c99f3902-b181-4d5a-a38f-bbcf834bee6f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629703692, "uuid": "4b531e86-cb51-4a37-8f25-b9fea083ee7d", "value": "Requiremnt-Aug-2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d7c3dd5-043d-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629742107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742107, "uuid": "766daaeb-264f-4759-9190-8dc8f2f70aae", "comment": "Malware payload", "value": "85614c9f5c7722694c815a84d5e29d13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742107, "uuid": "95d6d388-c3cd-4e43-95a8-f200936a1520", "comment": "Malware payload", "value": "4773c37d69708d7e8a6716bb6043323857b7b9e117d56d9487d5852a14dc0e9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742107, "uuid": "f72f11a5-395d-4b32-b58d-723d28a3207b", "comment": "Malware payload", "value": "bea7cfd499cb77dcfb2e48c4162bab8e6f37d874", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742107, "uuid": "70c83ea3-b93d-4fe2-82b5-f217d13b1e80", "comment": "Malware payload", "value": "d046281fe970b584dcb95fa087dd0448c59e0b5d24ba32e19041fea45a04d797a38b529d734b66cb125b95368573d693", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742107, "uuid": "add756df-9622-4096-83ff-4cc90aedee78", "value": "T17702B604BBE88105F4FF1F382DF65712163AFA861D22D79F5C94815D6D32B808AA1FB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742107, "uuid": "40cf7788-1e29-440f-8092-f576133fc51c", "value": "192:S5MIlrB4gQyZw5b9BPIdDBaGXghgf8bZ/2+Y:SBljQyZw5b91ADBaYMZ/2+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629742107, "uuid": "fca74b4f-e9ce-4ede-95b6-8935e14d809a", "value": 8704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629742107, "uuid": "6a773009-6717-41b2-be61-b07d2d1980b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742107, "uuid": "2fdf4350-4128-401e-8653-8799f5b5b354", "value": "85614c9f5c7722694c815a84d5e29d13.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc2a95d9-03e3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629703772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629703772, "uuid": "629e059a-0283-4711-81b0-93a605853a25", "comment": "Malware payload (SnakeKeylogger)", "value": "e1ca58a6eaf8d4887add633a625d9141", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629703772, "uuid": "35a684fb-7c22-4c72-8272-2af6fd62ec32", "comment": "Malware payload (SnakeKeylogger)", "value": "490f0fa417b2fff4e5834aa49741bc79191652daa5b88ad0327ddb37216beb5c", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629703772, "uuid": "485f0927-6b52-4ecc-bc57-8e5d7bd067ad", "comment": "Malware payload (SnakeKeylogger)", "value": "30b86d652955b651becb4d92e3a8c6627d029ba4", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629703772, "uuid": "5b047391-1ac0-4712-ad4c-42a3f3c9374c", "comment": "Malware payload (SnakeKeylogger)", "value": "d5d6b4b3ecd2bc3f513419a3417d06908139a6fd1c1c9daa27bf852fda97caa1966585ec899237e7eb6cbd0e31721d52", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629703772, "uuid": "ca17622a-e3b5-41f8-8ea9-f27f052e3761", "value": "T185D4235DC82175EF84CF3D7AD9AF08BE8532F624B2F609024B78E956EAE2054D3478D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629703772, "uuid": "1734549c-4620-4682-b372-79a7f5a7bd8e", "value": "12288:Y9q6kUKpjqoocf/HtQkJbA1nbThbIt0YRms0Ii4kI3kzp/3MEykTGm:YpkXqoL2WbAtbTZk0/swjd1Aw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629703772, "uuid": "5c7ad6da-7420-4a6c-93f1-f424d1befbb1", "value": 654016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629703772, "uuid": "39db02cd-3c3b-41ac-b13b-98c28939d8b9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629703772, "uuid": "9e75801f-bf7c-498a-9b7d-052a91dd439d", "value": "speci.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5284a1d9-03df-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629701823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701823, "uuid": "eb2eb5a5-d714-41b6-8a3b-83567f4c0a93", "comment": "Malware payload (RemcosRAT)", "value": "1f6445dd70e0c3da09ac2c5d7b736945", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701823, "uuid": "04e2f51c-890b-4ef7-b852-c45b607285a9", "comment": "Malware payload (RemcosRAT)", "value": "4af3d60f86b1be4b16c76214fc9ba6e23f937c4a7fa93d2eb25e615bd1ce63b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701823, "uuid": "45c1e347-a6af-4fb1-91af-7541de77ea8c", "comment": "Malware payload (RemcosRAT)", "value": "b4dba50c596aa315d655ed6acd82876fb85697e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701823, "uuid": "f18f16c1-03d7-4f83-9ee7-11aa624ee37b", "comment": "Malware payload (RemcosRAT)", "value": "6a8cb763827709eb7e108fcc34d239e857d779cbdc0f783c91e5c0871dc4085727d47a694e7f4929937de962c57f1ea7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701823, "uuid": "b2f901b0-b946-46a1-baf5-d278535fe580", "value": "T16F359E31E2D11873E2B33A785D6B5B76593BFE231C29A8995FFC1C5C8D39241385A382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701823, "uuid": "c59971b5-87dc-41fb-9193-02ec31e69178", "value": "61da5f388fb525c6541a6c21304d4040", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701823, "uuid": "d16cc922-5f46-4ca1-b108-2b3a3ece5f98", "value": "12288:VnCFpZeB7uGHKKaWU8drn/1iNyhpyv0oM+6yRXOuDvrq8EU0th6gU1t:VnWpBGHK4Um1dXq0oXec959x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629701823, "uuid": "052f3fbf-c201-400b-bcbe-85828260c0ad", "value": 1089536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629701823, "uuid": "f7c5bfc7-8ba6-4e10-8034-25d354244f43", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701823, "uuid": "5834cbb1-f304-4b2b-a2ef-81f64bd41197", "value": "Produktspezifikation und Bestellung - Ramsauer GmbH & Co KG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "600b2a24-041f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629729334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729334, "uuid": "c00784ca-3d2c-4b6f-ac70-5307f5c05e63", "comment": "Malware payload (SnakeKeylogger)", "value": "f02099299dd052f926cec45154538101", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729334, "uuid": "68750d09-442b-4251-93bf-43bce3345be4", "comment": "Malware payload (SnakeKeylogger)", "value": "4b341e16432fb77cad6dc044c4691477891d4a65e606f4256b0b20b17caf3556", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729334, "uuid": "d855e6cb-787d-4410-a4ff-9385dce0e844", "comment": "Malware payload (SnakeKeylogger)", "value": "06a2ea35814529c1fe9818a9f3f37d6e5dd04147", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729334, "uuid": "25f0f8b9-6f43-4cb5-abb9-bd931e14766e", "comment": "Malware payload (SnakeKeylogger)", "value": "24afd0ba819db501dd97ac8feeed14d113e4b6ea22ee616ae477835c48efb634f75f2058922148beb99870e6434f0273", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729334, "uuid": "68ee5a32-9ba3-4e9a-af36-35d54859d8f9", "value": "T1583284BCC08742988F8966F4671E6B89014D7A7DB749A53776BC67702BE2C7B801783C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729334, "uuid": "a46fcf6a-7116-42f5-991e-106e85f57033", "value": "192:+Zdf72KZTnsM5AaJHdWiAj5XH6mOSykr/gwUJF7FTGum+lxQ6H/4eAp30MXKHp31:+t1Z2aJ4h3fHbgBxaum+lx/A5Wp58pox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629729334, "uuid": "d848a400-6bc8-43c1-b70c-c969aa84d21e", "value": 11302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629729334, "uuid": "26584a4f-ac8f-4e89-8e8a-942e129e56e8", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729334, "uuid": "e6d9c123-37c8-4989-9bc1-33f43c39bad6", "value": "Payment Information.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88bd87a9-0403-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629717376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717376, "uuid": "abe2cf81-b444-4c97-ad23-d25fd3bf3b1e", "comment": "Malware payload", "value": "2dabe28babd57abb5ff5854bdefe65ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717376, "uuid": "7eb9365a-3924-40fa-a40d-db433cb34d9d", "comment": "Malware payload", "value": "4b611d0f1bcb7daca27c3093c8c7ea6359e5b6e5b6b4c91e4cba798f60b3413c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717376, "uuid": "79dd67de-57b2-4a41-b970-4fc701ac0ea1", "comment": "Malware payload", "value": "69d81c104bd8bb4953319b2df04b21dc1ae428f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717376, "uuid": "38732f42-efd2-4e2f-9f83-684e2efab5f6", "comment": "Malware payload", "value": "ce31ba100e4d5b5ad9f327c8a9a441380faedfea53ec3180e0d22ec1c63fe37aab0abf2a91416702e7d0b3edcb08f52b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717376, "uuid": "f9d10eec-ce7c-4e08-a5ed-b3dd2a1b7370", "value": "T13175010B99EB1167FC552B71D02548B310FBFDF60E464722BAE1F60E2B31FA165384A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717376, "uuid": "c99801c1-fad9-47da-8051-617389e4a303", "value": "2f095340e94ca508e3b83fb009ebf4cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717376, "uuid": "fdeed902-9327-4353-9036-b9589225eae8", "value": "24576:ecCT67wHqWis4l+jIACFr5hqjiLDpSJDN93pqb6W8cU4gLQlA:3Cpn8t74iA3qb6W8cU4Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629717376, "uuid": "1d67aecd-6d7a-415c-a95b-eefa94aa7084", "value": 1576960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629717376, "uuid": "e06eb44f-5ccf-4827-90ec-abc175863d3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717376, "uuid": "e4859a59-1265-473a-9f89-de0942acede0", "value": "Cirtuo Dringende RFQ_AP65425652_032421,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d2d54ff-0420-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629729651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729651, "uuid": "5a6b194a-c50f-4df3-870e-c7535c623a22", "comment": "Malware payload (Formbook)", "value": "6760461acc7e15761fcd9e4af11ff1b2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729651, "uuid": "774829ec-38cb-423d-93e4-0fec3a15fda3", "comment": "Malware payload (Formbook)", "value": "4c148a8d0bb70fa99670f5ad3ad4d05db937bb5ede2157ba70db6de279d63429", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729651, "uuid": "b5c865bf-f154-43a5-b0d0-899d6b06aaf2", "comment": "Malware payload (Formbook)", "value": "304c23627c3f65fbc1f49caf77f15ce0ba81d6a6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729651, "uuid": "c4d0b02c-bef3-4a8c-9ec6-614a689ef77d", "comment": "Malware payload (Formbook)", "value": "5b5c4321219bf28fcad280f2799184025591965f6890eefb765b3d8d4602b697e06a76b3664d2af17fa34720dc13ea7d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729651, "uuid": "0bdec9e1-f269-4aeb-a907-34ec989e8b07", "value": "T14B452235EC7DBE06DFB20F3A2A4651A932384D1B1F19710E1A9E70F531FD1748683A9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729651, "uuid": "db6194f0-1489-42ee-a73c-dc96f07d0ae7", "value": "24576:FPeXvPq5fZghhasrGZPUAFTYQsJaXKTj0nJQONo/L+9U3n:JOXq5whasrGZsAEJaXKTj0n2OuLC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629729651, "uuid": "70d9e816-dbee-4cc4-9453-b7997d4515dd", "value": 1249912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629729651, "uuid": "251b40f4-1c6b-4b87-87df-75fb7cc0b0ce", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729651, "uuid": "dfdce82f-75cc-45f3-b0bd-32401e398186", "value": "ACIS.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ee9ba9d-03df-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629701898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701898, "uuid": "d401943c-d6d2-48ac-a16e-8d7875181c50", "comment": "Malware payload (AgentTesla)", "value": "6c03fc629c9ce92c6a8557f2244e256c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701898, "uuid": "9ade59bd-3612-47bb-a0ed-6ce65273a6c4", "comment": "Malware payload (AgentTesla)", "value": "4c16950bc8626982c61e1e1e5dacf341823ffea21060ec919e8a5d5951491548", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701898, "uuid": "d8f19c2c-7f50-455e-b9e6-197083c613a3", "comment": "Malware payload (AgentTesla)", "value": "fbcaa2139503f5407a4d05e8bbb89a865772f3ed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701898, "uuid": "934d7600-2776-4b17-835f-19f9c8cc5c07", "comment": "Malware payload (AgentTesla)", "value": "82476fba62a2b4c6b5328590a01507c88423351bc688afe4d8113d6263fb6ec60cc8e37212255ff50ce6bee4bc731b6f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701898, "uuid": "25fd7a5b-5ac7-428d-80d0-99f069e31d26", "value": "T1C645493D1AB91633C5B9C375EBE58523F158985FB400EE696CDE03A7021BA8735C362E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701898, "uuid": "7d18c7fa-d069-4d24-af26-143a9b162b41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701898, "uuid": "fb756df5-1ba6-4530-9d93-fdfa8f4c66c5", "value": "24576:YMggngOkjy/Vmlsa5iAay+fwm2wUubBU7CZsGUyY:9ggnrk+/Vmlsa0pt2wUuC7iWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629701898, "uuid": "fda3cad9-94cb-45cc-90ca-85655054d061", "value": 1212416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629701898, "uuid": "bcd2ea21-918d-447d-a6b4-c5ffe05f82e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701898, "uuid": "ba0a9917-730c-4bcb-a28d-99ece107e290", "value": "payment receipt for invoice 20210801910.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b89b2ef-0454-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629752009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629752009, "uuid": "935f6a43-2b94-413a-bac9-d7cc9d6465f6", "comment": "Malware payload", "value": "ba6c5d53e9418b5ce3c569831b68a0c7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629752009, "uuid": "6c731bf7-fa55-46ba-b9a1-7dbf00b459d7", "comment": "Malware payload", "value": "4c8fb25ca2c5a4b5247188ff6da4620908d96fc4b19ba6c9ba7b7a9c1f7f2bf2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629752009, "uuid": "57efeb28-6fce-4cda-9828-1b103ce92fce", "comment": "Malware payload", "value": "5083a08925984bc70e2e88a9c4f94ea2ecb53d7f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629752009, "uuid": "3878bf0a-8813-47b8-9e18-404140d20d3c", "comment": "Malware payload", "value": "0d32fa3eb331f29e39d31af7c37be1cc43a50c7b29bb244dd60037f8082d64868cf074fa0956e6c821443a40e474f6a8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629752009, "uuid": "cf969ed8-55e9-4e20-9d01-843274637e60", "value": "T140550A391578393BE17EC379DEE44D0BF2D4B45B7A11AA16B0DA13670703A02B99327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629752009, "uuid": "5a024c51-da5a-4a5f-a9f4-7d191b9098ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629752009, "uuid": "27912c7b-254c-4b58-a2f0-d83d63b3164d", "value": "24576:Y+FsA4cCc2zQhIEvJjJFnSL36RKp0qsKdqE1suBiCwxFLuUp:YklfBg36kVseB1dUxFLua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629752009, "uuid": "07a05523-28b7-4526-a95f-35fdbffa3c1d", "value": 1335296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629752009, "uuid": "16c2fb92-afbe-4b37-ab12-f4c1e3e9bff9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629752009, "uuid": "d6cc760b-4928-4e6e-98ce-944e7419d87e", "value": "ba6c5d53e9418b5ce3c569831b68a0c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2da8926d-03d7-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629698326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698326, "uuid": "a9414e3a-0ee8-4a0d-b722-deffc187d018", "comment": "Malware payload", "value": "af3c09ee6b681fcb10be5c3d1e40d890", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698326, "uuid": "13062fe0-22cb-419a-8880-a1490d2ffb04", "comment": "Malware payload", "value": "4c9195740002b163c012571e3f5f1fc3af645b767ca64b7f0f8da1c1445c3c11", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698326, "uuid": "f16dc3c8-62b8-4f7e-bfe3-7d2788c83871", "comment": "Malware payload", "value": "45d0d5f940f52a6484082d6f40d34169862ed038", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698326, "uuid": "8986d8ec-f6e1-40c6-ade9-613f5b622bc2", "comment": "Malware payload", "value": "0cd715e32fe94b8a5a6cda77cf7a8d65e199483723b7bfe6da3a548e4978cdf612b81592892e4b5f4973fc6eedc670ec", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629698326, "uuid": "8eb8f64f-503c-4062-8f98-6ec39c65e34a", "value": "T131466D13B284943FD06F1A364E3BDA94A93F7A712A12CC4F2BE45D8C8F356407A27657", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629698326, "uuid": "12d1f695-ead1-45b0-a1e9-c61bc18ad7b3", "value": "98304:ruHUh907tnEnMYfxUIePThV3YS8gJekOxIxluWDAEczOYwA:r4lJYJy3YS8gF8IxFU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629698326, "uuid": "0846cbdf-4678-4988-b484-c81e441c99d5", "value": 5398016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629698326, "uuid": "989aea7f-f1e8-4add-9b63-a2481f288fbd", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629698326, "uuid": "4fda43ab-1379-4f0c-8a5d-afc05b6fc22a", "value": "factura_qcmbrzofwjavutotri.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0368cf61-03de-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629701261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701261, "uuid": "ae1f83c4-0cc2-48b5-9704-148c1788ded3", "comment": "Malware payload (RedLineStealer)", "value": "7296f37903240acfb47fe4719d5896b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701261, "uuid": "e62e9fe5-eea6-4f86-b9d3-fc7153a01ded", "comment": "Malware payload (RedLineStealer)", "value": "4cbe70c0961c305072fb8d58e96aa477b40ab4bd19a5799dfda282702c55467d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701261, "uuid": "a9c90542-cdef-47b1-aa3e-d19f9a160d3d", "comment": "Malware payload (RedLineStealer)", "value": "4b29d0fd6e5575c3d6c00eaa11e1a91869da9045", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701261, "uuid": "029db264-fca7-4a47-a0bb-c0ea275bdb58", "comment": "Malware payload (RedLineStealer)", "value": "eedee74f6cc2852c38054026ade6c6fd178ff06d0ada6f4a55cd36afdaf98f4d83bfa625a0c05f2df8cdcc9135ab9dcb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701261, "uuid": "7707e132-cca2-4124-93c7-2269e971e96f", "value": "T1B715120B37E504B6E4B557B44AF2018726B2BD95AB3483DF175ED82E0E332A29277707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701261, "uuid": "301797b1-d87f-41c0-bc2c-21b9483a02e8", "value": "013c74198fc6e42dcf33737d6c40c012", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701261, "uuid": "9593706d-5c76-4af8-aee6-fbb7b019b32c", "value": "24576:nyLHuEU/Ve5SXJe8qXHgaKpr6gLUIpnK2ljS27vs:yLOgR3fgLPpyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629701261, "uuid": "5f945d49-fd7d-42f7-a124-a8a3e3220a36", "value": 897625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629701261, "uuid": "074b960b-e4b1-4f01-985d-351eb9ee5bda", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701261, "uuid": "e124a848-fc47-4474-9c25-46b84fc44216", "value": "7296f37903240acfb47fe4719d5896b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e08cd3a8-03ff-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629715806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629715806, "uuid": "8d5b5683-adc2-4916-bc46-d447b4b62398", "comment": "Malware payload (Mirai)", "value": "21d8af5ae72d80fc190b935ff613e610", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629715806, "uuid": "a4806332-4e64-4c31-af84-2d9923465017", "comment": "Malware payload (Mirai)", "value": "4d4c4a4b749d6b793e4c8aa8f47bdf4be93aff2534f4f280663697c621d85824", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629715806, "uuid": "65acff6d-f06f-4c33-87a4-8cb33e5d7b5a", "comment": "Malware payload (Mirai)", "value": "a646209e82e329466b87a6a72e409bcdd8eb3596", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629715806, "uuid": "b66cb019-36dc-41a9-8942-535558e8d8d6", "comment": "Malware payload (Mirai)", "value": "ee69f4f01d1c2319e81edb44dd342b2edd73a46833c8e800fb017a098497818c1760bc632029ca6320c8c612e90a15c5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629715806, "uuid": "4c64c09b-ac5f-49d2-a12a-553463ade10d", "value": "T157C2E092C3A86292C86C8934089F3F4E6975F609931556F1F3C52E766CD6A387F34363", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629715806, "uuid": "a88ceca9-39b3-40da-a17d-1c303f728651", "value": "768:AJ/su/XVJxVZ+ok7DLG6rHnbcuyD7UHQRjy:AJ/su/1twhLnouy8Hyu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629715806, "uuid": "83c9bc8a-b12b-4e15-8941-f74519f0ebef", "value": 27948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629715806, "uuid": "ff3ea8fd-c71d-47f4-ac85-8dddb44fc988", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629715806, "uuid": "edda4cdd-3f35-47ad-ae37-3c8f8b9e8067", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a729360-03db-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1629700172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700172, "uuid": "375a3d98-8523-4156-85b9-d67c827413a8", "comment": "Malware payload (ArkeiStealer)", "value": "f410aa20278033a2158bc670a4d341a8", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700172, "uuid": "e23a171a-98d9-4df5-8d29-4820f8b992b6", "comment": "Malware payload (ArkeiStealer)", "value": "4d5c0f48a8ce95adc60131576a3b2a58101e382e9299d5b7ee120508a88f73f3", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700172, "uuid": "8287fdd2-2afa-42be-92ad-08054e2e3683", "comment": "Malware payload (ArkeiStealer)", "value": "fe81a5c5cc0ddbc59686bd14b7314889523f0015", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700172, "uuid": "b96de298-0686-4723-928a-aed8d111852b", "comment": "Malware payload (ArkeiStealer)", "value": "a8c7113339e0c1d42dc6b40363952a5948063c41d5aa1e3240dc399f69c34aba51371ca537acdc81779d0d347f5bae1f", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700172, "uuid": "eb7e6bb3-2fc9-47fb-bcd7-ac1aabef0983", "value": "T1B3F2AF55CB861C12FE63CC3531E1CA223734B7126AA6CAFF875DC1149F81B8711E86B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700172, "uuid": "fbcdd296-27ec-485f-b746-0bca69348e06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700172, "uuid": "627f1fb0-fa36-43e5-a3bb-7c5447225b8b", "value": "768:/+BoT9wWE3SO/JtmZ6tbGkRsZlrHEzOKXI9PIBw9DGrDGqh2O:miT9K3ltkkRukz22BwxO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629700172, "uuid": "db57a44a-5e70-4187-b327-f9232e8969e4", "value": 35536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629700172, "uuid": "25cc0180-457d-4bdd-9f3f-139a48f5913d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700172, "uuid": "3733cb40-6097-4cc6-9cdf-4ec33bbba123", "value": "f410aa20278033a2158bc670a4d341a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "970b1c5f-03d5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1629697643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629697643, "uuid": "43fc915c-9b08-4950-afae-f3b4e4c16b15", "comment": "Malware payload (CobaltStrike)", "value": "fac3cfeceb2e68967ebdb76440c70531", "object_relation": "md5", "Tag": [ { "name": "39.104.77.83", "colour": "#928B7E", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629697643, "uuid": "989f4c7f-37ec-4b1a-a44c-5b4305d225a2", "comment": "Malware payload (CobaltStrike)", "value": "4d5d42436a9acebc595836c5d881612fe499cee0194d519c70e1dd3c84c7c39d", "object_relation": "sha256", "Tag": [ { "name": "39.104.77.83", "colour": "#928B7E", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629697643, "uuid": "8d36cbe9-eac5-4213-aa78-2a0c10360b52", "comment": "Malware payload (CobaltStrike)", "value": "68fa054c73845d1f1dbfa835f6576927798c73ba", "object_relation": "sha1", "Tag": [ { "name": "39.104.77.83", "colour": "#928B7E", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629697643, "uuid": "d40cfb48-8a84-4194-bf05-65d436a3750e", "comment": "Malware payload (CobaltStrike)", "value": "fed389f25e86825a226ebe6df76dd11734d1ff6ebb0fa55a436e8b60a8e79ad3016700c5f75edffec0217e6136657acf", "object_relation": "sha3-384", "Tag": [ { "name": "39.104.77.83", "colour": "#928B7E", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629697643, "uuid": "ce662660-d5c2-4d5d-86d4-5346724bd7b0", "value": "T10C463308326218EEE7B6453A9891983CE2B37C560761C64F932417799F77691F83FF22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629697643, "uuid": "57866262-062b-4d5c-ae19-0bc1633bd600", "value": "b0d2bcfaf69e32f6189b93d5e3f439ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629697643, "uuid": "b7fcc040-67f3-44b8-b1d0-f0638bf4b92d", "value": "98304:akZVkEZiJELAsVuqxSTw0DG7ez7mspM75hn3kh1k/ZyITmY8NPq3te0KMo:aBJEfxSTrqGasuH3kTk/dK096", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629697643, "uuid": "05aa3375-ccf7-4428-9b1f-550be52efbfb", "value": 5775927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629697643, "uuid": "73f2013d-7431-46d5-8d87-5da27e07e667", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629697643, "uuid": "89285ddd-ef13-4356-9369-900db07c5ab5", "value": "4d5d42436a9acebc595836c5d881612fe499cee0194d519c70e1dd3c84c7c39d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "612f4151-03d1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629695835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629695835, "uuid": "67205780-d002-41d3-8ce7-5f4b8837ac7c", "comment": "Malware payload (SnakeKeylogger)", "value": "aea89ebce1ea6c5b9fa9b616fd9330fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629695835, "uuid": "b2cda2a6-c3cf-428b-b571-7bc14c7165c1", "comment": "Malware payload (SnakeKeylogger)", "value": "4e41195cd8ce2612af3ce69f3eb5bd0f8c9e46269d88c8de7e7f69e7888c820c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629695835, "uuid": "5e9e26fd-64f8-4c15-82aa-2d5e1693ce8b", "comment": "Malware payload (SnakeKeylogger)", "value": "e4449854e8ba04402843178e1e57acb5787faefc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629695835, "uuid": "aba1a747-92f4-41c4-8334-7843b4cd82f2", "comment": "Malware payload (SnakeKeylogger)", "value": "d5f3b7fd76f1eb5d1dfadeb18aea7090cce29125ef4a5481de319ebe76724652033660647248dd86ee1338b5f6673894", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629695835, "uuid": "bcf514dd-89e4-4dc6-88f1-90e39bdad451", "value": "T123E417483790B19FD423C9338BA74D30E66164A7978BD343D013D2ADA91D2B7DF186AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629695835, "uuid": "975995bc-bdc9-4dc3-992d-f5db66965cd0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629695835, "uuid": "e820894c-8810-4f2c-9808-b97c266f2add", "value": "12288:K3tUmFVle+F2nEdmm9WEv75YHpQJ8mYhH5gfuvY9qdCLavIHHOGXxAKW7xaAjfYm:Kd1vle+oMdXv75YHp+/YhH5gNCCL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629695835, "uuid": "2e285077-9be5-410f-b7f7-0598628853f9", "value": 666112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629695835, "uuid": "fa6f787c-1036-48f2-ba09-abdab091bd20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629695835, "uuid": "38e67e21-efb0-4d6c-afa4-00c2ec98e47a", "value": "swift copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dfa8e30-03e1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629702594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702594, "uuid": "a4e3e82a-0fd8-414e-8c90-29b01559e73b", "comment": "Malware payload (AgentTesla)", "value": "132573ed7878475df9cc610c90d06df5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702594, "uuid": "c84bae91-06fb-4f73-82e2-df6ddd02fb80", "comment": "Malware payload (AgentTesla)", "value": "4e41d50a13930ca431d849e39a144a8ce5738c6c414006e273a7e911af3470e1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702594, "uuid": "c66ba3da-442c-4958-a3c0-6994b2ad498d", "comment": "Malware payload (AgentTesla)", "value": "4f132925a912fc84e48141b43b82c1818f173cb3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702594, "uuid": "8f2806ac-aac8-4b1f-8acd-3c9a2a1b555a", "comment": "Malware payload (AgentTesla)", "value": "afced4aab6a63b7a6f332040414ae7ae15ae6f664f45c04de3dd62d0dffbebc903efa32e4798bd2fcc1d5238efa18424", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702594, "uuid": "2ad1c2c4-034c-47dd-a83b-d34bde10100d", "value": "T13875F53955B82627F076C7758AE18827B3445CDB7DF0AD9858D2376233F2A8364D322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702594, "uuid": "bc3da24c-ed6a-4bcd-9e7a-1a3b4784d37e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702594, "uuid": "46988516-c944-4270-9207-ea588ae110ee", "value": "24576:XqNO+2lhdQOdBKYhWtpj0KWQWbvY3R174Xfs89UrmMnfk/iQ2+S0dj3VjW:XZ+K3TUjj0KZWbvYBFkfsaU9fk/Pjq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629702594, "uuid": "082a1eaa-3e94-4b1d-bbf5-eb54b13b4636", "value": 1559552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629702594, "uuid": "fd692cf1-018f-43b4-95df-c121b3fe7723", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702594, "uuid": "fac1729d-77ba-4e45-9ca7-5b2c0994c0cb", "value": "QuoYW5EqAidKXqM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e48ccf2-03eb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629706863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629706863, "uuid": "70997810-db0e-4caf-87e9-5d22297bbdd7", "comment": "Malware payload (RemcosRAT)", "value": "72f7678095b2e212d0b3c3da5cf12821", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629706863, "uuid": "e665dce5-4586-4443-a696-1c613976e10d", "comment": "Malware payload (RemcosRAT)", "value": "4e91bcc380f2283929f4b8e6fc746e3108dd5ebac3ef8f7a16b6f831613ae1e3", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629706863, "uuid": "50905db1-97cf-4417-b048-ca051fb1dc02", "comment": "Malware payload (RemcosRAT)", "value": "093eb005c06ead9aedb0965e9f5f392d22b56b9c", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629706863, "uuid": "2d4acff5-b1df-44c2-b729-943227127e53", "comment": "Malware payload (RemcosRAT)", "value": "0ceeb059f1d7111cba60dcf207502cde362eb5ab8ebfad57cf9f21add8dcd24c49f9b70d3b663c6172c2b8cddba3e717", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629706863, "uuid": "514ec1a4-5242-4327-9fa4-68e36c0dd289", "value": "T1B8358F31F2921837D6222539DD5BE7AA5B39FE40292CBDC62FA51C5C9F353803826367", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629706863, "uuid": "381e5414-330d-432f-a9d2-c7c5fbbb46ef", "value": "12288:pnCFpZeB7uGHKKaWU8drn/1iNyhpyv0oM+6yRXOuDvrq8EU0th6gG1t:pnWpBGHK4Um1dXq0oXec959n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629706863, "uuid": "23279159-e3f7-4492-9549-a557b93bdcd4", "value": 1150976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629706863, "uuid": "8b2006b0-0813-458d-9a76-8445e9fd835b", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629706863, "uuid": "6593752c-0db2-4896-9983-fa034661ca24", "value": "DHL (SCAN) Shipment Notification.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "320ad135-03d7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1629698333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698333, "uuid": "9973124e-2494-4b4a-973f-d206a51f66d1", "comment": "Malware payload (CobaltStrike)", "value": "dfc20938ac209c0ae2654e19987a8cc7", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698333, "uuid": "5efedc83-8ccb-4a75-b59c-95354b8ec067", "comment": "Malware payload (CobaltStrike)", "value": "4e9cee63c296120b3640a6201b4cb4295be8cfec39a4828eb4c4fc34d69cc69c", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698333, "uuid": "11671fe4-4f38-4f0b-a6d8-0aba27fa7744", "comment": "Malware payload (CobaltStrike)", "value": "bb89cb27983077aad3c32e358fb5c86861d28d31", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698333, "uuid": "c5dd750a-d5b4-4aaf-9bf0-8b21dcd0b812", "comment": "Malware payload (CobaltStrike)", "value": "b5549e94bd8bd64a16ac07f367d7f5e52e89e658b0a1878f88fb42c17a35c7f2058f469417e9744a86c632f5c8505216", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629698333, "uuid": "c25ec14c-d9b8-4e4c-9e24-f0c698703a71", "value": "T164567D13F8AA24F6C6FEE13085619322BA71386943313BD35FD4967A5666FE47A3D300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629698333, "uuid": "faa38ce7-fbfb-43c7-9cbd-67347ee227a6", "value": "93a138801d9601e4c36e6274c8b9d111", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629698333, "uuid": "8e5d53cb-7423-4488-8f9d-bdb51908a610", "value": "98304:0WfpNGBkh9DALtSlJ+E5kTq+AvulpwCGu9+I/ipqbjqBxO:0WhNG+h9DAolJ+LVIxu64be", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629698333, "uuid": "cfabae15-10f9-4147-8156-a0ed132faf2e", "value": 6422016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629698333, "uuid": "e04d088e-f7cb-4320-9d8f-2231dd5db33b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629698333, "uuid": "9a419889-64c2-4362-adf6-261e412d6d0c", "value": "dfc20938ac209c0ae2654e19987a8cc7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce6aded6-03c0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629688717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629688717, "uuid": "c59ed188-9006-493c-9d75-932325eac366", "comment": "Malware payload (AgentTesla)", "value": "6ed107f4715c38f1f5955393cb90bd9e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629688717, "uuid": "244db90b-5c03-415c-8aa1-0d90f13f48f9", "comment": "Malware payload (AgentTesla)", "value": "4ecf0c0afdfe55b4acd3aaf60b098acee410863517d366b2284f4865d822aa1e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629688717, "uuid": "21948213-fbc9-45c2-968b-18347de59dcc", "comment": "Malware payload (AgentTesla)", "value": "f097df2ad4b3e3e523082ce29be2f3069a645207", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629688717, "uuid": "94b60610-c661-4c08-b561-6e357b4f21e4", "comment": "Malware payload (AgentTesla)", "value": "1f5b7f255d89231c2fd06f2f95ec0e7d8294fb0d72820fb62b843fe5e2fb246668632ca06959d284afc0dc0ca720e6da", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629688717, "uuid": "d71a5437-d6bd-42cb-8ddf-02615f54ab0f", "value": "T19FF4AD12E5818072DA322B304676D9BE08AF7D713D719A9F178C35356F731C2A936B2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629688717, "uuid": "b6c4d902-9cdd-4da5-b594-1707d0fbd146", "value": "bf08a978649b718b66012803a6d17e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629688717, "uuid": "81b66b21-88d5-43b9-91a5-44d56f9eb59b", "value": "12288:zwM1j+p1h79i/Dd19t0cfJjpugk2POGwbAr0BXDiW6Sg5m7i:zwY1DdR0cfJ0ArSDiJS0mu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629688717, "uuid": "e2479451-98ef-40f9-94e6-44ac17291d6c", "value": 726382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629688717, "uuid": "7a43181f-59d8-4852-8049-06fa7ed51fd9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629688717, "uuid": "9fdf3895-f4f3-4112-9785-51ec7acfe5af", "value": "SecuriteInfo.com.UDS.Trojan-PSW.Win32.Agensla.gen.3171.15879", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da85fce0-03da-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629699904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629699904, "uuid": "e96714b2-ca34-4579-95fa-d56b0fe5723e", "comment": "Malware payload (Formbook)", "value": "a576607b8a3089dea60d25f123fedfe1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629699904, "uuid": "3cd32a99-4efe-4fd0-8621-4a5c234721db", "comment": "Malware payload (Formbook)", "value": "501242ffaabd951fbd62a6b12cfe8955915f65acc7d6c99effd41366054ccdca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629699904, "uuid": "9d54faa2-1976-40e0-929e-bcb9954e419b", "comment": "Malware payload (Formbook)", "value": "92ae2570c2b46c5a7c4eb0aadf5e91ebb2688790", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629699904, "uuid": "2ca1c231-e5cd-4222-8717-68fbb01a44e6", "comment": "Malware payload (Formbook)", "value": "97753c5aa9eaa3f2e0aa2568440568681466b90247abc7ace0320355a49889a6726d9df905f06d2dc72b5f3cc0371f44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629699904, "uuid": "bd31fb2c-7b8b-4d96-ae08-aa77b415b4e0", "value": "T1D805063D19F91637C1B5C355EBE58423F148986FB404AEAA6CDE03A7034BA9735C722E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629699904, "uuid": "6ff4950f-c6e1-4125-9061-211cc66a0801", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629699904, "uuid": "7802685d-71a9-4d5e-ae17-e203efe0574d", "value": "12288:YqXh2RjaCaFErmtz4+XxFXtU6m5oyQnIUplAK+H:YqYjWFFnGL5pSIU3K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629699904, "uuid": "efe456e3-b3b0-4472-8e12-d14e03067bd8", "value": 864256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629699904, "uuid": "5b847514-9f28-486f-9382-d58afd675634", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629699904, "uuid": "75f262df-ff05-48a3-b9b4-2911869f501b", "value": "a576607b8a3089dea60d25f123fedfe1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cf55541-03d7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629698405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698405, "uuid": "97c0ae17-0d3f-4a4a-ac85-a2a1640f235c", "comment": "Malware payload (Mirai)", "value": "1f2a8554c6cf0bfefcf172a37b7ee205", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698405, "uuid": "aeb632ff-e71a-409a-a76c-05ab859b34c5", "comment": "Malware payload (Mirai)", "value": "50a55def79b57aca01de509426b669b20af9dc7cab1f36f392309c8f67f368ee", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698405, "uuid": "b208c7ca-ec54-48a9-925f-dc7c95eb7e6b", "comment": "Malware payload (Mirai)", "value": "22ffe4b223846abf6b0fdf4bbe9fefe1221fe136", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698405, "uuid": "f2920e8f-e357-4248-a26a-b37f8d0fe863", "comment": "Malware payload (Mirai)", "value": "9957575a127e5ecd08026b72ba657dfb699776ca67234f08c1bf69f6e1c971c361a8cfe23d21e203974f769347b85c2b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629698405, "uuid": "2388fb5a-7ff7-488a-b415-8ac2d01f7064", "value": "T13B33F2E2E3469764E9B11C35E32EC1C05B0A4E9ED3AD31A324018F915C97DD3E5B989E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629698405, "uuid": "737f2356-6292-4978-ae00-bb8bf68463a1", "value": "1536:RY3AmUi3ML4EkwjIQV5WW+P/2UL9FtLV2xourX:O753lWI+5P+PHLLtR2FD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629698405, "uuid": "2949f49c-f4b9-4806-832e-adbce30a1795", "value": 53400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629698405, "uuid": "3481854b-1590-449d-8fc9-af3e18724db2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629698405, "uuid": "783c2a5b-4099-4914-8866-771d187da867", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb43c060-03df-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629702080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702080, "uuid": "e169a762-d47c-43ec-bf36-257419cc6329", "comment": "Malware payload (RemcosRAT)", "value": "521f2d399992d8fb05750edd2d4b168e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702080, "uuid": "0634cf98-ca0d-4a50-a35f-6e59ee8282a8", "comment": "Malware payload (RemcosRAT)", "value": "513c4ee69d193fb544171c1484f3309216307c93b9d0ef8fa4d4cef86d3a6507", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702080, "uuid": "7f6a940d-e665-4440-bc2d-f45e7243659d", "comment": "Malware payload (RemcosRAT)", "value": "a3d5a5f4c93bf4a9463b571d2600e05bb5a5ec8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702080, "uuid": "b4d6f1a5-702f-4999-a398-1fea8faaee3f", "comment": "Malware payload (RemcosRAT)", "value": "0de2e00dc3866f067434d8431bdd64f84b10124d3a0e8ef6407ae8c5b2570726382467e8a7c6ca6cbab264738845da58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702080, "uuid": "32cf79c7-3437-4975-a73c-293cc7469746", "value": "T194357DFEE77F9DF1C0164A38AB3AA56581067C202F19BC42B6D44D8C5AFC953742BC86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702080, "uuid": "93839a3c-3111-4a77-86bd-5ac26137d661", "value": "cd897a852beb0d729ee0e0d2a4c10746", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702080, "uuid": "6cf20f13-e5ec-43cf-bb6e-a8c1e904b337", "value": "12288:Qq8SB+x3pPT30Sv6kGDbdYMqFMS7kLWa4H+NZ6rq436TD9dFSKt8Ed8Fj0RIRcDU:r5UzPT3Bv6L9kaDNZAcFSXvVRQyP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629702080, "uuid": "b87ff501-1db1-4bd2-a1b1-4484699e7d76", "value": 1111552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629702080, "uuid": "865e9de1-c9f2-4364-9a07-696e6cb59207", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702080, "uuid": "316997ef-7552-4635-8366-d0983f2debad", "value": "PO OrderNo 338390208B,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89466397-0419-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629726826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629726826, "uuid": "b7b3580d-d0e6-4fbe-a09c-3d683c14d55d", "comment": "Malware payload (RemcosRAT)", "value": "f052f944719885f1dff915a64e88ca10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629726826, "uuid": "e75318d1-a682-476b-808e-c4a62210cad0", "comment": "Malware payload (RemcosRAT)", "value": "5191e0986f9d1886402809cdee8aa3b8f50bac0c36813efc602e3d5e59b9d1ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629726826, "uuid": "82e17485-704e-45f7-883c-11c32c8f791a", "comment": "Malware payload (RemcosRAT)", "value": "f11fad1f929f29cf6765da9a51804b0b8eb7d110", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629726826, "uuid": "22d66982-5a7b-4e57-92c9-0f1d2d07bcda", "comment": "Malware payload (RemcosRAT)", "value": "8bd95dbc8d6117160e154b8fb19dd7bcfb7306d5f833afe29231e8d40fbd92f3172d92e1cc18f3dfa69adca2e99ca2b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629726826, "uuid": "b00e5730-3e10-499a-a848-a2b5716a0244", "value": "T13C1512093659FB8FC72FCE7B98652D209BE1E9361353D342AC8325D8289D795CB102B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629726826, "uuid": "5fb76279-a46e-4635-9937-c87256875502", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629726826, "uuid": "705c997d-9e9b-4184-99e6-2187bb0c3cd0", "value": "24576:hj6kgpmkIBtdhjOq1KatgGDrIK1QUi8WY/XW:EkrkIJhjDN3DrIK1QUkY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629726826, "uuid": "218729e2-97b0-42ed-b888-4878e1c75448", "value": 952832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629726826, "uuid": "1b935992-120d-47b6-8735-4caed40a076a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629726826, "uuid": "304abec5-adb3-44e4-908b-720108262536", "value": "Proforma Invoice No.0976.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d46ad2a-03d7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1629698352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698352, "uuid": "7d4a1f66-b5b9-4448-b44c-3593bd8ccf56", "comment": "Malware payload (AsyncRAT)", "value": "1ac34f8055d611e65138df12cca6cc39", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698352, "uuid": "402eb8c4-01c9-4beb-9e7a-920e4e7dc642", "comment": "Malware payload (AsyncRAT)", "value": "51e6527daa5a10028c434c7ceaed1570ddd95e1de0eafa702f77860cec3d0b7c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698352, "uuid": "56bfd0a7-d512-47d0-9d39-5a2e1901d07f", "comment": "Malware payload (AsyncRAT)", "value": "455375b22493ac2a9b6cac7c76e741508c045369", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698352, "uuid": "5b504f17-5c99-41d9-9386-b0957e3feb5a", "comment": "Malware payload (AsyncRAT)", "value": "b2fea3be6a69da83193f92ff73fa4f3793782e3b4ff94639b9165d348181721d7ce4cba7ffa6c6c05c7e61d6484c9ebf", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629698352, "uuid": "cf0fb9dc-71e3-4964-964e-2f4b155c60ff", "value": "T15094A1422AFF4683F354D53089CF7D244799BD92B63192FE3A28718C99D1332995C3AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629698352, "uuid": "8ff154ce-7976-45f9-8fd6-126cd7dcdca2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629698352, "uuid": "00e96193-2988-4516-afff-c8cfa73d6b07", "value": "6144:y9/uL7WLpFYQ9akff07EMoM5AfLJ82k+baoNwL42rO:y9M79OftvzJhk+WoNwL42rO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629698352, "uuid": "4afa738c-698a-4547-aa63-4adcaea9567c", "value": 426272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629698352, "uuid": "1bc924ef-d16d-4a09-95d2-eece652ac116", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629698352, "uuid": "1c61e32c-cea5-46b5-8b0a-e9108f057348", "value": "1ac34f8055d611e65138df12cca6cc39.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59ec2c9c-041f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629729324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729324, "uuid": "0137fe04-ccc7-45fb-b12f-b5f094d9bb82", "comment": "Malware payload (AgentTesla)", "value": "fa9d0de3541696d4c4a10c7ea054a258", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729324, "uuid": "7bf991a8-6333-4749-948b-3b94e4ae8cc8", "comment": "Malware payload (AgentTesla)", "value": "520a27ca424cc933830ff81757b869faa27e08105eb2cd06c51bf71ec87dbc04", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729324, "uuid": "9892c739-be3e-498f-8144-fab7d1b48df2", "comment": "Malware payload (AgentTesla)", "value": "91d1d2f6eb6aa676bfa6b434e8714ac3ab265da9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729324, "uuid": "4081ab01-5577-43f6-a0dc-748fd5e741b6", "comment": "Malware payload (AgentTesla)", "value": "1c222a95abfc7b547ce477339152a5f35979b9106d1da6d4d210f36c7cac09566fc58b83a62a21393ad3304273a0116e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729324, "uuid": "37d86111-3e86-44bf-a847-7a87f36943a0", "value": "T15A42A5BDD84705948F86AAF8670E6B85144C776E72C8A17377BCA73527A683B4123C3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729324, "uuid": "0e487d94-1472-4773-bf6f-e6b5a6c14b5a", "value": "192:nD4qPHC04Dn9rgWDWqm7IH+F2MLHxCkBhSNiwjAjlUoTocx+nYd5d1v8LYt7ZoOq:nUuC0m9fDWqwQk0MjlUoTwnY2YJZi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629729324, "uuid": "0d101ef0-a4fc-4bbb-bc60-b5f3820d5ead", "value": 13118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629729324, "uuid": "e6ad96cf-60d1-4d00-906a-5c915675e506", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729324, "uuid": "fa88c063-b77e-45a6-b82b-0229865bccd9", "value": "proof of payment.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f901ddba-0457-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629753642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629753642, "uuid": "2c0769fe-4fdc-47c0-b7c7-4707f164b744", "comment": "Malware payload (Formbook)", "value": "ea33022709c503df639489d609127c21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629753642, "uuid": "401a8166-107e-4b7e-a8e4-2810992a88be", "comment": "Malware payload (Formbook)", "value": "52aaa20eef4d75bb209ef1d632a3e5a894358ebbd5ae9e18262868209fa30b7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629753642, "uuid": "edfbb610-b597-410c-af57-ad1f6dd5ee4a", "comment": "Malware payload (Formbook)", "value": "accd2282ec0d04f190d2cd9c6e89394379cb7e7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629753642, "uuid": "0fa125fd-c870-4656-ad77-8c032dd64fac", "comment": "Malware payload (Formbook)", "value": "173d5c94a0952c420e868712ab56c9b69dd1a1ee64a3000324f1d82f1c60d72df746f00efd4eb85cc106ff8a091481d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629753642, "uuid": "80a015fb-97ce-4000-88c7-d326910a5bc4", "value": "T17405063D19BA1237D1B5C365EBE58423F149985FB410AE6A6CDE07A7030BA9734C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629753642, "uuid": "c4e480c3-dc56-40df-9b44-86a489de9859", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629753642, "uuid": "94d160a5-0d70-4ba9-a687-1891f53ffe89", "value": "12288:CleaXJ+qopzb8WE3vOuq6wiIOFGkFOKicf35Qg6L2/ZsjSmxjnV:7k+GWEGuqykkFvd35Qgf/ZsumV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629753642, "uuid": "a6244667-fab8-4757-9277-87a559dd6d8a", "value": 857088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629753642, "uuid": "a7a681f1-4624-40f0-b8bf-1c1609087818", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629753642, "uuid": "91920aa9-ccc2-48cb-abf0-eede6dc4c98a", "value": "SecuriteInfo.com.Trojan.PackedNET.999.22645.5322", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74a5cfd2-0469-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Adware.FileTour)", "timestamp": 1629761151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629761151, "uuid": "7eeae35c-b322-44d0-b228-00165bbf709e", "comment": "Malware payload (Adware.FileTour)", "value": "28048a470181ea26c44efccc5613248d", "object_relation": "md5", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629761151, "uuid": "00da4750-39b9-4a8a-b661-ec3f56d3fe07", "comment": "Malware payload (Adware.FileTour)", "value": "52d2303ef0ca3af61a62ab3041abdd1782189394a97777c7d5d9b488b85f1cdd", "object_relation": "sha256", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629761151, "uuid": "b3ca04e3-dd1d-44f5-a20a-d95df19c1d1b", "comment": "Malware payload (Adware.FileTour)", "value": "ecf49125ae5fbab3046a36550c7e46074acbfdb2", "object_relation": "sha1", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629761151, "uuid": "9858e8ef-a043-49c2-8797-ddbf4e7e78d7", "comment": "Malware payload (Adware.FileTour)", "value": "db809759779ac9ad95acb91f3038008c3b110a8cea182d76aba6c7a08c6803ca254c222bc1e6ce3b58d7ce1f9313d4e5", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629761151, "uuid": "992fc5fa-1905-4b78-9cdd-9b07aa8a0977", "value": "T1AE263398120DE033E4BA363217219F9F5F57F44B1BE43BAA9790015CA26E6E7D91DE30", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629761151, "uuid": "60eeb6ad-38f7-418f-919c-51fe8198fc80", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629761151, "uuid": "70845f42-7092-4a36-acc6-42740329ea74", "value": "98304:yuROg/xvMXxNE+yK7cRAMM3mLwhd9Rb050ldg+nmJbeLMYBHSAkUBIi2:yuRb/xArEKwyMM38wtR450Dg+mVAHS2S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629761151, "uuid": "2817bf7e-9ea7-497b-b843-a6f412caba5e", "value": 4561715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629761151, "uuid": "724190e0-597b-43c3-9ae9-138ba971c1ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629761151, "uuid": "ce09c6ca-25ec-4678-966b-347058ccfe8e", "value": "28048A470181EA26C44EFCCC5613248D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eb7b40b-0431-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1629737089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629737089, "uuid": "c73a7ac2-03d4-434e-9fe0-9b5cc3450195", "comment": "Malware payload (NanoCore)", "value": "3a0872546e9e83b0c049f3c57d003e4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629737089, "uuid": "a70a5b87-5718-45a9-897e-a5f825bafae8", "comment": "Malware payload (NanoCore)", "value": "531158b37cc8bfb82ee3f118e9525f132fddd14e52df5a30ae1563c4ccf5d176", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629737089, "uuid": "b2edbd91-07b6-4744-b67e-9e87bc1da9ce", "comment": "Malware payload (NanoCore)", "value": "8ed218c8b1f287a39c710b09009af1e11d33074d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629737089, "uuid": "368aba79-ce49-4aa8-900c-26c9dc7dc0ae", "comment": "Malware payload (NanoCore)", "value": "0477023133c4309c7a04794c7d5a3b0c01a6d380c195eb61dc3610812efef933a4894a60fc9420b4fefe4f9e9f00867c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629737089, "uuid": "67a422e8-1450-4831-acba-95ef5ce49602", "value": "T1DE457D29B34077E6E42A0F3B4832168C03F99A477636F75FA8CE36D85C35616871B693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629737089, "uuid": "eccce65e-f100-4a56-913b-de2819e860e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629737089, "uuid": "573db986-0691-4632-9385-9cf9d2b6e120", "value": "12288:CWESXLuQ/VP24GgcLQsLjBN9aTom5Ouj+Oh3jwgeE2ELDFE8AvZNGzHKEU9v:btPujf9aTXEujwvEBDq8eZwzHM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629737089, "uuid": "f7f26ba8-7d3e-4b79-9716-8e9dfa76d939", "value": 1207808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629737089, "uuid": "070cda50-2fdf-4c42-9903-ea162edcfff7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629737089, "uuid": "31e984c1-9535-4707-97c9-77e87bad2436", "value": "BL-COA-PL-CI_09876543234456787\u202ercs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "524b9e19-043a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1629740907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629740907, "uuid": "6fc40344-7047-485f-a2b1-e2ec2563391e", "comment": "Malware payload (njrat)", "value": "5c2290800ac60e5db0f93e754d78286e", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629740907, "uuid": "048dcf16-3672-4e86-885b-de447a266dd0", "comment": "Malware payload (njrat)", "value": "5325cdea20361dac7b59b75dd03c25274ae0e40629155f1112ce71549bf0b3e8", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629740907, "uuid": "17322528-c043-4fe3-aa9a-f54b2b7baa36", "comment": "Malware payload (njrat)", "value": "d7207edd68b9738e0a2cd72a0d5f776b422ad4aa", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629740907, "uuid": "fc6ac723-3d57-4a78-b5f8-ffbec9dbe9b0", "comment": "Malware payload (njrat)", "value": "2dbd5fbcd25b478832904587d7c538d5078f65e62947557e0259574db64d05832b19506345036b00dd6bf75072496c95", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629740907, "uuid": "cf922817-4f40-4582-b309-736f8eba8bd9", "value": "T1BB012B0A5D29CDDB0059F18642C38DE9C6604BA74F806E7A2478794B6DED22F6DCCD87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629740907, "uuid": "1c04790b-c278-4ff4-95c9-88ff37ebc1c1", "value": "12:0ChGF2MBNMnXNoxAbOJk82cG2bwELPdg3Nfd+aaiTC:HgF2SNMnXQXG2UE7kNEuC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629740907, "uuid": "e4af2852-f25f-401d-b0bc-728ea8dc0a6a", "value": 729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629740907, "uuid": "980cc440-c3ea-4aed-a93c-476944ca9ec4", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629740907, "uuid": "35f66d76-bf4f-440d-80c2-f4ba00552d1f", "value": "A719830-Paid-Receipt.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cce49f44-03d9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629699452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629699452, "uuid": "754c05d2-5ead-48ca-b9ac-e42e107bd66d", "comment": "Malware payload (Dridex)", "value": "9a812ebcc070d2a63465ebb416ba8b95", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629699452, "uuid": "eed59b02-c02f-4db4-9adf-2c371d432ef1", "comment": "Malware payload (Dridex)", "value": "5335f80d6710c813429b45a7a9dd460c1d9a4ffd460a4fa42088b35e71534f9d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629699452, "uuid": "963899e7-cc88-4064-acfb-66e24c96900c", "comment": "Malware payload (Dridex)", "value": "02c500a526f5b195b0769259457c3e725e5119c4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629699452, "uuid": "7eaee4d5-45ef-4692-9add-cdbbd9b36530", "comment": "Malware payload (Dridex)", "value": "1941b06f495bb5adacfa3d6044c2de2df38fe7c864d164f0d4bbf6606842c006c4e68552aaf7bafd69d2b5c510344f69", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629699452, "uuid": "7eea6c40-4d8d-4853-a6bb-145ef3511e81", "value": "T17564020A1873E024FBA7503D9C8E1FD52BA49FAF56E06E5AF0E5D30DAF09CE39250585", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629699452, "uuid": "87e7c3f1-ab60-417f-a300-b6dca5382e27", "value": "6144:ScNSLcq+YXEsIGJWFXkpMQfmnoM0G1TY+Z6WysSIS:/PYXEshasMumZ0aT7KrH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629699452, "uuid": "a3b6af18-c0ee-4b29-ba5d-76ccc169e1f1", "value": 315889, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629699452, "uuid": "c17afb09-66e7-4fb8-88fd-3ddc3ddfb539", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629699452, "uuid": "afb2605b-23b8-45f1-949b-7d35876d4eb9", "value": "taxve_710451_20210816_93407095_353985987.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "170f3c2e-043b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1629741237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741237, "uuid": "64a74a0d-d518-4c31-96ec-728a3dcf2436", "comment": "Malware payload (NanoCore)", "value": "3cdd7f0f55855315e1b79e87fe093a47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741237, "uuid": "57d024f7-e4a2-486f-a749-b1a49889fd25", "comment": "Malware payload (NanoCore)", "value": "53a56fc0599866ae8f92087f15ca6b36348926a4c7f7cee1781ef2296b91010e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741237, "uuid": "0baab935-72ac-4b92-aa95-bbdac164e313", "comment": "Malware payload (NanoCore)", "value": "c8b0a3caeb0ace966c28efc62a75101f227d9721", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741237, "uuid": "466952ec-b02e-42ec-a9e6-c1d700863dc7", "comment": "Malware payload (NanoCore)", "value": "60ef619756f4712ba8f1eec77a8dd7919b71908a9bfe3c39ef9869a116fd943d561e489a13f7127ba5991e466aa83f86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741237, "uuid": "ea3e6388-6f25-487b-97bf-0ec6f42e6716", "value": "T157F402483680FB8EC63ECEBAD8501C6497F0E5725307E756AC8316F8598EB598B453E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741237, "uuid": "87c4a2db-6011-4aa4-b120-e3513ac17e8c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741237, "uuid": "5dc76856-b42b-487b-a6a1-e5a45dd0048f", "value": "12288:oq1FrEbHqnn5sUNaS5sGwX3DqbRuSZmmMPJ0b8zLNS60UcNSxUiN8LMnBnuUXOm:p2O2UAS5kXzq4fPP2b8zLgU8SaiiL0B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629741237, "uuid": "fafe46e7-7699-4d1a-9a2b-0f8b4e65735b", "value": 757248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629741237, "uuid": "d67bcbc3-d695-43cf-82c4-3411dae6b6b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741237, "uuid": "dcf5e248-aeb5-4b88-befa-01980778e6be", "value": "3cdd7f0f55855315e1b79e87fe093a47.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e96ff9a1-043a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1629741161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741161, "uuid": "8374bd59-27a0-42fa-a28c-05c55682b7c0", "comment": "Malware payload (ArkeiStealer)", "value": "8595c586a62cc4c6dc4bbff8a3e9211c", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741161, "uuid": "59db6f0d-373c-45c7-a490-ff7a7de1210f", "comment": "Malware payload (ArkeiStealer)", "value": "54861cce48e60ea601696eabdebeff57e29088bf5f343d9e1eaf3448b2d8613c", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741161, "uuid": "664ac585-de1a-4d69-9c43-d8429717e39e", "comment": "Malware payload (ArkeiStealer)", "value": "ba3495a391e5d07e97507b199e9f7bf46649739b", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741161, "uuid": "9cdd30c7-1fb3-4234-8af5-188e28bb45c8", "comment": "Malware payload (ArkeiStealer)", "value": "6f85fca45a9a1fa188df0c2a3a907eee7bc79f49ab2ec6ac262caf4ae8ad0553f8b5793f99c0c0d735739f591c8f3751", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741161, "uuid": "b3147a4d-7dd2-4614-8a47-c4484f5b01a4", "value": "T15AF29E5ACB921C12ED13CD3531A1CA237B34B752AAA6C7FF865DC1109F8178711E87BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741161, "uuid": "962dd105-7d63-438c-86b2-118bc50e0f47", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741161, "uuid": "74b591d3-9357-4747-93c9-8f581c7e299f", "value": "768:T+6Dw3y3SO/JtmZ6tbGkRsZlrHEzOKXI9PIBjKDGrDGqh2O:C8r3ltkkRukz22BjeO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629741161, "uuid": "6a78a26d-6913-473e-bd67-72aebd52f1fd", "value": 35024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629741161, "uuid": "b5c378d2-c2f5-4bc9-a356-150ec9d1b4b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741161, "uuid": "b5677d94-fe34-4969-9823-70dbf9743b2c", "value": "8595c586a62cc4c6dc4bbff8a3e9211c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79a6770d-03e7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629705325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629705325, "uuid": "6a5a983a-72bc-42cb-a57a-581e581cd06d", "comment": "Malware payload (Loki)", "value": "308486a8f8b2b7a0b5ff034f117d4706", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629705325, "uuid": "fe274f28-2816-4cd4-86a3-691877b715fc", "comment": "Malware payload (Loki)", "value": "54bdd507eb726a7a4ac9f8d7c220e97f447b37c61986e050cf54119ceec42c65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629705325, "uuid": "556710cb-6301-43fd-84c4-14d4c1f4d182", "comment": "Malware payload (Loki)", "value": "6374206969998fceef070309b4b8104a85be6db5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629705325, "uuid": "e6cdd37a-68f2-4ac3-a87b-dd79c6ac03b6", "comment": "Malware payload (Loki)", "value": "2875d5ff07df2ed00568167990ce4e533046db4a8a371a4db878c251872f43a299bfad7c6e2c6b315e22c8618897f04f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629705325, "uuid": "a0465eb2-a4e2-4ff8-a751-2fc5ddb8ce3c", "value": "T1FBB4BF21B9C1C032D673383107B5E2B749ACAD712D269F9B57982A365F74480FA35B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629705325, "uuid": "d5da86fc-c973-4f1b-beb2-0748dbf50aa7", "value": "bf08a978649b718b66012803a6d17e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629705325, "uuid": "38081f45-ef0e-4e1f-9626-da5c06262069", "value": "12288:rQ3dh+p1h79i/DdA1NUyfJjQuAkZPRQstAFzspR0ab631R:rQNjDdkUyfJ+0AFzspk3P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629705325, "uuid": "5869e341-1e48-4beb-b78b-e49a4797765e", "value": 529218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629705325, "uuid": "67be81b9-ffa7-41ee-b981-9295e12903c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629705325, "uuid": "e207a76a-2c65-493b-9210-cf0c4117b66e", "value": "shipping_documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80d5fc49-03e4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629704049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629704049, "uuid": "4b97d560-abd7-441c-83c9-1708ebfe6875", "comment": "Malware payload (Formbook)", "value": "0867481d77cd5a01f6701d1c5828158d", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629704049, "uuid": "769216a3-2f91-427d-8a5b-aaa390befdcf", "comment": "Malware payload (Formbook)", "value": "54cc7072959884cba2b018d91925f5e120e8051f67bf4be8ee0545d9250d5be8", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629704049, "uuid": "62936320-5051-42c8-8d62-1c17b2032058", "comment": "Malware payload (Formbook)", "value": "e78132a6e82206f7ff24421cfadf2c79e32c966d", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629704049, "uuid": "9ed122f4-eca1-439f-9cf2-8c3be26f8832", "comment": "Malware payload (Formbook)", "value": "0d46a51f65d5477c2395f091862f4fdc4da28b15fec6d63237b59321d8633628467cb2f076285043f01730ce985ed230", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629704049, "uuid": "9642fc58-9144-4806-b9a3-90e2e991eb51", "value": "T139D4234AE2C28D064D4CD79243A1718F57533FAF8FBA6AB6043045DD1AED07E9D7A60C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629704049, "uuid": "236af621-cbef-4a0e-b1a0-992547500bcd", "value": "12288:t57fcABE1sKlP+X9CoFF+k9wQgqBGehRNyOKWSsETqxBAxXniR:DER1TsNxFFBOQTBZ6TqxMXiR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629704049, "uuid": "b3c0b888-d9ee-42e4-aeb3-a202eb2b4f4a", "value": 606167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629704049, "uuid": "2969134a-affb-4f13-997d-136d3053ee1d", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629704049, "uuid": "71bd5330-1840-4657-8a53-9c6f3b8ce643", "value": "20210812GLL_pdf.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53135cb2-03dd-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629700965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700965, "uuid": "0e23e370-f1ab-4b1f-908c-b6ed590744e2", "comment": "Malware payload", "value": "f6e61fa41fcf802c8272f672966e4a3f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700965, "uuid": "93391917-dcdb-4c3f-9084-07dd14fca5df", "comment": "Malware payload", "value": "551c83c3f8d09737769b62218c76e7208c4a4f84a6cf25804b0cbf4d16b46729", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700965, "uuid": "a827ae77-db31-49b9-b301-089850d4b072", "comment": "Malware payload", "value": "45e11be27ee01437a4ae98e66906e79443dd9d0b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700965, "uuid": "471fde45-825c-451b-b2c7-7cf416716b69", "comment": "Malware payload", "value": "deaf8e161bd0bdc8b1bd6914210ca07465b2ee57bc4b967e5ae745fd0119755fb782e420abd32ced477823c428371f61", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700965, "uuid": "805780ec-ad38-40e7-80e3-d02e6b58555a", "value": "T1BCB31801E5518727C1D3237ABB9F865D3B332BA493DB33115A247FB42BC2B991E39921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700965, "uuid": "65f88095-ffb7-4401-80e0-ffec0ac21135", "value": "3072:+Z81FKKCQn0Nv7JaytfQIhDKBi+m/QEhHXINe:R1FKKCQijJa1IhDKBi+m/QEh3INe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629700965, "uuid": "cdf738a6-402a-4e0f-8b7f-9330ecef8a8e", "value": 116847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629700965, "uuid": "b422726c-32be-4da2-b6f1-520d2751f50d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700965, "uuid": "92366ea2-f6fd-49bb-8bb7-f5fab1510b29", "value": "f6e61fa41fcf802c8272f672966e4a3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f028bd2d-03de-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1629701658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701658, "uuid": "621d216a-1692-456a-ab0a-e20151f81546", "comment": "Malware payload (Gafgyt)", "value": "1ed56fee56b28f6e76c4be3e51a45cd4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701658, "uuid": "db410832-e484-404c-baa3-17e59b547bf2", "comment": "Malware payload (Gafgyt)", "value": "55630297e171e1701b67906ede5b0966d3fd12c36df84f8f7679a0a3e5d0ff6d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701658, "uuid": "fb5162b8-2352-44f3-bf2f-bdff017e164e", "comment": "Malware payload (Gafgyt)", "value": "0c0af8200abf0524b873ff6794e3abde813b0355", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701658, "uuid": "d387f3e4-d216-4d5c-aad2-b6f0e4ac2e11", "comment": "Malware payload (Gafgyt)", "value": "5d2bc33430bef34c9b7ca44890339389c1bac1ba142f743328692909732a8ff2e12529fc33b11f486cc142db47fa2468", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701658, "uuid": "e2b292bc-8c78-480f-ab86-bb4bbf811d49", "value": "T140A32A41F9458B27C2D327BAF78F479D3B36569467D733015A387EB42BC2B882E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701658, "uuid": "e19584d8-c06e-4faa-a6db-ec46b5cc3c41", "value": "3072:i+BbgJ1MyopG91FrPh6bZpmL0rQA8nsX+15:ZbgfMLpGDFrPwmL0rQA8nsX+15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629701658, "uuid": "e33c0750-8fcf-4d0d-93d2-848fab377e63", "value": 102905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629701658, "uuid": "b70ead14-1dae-495b-9e4f-b88023fd3839", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701658, "uuid": "a4114d43-bf6c-4f4a-92f6-c45834f6549a", "value": "1ed56fee56b28f6e76c4be3e51a45cd4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45ca6213-0446-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629746040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629746040, "uuid": "c014f27a-e04e-4ebc-8236-170ec4bd3da1", "comment": "Malware payload", "value": "3e65fd2988671a1dd2269fa50f2f10e8", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629746040, "uuid": "d572357c-a8af-4355-98b7-43b19ce61073", "comment": "Malware payload", "value": "55e5211ab621f036553f7025e9a3d9446fcf84f6d6dc8f0256033d2199d53734", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629746040, "uuid": "5b0d2162-73ac-48bf-8016-8c19f8c44a20", "comment": "Malware payload", "value": "909231aaefcda1ec3e233111d766138e91e73897", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629746040, "uuid": "24b5dada-2716-41b3-8d88-a5e06f567e1d", "comment": "Malware payload", "value": "a4ed02fd971157e98f5cbe0ea3a40119372cbddaee546ad6f0ff73a47702560bc0dc948687ec5d7546f1ca7c2b04724a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629746040, "uuid": "0891d9bf-2f4e-46f4-bfc5-5c5cfccb5395", "value": "T1F8F5331A5BD3DC57C42BC27642072903396A38AD51CB3A6E09760CDA18D365CDB7ACFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629746040, "uuid": "9ba87676-3117-4c01-9b9a-eb6ef8c779ce", "value": "49152:rvbDTFYSO6ystCT9TVk/iE2dyIGbMHG19QnkeXlZu79qtvglSyDWnjzWIoqn7tCA:2S+stSpVS2k1jYke1479uIlNovoksSf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629746040, "uuid": "683e6255-0849-4e83-9c22-3c9e1692c547", "value": 3405076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629746040, "uuid": "b4f90082-44fa-463c-85c5-8d885973e5fb", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629746040, "uuid": "40ab9c4a-4b86-46ee-a2d6-a24fe1b65223", "value": "AndroidG\u00fcncelleme.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dd99ad9-03da-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1629699749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629699749, "uuid": "1bf78e5b-7851-42d2-8a95-0c7ce601bc88", "comment": "Malware payload (DanaBot)", "value": "eb749e44a75448c807d0af28f8b83e66", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629699749, "uuid": "f24aa0d4-9142-427a-917a-ce3319c9c463", "comment": "Malware payload (DanaBot)", "value": "56086c245c079cb9345f744d6c352931877ea6aa2286950f9451d3ec372d6e19", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629699749, "uuid": "02aa5107-d588-48c3-9a38-da55305c62f0", "comment": "Malware payload (DanaBot)", "value": "f00ecf94d2ca07d843242b23b1d6e9f92d80c0ce", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629699749, "uuid": "39c4e505-cfa2-40af-b474-b2c583f2676e", "comment": "Malware payload (DanaBot)", "value": "64b6f2dad8cb112cb6540c24235d256ab99e0b67b9934dfdfee1807a5fb022f9ddbd5562c7c8552881a1a642cb0b569a", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629699749, "uuid": "7d8309b6-3803-475e-bff3-94e043ccf4b4", "value": "T156D4E130B7A1C034E1B312F456B98768A93D7A72573550CF63E51AEE1A386E9EC30747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629699749, "uuid": "9ba120b8-1e89-4876-a7f7-c7874023acb6", "value": "4aded8f080ac4b6e892c4de31a213f2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629699749, "uuid": "548f3b39-de9d-457a-8e73-443bb25c25f0", "value": "12288:eKOR/0vrmf7SehkqWtVHd/me+NI7E7936QNq3PDQw2k:q/0vwkBtVHd/mNNS/DQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629699749, "uuid": "042e411b-5352-4747-a5c2-eeb77a99c57e", "value": 638464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629699749, "uuid": "6f74b9a1-a830-4ea5-96fa-0ce92c0e75ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629699749, "uuid": "d1b66af1-c280-4f5d-8271-7eb2a3744543", "value": "eb749e44a75448c807d0af28f8b83e66.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "882849ed-03c9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1629692464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629692464, "uuid": "14a2a6cb-7da0-432e-b14f-335dcb955a9c", "comment": "Malware payload (AveMariaRAT)", "value": "0c783d3018a72d865716d2c99378f918", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629692464, "uuid": "7a280553-a26c-4029-84c3-131db8e8e83a", "comment": "Malware payload (AveMariaRAT)", "value": "562dd81cf76983ebc3fa71b9914d25e9f40a5a6ddbf5bf95a48d60104812cca0", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629692464, "uuid": "d4e68f2b-8e2b-4157-aef5-9bd1115d97ad", "comment": "Malware payload (AveMariaRAT)", "value": "89b5b5440f4e9da2135fc3665e0a2bcfbc5009b7", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629692464, "uuid": "fa9e16a4-edee-4c54-8f30-ccbb771d896e", "comment": "Malware payload (AveMariaRAT)", "value": "a8391052d3843a6083e98c84d0bcc44e5c3ff8bfad99fd76302d65e9f83bed56cf0f326c1d09965f4fc0a45d1d69209d", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629692464, "uuid": "77441abb-0753-4465-b391-a9af7c411f9b", "value": "T18705063C19B91637D1B5C3A5EBE48423F148985FB410AE69ACDE03A7434BA9735C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629692464, "uuid": "ac86a040-a514-4c42-af36-e9dca55e9f16", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629692464, "uuid": "8a34c858-35f6-4303-aecc-8dfde328529e", "value": "12288:blqNnk72gbrv2bTMJB+TtJRUO6jZ4wf/x/aLXNPi9S6xJ:wNnkqIuHMb+TtJqO6JaZiJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629692464, "uuid": "ddad0f87-a808-47e9-831a-cadf136f268f", "value": 840704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629692464, "uuid": "895205d9-6954-4308-989c-8e2edd40f49e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629692464, "uuid": "a042dccc-7024-4650-8096-1d580b8ea5de", "value": "BQ011612,011679.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8b4f114-03df-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629702048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702048, "uuid": "1a1fd6c5-4a7a-40ab-a7c6-54f32a0c815f", "comment": "Malware payload (AgentTesla)", "value": "dd2b1bb34e88832d4257878f3f813f33", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702048, "uuid": "ba17a013-0dd7-459a-afde-b37abacd135a", "comment": "Malware payload (AgentTesla)", "value": "56bba235794896593f63fc2ebefab4aa0d211876d26c367166886daea402722f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702048, "uuid": "8d7bed79-705e-48aa-8897-52c58e4b4c77", "comment": "Malware payload (AgentTesla)", "value": "e9f87ada92febecc6acd3b703ad6d6736359c231", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702048, "uuid": "16ccf35f-bf30-4373-b24e-0fcd4ee0380f", "comment": "Malware payload (AgentTesla)", "value": "cd2cdac6bd37be07eb5406b9f300a99f271ae329131016644454c927fbcf971b25050179a87e72968017496e3c5b47f8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702048, "uuid": "c923f109-c0f0-4957-9e38-e9878be345e2", "value": "T1E3F402157204FB9FC52F8E3A98414D40ABF1B5764B03E767BCE315EC2D8E69D8E22192", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702048, "uuid": "9b825e7c-e740-404c-9aec-9bcfa96758d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702048, "uuid": "6c7231e2-b767-4169-b416-394c36c678c5", "value": "12288:Y1yFOKgxIdnnUOgRrry9vmQ8bmS59K4TbvAmkRSTrpRcc1nVkFRy/:Y1yF3HdUOgRvy9Z8X9loz4TrpRcCVk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629702048, "uuid": "30262ce3-1b06-4a47-804b-abd1ed171a00", "value": 772096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629702048, "uuid": "eaf165c2-33df-4d1a-b718-a9b4a7ae368e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702048, "uuid": "f347ee8c-f82c-4224-88a7-3cd7d9320f0d", "value": "Detalles de devoluci\u00f3n de pago.PDF.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20758f0b-0446-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629745978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629745978, "uuid": "455c71da-544c-42fc-8434-2ddaf19c03d8", "comment": "Malware payload (AgentTesla)", "value": "3f5998401e2da3c62b4ef0114b8a27a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629745978, "uuid": "2cfa9fa0-9151-4ac2-8a1a-51f6dcb51047", "comment": "Malware payload (AgentTesla)", "value": "56f1f7df9b82c8bb7024f0c7cf699ff64b2f95014f72b5f8275af4d434e45479", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629745978, "uuid": "12cb6867-1b43-4378-b041-d748bd0d9de1", "comment": "Malware payload (AgentTesla)", "value": "17bcbcbaec9d6c399055c527ed32f12f7d2053db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629745978, "uuid": "b4d50fc0-b476-44c5-b8d3-56a55d51d590", "comment": "Malware payload (AgentTesla)", "value": "69143bfd13bb67bc8857f53ab022f773a3971247d2a882e1378cb27ce97f13efd60269243e7c0f730c0bd99c911c5776", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629745978, "uuid": "221636f8-60f2-41eb-81c9-36fbfb6e2849", "value": "T143340204D72E9728D642C4F8AE9CF67F69146E72949F46F39792728C0AF04F6A720713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629745978, "uuid": "73995361-ff64-4951-a272-4956408906c1", "value": "6ef74f7b87fa15b6df54d064a5b8ef31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629745978, "uuid": "94ec19ef-dfe7-4782-8b80-8ec48c422b2e", "value": "6144:cc2N9p280gTK/tdUqBW/SEHl2mlQ5FK2AJPg5x3VAJDlKqlaZ:ccaKgKrUlSEHMmulAJP9DszZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629745978, "uuid": "89131e58-64a3-4df9-bbfa-c7a780c4be9a", "value": 240093, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629745978, "uuid": "1c1063d8-7db8-4500-9753-be1274860afc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629745978, "uuid": "598a65e2-2689-40d2-8f5b-f285c6cfdfc6", "value": "3f5998401e2da3c62b4ef0114b8a27a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f32e78ca-03dd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629701234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701234, "uuid": "2479b3bb-b00f-41ab-a5c0-2fa276e63e41", "comment": "Malware payload (AgentTesla)", "value": "05fd99c2b63cf23545c59d5002d3f105", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701234, "uuid": "5ec6ed3a-d2e8-4f9e-904d-b35e9eca4312", "comment": "Malware payload (AgentTesla)", "value": "56ff0c69af4afd79128a19508f3771e8e3e3037292dea0b8f662c406a169f30a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701234, "uuid": "0816f059-864f-48bc-b236-e08e447d22a0", "comment": "Malware payload (AgentTesla)", "value": "ca896f203428d8c1c529f9b0b9b2329b5d4f116b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701234, "uuid": "c5a08237-e2c6-4bae-ac84-0813495826c8", "comment": "Malware payload (AgentTesla)", "value": "eb8adb54cc2cb265cd8b6eccfe8a5aa9c750ca221589da80b5db9e793b04f6cd1c3ce1a8f85fb650afd5ea8170fc1e46", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701234, "uuid": "a4cea84b-f06f-4903-a62b-c19de953f2a3", "value": "T14305F63D19F91637D1B5C365EBE58423F148985FB404AEA9ACDE03A7030BA9735C722E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701234, "uuid": "d5e27aed-e9c7-4bd8-aa5c-ae29b9b8c29b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701234, "uuid": "1d9bd36c-f7d2-408a-af76-2b57c51f96d9", "value": "12288:Ptt0kNI4e6ISO8JEEGKafXDcXGnpgomrsmvtirWxgwXCD:PtWEe/E8ckgltiCV6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629701234, "uuid": "dd85dadc-3236-49b3-9146-dbc9332b2939", "value": 818688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629701234, "uuid": "c493380d-e9bc-4332-a6cf-9a2c78d7065d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701234, "uuid": "63a71029-a212-4cb8-80cc-31ae16a4b4ef", "value": "L911B410,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "629c29d9-041b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629727620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629727620, "uuid": "65cdeca3-8218-4873-a050-06beb8671998", "comment": "Malware payload (Mirai)", "value": "b839130d0aa6f27b7f6fe537164082b4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629727620, "uuid": "2cc3237f-1e7a-4bb9-8a18-da2765b96b4c", "comment": "Malware payload (Mirai)", "value": "57e2f336f9b90f1b0abd3de7e68a198ace5f1a9f0f8ab3bbfae96b90bdd3428a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629727620, "uuid": "bf288930-37ff-4e67-9baa-16617d717f5f", "comment": "Malware payload (Mirai)", "value": "64a7277ac02db60733916d37c34188f8870725e3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629727620, "uuid": "89b97342-9a66-48e2-bee8-40def753ff53", "comment": "Malware payload (Mirai)", "value": "6472c0cbc66abcd718d0ef78e4cd5b75263dbbc9228216bdbfd8569f188c018e4e7187e0bede951ef79666c43d46ce27", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629727620, "uuid": "c883e15a-ebd2-431f-bd41-82ddcaabfb51", "value": "T1CF634A01775C4E43D1A61EF8293F27E193EEEE9021F4F5842A0ED6465272E33994AFD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629727620, "uuid": "a72922b9-7468-469e-b2c3-f1c185057cef", "value": "1536:ZjVO2KsrO4zb5BdM1BpTaQnQSe1ECj5ds:CPsTHdMxNQSe1bjrs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629727620, "uuid": "051aed44-840d-4e39-8c32-f72eac20cbd6", "value": 67576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629727620, "uuid": "ce0aab46-32c5-4f54-bede-1a31d69d67af", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629727620, "uuid": "95fa62b9-33b5-47b1-9a3c-bc0a93a6b3b5", "value": "b839130d0aa6f27b7f6fe537164082b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30d887cd-0454-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629752018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629752018, "uuid": "fe1eeb2b-9466-4010-8af8-c28ef454b1ac", "comment": "Malware payload", "value": "0fe65d945d9f773bec35a27ce6999a3f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629752018, "uuid": "2a1c1a35-1f8a-48d6-83ab-76fbfa774080", "comment": "Malware payload", "value": "58f465541e9fe204911a03c7c7bdf467327c1e448358a471beeb3bc898eb5666", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629752018, "uuid": "50a2b40f-ace0-446b-84ee-d2ae6d5ce218", "comment": "Malware payload", "value": "ff908cd8d0e895fa8a0649afbe08cdd101c3bd06", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629752018, "uuid": "cff07012-d894-4d9e-b5b0-5f350451cc62", "comment": "Malware payload", "value": "ff536b451bdfb8252391de0cde072f869edc41e0abb953c97b2e17c5c282d9a199963a7d445e02dc3c0b8c44e44138ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629752018, "uuid": "2a958ebd-239a-4de9-9a3f-259c683db7f9", "value": "T1A7550A3815B8393BE17AC33DDEE5680BF6D4B45B7211AA1670DA13671703A02F99327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629752018, "uuid": "815140a0-ba66-4b4e-8039-58f5f08a406d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629752018, "uuid": "c87fd1c4-4e06-49bc-9822-3935812261d3", "value": "24576:9yuYccWcWz6V/wgeXE6RFn224ej7m8a032sIWM+weRWZ4Gucn1V:22lBRjiumghdY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629752018, "uuid": "2ab59e73-9bc6-49e4-a732-67c6620f9a24", "value": 1355776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629752018, "uuid": "106596ec-81bd-4a1b-abdd-478e692365d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629752018, "uuid": "8986c746-d174-4ae4-ab30-7f5e03a2ec95", "value": "0fe65d945d9f773bec35a27ce6999a3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "661d8ceb-03fa-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gozi)", "timestamp": 1629713453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629713453, "uuid": "ce9b6fb6-3091-43ad-bce0-ee676b5d1f4b", "comment": "Malware payload (Gozi)", "value": "939f73a559fd7147c356cb7d8cd23457", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629713453, "uuid": "6f5c6df0-7495-48c1-8d8c-0a6cce52af21", "comment": "Malware payload (Gozi)", "value": "598029ade1d8cb6d0f8f86188bd2fa123e2f15024ce72fad8042913d333ea77e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629713453, "uuid": "ccbd138f-23d0-4a59-97a7-57cdfa00e0b4", "comment": "Malware payload (Gozi)", "value": "52106e7807b52406fbe1ffa99d73a3b93d1659ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629713453, "uuid": "83559d7d-da18-4910-816e-05564217a5d1", "comment": "Malware payload (Gozi)", "value": "07e71857e121fb839e048d8156988e56f4f116174ac16ece7dcc7117453aa154a08f97880f288ccde09f18d879d7a4bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629713453, "uuid": "34a70ee8-596a-4707-9adb-70f46b31a545", "value": "T16D346D6AE2E50A95F9B7D6B9CE93C617D7F234490B64C34F13B0CA966F43321B218381", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629713453, "uuid": "83062357-2d4e-4b2d-a65e-9c38fba615f6", "value": "6144:tmnZO0GDlypHAT/cxkDyPFXkfh+3m33c5TWjak4SvS83x:tMZOrEpHAT/cLPF0Im3s5TWjaCK8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629713453, "uuid": "9f74fa8c-44ac-416e-be45-bfabd5031ac3", "value": 247808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629713453, "uuid": "f8c454ff-158b-4b12-9089-004e2f0b1f07", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629713453, "uuid": "dc6a4213-da05-4e51-a66e-83ce4ceac8f5", "value": "eb70000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e25a15c-03dd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1629700957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700957, "uuid": "e5c0a076-2371-4473-b1ba-ff9361e2d29f", "comment": "Malware payload (Gafgyt)", "value": "ea1f79937a81720bd68816ecea6365d8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700957, "uuid": "4a7ea991-3ceb-4ab9-b9dc-d1e206fb0e08", "comment": "Malware payload (Gafgyt)", "value": "59dff74e889eaf64e3da1f859901fcdd5da27ced7df0ae944b75b20d392eda32", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700957, "uuid": "bff81c97-facf-460c-b935-5ee9e17d3859", "comment": "Malware payload (Gafgyt)", "value": "dd76fb4a97b4b33b8c3feee505b54bc19a110bf8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700957, "uuid": "5aabc28e-4fe3-433d-b0dd-a54660dd9f4d", "comment": "Malware payload (Gafgyt)", "value": "335ada448c965bbeb95c07d5991213ec2562c2da65b17db137d4c44ad00e17696e9cb8749d33692d12b37097417bb155", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700957, "uuid": "ceb5e466-be37-441e-bd04-65c2e70fcfdc", "value": "T1D0834B42F743C6B3C8830AB6129B9A261D32F9AA0E2A8F55F31D7DF46B134C47116F56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700957, "uuid": "38ec9db1-29ef-4a4d-bdd5-02f9a8232f2a", "value": "1536:VH+8BIuBSQJnarAH5WM6kG679l5MNurj9vjmbJxVoBjY4fZ4P:48ekSQBaCM5hUpmtxVoB84fZ4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629700957, "uuid": "457393ef-4038-4e28-af9b-23645b6ca663", "value": 81711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629700957, "uuid": "e5886a22-fcb8-45e0-9be4-328ff8d82753", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700957, "uuid": "7ea992fb-7905-4c9e-8de4-8a470945a20e", "value": "ea1f79937a81720bd68816ecea6365d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "975aaae2-0424-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629731574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629731574, "uuid": "90f98d16-a3b6-4eb7-a9d8-89bcae5cf432", "comment": "Malware payload (Dridex)", "value": "49d1978dc16a3c33f6574f4f5601faeb", "object_relation": "md5", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629731574, "uuid": "57889bfd-e071-4692-b8b1-3ceea30ecf82", "comment": "Malware payload (Dridex)", "value": "5b47ee3bbaf043a22046daf83bf5d05a4c300bcbf8e8b0b745355156e59147ae", "object_relation": "sha256", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629731574, "uuid": "3a4410f5-a85c-493f-8a55-7ed10b9fcba4", "comment": "Malware payload (Dridex)", "value": "4cb1140b341f95598e6e3ade0c737034fd1643d0", "object_relation": "sha1", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629731574, "uuid": "3ec37534-1c78-4300-85f5-1e24b3646a4e", "comment": "Malware payload (Dridex)", "value": "de546112237151fe8ae92865e1e0c40bd02e108875924a44ea9a3f99af417fd0ee2db16db305ac7d91dc616725a4841f", "object_relation": "sha3-384", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629731574, "uuid": "757c7075-3d8a-4b64-8430-e79f530a64d4", "value": "T1A614D012F39A42FCD57F08B4259A397F951934206733EBF5EA13C388A622266D4F1772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629731574, "uuid": "e66440f0-3674-4ac7-bfbf-949ab4ad5b42", "value": "c465286f86f74557d97208a90e0e5e44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629731574, "uuid": "5bedd36e-5621-441f-afaa-00a512dd3463", "value": "3072:48bP7oCIkCD6Wgk3OIbtRpr1eVE+nxNS5KL/JcmdzuI51u:doCXC223Ow5uznxNS5WBJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629731574, "uuid": "731f4e13-b696-4942-8298-0be887627263", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629731574, "uuid": "cf61d11f-02ec-47f3-9e58-87e80932cf74", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629731574, "uuid": "d1b137b0-42b2-4c0c-80ed-24b3d5a88ecd", "value": "NiYrOVoTcw.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2d11ae6-0403-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1629717447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717447, "uuid": "cb659ea4-894e-4c37-ab4f-fae4c1118389", "comment": "Malware payload (NanoCore)", "value": "00789e0ad9991b34d44c35bad96947f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717447, "uuid": "784ad3bc-1200-4115-b988-61429b6d056e", "comment": "Malware payload (NanoCore)", "value": "5b9211e112c22fb2635a68497b1ad694e3780759568c9d5a0260257c863ac8a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717447, "uuid": "bf4e434b-3911-40c3-8d80-f3808e8f0c53", "comment": "Malware payload (NanoCore)", "value": "913bd304f2818da979d5e4a368fe29d6747d6d8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717447, "uuid": "ef7d15f3-a24c-4b57-b8a3-baf762ccc108", "comment": "Malware payload (NanoCore)", "value": "13284f1298c785f4bac0867f2a95bc104e9bfc3c4eb08f905005888f8e813d2c06671843b2f9869edbfedde63a74607d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717447, "uuid": "b46b003a-8e9c-4fe5-b1ed-12187bacd7da", "value": "T1F555E83921B42B27E475E364A6E54417B3E09C5FB225ED59B8CA33A70372F4264C363E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717447, "uuid": "9603f64a-b37a-40c5-a6ab-64f1c94986a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717447, "uuid": "a7aea0f8-c74c-4ac1-ad6f-b6190f3229a1", "value": "24576:pH1R3FY9blhB8AtuWDSf8YPWpQgQZxjubA0:5TyN18AtdDfpQPjubA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629717447, "uuid": "32dce053-4a5d-488a-a41f-69ade07cbf45", "value": 1294336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629717447, "uuid": "3ef4a63a-88fb-40a9-9d71-6b54d651c8fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717447, "uuid": "00a5f649-c38c-4d3a-97a7-517376d169bd", "value": "Confetti_Yeni_siparis.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "041a344f-03df-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629701692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701692, "uuid": "a7f1b1e4-65c2-4592-8331-5afb332fc08e", "comment": "Malware payload (Mirai)", "value": "aed0b2b27c3dfc74509ac8f52f85590d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701692, "uuid": "e4e8eee9-5c5e-4978-86ff-33065184e4bd", "comment": "Malware payload (Mirai)", "value": "5c19be0a8d4c6591e89372be8b07d3292fd0207d8954e6b547c7e97952047f07", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701692, "uuid": "6f5dad51-d3a5-4dca-b495-f76f13fd25f2", "comment": "Malware payload (Mirai)", "value": "db26f402b030e4f7d3a7662f1ac249052a30666f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701692, "uuid": "d459ace7-694e-46aa-8a7b-9ac4cb12e80f", "comment": "Malware payload (Mirai)", "value": "959888b5bd17941f179315ed16ba4f08229e150e8f0b87e29b12b0e5cece151ab0fdac85fd77fb5c445cc37786c9da74", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701692, "uuid": "212b1658-60da-43c0-80ff-ce550a20e532", "value": "T13623F1ECE6B03B80CB7C18B9F09D0A67155264DD338A0A54BB15ADD4F530D37BF5A8A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701692, "uuid": "01c0f3f6-2bbd-4269-ba89-7f0dbb85a7cc", "value": "768:KXu04w8OkKBmHk6ItvUmsWvkVii3XMe+8NJ8+5ENBGWWy:Z9cijIDAVii3t+8ACy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629701692, "uuid": "5a06be8f-29ee-4b27-b96c-edc8c054f2a6", "value": 49868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629701692, "uuid": "cac361fa-1ef0-4efb-864a-c4ade1632170", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701692, "uuid": "457b33c1-8c19-4fea-acd6-43767c260694", "value": "aed0b2b27c3dfc74509ac8f52f85590d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77a4af9a-040b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629720784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629720784, "uuid": "33be0a25-cf43-4a4f-8e26-65185befadfb", "comment": "Malware payload (Loki)", "value": "d5032a79b95be7ad05d38d1ae3c7f26f", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629720784, "uuid": "2a3b5bc8-0198-4864-9ce9-c2868e4691b2", "comment": "Malware payload (Loki)", "value": "5da233d0af3767b7b5434003a6d6289750d09cfc8b984e2769f7643b7bba9e84", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629720784, "uuid": "44b0983d-04e5-4bd2-b8ec-ff26a891d15f", "comment": "Malware payload (Loki)", "value": "430594789e765a2e5a956d056a9868696160060c", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629720784, "uuid": "fcc9fc74-513e-46b8-9a15-985687b620cb", "comment": "Malware payload (Loki)", "value": "d046c04fa54a28e41da95f98f56af71fa76cae25f7f309a2b7e62d2fce68336dd36673ee3e917208e97fd5e829fcb73c", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629720784, "uuid": "fb104446-86cc-4916-9461-61f49f4841de", "value": "T1F3C4236DB072012AE4E62604BF99F4C04463EE147DD04770CDF62FAE9D0E77AA09B765", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629720784, "uuid": "7f7c9d59-c23f-451f-af6a-d6e1a4f5afb3", "value": "12288:cNScfPpLsclvAUeG++/oZCJQxpjuikWFbatgJMnNiqRxA:cM+pL3lYp+Q9xpjuikW0jnQUxA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629720784, "uuid": "694096fe-d83e-4eac-a671-26d6d21f2a26", "value": 551427, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629720784, "uuid": "5cc53b0b-f66a-42ba-a88e-ba55845ee6e4", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629720784, "uuid": "e8fe056d-011c-4abd-97a9-02f57234b83c", "value": "ENQUIRIES.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68147b72-043c-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629741803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741803, "uuid": "19538098-7816-4438-8f3a-50a2f9e16ffb", "comment": "Malware payload", "value": "224b8bb42508de25bd73489dc6e8ac32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741803, "uuid": "d6493a31-6672-4e47-89d5-99a1a452bcd4", "comment": "Malware payload", "value": "5da811afb0060155dfd958f586069bea2ad60377ac8eca3cf6b670310a3dc30f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741803, "uuid": "71140c67-60de-462d-bfbc-ee5a16966368", "comment": "Malware payload", "value": "c2cfe643fcda2d3183fed26857f6f08283ee4c17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741803, "uuid": "79df70aa-bc31-4fdc-b096-34c4fdbe9c25", "comment": "Malware payload", "value": "4b787bc74754e1ee171ec1e12c37b5390a2f8268d5a49a09cc7627c6fddf337f07c60417a8b8eee096aa4faaf44a9947", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741803, "uuid": "43c4c05a-d9bc-4a80-8c83-53746fee1be7", "value": "T1A535383D19B91637D1B9C365EBE09423F158981FB515AE6A6CDE03A7030BA8334C727E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741803, "uuid": "6ded6e85-db0b-46e4-a627-bb6651180b0a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741803, "uuid": "c6a6e8cf-f7da-43a0-92d7-63536189ffcb", "value": "12288:ocluJzadKBNh8w3jDLSeyXIWN9sBW9SISYZiRI3R4Q3iflpVq0ipc7U/hmxM1sjI:oclMLhZ2eGl9l9SI7diQSn00eV8M1aK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629741803, "uuid": "565bc234-e42b-44ca-976a-16e69f619adc", "value": 1104384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629741803, "uuid": "e3f7e1b0-3670-485d-a649-b275a412dcd9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741803, "uuid": "1ead962a-10a2-473e-aeec-40ca439270ac", "value": "224b8bb42508de25bd73489dc6e8ac32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a54be84-0463-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629758611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629758611, "uuid": "f88438e1-db95-4644-801a-3514c44e1fca", "comment": "Malware payload", "value": "823f3cbc0b6ad5ee6f23d1da1a49cdc4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629758611, "uuid": "793fa26c-e31f-4253-b518-bfe55c815db1", "comment": "Malware payload", "value": "5e3fb9f22a412050356e0ea4079847c7969c8aac021f8855404435032a4427e6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629758611, "uuid": "2aa5acc0-c025-4238-ab7b-c3e45c4b14a3", "comment": "Malware payload", "value": "11dd73b158c83d90c45ef0114de72de881b0066c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629758611, "uuid": "496489e1-11cf-4528-b891-e751fb2b32b6", "comment": "Malware payload", "value": "b70941eb57588922a369568a7e01763e47536aa3c5f76c3990f15d216f825b1ac04f91f73e04ffe74a6fcea0ae4aa4d8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629758611, "uuid": "77e590cb-30ef-42fa-9045-4ad206ce845e", "value": "T13FB4E020BAE4C138E5F341F459BEE3A869293D705B2450CB62D627EE66372E4DD30787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629758611, "uuid": "34bde2ed-f045-4636-92fb-7d9772342272", "value": "0579ae0629fc2c520498364f1f007f60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629758611, "uuid": "acfd3a91-7cec-4148-8955-60ad88c0907d", "value": "12288:a/XEWr9xop/mAOTJA4rtfqDJfbF8IQuUJh:urjo2T4DJbqIvUH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629758611, "uuid": "6b16734c-31d7-4b5f-b1f0-dbe2461d399e", "value": 536064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629758611, "uuid": "821bc175-f331-4128-91cd-6354ba0fd163", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629758611, "uuid": "d86d6e1c-657d-4edb-a51e-3c18f3117c51", "value": "823f3cbc0b6ad5ee6f23d1da1a49cdc4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79352b5a-03dd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AZORult)", "timestamp": 1629701029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701029, "uuid": "f5a94a1f-f52b-4b40-bd34-e281af75a88d", "comment": "Malware payload (AZORult)", "value": "5eb6e2ccdc44749a5b39d9c7d903f270", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701029, "uuid": "e86449d1-2b34-41b7-bd04-f282a202e45d", "comment": "Malware payload (AZORult)", "value": "5f9fa8e86c0738cd9e6ab73272015257d596e9f7048d4fa1e1b57d22816b67b9", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701029, "uuid": "2b874d41-72ca-4554-88ca-683352d41ec6", "comment": "Malware payload (AZORult)", "value": "35f8c7c1d1794e12c413dccdb6f2d7142202c4ca", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701029, "uuid": "10b581fe-060e-4583-ab9d-91006a8202e7", "comment": "Malware payload (AZORult)", "value": "db77e19440a0a8b57ddb207ca8782d12723f3f8cc0421c9ede320376110297e76b6a4574e7bfa89b66c6d5c77b8cd7d5", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701029, "uuid": "6a384747-6930-4b1f-a0e4-d49c87f49ebd", "value": "T184642321D360DDDC836BA40FAE00A6C266FD067BF583AB9C694460C7D1A27D9235FC5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701029, "uuid": "2b58a635-b366-4f2a-98ba-49e073e227f2", "value": "6144:LF/pUrKnPdyxHfX3aD+BT8mT3UVw2NcFbEaWWxRH7YnnwEtXdvZF80qwj9kyE:5aOnPdyxHFGuFbEaWEYnnldvZFnqwj9M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629701029, "uuid": "eb708e99-588a-46c7-8d83-87ce8f322e8a", "value": 336273, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629701029, "uuid": "df1c94e1-631a-4c0f-9a5d-58e900af97cf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701029, "uuid": "1136d051-3d0e-4315-be2e-720c25a075d8", "value": "Pi Request.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "241432d1-0446-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629745984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629745984, "uuid": "8788212a-6f0b-416e-950f-352e950deb7e", "comment": "Malware payload (AgentTesla)", "value": "0bdd37b8a257b2c21b63508c9e53ac04", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629745984, "uuid": "fbda4ce8-1b08-4611-af35-f9e236a5ba87", "comment": "Malware payload (AgentTesla)", "value": "60984e3b0494549fbbb8bd41bd79c370168bc76d750ada32e6c1af8619fa01d5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629745984, "uuid": "df12bba2-cbed-4e15-9776-a973ac9e248f", "comment": "Malware payload (AgentTesla)", "value": "2cfbf93f5eca09f5a77a95db2d942d9e29b02cac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629745984, "uuid": "dc50be21-0ba4-4ca3-a7e3-b3206b986582", "comment": "Malware payload (AgentTesla)", "value": "883a34c0be1d78304c712f0d0b73ee407fb1a8cdd327a6283791cfad84fd8ee3acc69981bcff293f36b510829a47cd07", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629745984, "uuid": "642c08d7-7fba-4823-8bc3-3fb1b6c72d56", "value": "T15C341256DF2D6355C4569877864942FB38341F38F85F9B771B82B80EACF12C0E6229A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629745984, "uuid": "1a401c02-596e-451d-8862-5f833ad60d32", "value": "6ef74f7b87fa15b6df54d064a5b8ef31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629745984, "uuid": "5f9e4f70-f519-44b2-8ac3-aba534167c37", "value": "3072:b9Pt5e7Mw3tVlMoTwgETpkh3XYVgt77NB74b4TMLfJWK4J4L/9DLYXVloQT7Dymg:bh/envbTFETUX/t7K4T+V/dLYIJiARJp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629745984, "uuid": "502bdb93-5ac4-40e9-95e2-babc4c6e91f2", "value": 239783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629745984, "uuid": "fe292f1e-1f6b-48f0-98ac-a4bceb9b2205", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629745984, "uuid": "af2f2eb3-ad30-4983-bfc2-50e39f6e363f", "value": "0bdd37b8a257b2c21b63508c9e53ac04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "613a99e9-043a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1629740932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629740932, "uuid": "11ea9bc1-0b1f-4615-9d6f-417c7e619cd8", "comment": "Malware payload (njrat)", "value": "9180372d6bceb05b046f15cf65ec734e", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629740932, "uuid": "fd9ad0f7-5290-424d-b176-41a0047a54eb", "comment": "Malware payload (njrat)", "value": "61a8385def4eb1be1e85b3f1bdb3b98721af8f522c675c89f18a24707ad5905a", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629740932, "uuid": "ca05fe77-586c-4a01-ba22-11ec5816a17e", "comment": "Malware payload (njrat)", "value": "b3c3d3a794adad9447ae12d7122f7bb2b67f3a50", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629740932, "uuid": "4d03a4a5-e3ee-4e46-b038-a712d2895065", "comment": "Malware payload (njrat)", "value": "f16dfff78c523f0409b6f3a74130587f93e129512c0bb84eae6446baa2bfaa23f16fc7b26a7c012ca63206381928a1b3", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629740932, "uuid": "b6a8cb7c-12ea-493e-94b2-bd08fe988604", "value": "T1BC012B0B4D29CDDB0149F18242C38DEDC6604A674F806E7A2478754B6DAD22F6DCCD47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629740932, "uuid": "5cff9f29-72ee-4a83-be83-385e0119908d", "value": "12:0ChGFWNZ8XNoxAbOJk82cG2bwELPdg3Nfd+aaiTC:HgFWNZ8XQXG2UE7kNEuC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629740932, "uuid": "03db54a2-41c7-44ef-9d85-0f9a0dd39657", "value": 728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629740932, "uuid": "9f0b17c9-2a9c-43ef-a7d4-e029abd297dd", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629740932, "uuid": "4abb167a-e20d-4407-a5d0-4204196ab06e", "value": "Invoice#4110.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "077d3f19-043b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1629741211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741211, "uuid": "c6382c98-b315-485a-94bf-a6709e719402", "comment": "Malware payload (DanaBot)", "value": "7cb7086237327a68a89f9ffebbe5a228", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741211, "uuid": "ef5b0fea-9ebd-499c-9cc1-d196fb31c469", "comment": "Malware payload (DanaBot)", "value": "621130bec2ab9105386df86d03072ec6762e510b5706614678555137cf8603c6", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741211, "uuid": "4d4b274b-62f0-4fda-9b82-03e1de3904a1", "comment": "Malware payload (DanaBot)", "value": "7384435fe71c6c8275fb5204218da4900ef27f48", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741211, "uuid": "1491dcef-e1b5-4a17-b0b0-e27498cb2a88", "comment": "Malware payload (DanaBot)", "value": "f65c74a5acfb75694152159f5d685e5711f85a7888dbb27fce3100617c84e6943883cefbfb544b84a5687bb20d604875", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741211, "uuid": "89370098-93fc-4075-b5ea-b91ac789760e", "value": "T14F35230A7DDDD471E0E78BB21DB25B3206A2FC60357AC71A8B90BC5E7171922D225B1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741211, "uuid": "4dac9d02-8c33-48d9-b10a-81d7fe59ff8a", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741211, "uuid": "c0a99bc1-cbb6-4d40-8d79-a18340f0d05e", "value": "24576:la81Z/0sin7rvPmds+nx9XkOFDlerCkGhQZ8t/4wPVii9WA:V1ZHin7rx+xFkoBerCkGhjbVinA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629741211, "uuid": "550de491-96b3-408b-b5da-e1882d2ee8d5", "value": 1090473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629741211, "uuid": "99f7511d-5598-4e7a-bd2e-aab5136892ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741211, "uuid": "89289935-a204-4ff3-9d07-10f850792a8d", "value": "7cb7086237327a68a89f9ffebbe5a228.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e26d933e-03ef-11ec-8fa1-42010a9c0011", "comment": "Malware payload (BitRAT)", "timestamp": 1629708937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629708937, "uuid": "b620653d-a7b8-47b5-9d85-843b31b1d9eb", "comment": "Malware payload (BitRAT)", "value": "fb46a7fb710bb84d274bd77993a094a2", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629708937, "uuid": "8abb11fb-9afd-4300-ae92-9474f0a06a00", "comment": "Malware payload (BitRAT)", "value": "6548ac6fe1d508fddbcc21c79f64419986982826f2251aa7e664c08c076bf4dd", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629708937, "uuid": "37149539-eafb-4008-acc6-909c8d29d693", "comment": "Malware payload (BitRAT)", "value": "85670ac8a45a4c12983e282e3f4343d98aa460c8", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629708937, "uuid": "30e4c760-b96a-4423-b5cd-fa0130edb102", "comment": "Malware payload (BitRAT)", "value": "c95b2d93ebd5b69c5eb5d3c662f0df7d37874f44413933010b760c551692a1dfb2273a0c67ea3706173b168786845fd2", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629708937, "uuid": "ff4b88b3-2e53-4105-aced-d9b297415706", "value": "T11D06CF02FA46C562D2570230E96E77BB053CF9350B2085C3B3946A285AB56D17B3BF7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629708937, "uuid": "a6c61ba2-b35d-4a15-a4ac-da2bd2b3ae94", "value": "71955ccbbcbb24efa9f89785e7cce225", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629708937, "uuid": "4e53d5da-8189-4f23-a8e2-9bd4b11423d0", "value": "98304:X77Pmq33rE/JDLPWZADUGer7B6iY74M/SmlwXVZ:f+R/eZADUXR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629708937, "uuid": "4c2c9128-f9fd-409f-a93c-3ddc0d18f0ff", "value": 3944400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629708937, "uuid": "20edbbce-d451-4fc3-ab16-0454a53c5463", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629708937, "uuid": "fe2b7639-f6c0-43cf-8e4b-52b99e67e48f", "value": "unpacked.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f3bd72d-03b8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629685067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629685067, "uuid": "5022220b-35f6-4d4c-b0ab-6bcba571c997", "comment": "Malware payload (AgentTesla)", "value": "481c1c833e4e277d4a188562c18d6b47", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629685067, "uuid": "259aeaa9-17ab-45bf-9ba4-4198fcf0f7db", "comment": "Malware payload (AgentTesla)", "value": "655512a6e55c50671f9be59d3c3fc0c31541853467d141e50ad3726f4c7ca89d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629685067, "uuid": "a7d5c4bc-e30c-4e38-94d0-7745495110e1", "comment": "Malware payload (AgentTesla)", "value": "c7a3897d24a6646b337e595601e7e582b0ac5d48", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629685067, "uuid": "3a6f220b-8c25-4345-9f9b-74f7fb920a35", "comment": "Malware payload (AgentTesla)", "value": "c7cfbf2fc987422d636cf86de3557135a9ce92398960e5ffefc878162d8f0c3128e792338866a882c5571e279b930978", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629685067, "uuid": "e4caba00-f866-4e0a-b9c4-ee7467ea5d73", "value": "T1CEF449483790B59FD523C9338B974C30D66164ABE38BC343D013D2ADA91D2B6DF186AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629685067, "uuid": "eef6de73-86c9-4247-a2c7-18ce195b63aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629685067, "uuid": "2702bf7c-0ade-4e8b-bbef-e441fb5ed4bc", "value": "12288:j/JfSoAAGJBxrkESCvmzBQXkonblTyQX0UFyCe7OqXkVn31n/UGnXaUw0cN1n6U8:zfUkESCv6qXh3jFte7O/V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629685067, "uuid": "23a8d613-735c-4cf2-a45d-3d3f6cc4bd10", "value": 766464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629685067, "uuid": "fbae3cc6-dcc4-4fd6-a956-9ff683538c71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629685067, "uuid": "864b14de-f10c-4c66-a902-4ef7de9b3d98", "value": "purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f798c980-042f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629736460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629736460, "uuid": "2a2fdd57-ed3a-4ac2-9c6e-246e9126c3e2", "comment": "Malware payload (RedLineStealer)", "value": "e16f915796d4762014fc3864d4444ac3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629736460, "uuid": "17aba939-79ce-4d11-948b-8e378a46a93e", "comment": "Malware payload (RedLineStealer)", "value": "65dee75f5d4f0d7e0c1065a689ebe79f67c87a4d3d9654193164128e859a0ddd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629736460, "uuid": "89ce6b95-1464-487f-a130-23aad6f56451", "comment": "Malware payload (RedLineStealer)", "value": "819364784cf0d3fe440b6c9a3950de7fa093e805", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629736460, "uuid": "9d111fb3-9ab3-4216-915f-e60883b7fc3c", "comment": "Malware payload (RedLineStealer)", "value": "881ab2b483bd452337ed20675b982e36e9c63c573cc8925ee60567d2bff67409d172c24ddd39c696624efe9a54f88d3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629736460, "uuid": "b741414a-9ae2-4b6f-ad54-b8ae1d609cb9", "value": "T1A5A4E06661D020C8DAB245F6D9511B06EB7174764B21A3CF5BB853F72B1B8DA8F3C390", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629736460, "uuid": "8e94f56f-5b48-42ac-bcbc-07c23f84b870", "value": "f326f88ca83c9aacaa44acfb8884f1d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629736460, "uuid": "257d7ba5-9856-47cc-9740-5be0b54fb542", "value": "12288:K5oaqjp/9TTRxMwrxKkfk41vD1I6lgVYCAOQlgm:K5v4DTTzRtR1rOuWTQt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629736460, "uuid": "efe7b9c0-0083-4975-8680-1fa55f8cc940", "value": 459776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629736460, "uuid": "83cba1f5-df92-46fc-bc4b-b0edb0f50a96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629736460, "uuid": "c04f60f7-883a-4479-ade2-44e85b049564", "value": "e16f915796d4762014fc3864d4444ac3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5de9e7fb-043d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629742215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742215, "uuid": "9612974d-d7b4-4dea-9d0f-ed0b135b8c69", "comment": "Malware payload (Smoke Loader)", "value": "42c06d0099eb04735bf5229e526092b0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742215, "uuid": "c6b9acda-d29c-491d-ac81-aa24ee1c8b5d", "comment": "Malware payload (Smoke Loader)", "value": "6627c9361e155d9298742a38e549d7fda3a06196bdcbdcf679217b663753e9e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742215, "uuid": "f239c232-a048-43e5-a794-f4213cc9df58", "comment": "Malware payload (Smoke Loader)", "value": "8133ec5c8c7c4891b49dbd853395a67b4a625bd7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742215, "uuid": "f9e41397-65d7-470c-8e56-06bcff165eef", "comment": "Malware payload (Smoke Loader)", "value": "a9ff916f8276ec3ffe6ded50ea5754fcb86b7fffa01f7bdb5f06aea31a49274da0122a3479f1e03efb656ebe9577650e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742215, "uuid": "855f099b-37de-4154-81f4-6922b7f9cdd2", "value": "T1EA548C30AA91C034E5F612F855B683BCB83A7AB16B3450CF53E52AEE56346E5EC30747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742215, "uuid": "3c526962-15f2-40ed-8053-2f385506d079", "value": "ab6a8b01372d51e7fed6c22dcfc42852", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742215, "uuid": "1ee0aa71-15ba-401c-888c-954f2a64c865", "value": "6144:Z/+7J4IR9CDXbwJrPPTVVJ35HoWPTlFHO4SLnnDXp6GBpZv:YJp9CLwBhOcTvHO3nDXbB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629742215, "uuid": "96057182-1ab6-49dd-9e63-65397b24afd1", "value": 279040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629742215, "uuid": "b0dd43a3-039e-4671-9321-d4c49d6c3ebc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742215, "uuid": "5a63e30d-d889-4a08-9f70-e70ac5db6b09", "value": "42c06d0099eb04735bf5229e526092b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f4cb31d-043d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629742110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742110, "uuid": "142950c9-8c47-4521-a771-25e93850ddcc", "comment": "Malware payload (Dridex)", "value": "eec7956961ccf9bb2f3d2c030ab9a0a1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742110, "uuid": "70cdb663-fbeb-4f3b-882d-92e17cf6126b", "comment": "Malware payload (Dridex)", "value": "6665312832e46166fc06c88fea8db69523ceb7dd982de0346818757e2ac3ad3e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742110, "uuid": "f7a7f77d-8d63-46a1-adf5-aec77955fbb7", "comment": "Malware payload (Dridex)", "value": "3e3752cb1245f21a0f58f575dd617725e8901781", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742110, "uuid": "2c62d96f-0d99-4ccc-8a86-f1b0ea626cf4", "comment": "Malware payload (Dridex)", "value": "a4f69de0467702cfe3e2beb5ece5ac6cbc0fa5f3278e828af507b08de20aa94e705113c5cdb9c3f8d42619d61cbd3aa7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742110, "uuid": "28ae67eb-f7d7-473d-b79a-fc591b5500a5", "value": "T15004DF02AC8E81E1FC32F57520671E3F66AE71195ED8DE95C0C6C9158CBB3CA59C2B78", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742110, "uuid": "f7c841a8-b889-448c-9a57-c3749d2f1e6d", "value": "01be7d9c189bda0da49084123a5363aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742110, "uuid": "8f364c05-cc17-4563-a3bc-414d6b08cbb3", "value": "3072:Whd6lp2ffOeP3gv+i4W63iFfKfXM9mQltYwgO226+f33JxVQcY:W3fOeIv54W6SFKfc9me9v9/JxV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629742110, "uuid": "017807e9-48d2-4a5d-ac79-a1e4810bb26f", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629742110, "uuid": "5b80005b-02ce-4477-9b45-c876ccc65ec2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742110, "uuid": "b8c3217e-2d1d-4be3-8851-ac5f2755db14", "value": "eec7956961ccf9bb2f3d2c030ab9a0a1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86017d8b-03e0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629702339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702339, "uuid": "70693518-7d6b-47ca-9933-1c84b56ac2b7", "comment": "Malware payload (Loki)", "value": "162c0de193b3ba1d3f873bb06a8bdd60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702339, "uuid": "bdbf94aa-5ae9-44a7-a9f2-d805b6625cbd", "comment": "Malware payload (Loki)", "value": "672bfd2ee1ff418a1d0a969c4a8e548a359a389f31c12a720feb7b821975f8a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702339, "uuid": "c9f91d95-6d1b-4db1-a1cd-73c5088aa392", "comment": "Malware payload (Loki)", "value": "9f664512bc0cfc106c6f1252279fb62aede77261", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702339, "uuid": "4ea5aac9-d9e7-4a57-979e-028df5582e4c", "comment": "Malware payload (Loki)", "value": "af84e7ade3eb8d6c962583e4f057f26aae552ba803d13a5fce8eca1d977e2b2e05956fb7477b0d24067e887ac1f19ad0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702339, "uuid": "c42a04a3-e69e-467e-9923-d76e1d740a83", "value": "T1D3B4CF10B9C1C032C673397447B5D2B24DEDAD202D219A9F53983A396F741D1BA3AB6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702339, "uuid": "87c72dad-3213-42f5-a298-7e4cabcd7dec", "value": "bf08a978649b718b66012803a6d17e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702339, "uuid": "912464de-f2bd-473d-b476-22b556dfa7bf", "value": "12288:3g8tD+p1h79i/DdVedE5fJD7uwkWPs6BJirF2kMsBtJ:3gwVDdcE5fJ02mAsBv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629702339, "uuid": "58b58e2f-ada1-4361-9dee-e24a347ab223", "value": 528282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629702339, "uuid": "403d6390-07aa-48ad-bccb-c678dcbeb773", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702339, "uuid": "98716b9e-9853-4230-b20a-3e315d87bf0e", "value": "162c0de193b3ba1d3f873bb06a8bdd60.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "962952d8-03dc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1629700648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700648, "uuid": "3d722952-31fc-46da-be20-7576c0d46079", "comment": "Malware payload (Stop)", "value": "bf9d16519047a548c24a9718b5fd6a8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700648, "uuid": "53c8dc97-b0e6-455d-8ed8-1f508cbf2bb3", "comment": "Malware payload (Stop)", "value": "67dc67478efcc733a9821421940e171ffc4d259112eb0a8f6c7e587ef3181cba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700648, "uuid": "33f97ed9-bd0d-43e2-994b-e872845f28c9", "comment": "Malware payload (Stop)", "value": "e8e8d042d4e807cc9bbe8d861ef4ebaeaa534933", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700648, "uuid": "6e867f28-5b70-4d79-8328-b4ac19684823", "comment": "Malware payload (Stop)", "value": "c0b997093fe92b75b8d07d2dd7cec1fb07748e5472413d16b17aaede48e1c9acb88bd451021bf542ff9d12b74c47bdc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700648, "uuid": "f3fdbeec-d943-47dd-a5a6-18f25574d80a", "value": "T1C005F130BAA0C035E5B715FD6579C27869297EB1EF3091CB62D226EE6638BD49C31343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700648, "uuid": "921f6c1f-ded5-456a-b07f-0fb756647deb", "value": "d26e096e6fe908b4b897c7b821179bca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700648, "uuid": "09efe4ba-7ee6-4795-8cb4-ce508eb40cb5", "value": "24576:/V+5MMrIgTTu0RpNODvzuOZRU417gt9eH:9IjppyzuOZRV7gt9eH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629700648, "uuid": "25dc99e6-a3a9-4aa9-844e-5d5b7e8d883c", "value": 800256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629700648, "uuid": "9ac88488-4368-48b1-9e59-bc1498abba7a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700648, "uuid": "b496488f-9843-45af-8698-bf885281a5db", "value": "bf9d16519047a548c24a9718b5fd6a8e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "461b28e9-0464-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Adware.Techsnab)", "timestamp": 1629758926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629758926, "uuid": "8125a5aa-e1d6-4151-8e63-eccd362140a9", "comment": "Malware payload (Adware.Techsnab)", "value": "8bde7b905bea26c52a7576b133e11279", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629758926, "uuid": "21f0845e-fefc-4cd6-a302-1a6cc9f34082", "comment": "Malware payload (Adware.Techsnab)", "value": "68c309ec74f6dd5ec81d2fd23378a84b9d8091ccd28bc8e5f962fabd82e526f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629758926, "uuid": "119a7dbc-1457-4477-9fc8-18f2fa6aba90", "comment": "Malware payload (Adware.Techsnab)", "value": "b0f1f807d974e3db899044fa3fccf9e8fe7a8a2a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629758926, "uuid": "163f941e-8806-487a-afce-21ad46d1338f", "comment": "Malware payload (Adware.Techsnab)", "value": "710e7ed163cef77156a18455133c6d1c3431c92a3f34d1253dc564dae0bb7e291b6f67e24baa623a6c0665bd025cdd43", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629758926, "uuid": "0be469d2-0044-40f5-8347-108f44f359b9", "value": "T16674AE30ABA1C035E1F612F845B683B8B93A7AB16B3450CF53D51AED4A386E5EC30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629758926, "uuid": "1be76a99-dfb5-4bf7-a911-2a0a27984db2", "value": "9d905009ce289bf09ec9a9fc544fc23f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629758926, "uuid": "32eabcd2-ca02-452e-9857-e9fc980ced89", "value": "6144:bD0+4pw6SadU5olR+B2jrIetD6AldDrltd+gQp21bXS+ndY+HO:8+QwXaUu5jrIGD6mrPwgQp21weO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629758926, "uuid": "880fe509-b636-4c19-aa6b-1ab549bc29a3", "value": 353792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629758926, "uuid": "42210e6a-03fe-4ade-8d05-3c3254f133a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629758926, "uuid": "d2871a0c-39f2-44ee-91c4-cec93169c81e", "value": "8bde7b905bea26c52a7576b133e11279", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99405580-040d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629721699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629721699, "uuid": "2177797c-9586-4077-80cf-0e468a71a788", "comment": "Malware payload (RedLineStealer)", "value": "ca5aa2aee048f47401ecf4ad436dcb8d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629721699, "uuid": "5b0d881c-23fd-4678-afc9-8816f5cd0dee", "comment": "Malware payload (RedLineStealer)", "value": "696c4fe1eb993a58f7380b308157f8a779ec36bfce17e1488299021074a2b652", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629721699, "uuid": "4c363c3c-5253-400b-86e0-59db3d6e1408", "comment": "Malware payload (RedLineStealer)", "value": "03ed6e0e60d6b86d01a6138b1fe5a7e962746ed3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629721699, "uuid": "4d4761f8-f478-4b13-b430-6e4b2fe92b25", "comment": "Malware payload (RedLineStealer)", "value": "9cdda8000ad6f4c93b41f982d132ca1129d4f1e94a6c810ba8ae16b873af0641105932afca334fd4fc7c491cead4ca46", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629721699, "uuid": "1640f6f6-bd93-4625-b939-319122ce404d", "value": "T1FD74AE30ABA1C435E1F352F855B683B8A53A7AB16B3450CF53D52AEE0A346E5EC30747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629721699, "uuid": "def878a4-ad72-4671-902a-1c8fedf75d99", "value": "5c06a288f07d43206aca52d5d94444b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629721699, "uuid": "3713eb55-9bc4-44e9-9f0d-f579bb3eddff", "value": "6144:9Edt4t3aiafNzc1xeYtD9GUyaFuzEyJMM4CSPeaJWqoB4eeafVfJt8uBc:0t43HYxcttD9HyaOyMpCesWXB4e5VUu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629721699, "uuid": "167aca49-c35a-4041-b601-e33131ebba06", "value": 355328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629721699, "uuid": "cc189bcd-f02b-4245-bce4-f6a6945c149c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629721699, "uuid": "bc67e603-ea63-48aa-81d7-3629ade5c5d2", "value": "ca5aa2aee048f47401ecf4ad436dcb8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66d27110-043b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629741371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741371, "uuid": "1b763103-b711-4ccb-962e-d9bf88b195d3", "comment": "Malware payload (Loki)", "value": "9c819f10b05b46e5363479fd47c2ff4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741371, "uuid": "7015e30b-e3b3-4ff3-841d-603d1de5b020", "comment": "Malware payload (Loki)", "value": "6a669a5b74625b718574d4e2f917c32c5eb15f250fdf8b2e72c626f1bc2dcea2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741371, "uuid": "f2a5c142-fb1a-4e92-9b58-1b6e135bc545", "comment": "Malware payload (Loki)", "value": "badaa71b50cffcf0201c7ba6b2a123a5250dba41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741371, "uuid": "873f7c3d-9e07-49aa-b910-971eddc83ee8", "comment": "Malware payload (Loki)", "value": "1372f31b8c1021852d091efb9a754160f347bcc94b1b0016911ac071696e75364985c6f1ee8d7cb3082b1055917f50e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741371, "uuid": "78bb84cd-5c31-4618-98b0-5489205673ff", "value": "T11DF4C43D19F91637D1B5C365EBE19423F148986FB404AEA96CCE03A7034BA8735C762E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741371, "uuid": "9f82956a-b6d4-4901-b56f-62155b9cc515", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741371, "uuid": "199d45d5-b061-4818-81e3-faa769b306b2", "value": "6144:iF6PhL1qW2VE12sj6ry7aVBXbhh4aLPfsVMR49y1GwHaRL/1pq7LJFVbJxKGWCO8:ir8vj6TBX741uYBL/zqfJOG4bJAoPad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629741371, "uuid": "14440420-124e-4c00-8c2e-a190f1c87db0", "value": 754688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629741371, "uuid": "fca8f023-d285-40a9-881d-274ac0e1b5bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741371, "uuid": "8cc71228-57a0-41c7-b163-3b3d239c3430", "value": "9c819f10b05b46e5363479fd47c2ff4d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88a58cb1-03db-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629700196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700196, "uuid": "82632067-c664-4127-a86a-d5f74e8ce155", "comment": "Malware payload (RedLineStealer)", "value": "ab0f902d63fb884ba35efc7e3b6c5ae6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700196, "uuid": "77948039-e861-45e2-8151-7a7eb611196e", "comment": "Malware payload (RedLineStealer)", "value": "6add6946515bb807ad4f84713b4492c279cd502cb0b462bb1d65faf3976fd55e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700196, "uuid": "1061221c-3fd5-46c5-8539-8c209994096b", "comment": "Malware payload (RedLineStealer)", "value": "1ba1dbe5f43ae7279cc67f1e1858f6053f296411", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700196, "uuid": "2d639b21-c544-47f2-a464-0466c0646f3f", "comment": "Malware payload (RedLineStealer)", "value": "55247ab13df091ffae3e2ad59aa7fa7bc6eaf59eb00dd6d9c980ae72162c9663f6b6ae61a0e927f2694d11e681412176", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700196, "uuid": "e00c0d48-3fb7-499e-b59a-78e1d11186ad", "value": "T12F74AD30ABA1C034F5F712F895B683A8A93A7AB05B3450CF62D51AEE16347E5EC30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700196, "uuid": "4fbcd999-7e9c-428b-9874-5d6cb10c2907", "value": "4aded8f080ac4b6e892c4de31a213f2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700196, "uuid": "6e5cf219-633d-4d1f-bfd4-ed91f5b84c04", "value": "6144:54zei0Dh/GcEYm03/iR5oiNu8kh/rvD6kIyHQEs6MkdsWi8tR:D3DVfM0I5oiNrkhTL6fyxsRSs4tR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629700196, "uuid": "d2c13359-37b7-416c-b743-63fe475e3737", "value": 353280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629700196, "uuid": "e05f602e-4b9e-470f-a9a9-c2ae325d5861", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700196, "uuid": "c8cef188-84f8-437c-a6a0-cd6bf12bafcc", "value": "ab0f902d63fb884ba35efc7e3b6c5ae6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0e2166b-03da-11ec-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1629699807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629699807, "uuid": "22166cff-a8dc-46d2-b2bf-2ca3ba34d660", "comment": "Malware payload (TrickBot)", "value": "088974648273e66f3b3ee0af36f2360b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629699807, "uuid": "ba76c716-65cf-445a-a401-8f0d367278b7", "comment": "Malware payload (TrickBot)", "value": "6b62e970d1c770e694aaccad7d7b874895731ed5c7c6029be9f6badc3b533332", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629699807, "uuid": "2df288f1-24af-4adb-94fb-19bb70b8cf03", "comment": "Malware payload (TrickBot)", "value": "78ebe4f00694549994a3889b9e66688678469314", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629699807, "uuid": "2adbee2d-4fa5-4aee-a2e9-de147c7c05f8", "comment": "Malware payload (TrickBot)", "value": "de2ed8e6dceb3c4a296be94b9ff0c6aa484be0f0b9810486466750739e1aaf901b4d3688649b4705520fc3a688e5797f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629699807, "uuid": "969402c6-bea1-4ab4-94ad-230fdfdedd99", "value": "T1CA94E039B5F080B3E577023098F10B7AB6FAFC141B3197BB4B525B1D8C316B95922B5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629699807, "uuid": "9aa8f12f-7f99-45ef-b5c9-7a0d6af20f30", "value": "a72f794c30711c44b7a2c83e9a1e7673", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629699807, "uuid": "d5bf5348-d3cf-410e-bbf4-3c5b0a049d5e", "value": "6144:9afI6X0INk6tLbuuMcgUrRBIYG0CfARZgmaLb2jnI:sfXhk6lbMJMtZKTGjn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629699807, "uuid": "9fcdf0f1-bdbf-4165-9a76-82884a08c30c", "value": 425984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629699807, "uuid": "2b9cdd73-8542-4a0f-ba28-b3afcd557b46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629699807, "uuid": "691775f8-345b-4c05-a43d-f32d2aff3f54", "value": "088974648273e66f3b3ee0af36f2360b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2132a5e5-03d1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1629695728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629695728, "uuid": "e0878177-6113-4ec6-a8bf-089f92014594", "comment": "Malware payload (NanoCore)", "value": "003cfe48742926d0aab47ff027f040a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629695728, "uuid": "bb0c78b3-3527-4be5-af8d-eee47cc5775e", "comment": "Malware payload (NanoCore)", "value": "6c7b4ccc76dd75871cf303f374b8a5da1a1e12ad7d27031103d168db2ce59d52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629695728, "uuid": "ce9672a1-49c2-4253-9ab0-f891c7a1ae1c", "comment": "Malware payload (NanoCore)", "value": "2073048a3ec3b4d9055e19e0f67a0a036c1a7367", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629695728, "uuid": "9c7a4d88-c181-4b34-b847-cb11252bd501", "comment": "Malware payload (NanoCore)", "value": "0e4a09c46b2b024cd2cc9adb6610c638dc1bd99a8a22d3bd5c708f54e9206a62a214b20c9e03c20451b6a0ed3f7f9ab1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629695728, "uuid": "c2d8da2d-45d6-4fe6-9123-c0215d8f56b9", "value": "T1CF15073C19B91637D1B5D395EBE59423F148986FB404AEA96CCE03A7030BA9735C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629695728, "uuid": "d1b13a6b-3550-4b42-9782-4d8ea5f7b143", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629695728, "uuid": "3e470c33-2341-4958-81ed-06ccf898ca24", "value": "12288:xbqbDxtSj3q/J9J+YjWlgf0pCNgI1IFtfyM/4f/ItcqBdD90tNQnzI51AUHGhXQe:xebpJ9J+YK7ORytKMu/Fqd0SUm0ot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629695728, "uuid": "40339db9-cb4a-479a-ac5e-43694309c661", "value": 890880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629695728, "uuid": "540b8dff-a8c6-4a90-ab71-4c67a39ce21e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629695728, "uuid": "29e35086-d526-41b0-a044-cb75e9f2bc09", "value": "QUOTE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5bfd4ef-03e0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629702527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702527, "uuid": "d5729809-f5de-4a78-8e08-616828a2d29a", "comment": "Malware payload (Mirai)", "value": "c4eb6f1e38f8f870385bf569d6626c1a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702527, "uuid": "e1f5a9d6-66f6-4962-94aa-203f940fcf63", "comment": "Malware payload (Mirai)", "value": "6de6650151737ace84d8eacf93efc00f8b874df4f21fead8d925ca8454780d27", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702527, "uuid": "e2abb85f-b5ce-4ad2-9dd4-af982c299064", "comment": "Malware payload (Mirai)", "value": "c86cf4ed1893a90f9daaff177dbbd79781194f87", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702527, "uuid": "d273ca9a-f614-471f-b81a-c1e60c9b645a", "comment": "Malware payload (Mirai)", "value": "b725bafebe5de02a3a9601eb2fe73b140c17d35dc4e06ee0dfe2fef0bcb74fd090c055425cde43c16feabf40dfbb49b8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702527, "uuid": "e19e02bf-847d-48fb-b022-1fe0b7fabe92", "value": "T19A733938A9382A52C9D8F47F31F7C754B2F5321D3874998E7C610E5DBF24B8059962B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702527, "uuid": "851f5f2c-b20a-4aa4-ab1b-22c6ae7d5410", "value": "1536:iwgnT0oVy9A9r27p9ESDaTTK0WmgWw6v212RHpF2:DQvh27p9rDkTLgWJv22u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629702527, "uuid": "e74f996e-4c5a-4d32-a261-581b835e8440", "value": 79012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629702527, "uuid": "8f5aa0e9-5df7-41a9-bc3e-c0d0e71f7465", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702527, "uuid": "d28972e5-40ed-4bae-9a32-2ed2b837f892", "value": "c4eb6f1e38f8f870385bf569d6626c1a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56e9debf-0452-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629751223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629751223, "uuid": "ebbe1673-43a0-406b-8470-dd461f5ba1ff", "comment": "Malware payload (Smoke Loader)", "value": "bbf158c96e0fba33331ee1a827d68a4e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629751223, "uuid": "733fb4e3-cef8-419a-9764-545bfb3282ac", "comment": "Malware payload (Smoke Loader)", "value": "6e5318326145c9caf6e20fa4c1861de5e6e137caaf4d61f3f8c4cea0fedd99ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629751223, "uuid": "92795cb6-13ce-4fe3-93f7-cae301098cce", "comment": "Malware payload (Smoke Loader)", "value": "0d8d668ac0e69415ca76056d76b7a040037732f5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629751223, "uuid": "7bcb6f1f-ccaf-4c55-a008-4d4a884ca995", "comment": "Malware payload (Smoke Loader)", "value": "e85b9d16207b9a3ec7ae985990f1e4755f758c21987e0bcab4bbaac8dcc55a31c8067604fa350507432eacafcbd3c29e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629751223, "uuid": "ed708130-5b96-48d6-a23e-d97cf344a301", "value": "T1F4548C30AB91C038E5B711F855BA83BCB93A7AB16B3490CF52D12AED46346E5EC30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629751223, "uuid": "fc8f30cc-c79f-4017-9d09-c1c9b990fb61", "value": "4dcb3c3a3fe5e134dd41266130cc79d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629751223, "uuid": "5eb17d68-d204-4979-8b07-09902251ac5b", "value": "6144:anwT4fDmc3j3zM21LuxjZhY9KJKu7hRJRDNgV9AZVfU9T:RTaDmajM89cp9TRD6vN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629751223, "uuid": "f6a6ce3d-8f62-43a3-b846-5d53574ef6fe", "value": 280064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629751223, "uuid": "e3b9e711-416a-4014-8948-403b237ad3c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629751223, "uuid": "9e901ef9-0adf-4184-b69f-f42257450ac7", "value": "bbf158c96e0fba33331ee1a827d68a4e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c89fab0c-0451-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1629750984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629750984, "uuid": "37bd808d-e0d1-4d74-857d-412b09ff353d", "comment": "Malware payload (CoinMiner)", "value": "5b305c615044525988a27b61fcacc777", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629750984, "uuid": "bf8c9a16-d75c-4049-a970-e64e0ea7e172", "comment": "Malware payload (CoinMiner)", "value": "700f94a34591e321bba41a65fe6ad2d273d245381a64b8733898804c286ce4a8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629750984, "uuid": "d48440e3-baa3-499b-a9b1-8a443a8910ec", "comment": "Malware payload (CoinMiner)", "value": "1e5153d4155a50ac82bee455c5c0f9f0aa688f69", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629750984, "uuid": "3f4b9e7b-2535-4e06-a5b7-a15fe1f133ff", "comment": "Malware payload (CoinMiner)", "value": "6903e29808b5e3b5512999000963b777a4378c9cb6e908274672042ef9f4547f3bdc201028c3b387300a8e3bdebbdd2d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629750984, "uuid": "bc5c64a4-1fb9-40c2-a47e-97a221670d0d", "value": "T10B548C30AAA1C038E5B611F855B683BCB93A7AB16B3440CF53D52AED56387E5EC30747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629750984, "uuid": "dedeef49-4d0d-43e7-bc5c-ea7e07fb7593", "value": "4dcb3c3a3fe5e134dd41266130cc79d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629750984, "uuid": "ec68d70d-c5d1-4613-bb70-61d5480d9a78", "value": "6144:KHtz40ejmej3QEG1WOxCT5xYNapauRRRplDTwBcdPvJ7XII/TiO:Uzzejm6AEl8c53rlDZJcI7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629750984, "uuid": "dee3e862-703c-452b-9e4f-895aa931624e", "value": 280064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629750984, "uuid": "04df9629-2f73-436d-913c-983b434e4a6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629750984, "uuid": "5bb87aae-f4d0-48d0-ad2c-19959149dc0e", "value": "5b305c615044525988a27b61fcacc777", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a3ae801-0459-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629754262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629754262, "uuid": "8275b50e-c115-46b5-bb2b-f44b60c7d2a2", "comment": "Malware payload (RaccoonStealer)", "value": "505b07040a7c00672d73e71102906589", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629754262, "uuid": "23f5f044-6661-4eef-a8a6-ae3243c70706", "comment": "Malware payload (RaccoonStealer)", "value": "70c61a7220e7df5841fded5bafa8340c388440911f8c894b35872188f300f29d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629754262, "uuid": "9eba4666-f4d8-41dc-ab9e-ac7dbe889b23", "comment": "Malware payload (RaccoonStealer)", "value": "b88b5ea2df88e30f6dee5ce8faf3fef04992f28b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629754262, "uuid": "f2a1bca1-cc87-4240-bdac-2b2e775a6792", "comment": "Malware payload (RaccoonStealer)", "value": "c049985deecb81c70f09525b33bc8a50c831a543678826716edb59e80b68ba369a5ca176074a662f0ff60aae6d0d4b86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629754262, "uuid": "a0636b60-00ee-4588-97bb-dd305de419db", "value": "T11826343CAE041A67A2A6D129E0DA0907F5F1099F23301D4A11D76F5D7E4BD433A9B3EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629754262, "uuid": "f3710f08-2812-4bdd-be35-39210e0073f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629754262, "uuid": "753bbcf3-ad1c-4ee1-8f75-e6ff11aae15c", "value": "12288:uK5Q84ZS/7EFuMRyKaqbH7QN9m82Eeyd8LCx+ZrHfYidPg904AX0dJKwkPp0Dgxt:o8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629754262, "uuid": "c54b5cce-7a41-4399-bab6-7826177e00ed", "value": 4639232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629754262, "uuid": "f050e22f-49f4-4bd0-be2b-45c224682be6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629754262, "uuid": "d97918c4-327f-46ae-a188-9f63e3f68f76", "value": "505B07040A7C00672D73E71102906589.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "045152a3-043d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629742065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742065, "uuid": "c2a9fa59-4bf1-40f5-9fb2-1039be2c9e65", "comment": "Malware payload (Formbook)", "value": "875d520c82087afa19b50355a0df7d50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742065, "uuid": "454de8fa-8115-4727-a4dd-cda553995c21", "comment": "Malware payload (Formbook)", "value": "70d759be9f935d289ee1627038a118e9493d45ecebfcd477f0b43a8253afffb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742065, "uuid": "450e49c1-41ab-4567-8077-7ec849878362", "comment": "Malware payload (Formbook)", "value": "910a982a2ec09f51c6205f2ab585abdb73fb1cda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742065, "uuid": "cc41756d-b78c-41ff-902c-c4aaeb38e111", "comment": "Malware payload (Formbook)", "value": "044d451fffc5bfeb281a5f36378728c02db51fd42b91e4a654431658b942bc58ac3f481aacf9e35828d22c108a639a81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742065, "uuid": "d2f1d2d5-78f4-462f-8239-d1b2982263fb", "value": "T10705053D1AF91237D1B5C365EBE58423F149985FB410AE6A6CDE03A7030BA9735C722E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742065, "uuid": "af2d0feb-4c36-4456-bd48-f4ad41a30d6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742065, "uuid": "c39ed604-f152-4324-954e-8c4be772bdb2", "value": "12288:O/lUKzDFPjakDcjTnB0wZALuEqay20zWi6zE+zA9GJlCHjDqM5xwMGmc:O/WKl7OO7L7tiunCiMst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629742065, "uuid": "ff7b0400-57e4-45e2-b253-f91f572ad627", "value": 858112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629742065, "uuid": "d6b1ca24-eb89-4c21-8454-9d5201211e67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742065, "uuid": "71e108d5-b4bb-434c-b13c-e8826cd9519c", "value": "875d520c82087afa19b50355a0df7d50.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ae0661f-0464-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629758934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629758934, "uuid": "bcf5a392-9890-4bb1-bc15-67c42578b78f", "comment": "Malware payload (RaccoonStealer)", "value": "d110032f570a2c3945fb844948fc1184", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629758934, "uuid": "57f46de5-c8ef-476d-a2b2-cfc94ae37561", "comment": "Malware payload (RaccoonStealer)", "value": "71875b2f1fdbd32fcd8c8db55e437e150d7bfaba30c435d71cdcfdb31331080b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629758934, "uuid": "5ba012c4-6c06-4979-a0a8-ca32f3b743d3", "comment": "Malware payload (RaccoonStealer)", "value": "0e15ba5e6db53b261ae380dc8f5937b5ff066ebd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629758934, "uuid": "a664b63f-6001-4ad4-8aa9-82e055689f05", "comment": "Malware payload (RaccoonStealer)", "value": "0dc52c6ae5d6396fd2c4bdb6c6ab8b14b3e87c3b98b802d78539fa89f3b7b57b8f19285b704ce7cee5c81412ac1c900a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629758934, "uuid": "ebe094fe-e5f3-4884-98b8-376b220a5db4", "value": "T106B4D030BAA1C434F4B602F859BA8378A83A79B16B3454CB93D51AEE57347E4EC31747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629758934, "uuid": "fea31b8b-542e-4c27-8d11-faff56be0433", "value": "9d905009ce289bf09ec9a9fc544fc23f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629758934, "uuid": "b5813fd4-ab1d-46d1-89b7-42043915fba6", "value": "12288:oJFNLH1JZEvU8m68AT2oq7mGyxYKtNm9fCt/Y:IH1JI8I2oKyxYKft/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629758934, "uuid": "83001020-a141-4acb-aa8c-7629979f5eb8", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629758934, "uuid": "15c6cd6e-bb16-47dc-bbf8-c56affc7f317", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629758934, "uuid": "134b49d7-1edc-4cfa-8e4b-3117d604cc7a", "value": "d110032f570a2c3945fb844948fc1184", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d9c525b-03c5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629690782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629690782, "uuid": "b5d47903-ae0c-43b3-84e9-1fcd604c30ea", "comment": "Malware payload (Mirai)", "value": "4664bdc96149a0989fbc3e22f0e75ae1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629690782, "uuid": "cecd22fd-8335-49a5-af26-d8efe09d1e11", "comment": "Malware payload (Mirai)", "value": "72c068fc2645b41fa387bb3929751706fba7c0314b18b99c1655ed97b1b1bae7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629690782, "uuid": "14a872a2-c4aa-4368-8308-681da087b931", "comment": "Malware payload (Mirai)", "value": "29f2c88baf59bd93ac0d81963ea5a8719a973a41", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629690782, "uuid": "a4a350f2-a397-4764-9417-2164e2b229a3", "comment": "Malware payload (Mirai)", "value": "ab64ef244f169fd1837cb83dc29bb536133f35eb6be64c2b0d6b87f813c5af0f3d2bcd48a775c6d28b28e7f16daa8679", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629690782, "uuid": "7de8962b-9e70-4d5b-9be9-476b46f83ca1", "value": "T1F2C2D06AD11ABEB2DEAD58455BC9CBB173F43F8BB369DA5070C21751DF82A3762018C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629690782, "uuid": "ee730b4d-2f2c-48eb-94a6-85cd60def51a", "value": "768:XBy8hVALFuZZXYIInSqT5DTgWKjZkkHQQZ4uVcqgw09Kg:kR8XUnhdgWKjZJHJ4u+qgw09l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629690782, "uuid": "68aa02ab-7091-423d-a285-6c76c2f5c170", "value": 27864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629690782, "uuid": "450f9dc9-5fa7-4182-a9a0-db4a38832e0c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629690782, "uuid": "858732fd-5010-46f3-8910-e65cba693c90", "value": "4664bdc96149a0989fbc3e22f0e75ae1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49c82ceb-043c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629741752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741752, "uuid": "2bbc8f05-5a8b-45e3-b281-3c007ac00e9e", "comment": "Malware payload (RaccoonStealer)", "value": "d9b60a653f389fcc6ef9a07e403c33b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741752, "uuid": "81ebfc55-c19a-4ad3-9960-56a8240d65c8", "comment": "Malware payload (RaccoonStealer)", "value": "7357b2864800050c1ad92e4447e1399127a5716fb9d4465d798a53ece929454c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741752, "uuid": "ad7a0b0b-32fc-4b95-9b45-9ed7963fa797", "comment": "Malware payload (RaccoonStealer)", "value": "4ae0a76a374bc834672b6470fa5c72b826991fc4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741752, "uuid": "c353e0ab-b3bb-4e92-bc2f-e132cbc39e71", "comment": "Malware payload (RaccoonStealer)", "value": "69f7b15dbab2e168e6a5d7a46dc6bcf13b611a306a69ecb006926015102137d764d8378cea246131b327ce2a5e7731b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741752, "uuid": "19423ced-6f41-49c2-8157-dcc1d17028fa", "value": "T146B4E030AB91C034F0F711F856BA83A8B82ABAB05B7550CF63D52AED17346E5AC31757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741752, "uuid": "4850ecbc-d313-440a-bc91-ee8d147dd2e5", "value": "3431c4d066a67bd4eed073be41b2ef83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741752, "uuid": "ed5d10d0-cb1f-46cd-967d-a5191cba94ee", "value": "12288:Rtryy6zy2Wk7Vul/OK/7ojtsYlXoFcLcoyoNgOB:l6zy12XlXoSLcyNgu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629741752, "uuid": "b2a75315-6aa8-4451-a4d2-ef9e3969747b", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629741752, "uuid": "c979b58f-668a-4898-af87-daaea0a2d3b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741752, "uuid": "8af94c43-a6c8-4361-b7b5-2994b013524a", "value": "d9b60a653f389fcc6ef9a07e403c33b7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf753558-0406-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AZORult)", "timestamp": 1629718757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629718757, "uuid": "fe274495-2464-4937-aabe-6a593c4fc9c6", "comment": "Malware payload (AZORult)", "value": "7a6ef0f579b3c195bed6cf84b8861742", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629718757, "uuid": "907b4ff7-0368-4a94-a8d9-b3109f5e2b4d", "comment": "Malware payload (AZORult)", "value": "737ff2b259449c91d68130a8508b51544310a6e6b50891fdc5682e7d242a79b4", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629718757, "uuid": "0aca6f1b-a757-499c-a8dc-45d48d7b659a", "comment": "Malware payload (AZORult)", "value": "2498c1d5fe7c4794be18389d1cbb92f63d67c2ea", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629718757, "uuid": "e08e0441-5977-48b5-983e-daeb180dfc4f", "comment": "Malware payload (AZORult)", "value": "0f21254aaabc923787dd970b8b6712d1867a83e02a1edf32719406228242c3abe0cc2d32b2d1e0c8c1eb232ef63be41f", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629718757, "uuid": "0c18bc68-8602-43bf-8ccd-3b27964a44f2", "value": "T1D2A46B003BA86A2FF239D67B5B53C13143B355CBE5D6E784C980D2AD2D713709A0AA5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629718757, "uuid": "f84164e2-e52d-42e7-96ea-069ffe0e9edd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629718757, "uuid": "177ddbe2-7d96-4997-b40b-871684538d83", "value": "6144:Fyk9Ml2Np2SJ6qzmiU+9P7TcWlWCLhhAtzQv1JeiqhNYZiWc9zwV6h1:02jJ62minP7llWCL0uve5NsbUwEh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629718757, "uuid": "d12096fb-a698-4deb-aa79-c0606dd1657b", "value": 454656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629718757, "uuid": "43bd825c-21c8-488b-b643-f034ad114c81", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629718757, "uuid": "1ed4017f-7485-4f68-9f85-244b962bbb8c", "value": "PI Request.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9761407c-040e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Amadey)", "timestamp": 1629722125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629722125, "uuid": "adeb2a85-4d71-47ac-8349-652ceeb3eebd", "comment": "Malware payload (Amadey)", "value": "df363903dff4aadee5ac1151b1caf8fe", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629722125, "uuid": "f18c2a3d-5381-4232-bc12-af363b64d93a", "comment": "Malware payload (Amadey)", "value": "73a03dfe6ff46aa1490f72f3b0e5f4886ffc5622d42acf4cc1ba0a706f6d04bd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629722125, "uuid": "56dbcff6-e7e2-40f5-917b-d82c472e96d4", "comment": "Malware payload (Amadey)", "value": "3bbf09a55679e74a4eb12e735f068633c4a2a6d4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629722125, "uuid": "1daf863c-31fb-4c1f-8587-c5a298ef8c8c", "comment": "Malware payload (Amadey)", "value": "08089163e44ea998463bdb179c582d2106cc2f7b0ee0708552cfc703a58e2d63fc804803f352ffd14dcba242ff98740b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629722125, "uuid": "b3374614-6754-4dca-a5c1-edecc72f38ca", "value": "T1EB649D30ABA0C035F1B712F855BA83B8A93A7AB16B3440CF53D52AED16346E5EC31757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629722125, "uuid": "5c3dfec3-fae0-495b-8411-efd26190422f", "value": "5c06a288f07d43206aca52d5d94444b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629722125, "uuid": "50de47aa-5bf5-4296-ab99-5211a89493ea", "value": "6144:1jpR4StniaMAjmHxeXZKH04PaypUjuPo9kxmn7eTWzq4Jork1m:zRLti7UmwZKHpPa8UIo+xe2WzqWY/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629722125, "uuid": "2236d5cc-6411-4c7c-ab11-722499246568", "value": 329216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629722125, "uuid": "53194f13-4764-4e9d-b28b-87e4c1c49904", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629722125, "uuid": "1e942bd5-0d5e-4640-a321-ea9c76fa2631", "value": "df363903dff4aadee5ac1151b1caf8fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f88b0bd0-0429-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629733885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629733885, "uuid": "136fa821-cba1-4081-981e-22f094f031fb", "comment": "Malware payload (SnakeKeylogger)", "value": "76bb446dcf0629ec91c21cb40ca202d5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629733885, "uuid": "5184aa4d-b8c4-4814-b405-4d1b084adaf6", "comment": "Malware payload (SnakeKeylogger)", "value": "751fda7032b2089c680c912b61fe3967f5cce92568b002064cdfe8a75945f0eb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629733885, "uuid": "db155c3c-7f47-4014-ba99-aa93e9f7b333", "comment": "Malware payload (SnakeKeylogger)", "value": "f9071ca3ef1e2bffc30bd9a0829eab86accb5fc5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629733885, "uuid": "772e401a-94ca-4c3f-a21e-ae103c691821", "comment": "Malware payload (SnakeKeylogger)", "value": "905f893979f59840c718505a83635cb78227899d2bbf053118eb32f44e031712ebcf9d01aedfff58c7010275b60c0b88", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629733885, "uuid": "568346bb-12ce-41be-9bfb-04468d03a609", "value": "T153E402047384EE8FD1BF8F3B9D29142097F1E9A21723E36A6DC522F9094DBC6565029F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629733885, "uuid": "5421ac54-566f-41e4-b8d9-acce47d3929e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629733885, "uuid": "b23052c6-91c4-41c9-ad7c-76c2bb4dcce8", "value": "12288:QoCABdPV3arJmJQRSfc+g1kFrXsSYX8iR1HQMTw+cQtYP0T/:kwP6m+Rgw6Xu8GdFU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629733885, "uuid": "04ae9570-274e-4622-b90c-c2f15037ae03", "value": 664576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629733885, "uuid": "0cf18b04-1179-4e08-9219-37d69f3c0c4d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629733885, "uuid": "99ac91f4-2bf3-4edc-918a-3af780181706", "value": "76bb446dcf0629ec91c21cb40ca202d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb8c0132-03e5-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629704577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629704577, "uuid": "87cbcefc-ddd9-4718-91de-a629eef7975a", "comment": "Malware payload", "value": "462be74da73529d4a57dd33ebb013355", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629704577, "uuid": "66774afa-9fe3-4e71-b2b3-84d79674aba4", "comment": "Malware payload", "value": "7520f0fed54a71886061557c4257452d83878b878ea0a2fd1a773cee36870455", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629704577, "uuid": "2a567da6-9c27-40b0-829f-32e1aae152dd", "comment": "Malware payload", "value": "d7e86463a55440794ca0487a82fb8187d67b4bae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629704577, "uuid": "6651008f-d1e3-4d47-8e82-f50b57528586", "comment": "Malware payload", "value": "24f740bd25bf6bf5257a4e6440a6d619bf93595d2e3b84907b9aeaa185765186488a0bb47021249e2e57e8593db27b40", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629704577, "uuid": "0dabe259-0fbe-4e69-a34a-2d906b8edf4b", "value": "T15BA4CF30AB91C435E5B312F855BA82BCB43A7AB16B3850CF53D516EE1A386E4EC30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629704577, "uuid": "e6ccf8e1-4a4c-4795-b5ca-abac917def2b", "value": "47838eb3376cd956f1ad4ca3d2e871c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629704577, "uuid": "e792578a-0670-495e-886e-9cc53353a4c6", "value": "6144:xO+ipfCejLZTXWODQ4bFrIi8kxBG3FXehjXYQz1tKsvCMiuyy92zeAl/T9WPcMgh:52f3/NX5FrIPkxr1YQzjmteAl/Zcmfp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629704577, "uuid": "30c603bc-53cf-4851-9fd8-fee776fe88da", "value": 454144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629704577, "uuid": "9dfc3eb0-1386-44b6-a9b5-46c3e5e3b9ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629704577, "uuid": "6bde8cc4-ba2c-4942-abf6-9d0235f7a511", "value": "462be74da73529d4a57dd33ebb013355", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddabb9c9-03dc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1629700768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700768, "uuid": "185cd299-9945-48f8-aa87-8acf6fb03609", "comment": "Malware payload (ArkeiStealer)", "value": "4c4a8f03b60bd055419a904e537c1443", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700768, "uuid": "a74d2151-6808-4212-9e01-aaa872f9e021", "comment": "Malware payload (ArkeiStealer)", "value": "752a86b7482efbe65389b57dcec9dda41493b992e30b5faf7067d38707d0d6fe", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700768, "uuid": "051b89d4-48db-43b0-9de1-0f2fc4fb586f", "comment": "Malware payload (ArkeiStealer)", "value": "1e161e080b49bb57ba3df4926ea1c3afaec8d829", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700768, "uuid": "5b1f2849-62e8-4497-8b55-56cdbb9922cb", "comment": "Malware payload (ArkeiStealer)", "value": "04eb7c8c72a3a6cd05c1a6c38cc5d3a397a3bcf1b5f7539c2e30372b2209c797c22ec32f3df66a1cfa7f0e1f98915113", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700768, "uuid": "e771d44c-5918-4dd9-afa1-4fa5c86921e2", "value": "T18EE2AE1167E6AF23D9714B761533CA920778B166AC33CAAF4E8A40CA5F6174907C2F73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700768, "uuid": "274a72f8-b0e6-46b2-b8a7-1d73da80e7a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700768, "uuid": "64462664-0dd1-4dc1-a132-2ed6c5f5c892", "value": "768:v27KDYqZauo3SO/JtmZ6tbGkRsZlrHEzOKXI9PIBCmB:v27KPaT3ltkkRukz22BD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629700768, "uuid": "17708506-6f42-4cd3-8074-ce246c37979d", "value": 31744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629700768, "uuid": "4874a058-f4b6-4f43-80eb-3a6ed2fbab86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700768, "uuid": "93693c18-4ef0-410f-81ac-324bf819eb84", "value": "4c4a8f03b60bd055419a904e537c1443.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66173f2c-0403-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629717318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717318, "uuid": "4e7bf993-c2ff-4110-8b1c-918f99ebaac2", "comment": "Malware payload (RemcosRAT)", "value": "6143a40ac4aa8a46ff2e2a3d134afcc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717318, "uuid": "3e61b0ee-3c71-42a9-bb9f-b874844eba1b", "comment": "Malware payload (RemcosRAT)", "value": "7597203abe144f08a18d0a3cb3f0ca1d1827d2e0322ce05cb87e541f59f9f72e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717318, "uuid": "526431d9-bc01-4f41-bd4c-75d5aa6827b4", "comment": "Malware payload (RemcosRAT)", "value": "7288cb24458b8aaa59003e1570b2e0ba2346e4b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717318, "uuid": "eccb8207-f66c-4ea9-a2f7-c05dc8c9235a", "comment": "Malware payload (RemcosRAT)", "value": "9754831f8d93e1bf800c2401cf95970220039515189782f9d4dad0a0eee3a39e68601944fb238bcc4f236af4220ce7d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717318, "uuid": "68602d1d-8d20-4aa1-8351-bf3c8c9d4bd6", "value": "T177058E32D692C937C0131FB86E076BD9E82D7D09293C54936BF178494F7A7A7393A086", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717318, "uuid": "ef0728f1-0588-418c-9ef7-b8d6f41cee0c", "value": "1abe4551dd4f8ef04deab38d0027e326", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717318, "uuid": "f6e6134e-2c9a-4ffc-827b-aec096b6b5e4", "value": "12288:WhxUck0fyI/Xv94r0umLKC+pvbIAsrxPz+o8wcZ:WhGdkF4r0uvnDIFpP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629717318, "uuid": "8e7f4983-5c08-49a4-b721-428d9b8c335f", "value": 846848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629717318, "uuid": "c09ae833-be07-425f-bdd8-1c839878b99a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717318, "uuid": "d7e3bf4b-2290-44a7-82df-d7cb14011d99", "value": "Zahlung von EUR 11.631,35,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1ff8c33-043a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629741148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741148, "uuid": "9d2bb611-e88a-4da2-99e7-c46bf5d1bea2", "comment": "Malware payload (RaccoonStealer)", "value": "3a8b95e40e1ffb50518b75ff30c5a06d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741148, "uuid": "3e2d8de2-d3c9-4ef3-9ecb-eff0899a0fff", "comment": "Malware payload (RaccoonStealer)", "value": "75b4dca03aac6933e4f2f22df735da98c918435c2d09677b183db5416744ecd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741148, "uuid": "2034d3c1-87aa-4674-b47e-58ea77b5935a", "comment": "Malware payload (RaccoonStealer)", "value": "be18d6e3b3452ed9c6547fa55868af3b10cf6210", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741148, "uuid": "d4e36e76-0e7d-4861-a977-029743b5584b", "comment": "Malware payload (RaccoonStealer)", "value": "4e40ebd6697654bcd2188f3f9c8b31fa3649bb765010340b0da625643b9263421c70954b28a201856545ab061fad6bf5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741148, "uuid": "f6957ed3-559f-4e3e-a62d-2027dff56361", "value": "T1BFB4D030AB91C035E1F712F895BA82B8B53A7AB15B3440CF63D166ED16387E5AC31787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741148, "uuid": "f4b9b5ed-249a-4c4d-8217-0a8bef92156c", "value": "fc0498b1146c20d46fc85d16ea8a2b68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741148, "uuid": "5b63f20c-00c7-4494-9626-c0c6941caf71", "value": "12288:K1MirRpP6T/2SneGkUc6A2ufiG9/L3ahx:8RpP1GkU3ANDa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629741148, "uuid": "f108e4d9-9062-45de-a338-8f6a2a83f652", "value": 539136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629741148, "uuid": "a832be7c-ccd8-464b-b55a-f3fd3d603828", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741148, "uuid": "7a719fe0-bbc6-4076-bdfc-76cd65767dac", "value": "3a8b95e40e1ffb50518b75ff30c5a06d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c41beff4-0454-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629752265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629752265, "uuid": "52bc11b8-496d-418b-90ca-959dee4aa064", "comment": "Malware payload", "value": "36a443909fb713e12bfd996dde324f0b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629752265, "uuid": "3502978b-8424-4227-8b1f-6a115cd61ae9", "comment": "Malware payload", "value": "765ddf2da4feba42379d78e79fea5ad23a28a5de5d8359f18c9be28031a9ef5b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629752265, "uuid": "de2f1153-f635-4726-ba52-22666d5709f6", "comment": "Malware payload", "value": "16f6f9cd325650f42ae2fda3f0e05f1734e0f9bc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629752265, "uuid": "dca58b06-9dd6-47c0-a4c1-827284bbffb5", "comment": "Malware payload", "value": "d2ec7de1d0760f9929fa9761440d0500f071da46df65c33042b54031adce4a5f7050ebdb1fc7f61e32b54878075c96cb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629752265, "uuid": "921b41b8-89e3-4883-ae8d-786210295a12", "value": "T1FD55EA3819B43A37E179C33DDEE5481BE6D4B45BB211AA1A70DE17671343A02BC9327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629752265, "uuid": "ad71db45-960d-439c-8b2e-452b690580ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629752265, "uuid": "5acdd68e-df45-483f-8a2d-c5193e812d27", "value": "24576:+x01ScQc+zleSgMjr6K6FnR+Xq+SKsDElIk47l9UGbm:hBBP+Slwa7/di", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629752265, "uuid": "8a56b070-b6da-4dfc-8d98-1ff52c53eca5", "value": 1354752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629752265, "uuid": "de83d9a6-fd6a-4b03-b155-3549bac0d88b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629752265, "uuid": "43fa1341-d3b4-4a5f-a190-88f3610c4f5b", "value": "36a443909fb713e12bfd996dde324f0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfe47f9f-046a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1629761761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629761761, "uuid": "2c076a61-2e34-4817-981f-a7bfb4ad79db", "comment": "Malware payload (njrat)", "value": "3d824c8c17957d261aaece5ee53047f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629761761, "uuid": "24664a60-bca1-4d97-b82e-27477e39c8d2", "comment": "Malware payload (njrat)", "value": "769fe46d5321bd9661cdcf55fd63bb859a04435d4e110eb27d20682a6a2c39b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629761761, "uuid": "2a78df56-9d66-413e-afa6-db16b1a1bd01", "comment": "Malware payload (njrat)", "value": "22be79dd301c9e317d30f9bbbe2d52deb607a934", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629761761, "uuid": "fafaad3c-1fcb-4688-b726-49720c112adc", "comment": "Malware payload (njrat)", "value": "f4b5bf530fbd2c27503f097dd8ac596f328dfe9b5fccee9ab25e77611c91c47007d18b594e8c33ede3203173f0cfa775", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629761761, "uuid": "770ed5ac-a8d8-4d12-bb90-706b709258a1", "value": "T1E755236248C21C56FEE574705732BC2AB5FF5D549002672BC7FB3925B232A503AA63B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629761761, "uuid": "0a462656-fde7-4ad4-b662-8c1c9881540b", "value": "29b61e5a552b3a9bc00953de1c93be41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629761761, "uuid": "ab88e3f3-cacf-41b3-a85f-dc7dd98680c6", "value": "24576:93HfXpfFqJwzAjU9ZAzJYc/EMcAklWJx9jR7lLljVObetnnuKA8:d/vzAjUEzJYZAkgxfpZjVoetnjA8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629761761, "uuid": "545039e7-12db-4694-ae8e-e06fc4f027b0", "value": 1402735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629761761, "uuid": "55c1e4de-21e8-4acb-abe6-75e2846f0407", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629761761, "uuid": "ec74f9af-233a-410b-94ae-12c7b2bbeae8", "value": "769FE46D5321BD9661CDCF55FD63BB859A04435D4E110.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e043fc8-03df-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629701708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701708, "uuid": "e416f5eb-3133-4c80-b6b2-00b9cbeab08f", "comment": "Malware payload (Mirai)", "value": "2cf2080593530e001ec828636e6e0a0a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701708, "uuid": "49e6b91b-abb1-429f-8575-07fc6b6c5914", "comment": "Malware payload (Mirai)", "value": "76f2082a2771c86314cae7c2a3a6905fd08101637541747bcc14b3a803528b3f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701708, "uuid": "325ca860-5600-42a1-b36a-65fff26460aa", "comment": "Malware payload (Mirai)", "value": "c5fab3f250d07ca641421adce1bacabadb09627f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701708, "uuid": "fd5586ae-0e13-4780-bbf8-43d51423e5b9", "comment": "Malware payload (Mirai)", "value": "fbe8ce9b7793da3027a2ff6b4ddb1ef2f25e6b56d40daf88e90480dba7c39a1fb5ad4554a5504cabfbac139f8d328816", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701708, "uuid": "85601575-e292-4ff7-a523-b1618dc16529", "value": "T1BC13E128A72CA813C97023B9E94586863FB7867CB1DE317F1A4E43E91D9B1D520E43D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701708, "uuid": "7c358c45-b499-4a1e-8d79-f85583689a2b", "value": "768:ibiIyIOiWbO0iPYD/GJVfjufVXu0L8s+0EtHknS8hFdFLPoyFcQTGOBZyCRCWyW4:iLyIOJEQaD8Ae8j0/S0/NPPNy8CW/yzJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629701708, "uuid": "967d3bf1-b3c7-4dfb-9a04-ac57d8cb1d77", "value": 45316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629701708, "uuid": "7bdd982c-58b3-4aaf-9d5d-c34b152b3e0a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701708, "uuid": "fe9c9486-a4bb-40d8-bf8e-4291214e75d1", "value": "2cf2080593530e001ec828636e6e0a0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45728349-03d6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1629697936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629697936, "uuid": "0435e142-7e42-49c2-901f-6b808e7fe143", "comment": "Malware payload (CobaltStrike)", "value": "a424b97fcaaa00c6e4c5a6cddaa3c461", "object_relation": "md5", "Tag": [ { "name": "39.104.77.83", "colour": "#928B7E", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629697936, "uuid": "298a7c4f-4773-4ef9-87ce-4ee6605d8d6a", "comment": "Malware payload (CobaltStrike)", "value": "77258e937b54e80e783dce89106b44264a78e0a6afe12ace639c7ae98dfa3e26", "object_relation": "sha256", "Tag": [ { "name": "39.104.77.83", "colour": "#928B7E", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629697936, "uuid": "8fa0bff7-1a6e-4030-9ff4-eff8204314a2", "comment": "Malware payload (CobaltStrike)", "value": "db29a33900abd3aff7000143d69c9b0c50dbcbe0", "object_relation": "sha1", "Tag": [ { "name": "39.104.77.83", "colour": "#928B7E", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629697936, "uuid": "ea832e24-b875-48df-8174-3c71429ea2e8", "comment": "Malware payload (CobaltStrike)", "value": "a0a7829e17dbb512403dc9a2e14e17fee8fc0ad068ce20aef2ebca254d98a749930f9c3df6543ecfa59d2ebb291c3686", "object_relation": "sha3-384", "Tag": [ { "name": "39.104.77.83", "colour": "#928B7E", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629697936, "uuid": "348b71fe-a3ef-4453-90c9-aca7bf4ad859", "value": "T18B71D7141ACB794AE8972603BD7A98842D3C1FA796D63C40B9F49320A497D34E1B7B84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629697936, "uuid": "e2656070-8165-46cb-89b8-4878e6734e82", "value": "96:9gOOMM3vvOmIecH1Yn64YkzkmUa0lgYR50ls:DS/vOkcH1YnzkmWPROe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629697936, "uuid": "46cd9d9c-7aa0-48b5-8670-95abc23270e4", "value": 3585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629697936, "uuid": "6c462816-8f31-4b33-8f15-bebd30973704", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629697936, "uuid": "0041543d-c5a4-42c0-a78c-bd22fbae08aa", "value": "ps1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "245d1910-043d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629742119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742119, "uuid": "4d57bdbb-3110-422e-a61f-b52c1f416db1", "comment": "Malware payload (RemcosRAT)", "value": "8d9caf8ff3d1d8fdba895c0d91013eed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742119, "uuid": "aa756032-7243-476a-b1f7-83a005751286", "comment": "Malware payload (RemcosRAT)", "value": "77ce24c903d75a340e3d5664091c7b72a2529640931e662b80b8dc3fb9226929", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742119, "uuid": "ff465f8f-8f36-43b9-9bfe-a1de63f0a3ae", "comment": "Malware payload (RemcosRAT)", "value": "72a438a84143951a533b2b67650f8e718d381e49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742119, "uuid": "ad9f9e83-e4c2-4c45-adcb-a2ba6393895f", "comment": "Malware payload (RemcosRAT)", "value": "9b9c7aaf09e16412b861ae675cba51b914f05f9815d2659967cd4c271d286f912d2c713ad20e4d96a215c98378d03ab7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742119, "uuid": "8b2665ab-5518-4503-a4a8-b50afe84706e", "value": "T1C115125A3348F78FC51FDD7E98659C20A3E1A2311307E7867CC305EE698D79A8B112A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742119, "uuid": "b48d4b4c-6eb7-4804-b849-1230e4aca2db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742119, "uuid": "9595fead-2935-4ef6-a0f0-995a8094f742", "value": "12288:zKRHSy4fm0PBSmFfwMgP+yNPT6IfnZBN9SAqpD2gLHMwv6zcKdkni9YhAs0kevY:ByiPo4YFP+01fP7S9ggLsw2fqqY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629742119, "uuid": "9bdb0300-e40f-4de4-80dd-23c085aae109", "value": 934912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629742119, "uuid": "4c303156-b804-4fad-a9aa-da4b3566cd58", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742119, "uuid": "014d950c-c1cf-4305-893f-422b17419a67", "value": "8d9caf8ff3d1d8fdba895c0d91013eed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed8390be-0429-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629733866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629733866, "uuid": "c6846392-9765-431c-9576-e1ceb9a75ecc", "comment": "Malware payload (Formbook)", "value": "fdbfac3db38e579f28f6a51e55e7b01b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629733866, "uuid": "4b71bf6d-ccaf-4150-b793-917b592f1853", "comment": "Malware payload (Formbook)", "value": "7854503f3fc57a985d64d1b24fe2517497f6ec23338156a25a77dc5c0e7c6e17", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629733866, "uuid": "25fccdd5-6c9c-4266-8a51-1e9c5bab950b", "comment": "Malware payload (Formbook)", "value": "88e11b109d1f9e6e4be019561ab6429e4ad838ad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629733866, "uuid": "ce5168a1-8c11-4118-992c-cad3937385ce", "comment": "Malware payload (Formbook)", "value": "3ef40aafe89bc461233460c21de3b2a648f1904c0d46e7b0a811dc663855d1d0d2e1785550a627cb132c85292eda2add", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629733866, "uuid": "21b582d6-6ec4-46b5-bc62-8d2e2d31d342", "value": "T15105063C19B91637D1B5C355EBE58423F148986FB404AEAA6CDE03A7034BA9735C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629733866, "uuid": "203eb7ff-0dc3-4ab3-9185-5c32d983c777", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629733866, "uuid": "178dd0fd-18b8-4d7e-96d0-93aae8aecdfc", "value": "12288:Hbi3JClVEQxWpU/01Y2mVVZRDvlC2kZlxin119bua3lz:HbiiERpUM1Y2mhV3gAndbuK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629733866, "uuid": "ec15d3f4-276b-461d-a34b-19479315e63f", "value": 851456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629733866, "uuid": "51769d90-f804-41ad-8c32-414edc3d113d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629733866, "uuid": "c9f29675-38c9-468a-ba49-86c346585c61", "value": "fdbfac3db38e579f28f6a51e55e7b01b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f976016-03e6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629704771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629704771, "uuid": "0b608758-4997-4fb9-a313-ef3615962045", "comment": "Malware payload (Formbook)", "value": "273401fff3380e8d51c17474b073460a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "NALA LIMITED", "colour": "#14E3BC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629704771, "uuid": "c6579ffd-0fcf-4d28-a141-587275e19a2a", "comment": "Malware payload (Formbook)", "value": "78c6567201eeeaa1a359ab8929325de30abf18c22993de371a08b7c9bc0af04c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "NALA LIMITED", "colour": "#14E3BC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629704771, "uuid": "ae1bbef8-bc10-4618-aab1-42b6a137d627", "comment": "Malware payload (Formbook)", "value": "7ad45180f20469040a3dabf8473d6f03e8c55383", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "NALA LIMITED", "colour": "#14E3BC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629704771, "uuid": "0c21de5c-f0db-425f-82a8-67f8938b4b21", "comment": "Malware payload (Formbook)", "value": "ba531e69155cf148d6fd30920632b6faa63ebcf5987414c63045a2fc4e2717266f9d7eb0e4c4c4568bab7743f7fa147a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "NALA LIMITED", "colour": "#14E3BC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629704771, "uuid": "979767f2-1ad9-4a4f-b004-8d82b23066f8", "value": "T171B4BF64EFC5E5F5E0ABD076ACDEA7FA401C2D0385D281979699BDEBFC30AD52023118", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629704771, "uuid": "ed8adbd1-4d0b-4bfb-b13c-e9c30eb6bdc1", "value": "558cb664e1465dbe9fdeebc9723ca307", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629704771, "uuid": "7cd96e2f-e691-47e7-b197-17f22ae12fb0", "value": "12288:VYPVoOow9L1t1wcPObu9+bVwMvz+gI85rL2zYSBs8:CNofw9L1Hw6iu9+bVwMvzNI85rLuYSL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629704771, "uuid": "ffd3b2d1-ff42-4b00-a492-aeb534d2d345", "value": 499736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629704771, "uuid": "45ada5d6-5880-4006-a833-268d108dd07a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629704771, "uuid": "1800462f-f9e3-4d8e-a423-835c88cc3b70", "value": "78c6567201eeeaa1a359ab8929325de30abf18c22993de371a08b7c9bc0af04c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54b88647-043b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629741341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741341, "uuid": "12f8e336-5e5a-4859-bd37-7c0776571ba8", "comment": "Malware payload (RaccoonStealer)", "value": "a8715281fecbe9e648f93a60294013c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741341, "uuid": "6228c264-a8ef-4798-8790-b30529013206", "comment": "Malware payload (RaccoonStealer)", "value": "794d14e6a88c2c5df38c27c71edbe0d2f0462fc63c67e39144339dc87c20eb1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741341, "uuid": "cd7b54e4-fddb-44c5-8e3c-a940b13cd245", "comment": "Malware payload (RaccoonStealer)", "value": "873bb6bd2c9af7b7c7286b1e991509be8f5022fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741341, "uuid": "d5ed8840-ee4a-44c7-b729-105b3af00f13", "comment": "Malware payload (RaccoonStealer)", "value": "97a82e1051dbd34623f0a2211684c474fed1bf6980d73a5f60f7a44d51da760bcda1b7cf0d60af4c82a2265145b4cc99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741341, "uuid": "6e3a243d-dcc0-41e4-98f3-d137e2dc1f83", "value": "T1F3B4D030AB92C435F4F712F885B683B8A53A7AB15B3410CB62E51AED06347E5EC31797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741341, "uuid": "58135692-84df-4185-97df-5e4be7f60516", "value": "47838eb3376cd956f1ad4ca3d2e871c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741341, "uuid": "514d9225-b658-497b-a038-0db8fab9d1c2", "value": "12288:wQ/lVZjglPH+2xXNbUwEkkKISO1qAeVO0/YlORL1fLu7pI:RVZjKlbEzBXeucF1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629741341, "uuid": "f3e36436-a09c-472b-9358-0a9882d38230", "value": 540160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629741341, "uuid": "2c759cb9-4f44-4674-afb7-ebfccb42f15c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741341, "uuid": "6f1d412e-abfd-4f15-bb7c-36e75ee3ffde", "value": "a8715281fecbe9e648f93a60294013c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be67bbb3-03f4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Amadey)", "timestamp": 1629711024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629711024, "uuid": "35d4ebd9-1ef6-4b09-9639-7e35a2f2712f", "comment": "Malware payload (Amadey)", "value": "f403b3a7bba12aa247e7195e8bb9afe5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629711024, "uuid": "fbb3468a-f059-4a62-aae8-0c5800394ddf", "comment": "Malware payload (Amadey)", "value": "796d5fe3cd876abd58768649087f6d13060f19b2d05db4bf384d81af41317af2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629711024, "uuid": "39aef3b1-34d4-4f02-a55b-93ef61468e4c", "comment": "Malware payload (Amadey)", "value": "70d695bd8b0e8a5071985eab423b014206d28098", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629711024, "uuid": "c02cd17f-3fd2-44cc-aee5-764bb688181b", "comment": "Malware payload (Amadey)", "value": "330c9ce0936551cd44f16689f6e1ff37cca4123d6d07780aab0e64773af2962f1581d9aa034818399bc69a2d5d76d905", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629711024, "uuid": "c9ec5d1c-1c13-4d77-bd19-82ea6d7029ac", "value": "T19E64AE30ABA0C035F1F711F855B682B8A53A7AB06B3454CF93D52AEE1A346E5EC30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629711024, "uuid": "acfc4293-ede6-4cb2-9ee6-e328d6637875", "value": "5c06a288f07d43206aca52d5d94444b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629711024, "uuid": "fad1d82b-52a0-4e75-9c19-41761fad04bb", "value": "6144:sjpR4StniaMAjmHxeXZKH04ZaW+9lq9IzxYHEEU0U:qRLti7UmwZKHpZaO4xow", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629711024, "uuid": "f1471941-90e1-4669-a9be-05fc525b19c4", "value": 329216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629711024, "uuid": "cb65e83d-d8de-47b5-8041-a23958b45c25", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629711024, "uuid": "f2400238-2543-4d49-8557-ba3ffcfa8c67", "value": "f403b3a7bba12aa247e7195e8bb9afe5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aac11a1-045f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (KPOTStealer)", "timestamp": 1629756732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629756732, "uuid": "e318bfa9-02f5-4dd8-91ce-abbadfb00f34", "comment": "Malware payload (KPOTStealer)", "value": "24fbf2c94a2d4e2d4849f224a99d73cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629756732, "uuid": "675b2e0c-024c-45c4-b64b-57699cd3e253", "comment": "Malware payload (KPOTStealer)", "value": "7b2e4ee7ff0bd5a37d0da1ff5f824ba8d44f264f884dea50a0990f22d2488be9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629756732, "uuid": "739aa223-671d-4fcf-859f-9d7cd8d8b8b7", "comment": "Malware payload (KPOTStealer)", "value": "8c369cc973d7e25dc01791cae7c4d95a824114f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629756732, "uuid": "71e128e2-8784-4737-88e3-72a9800ba5ba", "comment": "Malware payload (KPOTStealer)", "value": "7f242c9c3cf2b90c12bd03e982c7633eeada68a09ce7de9f631463bb3902f436ba57e815ab6a4ddfb94ff326eb792121", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629756732, "uuid": "a6022f06-e92d-4322-876f-fee370044c4b", "value": "T106A4CF30AAA1C034E0F612F895BA87B8B43A7AB15B7450CF53D516EE5B387E4AC30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629756732, "uuid": "1d1be58e-20e7-40c8-9669-3aadfcbe4b3b", "value": "4dcb3c3a3fe5e134dd41266130cc79d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629756732, "uuid": "760f6f85-1530-432d-b334-049d475b10b6", "value": "12288:g7G8m+ge1EQLI9iDeJPuN1Qcia6R2MYoEx4pSvK:Yge1xePuFiLhYo1S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629756732, "uuid": "f0eb6d54-0869-45c0-925c-f04b7f1986d1", "value": 451584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629756732, "uuid": "a5a4d7c3-9399-45f5-a071-a8369dd06eb7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629756732, "uuid": "7969562b-6927-4018-9b8c-722e60fe137e", "value": "SecuriteInfo.com.Variant.Fragtor.10550.1872.9084", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93302192-03e0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1629702361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702361, "uuid": "7bfefe09-5e37-4d2c-923f-9f0372b69fbe", "comment": "Malware payload (GuLoader)", "value": "9170f26f689ad9b18ca8363031a490cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702361, "uuid": "49895797-9e38-409a-bb22-989d78c4637c", "comment": "Malware payload (GuLoader)", "value": "7c0a44319ba7a567058b139432f5a549f937d2c9e499006744beffc927c8ce6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702361, "uuid": "494ea93b-71f8-4bb5-97ad-cc1101b9c7d8", "comment": "Malware payload (GuLoader)", "value": "671b67c0b1b9ecd770297f872aafd76dec5df5a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702361, "uuid": "99029b2e-9b8f-4ff4-939b-f6598f03f156", "comment": "Malware payload (GuLoader)", "value": "9e0a667b749aca63301b840b4d8c1a925d123321076e70f3cd3c0c6424b0f686592b5c298c6d74dda481125c83697f88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702361, "uuid": "854be60a-d8ce-4fd6-831c-22a05df76487", "value": "T1E2D38EF265D3CD42E711C472433247941EFEE8601833CA6B92CDDE4D4A77A81986FEA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702361, "uuid": "dcc14c8b-49a3-4a96-91da-ed35c8f41c34", "value": "dd3a3334209d6b1494aa752cb5ad8a77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702361, "uuid": "714f25d0-546b-438f-bc2f-8e12ea209358", "value": "1536:h3DyjIOeetL7EhTkPjGHn62TTcUS0ulEoB/f3T9lx/6r43jmxTgWUXdLdN:12aoL7mQjGHn6QYVRB/hv/ukmuWedLdN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629702361, "uuid": "c4fd3c63-e14a-41db-825a-544bc7946b10", "value": 140312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629702361, "uuid": "6cfedf45-aa58-4d7e-b01f-81f7a8de15c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702361, "uuid": "736c5363-19a3-4f70-badb-37456c2b9e3c", "value": "CERERE URGENTA DE COTARE PENTRU PRODUSELE DVS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d1e03e3-044b-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629748227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629748227, "uuid": "11e3f23c-44c3-4be2-8016-1c53e5d81a03", "comment": "Malware payload", "value": "a6b0c68d5870d0962b905eb433ab1cb7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629748227, "uuid": "e3154e34-c895-4962-a88b-e2407d0be0e5", "comment": "Malware payload", "value": "7ce7eb7e7253f514a68eb5e5c6e8690722bea15384f5f58202394b6a74f785dd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629748227, "uuid": "4b6f5b3f-514d-47a4-941b-9e01dd8e1d3f", "comment": "Malware payload", "value": "f75fe3866d9b77cc79dfddbb9bf72e70bfa09778", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629748227, "uuid": "f93c73a4-5eef-4ab0-a1db-17b5ef9564ea", "comment": "Malware payload", "value": "db337c5dca4353f6fc6735fb2dc80ad808e35c0fab38fe6bb6c7a1cef3912969bdecf695d42fda6ce7550d1107cd3567", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629748227, "uuid": "8405c154-7da8-46a9-a8b8-c80f657c840b", "value": "T105250105F726CE92C6BC0676E4D2592043F3D91392A3DB172BD432E10D633F6899FA96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629748227, "uuid": "7de2998a-8661-4a6e-8f6e-dbc687f2e506", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629748227, "uuid": "45b3d21d-4317-4844-a78e-d63f2641b487", "value": "12288:UX571OW+7KPACgYKoBaVIpLnwV/6BJHaTkWPe8UVU/sVj4grJS5fcbQsN+m5Y86Z:SnPVgVkaVIOFNZPeqdmnN76t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629748227, "uuid": "49ff8e1d-4fb6-4608-900a-3617c9121d15", "value": 1052672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629748227, "uuid": "951e6fa2-5628-4d24-832b-f8f751faf7e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629748227, "uuid": "5e114084-8f0a-4efd-ab03-72a4b5bbf481", "value": "a6b0c68d5870d0962b905eb433ab1cb7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea444648-03e3-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629703796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629703796, "uuid": "a5bb89aa-9f02-4b61-b7c5-02ba4d19aad1", "comment": "Malware payload", "value": "a1a454066b561968825cf19ca262b2fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629703796, "uuid": "9b5eed5b-cb0e-47c0-b9ad-e56b7e87db64", "comment": "Malware payload", "value": "7e97e7bcc1a5808c054f14db6e909bc6dd5a0ff9a7b911b948409f68485681a1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629703796, "uuid": "4825341f-df55-40c0-84d4-4165418ed726", "comment": "Malware payload", "value": "39b63173533a600b46a81c0f94ddd62488906948", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629703796, "uuid": "5acd7f75-5c7a-4e85-994f-ce5bd4e2abef", "comment": "Malware payload", "value": "035bedb0f9e8ca1f0cfe5a63511337617c7cee144c3c7c4b1feda5a7bfffe0cfd14a0b71a37fd8d9b54e5e00ba071450", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629703796, "uuid": "24b29fac-1d5d-4d46-bc38-4d8c8d20ec59", "value": "T1BA642955B6574E51D2C82B3AD09F200097A397856327F70BB9C813EA5F437EEEC4B286", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629703796, "uuid": "8808210f-b17f-431c-bbd8-176fe124153b", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629703796, "uuid": "c20619a5-67c8-41ac-8b55-d1817cb0877c", "value": "6144:m2enCgwRoFKRDBSCgYfM6Niz6DRBhBr3XAFZMJYA4gozN:ECUCg+M6TDJi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629703796, "uuid": "e44d51d0-ef87-4472-8080-6a8bbb9f4be2", "value": 318976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629703796, "uuid": "6ff127d2-bdd0-47b1-bb3f-09895bf082e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629703796, "uuid": "2c7d5f6c-25ff-4f14-9e82-6755b0de830a", "value": "a1a454066b561968825cf19ca262b2fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa3a8c94-03e2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629703259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629703259, "uuid": "bbc5362e-034d-4465-80dd-8e2b8b6c73a8", "comment": "Malware payload (Formbook)", "value": "fbc0a38898145f58ec52b75a6a0d4f58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629703259, "uuid": "21a0dc1d-19eb-4816-96d0-451edc300112", "comment": "Malware payload (Formbook)", "value": "7e99dc28bcc8be32fb1477bc6b67da52d67195e1e9ebc9612118a9e180675af7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629703259, "uuid": "57fb921e-bb65-45bb-aad7-741bb54b48e2", "comment": "Malware payload (Formbook)", "value": "0e1b7baa19c708aada04ebe148575996eb5ee7cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629703259, "uuid": "271a125f-8a96-46a1-bc91-763e5a6ff279", "comment": "Malware payload (Formbook)", "value": "7ccfa9fff0d2f92bb00074eaec07f153f9010a863b942cb51bedf56cf836ff60e6de99c8898aec35b73fba86f4cfdc0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629703259, "uuid": "b50ca401-d00f-4897-993c-9f8f54d35ccd", "value": "T13515C4BC19B9B6279079C765EBE18817F0409C9F3151ADA4E4EE27B7032EA5234C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629703259, "uuid": "7fc23477-e59f-42ad-a0f1-62d3134ea859", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629703259, "uuid": "3e1848aa-3eab-4bd1-8b61-b4380436611e", "value": "12288:bPvDc9F3nC0Py3gAhI3cPtgRBKmSL4NT29PnrpTtQ/wFkXih3cHIy2P5K:bPaK/LS2VnRK/w6wcHh6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629703259, "uuid": "9e509ad4-d6f3-4c22-bf7f-60f52998d7ea", "value": 887808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629703259, "uuid": "81b15bdd-2489-4798-86b4-7b25d9e4063e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629703259, "uuid": "4d273e58-e45e-4019-ad65-8c3c8ed49221", "value": "Payment Confirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8022f54-03d9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629699444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629699444, "uuid": "b4a336ff-3d27-4b05-9489-2a307dd74a80", "comment": "Malware payload (RedLineStealer)", "value": "b35bc1fc95f2c1f54d1579d57f61fe11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629699444, "uuid": "ef89e909-164f-45f8-9974-79ac73a972e4", "comment": "Malware payload (RedLineStealer)", "value": "806b94827deeb8e69adb9119e604d571af1dc3d4a60025d5faa9a6243f040f4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629699444, "uuid": "9f915ae5-e4c1-4df0-9971-a318fffd8664", "comment": "Malware payload (RedLineStealer)", "value": "dd3fca06f136853e72681f07a8de2f252954509d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629699444, "uuid": "6ef76fc2-e1a0-45c2-9489-e2ac7d2ecd7d", "comment": "Malware payload (RedLineStealer)", "value": "e794edd8f2f0f05a4586eb675db7ce797845f7f2eecce40a160b147b6fadb04b105d9965910864c452d472285e83c600", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629699444, "uuid": "f07770c7-6271-44aa-ba3f-792794d3e0f7", "value": "T19AE4E130A7A1C435F1B612F459B583B8B93A7AB1AB3440CF53D51AED06386E5EC30B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629699444, "uuid": "02385124-d1ed-4cbe-a61e-ec01fb066934", "value": "4aded8f080ac4b6e892c4de31a213f2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629699444, "uuid": "1824a8f6-0bf3-4610-92cb-db43c06383ff", "value": "12288:AzydwOBW203LShsGGRRWaOksj4juNPd1LT/DykP3UitLjTesCRTXltXeB22FTZ:bwOBPsGGREf/1Ln9zEhXltXg22b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629699444, "uuid": "67746f6a-cb90-4711-8a0b-48ef7f67b2fe", "value": 657920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629699444, "uuid": "af235bf8-7887-4fd0-9b92-71bf1539e3d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629699444, "uuid": "9d727804-1672-41d0-9749-c97fdb742b84", "value": "b35bc1fc95f2c1f54d1579d57f61fe11.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8fb4e1f-03f1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629709753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629709753, "uuid": "ba4941e4-245a-4772-a0c7-368048e1b477", "comment": "Malware payload (AgentTesla)", "value": "eec09b0a35398893e5bd081af0bdb6cd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629709753, "uuid": "6aafb8e7-6f7e-410f-a435-0e9c9c104a0b", "comment": "Malware payload (AgentTesla)", "value": "80b83b8c565fd2bd46a664cbfdd74fed363907946feee23cbb916a530725dd97", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629709753, "uuid": "1f9fb285-aac5-4d08-b8a3-e0ebbf4259a7", "comment": "Malware payload (AgentTesla)", "value": "0beccc9946c33d2b86920d561a8cffb25fe15b15", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629709753, "uuid": "46a7b848-d652-4535-83f8-8267d336b48a", "comment": "Malware payload (AgentTesla)", "value": "f1c2c0fba4118a1dbb8dca51d8fafbc20f26486a7a63d2d5f20fd99842369c78ac757c5e112b3741e8c0a483b958fbe7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629709753, "uuid": "416310c3-728e-4558-8d5c-e3a6dac88039", "value": "T1B7F44A483790719FD423C9378B974C30E66164ABE39BC343D013D2ADA91D2B6DF186AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629709753, "uuid": "3dee2c54-7a81-4258-98d5-08c3f9e546e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629709753, "uuid": "8c00801b-2c16-4e9e-b8d5-642b60462617", "value": "12288:7L4GkLIP46+qNq/fPslMQE+tHeJv1K13lIYl8RyZdHvTFK97coXaA0LpCUlHRHy:7Pk8PZJY/seQtHuNuIYl8Ry", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629709753, "uuid": "dc8fddbe-f89f-4926-9eb7-9282e630fec0", "value": 743424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629709753, "uuid": "822b5b25-7783-47ca-b6db-4f2ef8927a77", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629709753, "uuid": "a0fa8e59-09fa-4d9c-aa6a-e124442d7579", "value": "SecuriteInfo.com.Malware.AI.776618224.13550.1193", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38d1e89f-0420-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629729698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729698, "uuid": "48cf6ff1-db16-4a4a-b21d-63bb3f2f25c1", "comment": "Malware payload (Formbook)", "value": "e4f14bd7a11d0d84d9d917d33210193e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729698, "uuid": "2b7308aa-9dc6-440e-8b10-e5d88656987f", "comment": "Malware payload (Formbook)", "value": "8159bf69962afab903b18310a99aa119056e9cace183002a0ca105f431a40679", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729698, "uuid": "b86bc60e-4f01-49ce-bc8f-e760fa593c4d", "comment": "Malware payload (Formbook)", "value": "73789ac67c406487bb63bbd727bffc9ab6bfc22a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729698, "uuid": "135091de-05f4-492f-9e19-8f4e60f47b57", "comment": "Malware payload (Formbook)", "value": "99f1ac10a8d28e9f4a94cc2141c64810592bfbb8ead774bf239addee67d72895e1e5c4669ada5aa06090514e85d92fc6", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729698, "uuid": "ca97f5f2-6e54-42cf-9889-2c73022727d9", "value": "T15D5522178DA7A60EC4AEA07A7396D994D3F06D31B1DC68CB735F386431B697701E3888", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729698, "uuid": "14832fc0-5c73-4514-9b59-6fe536ca4ff6", "value": "24576:lpeg2KFntcb5MJmGGzmEQEYJkL+Eyt7OzX77xQkYqcF7bdg8e3NSeHu:lpeRKQbecGGaytLVs7O+z9xe31u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629729698, "uuid": "917a25d4-a5ca-4944-9c31-6b5c866707b7", "value": 1381096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629729698, "uuid": "fea458a3-e87e-40b7-bae1-f8f72b866dc0", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729698, "uuid": "a1404300-dae3-47fa-8a9f-1deaa7656823", "value": "AWB 9804583234.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56d1faf9-03de-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629701401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701401, "uuid": "fef1f105-773a-4dca-b3ff-a8e2600c2e64", "comment": "Malware payload (AgentTesla)", "value": "2523bc51a434b45d9fa9881a77340fb7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701401, "uuid": "ea2e442f-2fc4-49f0-8687-25b3369d8fdf", "comment": "Malware payload (AgentTesla)", "value": "816dcb90b3a0ca7d6dcecf4b65a1c999875ce0f1f9fdf1e366a75a4fa5961aa6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701401, "uuid": "eef9ccd0-08b6-47da-8b08-d952bcfb0751", "comment": "Malware payload (AgentTesla)", "value": "5cc3f91c0ecae0f5bccd83d32636decb3c849840", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701401, "uuid": "860a5cb2-ecf8-4e67-8e5f-5c15a1611072", "comment": "Malware payload (AgentTesla)", "value": "73187b3e822111bc34702f36f424ad9807755b23a2f2d6bd63985859259830a0948860b209604cd57162a76f2c4eb009", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701401, "uuid": "791a0d17-0b3f-4951-8210-ca2deef38de3", "value": "T125947A003B986A6FF130D5374B57823682B24ACBE1D6D751CC51E3BD7A31374AA49A8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701401, "uuid": "a7a31edf-84bb-482f-bb7d-008f84c812f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701401, "uuid": "22d147a5-94b3-4f4f-9a11-18a5b5ff76fb", "value": "6144:qLvDHBxZUvHoefKvbFFx15uOLykoFeUl/Psnl/s7xnqHLw/QgisQjB:QGIeS5zTuOL4essl/s9qHngisQd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629701401, "uuid": "ac23cff4-a05f-41df-9373-60415df5d06c", "value": 444416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629701401, "uuid": "08b53964-3551-44d8-9ebf-e6e1c23adfac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701401, "uuid": "e93a6088-6f6c-47ca-b1d3-ecfe1eb28707", "value": "PEDIDO DE OFERTA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "784b5d53-03d7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629698451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698451, "uuid": "f92af080-00a8-473b-9e24-2f537d29bc2b", "comment": "Malware payload (Formbook)", "value": "eba6f97891e9a26694480522670f2e28", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698451, "uuid": "5e0ed824-f9b9-4a0d-ad6f-22237d99c1a7", "comment": "Malware payload (Formbook)", "value": "81aaf53e0d025228ed4eae33a46f8dcbb42035969c2abc7e8a5bbf7bd2f34abe", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698451, "uuid": "97f0d7c7-c6bc-411d-bfc0-6d6f132d7381", "comment": "Malware payload (Formbook)", "value": "ae7d77470c16360dec75155a5afe931ea85ccf83", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698451, "uuid": "40473a56-4e62-4acd-8ce7-3eb9e901ea1c", "comment": "Malware payload (Formbook)", "value": "a1e067524f4890ae56ec29d2c4d8d3eaf7d6821aef71893429ea82ff3504d9c0915896fc2d0ff34f512b6a93f285ec55", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629698451, "uuid": "e4904a71-754b-42e9-9968-7b4bfe78d031", "value": "T11B8578F0AD01D4C1F57A5B6AF2FD3A48A1343217EBC94A4A00E7E6551EF6A11F90ECC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629698451, "uuid": "69fdd5c4-546c-4957-908a-05bca24e0022", "value": "24576:h/YthJHAXnG+sFIZMjhgkE6eyn0vKjIXmX:e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629698451, "uuid": "0b80e453-7b3a-40e4-b26c-070e1e4819bc", "value": 1768207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629698451, "uuid": "4df8c0da-426b-4dac-b8db-abaac88354f0", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629698451, "uuid": "f460cd7c-cd44-4962-9ef3-45b6cc41a969", "value": "ORDER-ASLF1SR00116 40HC 21T05 DALIAN TO GENOVA.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b354888-0445-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1629745566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629745566, "uuid": "4a3b2375-d765-4c66-8b9f-c66bb55a54a7", "comment": "Malware payload (AsyncRAT)", "value": "89b4d7e65dc37fceb714a17417349949", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629745566, "uuid": "183c3a0c-0108-460e-919f-477cc38b5f6e", "comment": "Malware payload (AsyncRAT)", "value": "82ba737a2c82a04869b77ada5d4dabaadb0267e596733411259a00b69930fdf1", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629745566, "uuid": "0999078f-06de-4cc2-88bf-5b36613cc21a", "comment": "Malware payload (AsyncRAT)", "value": "89c6f5b22ede9a88d8d05aa670d3953eed4992de", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629745566, "uuid": "c31eba05-f391-4786-8bbf-ba87fe54fa54", "comment": "Malware payload (AsyncRAT)", "value": "769d042d5ebfd65e4870a1d628afc6f58a8a063451dca1f9d78833646f6c0c515f6f7d49ca82675f29e89efd738340c7", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629745566, "uuid": "83de8a35-41a9-4e5e-bfa0-b59f30f749fd", "value": "T18904CFD0E74725D2E8BDA27CE49AA52F0390D5BED8A5C79E7B0147D4ACA84133CF4AC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629745566, "uuid": "0f64c966-45d2-4147-824c-43c869f66fc4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629745566, "uuid": "5f5d833f-d59d-4b52-ac33-e87ada2f6966", "value": "3072:WN9I7H919vuIhbZknLYkJiWrY7JqH0JdUowumRE6Q14vmOw38a9Mm:WN9ab9vuIFyLYOY7JY0Jd/9OQ1qoYm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629745566, "uuid": "02efe292-b62b-481d-85c9-4d1c3b7426d7", "value": 177008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629745566, "uuid": "848fb8bf-8a12-4f45-9b8a-310a901bd14e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629745566, "uuid": "b57b7e48-0424-4ebc-9bb3-fb4272497afd", "value": "89b4d7e65dc37fceb714a17417349949.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f001b852-03fd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629714972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629714972, "uuid": "d2e8591d-de39-456e-b20c-04aa4cd8e6e3", "comment": "Malware payload (AgentTesla)", "value": "1e4b67d4a4314bb080fb39250bcaa476", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629714972, "uuid": "0a31bd2f-0458-42ba-a5bf-ec9a6910f83c", "comment": "Malware payload (AgentTesla)", "value": "8328152ab55ce7e84797021a67502bae6236c6cb359fb87dd1c0e7153fb1201d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629714972, "uuid": "a1ffb6a4-1466-44f4-8d4b-916a61bb6ced", "comment": "Malware payload (AgentTesla)", "value": "6fd8653350dc3246b690287cf378a9f20a134742", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629714972, "uuid": "cbac0076-432c-4297-a2e4-40f9361ea974", "comment": "Malware payload (AgentTesla)", "value": "b0bb3e951e952a92771bb5ddc840f38e6d5aec492327ac107300b3a55a8ae9e2e7d4830d2073b0a7b3e9ba701800a316", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629714972, "uuid": "bbfffefa-a252-41b7-b9df-c42b0db53a3b", "value": "T1D8E401453750B68FD26FCE7BAC451C20C7A1E572530BE75AAC9312F85A8E7968F012E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629714972, "uuid": "724e8091-d4b4-4048-89fa-e361551ea75f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629714972, "uuid": "142e88af-a947-4e7d-a8aa-941da69af42c", "value": "12288:1gBlMxDBV1bk9xNRDOPZJWXhMc597s1tcyc8CvJQg6BJwFfrBcDq:OsDPVYDosMY97s1tcUgD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629714972, "uuid": "f3a8b2a9-873b-4865-9fc0-bacaf4f4d60a", "value": 680448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629714972, "uuid": "83dad034-cba7-4838-a461-2d373533bf55", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629714972, "uuid": "5c4af909-3154-4c92-b6fc-76f7aed3c838", "value": "SecuriteInfo.com.Artemis1E4B67D4A431.31738.1513", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d96bb5b-0451-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629750670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629750670, "uuid": "22a5b1dc-a281-4987-832c-05c15e369cc8", "comment": "Malware payload (RaccoonStealer)", "value": "4411cef6146921cdb7fafa72e7eb2973", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629750670, "uuid": "d3601a46-309a-42b8-a4a1-ba0d780c508b", "comment": "Malware payload (RaccoonStealer)", "value": "8499d2cf32acff33664bb3b960543c298f69266269c08c871b5ee6a222b447bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629750670, "uuid": "2a4543a2-42be-4222-a0d0-4c9025b6b320", "comment": "Malware payload (RaccoonStealer)", "value": "f333487944a3031d8888065e8dae1ff4101322ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629750670, "uuid": "4b8c64a1-c310-476f-937a-e3068f2c0bfd", "comment": "Malware payload (RaccoonStealer)", "value": "692b085fe6fae55323cf0a3bd9781eea6c982eda75d28d086fa4f513b183e5dff98db435ee7f7995ca8048e0235d49da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629750670, "uuid": "b8847626-a917-43ca-90ca-c9abd7ea7032", "value": "T16B941222B570C6B2D0934470CC65C6D071EEED516A7542833ECBABAEDE722C1C62BF59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629750670, "uuid": "2b49a852-3426-4240-9e6a-d5603f1fe3a6", "value": "9351114812ade0773cab5940b106fe09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629750670, "uuid": "45b23ec5-6846-449a-bdd8-63af94abe860", "value": "12288:6xLrTPpKXFv7B0GokW2GvIOEUC1YisZd+mTB3TZL:4T8B0Go002YisZImT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629750670, "uuid": "cdc08883-416b-4dc9-b76f-cf70f233795f", "value": 440832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629750670, "uuid": "6fa1ed92-fc62-4052-adef-3ccada25de5a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629750670, "uuid": "930508ca-f714-4b09-8ce2-97d04b933c40", "value": "4411CEF6146921CDB7FAFA72E7EB2973.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55fbb20f-0429-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AZORult)", "timestamp": 1629733612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629733612, "uuid": "3125d206-a449-4a73-bb43-9decc1fe7541", "comment": "Malware payload (AZORult)", "value": "395b7c06e528ce1943e4f10b923acc9e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629733612, "uuid": "ca92e572-626f-4cb3-af86-4d541082b422", "comment": "Malware payload (AZORult)", "value": "85932c4e295c16bcf796f038c97c08af6bb81df22fce7ab8a8e1ad7074d6428e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629733612, "uuid": "6093e61a-edea-4ffc-8c02-dfbb2772cba7", "comment": "Malware payload (AZORult)", "value": "d9250f18869d7168960a01f684ae1255866eb7c6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629733612, "uuid": "8a8b4706-4b4c-4177-b279-6b3cd08df4ca", "comment": "Malware payload (AZORult)", "value": "590c8b8e10ed776d2f9657b8ca3600716d0b563d22beefd1088cd154cde06a04007e4e3dba6407fd68d877bd5167004c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629733612, "uuid": "829ff778-5d3f-4c6e-94ba-f9b75858fbe5", "value": "T14DD4F1553355A78FC52ECE79A9961D209BF1E5320703EB1BEC9361E885CD78A8B102B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629733612, "uuid": "ef94ef22-ae83-437b-aa4b-32b26e5336fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629733612, "uuid": "617a15b3-7e1b-4446-96ad-bf4002723dcb", "value": "12288:1RkKl8/yy8DMD8l768NMekPVxuiCK1FS+HX24aP/h8:QKl8qy8mjekPSNuFS+HX2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629733612, "uuid": "e9963048-52e6-4f64-bb44-7205e9793b00", "value": 633856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629733612, "uuid": "c89eec48-0d17-4ec6-bca8-2e1b093d22e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629733612, "uuid": "2910ae82-ec92-4ff0-9afd-0fb559b33fc6", "value": "395b7c06e528ce1943e4f10b923acc9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6058b213-03e1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629702706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702706, "uuid": "828688c7-9ad6-41ed-8e63-d8bf750c08db", "comment": "Malware payload (Formbook)", "value": "fa84498e7c2f782eb7e2fbc031f70859", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702706, "uuid": "7d2490e6-8fff-43a2-a848-d3b5ea222be8", "comment": "Malware payload (Formbook)", "value": "85d66b1ddbd5ebdb7be3883335db72866c2c3a51f96a81655af51e6f139bb228", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702706, "uuid": "c21bd12b-801a-49b5-ab1e-b09f9458d48b", "comment": "Malware payload (Formbook)", "value": "cbc9482a3e102f8f2f76b07424b7580c475e7900", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702706, "uuid": "8c1d0cad-6e34-4418-b222-f5e858a3c4c8", "comment": "Malware payload (Formbook)", "value": "f619624560871df018a5e5c8204e13546f0650139fd4d3b1bc911c4e23ac2c05929b3f536f8f474577370198877f0e70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702706, "uuid": "37cb0446-e5b3-4a2e-b2e8-3a31c33a7c34", "value": "T18B556B3D29B92627C17AD775CBE18817B194A8AF7511EDA8A8D343660303F8775C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702706, "uuid": "36d34f3b-20c8-4683-8a0b-38cf0fa28192", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702706, "uuid": "39c07918-cad3-44b0-b751-82754676fec2", "value": "24576:sQ1ftboSzyRuGj6N/i44rhXZNus89UrmMnfk/iQ2+S0dS:syt/MuhbcWsaU9fk/Pjg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629702706, "uuid": "033551bf-87c9-4b0e-8654-3b9bab7f323f", "value": 1404928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629702706, "uuid": "204d6345-ffed-4be5-b031-731d1026d979", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702706, "uuid": "76caf457-ef14-4e22-b5d5-f802edb4490a", "value": "Purchase Request No.11724570 Saipem pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb28ffff-0428-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629733379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629733379, "uuid": "8a9b2729-4e06-4c90-a587-093388c17c9e", "comment": "Malware payload (RemcosRAT)", "value": "60a55d0c6cba71cd1215b63ee7a1cc82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629733379, "uuid": "95f931fa-1977-4bd7-bc5e-eccd038a3009", "comment": "Malware payload (RemcosRAT)", "value": "860e16c192167d5dd823b8e533858cdada7aa9b3173254f2f57031af68b84e0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629733379, "uuid": "00f2a854-f4d8-4a39-809b-f727526672f0", "comment": "Malware payload (RemcosRAT)", "value": "b95de481325d407e97336126af3a3a4d1ddfe315", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629733379, "uuid": "1cc96a96-51e2-4072-bf21-981fa2dee88d", "comment": "Malware payload (RemcosRAT)", "value": "475655d168757cbc54b1d81cd71d820179b2c67d160cc4464bbd78755e78bb2a2fed3710143e6c8aca5d8b543473a827", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629733379, "uuid": "7a52ba1b-d690-4e0e-8a0b-706a591547df", "value": "T142C3E6E29B615834D3752C70E8A3ADC163119F015ED3573F21DFFAAB25A0B82A4D734A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629733379, "uuid": "07f5a492-9f8c-433d-a80a-cb1f73804deb", "value": "c65aff2bab39ef464a2bad0c06b18bd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629733379, "uuid": "246de682-f681-4b08-93a1-f45091932012", "value": "1536:fnYgNdzXtWBB9m3w4MPnoQKFF/8ethr+mcjDVyk8i7jLimejN3j:fYgN6Bg3FMqZ7hrZwVNLibN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629733379, "uuid": "d24bc1bc-e594-4419-9da3-148368719f2b", "value": 126976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629733379, "uuid": "d95a24b3-4e62-4b51-9175-e82c17e816e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629733379, "uuid": "49f3b046-3015-4585-88be-2740d3be9eb5", "value": "http___s-rco.duckdns.org_11d_solex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3715f60-041e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629729098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729098, "uuid": "24bc18c8-d9bd-4b5d-9629-9cf9d4194aad", "comment": "Malware payload (RemcosRAT)", "value": "59b6819fd6875b148f559193228aeacf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729098, "uuid": "983325b5-6822-4ce2-b55e-fc547f0b127f", "comment": "Malware payload (RemcosRAT)", "value": "86da76aaa93035696752329676cc619cb00d99fbf38857a56b087fa27f80c028", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729098, "uuid": "391d6734-0e21-42d1-9c8a-fc9075426efc", "comment": "Malware payload (RemcosRAT)", "value": "9ae463940601c9adbcee46a275a57308cf77612c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729098, "uuid": "1180259e-9b64-4607-864a-7dbe81604eda", "comment": "Malware payload (RemcosRAT)", "value": "edc007467a228d3c51391803b30b440fd7b7378efb3093dee201ffff59ba1f1bd65ae084cc833b7a2100a79dc325798e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729098, "uuid": "a646d935-975d-4872-b171-320cb65241a8", "value": "T14DE49E2AF7F6B237C87726744907976C58167C63191CA0E79ED20C4C8A3B3A5BC2857B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729098, "uuid": "2fe74470-af74-45f6-88a5-bc7e5f27c482", "value": "8ba7b45407a54e1cc2cb82bc2d24f0c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729098, "uuid": "eb3863ec-6757-4a37-b2ad-76c131920184", "value": "12288:OWHQioUx/2JW1hxrQe+IguVZRFzODnQr0+NpYuJTquMvC:OI52JWhZvP43+NpBs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629729098, "uuid": "c97f72df-7f49-444d-a26e-933a9e822562", "value": 705536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629729098, "uuid": "448b3818-aab4-4100-bebc-c89f3ca00209", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729098, "uuid": "c07a4a39-969d-4d12-8abb-748af43f8e10", "value": "PO Order No 338390208B,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9802fb38-0407-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Amadey)", "timestamp": 1629719120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629719120, "uuid": "86da6740-5c44-4941-a96c-01a83538a105", "comment": "Malware payload (Amadey)", "value": "f13350d57a29f7f3b42535f7f0d12512", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629719120, "uuid": "a668ad06-de04-477c-a8c6-594c61295078", "comment": "Malware payload (Amadey)", "value": "871cb1560fe9f1d5a3ef8126d3ccd6e6a4678d7ce683a2fefaca28c217b684a2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629719120, "uuid": "9fe14b9c-1920-43fd-90ba-10067cb230f8", "comment": "Malware payload (Amadey)", "value": "8c16854363ba3e4214181f368d886258c4a27a4f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629719120, "uuid": "a3cc8576-2d58-4fb3-a51e-613aa276fd36", "comment": "Malware payload (Amadey)", "value": "0698619b3083079b5e42235759176476492aac3259e023974e748c6c8a79a46272903ab847073a63416d0553202965d5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629719120, "uuid": "baeb719d-3b5c-4020-8ed6-85014b93af42", "value": "T19A649D30AAA1C035F1F711F856BA83B8A53A7AB16B3440CF53D51AEE16346E5EC31B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629719120, "uuid": "402ca555-4e2f-4a18-b4fd-aba43635c567", "value": "5c06a288f07d43206aca52d5d94444b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629719120, "uuid": "064748d8-0021-4815-a874-73bfdd624c69", "value": "6144:q44D4Zqtia3Sv4Exe0Rj74tzagJpYt2oip8NP+s8niGlS8:6D0q8Am4yRj7IzaWicog8Us0iG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629719120, "uuid": "27961782-f5bf-4e8b-a03f-484255635e01", "value": 329216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629719120, "uuid": "88367159-0e34-492e-af39-1a491cbabfd8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629719120, "uuid": "a82eb050-734c-442d-a1b5-692aa6e5b2bf", "value": "f13350d57a29f7f3b42535f7f0d12512.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85a2f164-042a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629734121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629734121, "uuid": "3f8c487e-0c81-4b4d-b702-10982d68ec84", "comment": "Malware payload (RemcosRAT)", "value": "a27561650fe74ab80657545858791cd4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629734121, "uuid": "93902e08-0cb8-4379-be53-f04c8b0ad844", "comment": "Malware payload (RemcosRAT)", "value": "87284733f84447db5f12697e7ce2fb44671cbf404e040cf85085b223eab02b95", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629734121, "uuid": "d1886707-e0d6-470e-afb1-7aa74e5feda0", "comment": "Malware payload (RemcosRAT)", "value": "f4023c682b32622d10f0a856b4587aac07c61d15", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629734121, "uuid": "a2368b79-5650-47e9-a230-45736b7e55cb", "comment": "Malware payload (RemcosRAT)", "value": "1c32dbf6e6af821e1960d8f5b154a50d4dfe2051d60c917a0ca8f6cca92892556ea4092900554c5bcbc736d2b5e445ce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629734121, "uuid": "fabcc132-f6d5-45eb-84f6-6f57da4a2bb8", "value": "T1CB35493D1AFA1237D1B5C365EBE18423F149985FB414AE696CDE07A7434BA8734C322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629734121, "uuid": "25d52ff5-15a4-4fd9-96e4-0c129766d564", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629734121, "uuid": "160da928-eeac-4f21-bc4c-7c4fab182894", "value": "24576:QRdGTNKFnWH7JjqESxGWsTf0qIsoMIju7zTONnK0jteBeSdhZg:eduwWvUGfEso7G/Oljgxdfg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629734121, "uuid": "9544367e-c452-412e-98fd-ec509c725f8f", "value": 1094656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629734121, "uuid": "8a928fb3-00bb-4989-8896-81b5a83e4c5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629734121, "uuid": "226fcd83-d679-401d-9e35-17504c41c17a", "value": "a27561650fe74ab80657545858791cd4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60e87a46-03f0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (a310Logger)", "timestamp": 1629709149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629709149, "uuid": "a62f0446-9f6d-4970-aae5-7214e7d865cf", "comment": "Malware payload (a310Logger)", "value": "3dbc477725b5a88f511f1b4e3bcc38fc", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629709149, "uuid": "047d4cc8-5791-433d-93da-30ff66a44dc8", "comment": "Malware payload (a310Logger)", "value": "8742189aa8e9303ed7ce67da39348d2bb6628a6c5243c6e9a968499098f42178", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629709149, "uuid": "bb07ce1b-5407-4485-8efc-dcc170523bf8", "comment": "Malware payload (a310Logger)", "value": "a81ed8a5aed97fb6efa956e5c485f2aad8467e9f", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629709149, "uuid": "7f0a40b4-4862-44b2-ad0b-10c8ed55a9a8", "comment": "Malware payload (a310Logger)", "value": "e1d31b6e16931bac264f507c46dc5429d807bacf35dfc1094e8b6e411e969dd2adcc4fde3ba501dd3a9f79ec84a13d8c", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629709149, "uuid": "52dcef67-9a49-4535-ba64-7ecde9b3fcaa", "value": "T1EF35283D19B91237D1B5C365EBE58423B1489C5FB404AE696CDE33A7433AA8335C722E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629709149, "uuid": "4914fb03-0f00-4029-a3ee-c9c24f6e5f9a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629709149, "uuid": "9dff92cc-3325-4939-954f-07e94c3d8a47", "value": "12288:CGj/sthsNaJ31H2FTQi66ulHOG8BmRSdss/K0Iwxz0GAoSKv4wvx0mwTiEH8vPNG:9othaFMiA78BTQRGLgw0XTiEHwm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629709149, "uuid": "d4dea542-e74a-4d5f-ae8d-1d8bf9ec0b7d", "value": 1079296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629709149, "uuid": "2eb5eb77-5dc3-4a37-994c-aae6a110858f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629709149, "uuid": "36260dce-496a-4f5b-a315-02f0ff821aa0", "value": "SO#5933772-00,xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62f2338b-03e5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629704428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629704428, "uuid": "8e0a7419-eae5-42e2-9454-9bd00fad8d7e", "comment": "Malware payload (AgentTesla)", "value": "00e3fab4f66bd7643efbd81ea73be559", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629704428, "uuid": "33067fdc-cb8f-4a43-87f5-cc51ee583f46", "comment": "Malware payload (AgentTesla)", "value": "8749c16cb8cc3999e4db4fa619da8d90fcdee57c7c99479e96e5eb3427a427a0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629704428, "uuid": "e1c18ab0-7a92-4827-b32e-76125f2d8160", "comment": "Malware payload (AgentTesla)", "value": "4891c039dd36b17f94c36a48c21c2e4a514ce2cd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629704428, "uuid": "7e2107fd-b998-4bf0-b275-8e4f1a8e8e09", "comment": "Malware payload (AgentTesla)", "value": "d404302b48a8432abc685ef0cf3cb19f53403f2e456589337530c9ca60cd4efac26b9e75087fa54b7e871200a1c1008f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629704428, "uuid": "b5fdba0f-810a-4db5-ac97-9c01a2bafb56", "value": "T173648D90E249D886E9431DB6447B9C7120A7BEBC987D4A1E115F37295AF3383206FE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629704428, "uuid": "ed3adaef-7a0e-45a7-a791-cc100cce7195", "value": "6ef74f7b87fa15b6df54d064a5b8ef31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629704428, "uuid": "81bf1af4-3558-4356-b3c0-66b1d6928448", "value": "3072:RXzchO+hz1HoT4U5f489JzPdQITzMIPaiCL4NFZuSCHnErUMfJhka0YPcxxmSRc8:Jeu9JLdQAPaXgWEQMfJObLcGv4NQtf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629704428, "uuid": "9ee4d18e-bdc5-4f0d-ace0-222dd8010851", "value": 308009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629704428, "uuid": "837620ce-3619-48d5-a63e-3f28a1140f56", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629704428, "uuid": "417f9d5a-7b16-4025-8554-5f4b043f1005", "value": "dhll.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06cc12f9-0422-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629730473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629730473, "uuid": "a82db924-911e-4588-8923-487656de9eab", "comment": "Malware payload (RemcosRAT)", "value": "26df71e994159f78e663b090ef1b96c0", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629730473, "uuid": "07d3337b-c99f-4ab0-ad49-7a04f65c4ffe", "comment": "Malware payload (RemcosRAT)", "value": "88a3c56e5c4b20bcd3bfb478044de30a13af66dcc5371c71d0152f2ab6d81363", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629730473, "uuid": "ead48e68-b729-44b7-b4a9-77cc39a6ca8d", "comment": "Malware payload (RemcosRAT)", "value": "b308debf37a336dd8ebd261f5214ad090fddcbf1", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629730473, "uuid": "41fad4e6-6e88-4713-bf53-e3e7c35606c3", "comment": "Malware payload (RemcosRAT)", "value": "30d7b946f5cd0b7a4566079b7e80eb8195c49d7788b57d45290254d5ee4a084e08852ce81aa92a027e8f2a9612742129", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629730473, "uuid": "9569b779-e092-4fc5-975e-a7a53ff4d8cc", "value": "T14B52F7FCE4974698CF46B6FC2A1A9705048D7A1D728DE637727C973927819AA4027C3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629730473, "uuid": "be81d314-66ea-4b8d-89a9-88cbdee8fa96", "value": "192:TvvbHpQ2bKQDmptPs1w/EIhOWzFN0NsnN1yucU8Yvpsl3qg8uxyKUuLlrW+LAgpS:bjrKQyW1w/EIhtJJN1yucUVskHUfRel", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629730473, "uuid": "4ab3533b-a896-4e2c-9218-41400cb45555", "value": 13657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629730473, "uuid": "6a404d98-e013-4c91-ba7f-1d0bb651005f", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629730473, "uuid": "6caec65f-3d10-44ed-ba5f-6c94b3dc6da5", "value": "PURCHASE ORDER.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e97896a6-03dd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1629701218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701218, "uuid": "ed587829-0abc-4ac6-b73e-885456c4f784", "comment": "Malware payload (TrickBot)", "value": "faec42088bc5ff3b17898160d84e054b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701218, "uuid": "91046b75-29c5-4f74-b101-04ec2df100e5", "comment": "Malware payload (TrickBot)", "value": "8ab49e939399e4dd51e665e119b4d76c12cae36b3c72bb8aedf9c2ef73903a78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701218, "uuid": "67cfd709-a11e-435b-b271-17d1dbe52561", "comment": "Malware payload (TrickBot)", "value": "df4e0c2900d3746b2eea6f21fd15c214d2f4c4f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701218, "uuid": "e844b4c8-41a2-4213-90ef-7cf1288465d1", "comment": "Malware payload (TrickBot)", "value": "f1785e5cc80bf0a8268956bd19c548a853cbb7ddad5c6632880610ae2d2c3c2f860687cbd2045edcb5aa80a6b19a97bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701218, "uuid": "b7c1af0a-2607-4dee-839e-b612e40430d0", "value": "T1CF94E039B5F080B3E577023098F00B7AB6FAFC141B3197BB4B525B1D9C316B95922B5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701218, "uuid": "1862697b-15d4-4bca-b34c-a3607d0a6228", "value": "a72f794c30711c44b7a2c83e9a1e7673", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701218, "uuid": "783f1e04-8833-45ec-a995-9717f4a26cec", "value": "6144:9afI6X0INk6tibuuMcgUrRBIYG0CfARZgmaLb2jnI:sfXhk6sbMJMtZKTGjn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629701218, "uuid": "011518c3-284f-4c6a-b7df-cd0f2f30f0a9", "value": 425984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629701218, "uuid": "bb7e6dda-e55a-4417-ac35-62768255a32c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701218, "uuid": "046eb5a7-4093-4296-ad14-1658ff95f138", "value": "faec42088bc5ff3b17898160d84e054b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebcd23d4-043e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629742883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742883, "uuid": "87ab8b6e-03a4-4296-835d-03b63cc2ef40", "comment": "Malware payload (AgentTesla)", "value": "ec05e000add59408a09384895812d45e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742883, "uuid": "033f086a-b37f-4a7e-83f7-f2cc22762bb0", "comment": "Malware payload (AgentTesla)", "value": "8ab937136233e7a95aa91aeb947f457a0e3c53ac0369d4aacbeca83ace216dde", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742883, "uuid": "e5901237-af24-464d-bcfe-3025a444212a", "comment": "Malware payload (AgentTesla)", "value": "a789e1c7b68634e7cb1a95186d924b77a06ea1d5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742883, "uuid": "fa0ec001-6d32-4677-95a1-a320d74f2cac", "comment": "Malware payload (AgentTesla)", "value": "c29f326d94f35ff667a7a8942b92cd4324b445596c26ff30a24c30cd713ed8311a201324e045f0ca50f5b6f0f4507db2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742883, "uuid": "21a100f1-bcaf-40d0-832e-393ea21a56ed", "value": "T1EAF438483790B09FD423C9338B574C30A6616CA7979BD303D053F2ADA97D2B6DF185AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742883, "uuid": "60c703a9-149d-4338-9693-294c624b4b06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742883, "uuid": "009a73cd-204d-43c0-a026-2b310dc449c6", "value": "12288:S0WX4kNkxUPgd+X2QQGJTrqogXLK46Q+kr9y5ZhVV/te5L10CVZKm+1:FWIkNkDGQqOG46Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629742883, "uuid": "2ddf645d-e01b-4f4c-877b-471359dd3e2c", "value": 768000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629742883, "uuid": "7884535d-eac9-41bb-af83-f8d042996c4b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742883, "uuid": "f3b19ac5-8e1f-4447-9f4e-666fa8b9fba2", "value": "invoice.pdf.z.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a39850a-03dd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629700924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700924, "uuid": "6691ce92-0265-43c9-bf52-02a51aa89bb6", "comment": "Malware payload (Mirai)", "value": "77a0cb3b4543b6279e0dd9746f0bfef1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700924, "uuid": "74697549-bb8c-45ef-b984-6ff84b444b08", "comment": "Malware payload (Mirai)", "value": "8ac55c3bc16a934a26636af277aff6d2e11d21902cf26edb5f9a3c1889efd55d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700924, "uuid": "287496aa-2702-4797-9c1b-e0d380921fb2", "comment": "Malware payload (Mirai)", "value": "69c97df0654ab3b3fbcbdd9e9c396df55f9316c9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700924, "uuid": "1655f529-3e9d-421d-8463-61c8070f64c6", "comment": "Malware payload (Mirai)", "value": "570401b72bf702e74d52165b554df3b1835ec43df22220e95e6d238544403a467381c632cba4f5b248aa32d95b7dd990", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700924, "uuid": "3c538609-c8d9-45dd-aa2b-7694f299eed0", "value": "T12A03F18180A06395E90A8330ADCB751ECD81979D317AC9D5C8CEE8D9BD87FA3362459F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700924, "uuid": "0e7cb5cf-2829-46b5-b295-eb7ef2cdd6b1", "value": "768:JUTA2O9xyK5Nm5JeC9++0X7K02mGFEJ3lhwGAKA17nbcuyD7UHQRjY:JUToDyiUP8rAmGCxXwGmnouy8Hy0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629700924, "uuid": "03b8739a-004c-47e5-80de-ef2ae6dc789c", "value": 40192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629700924, "uuid": "5e64bb94-c3b2-4a3c-883f-56786ae645b2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700924, "uuid": "a643c421-1112-4bd9-81e5-422412cc0356", "value": "77a0cb3b4543b6279e0dd9746f0bfef1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc120886-040d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Cerberus)", "timestamp": 1629721757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629721757, "uuid": "42f14071-bfe0-4d3c-a7a8-f8544ee6e385", "comment": "Malware payload (Cerberus)", "value": "910821d6ff713ff5bc65cf4eea5ea779", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629721757, "uuid": "6d48b49d-8dcc-4d6b-9ee6-84c979985d1b", "comment": "Malware payload (Cerberus)", "value": "8b1b059cc24abbe98d07aebf99a0a43ab465384728004bd237735cff96b3cf65", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629721757, "uuid": "5ce55100-8b2b-4d7f-93e8-d545640204d6", "comment": "Malware payload (Cerberus)", "value": "d19b52e7dbd574efc354db51b81ab13827fb9fa1", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629721757, "uuid": "08c86fb6-bd35-4ae9-973f-bec020303eb4", "comment": "Malware payload (Cerberus)", "value": "e15fe968a6676a09fe088b643f4d036b8fc158ae63249c44bc3bbb4977c9edcce010deb8d25fab1cd3f921bb5eee35c8", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629721757, "uuid": "47737d2e-97f8-4ae9-bfe1-819184410c0a", "value": "T1C4F5332E8353884ED97F83316283656BA465226D8AF5196F216340F23CDFF490B77CE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629721757, "uuid": "3f77d611-deac-4d3f-815f-297915c0e970", "value": "98304:ZPBuU4Rv3euwpA7N0TmEuV5h8oLGt1o5UUdx:hBp4xeuwW7N0TbcEoLGzoZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629721757, "uuid": "fde6fb32-5020-4d23-8693-ed33ca52a28b", "value": 3528458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629721757, "uuid": "fe7f8d43-1847-4803-a231-a55336a42b2f", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629721757, "uuid": "5b141067-9eaa-4b4a-a2ff-20d51bf3ec6e", "value": "Google_Play_Protect.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ea143ee-041a-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629727291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629727291, "uuid": "646aecf3-af25-4672-ab92-e74970c41fea", "comment": "Malware payload", "value": "b293c3038385e59e5fe7d851b53dc76b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629727291, "uuid": "896258ec-dbad-4d41-babf-4ea78cb8a92e", "comment": "Malware payload", "value": "8b366eb1d6c2c558154131e350708add274315d91733f89a29d8306f53c4d09c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629727291, "uuid": "d4ed3a64-75f3-4d24-8425-292d04721f06", "comment": "Malware payload", "value": "11e1917f50e5234ee61251d0ce258221d4b9eb16", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629727291, "uuid": "4888704b-9e6a-49ee-b336-b74502e7ab27", "comment": "Malware payload", "value": "cfa3cdc164733906bdd4e250b859c641f8c29397c9a17c048402a4a6cab60a4d02e2eca6619ce01f23be9cd2f1bccd79", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629727291, "uuid": "46712e3c-51f5-4f99-a3f8-4cec0e1c2114", "value": "T19F3733A6A1F1D03EFAE3547641D7C2707BB3CFA00A269A63BF49012F6A91D935707D12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629727291, "uuid": "2e67d408-9d18-4642-97c5-8c072e416021", "value": "9d1f0da408c33eebb70b9bfa17b7fddc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629727291, "uuid": "12c490c1-1536-4813-bfe6-58255fbdf031", "value": "393216:YfVI3PkpFSHq5Gc2Rc1ljkXSgdqNzZi8KaNz4sAmF6qB/4Vq9QD11E/INYtX38zq:cVI/qk02sp0Sgdr5a5KrVq+RNzzCgi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629727291, "uuid": "5c4b763f-d8af-4e9b-8d00-4d287675c8c5", "value": 22767744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629727291, "uuid": "6a446dfd-677c-4961-9fb2-f7d96f9066c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629727291, "uuid": "7a786afd-2e38-44c8-b1a2-2917695524cb", "value": "b293c3038385e59e5fe7d851b53dc76b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5241b3f6-0449-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629747350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629747350, "uuid": "d18a9003-f05c-43f6-a3e6-8b6ca63d5a65", "comment": "Malware payload (RaccoonStealer)", "value": "ed3379f3fafe77973058a6b8e02d2e1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629747350, "uuid": "7b756dc8-a68b-4c90-89fb-b505300821d4", "comment": "Malware payload (RaccoonStealer)", "value": "8b3c9cd19c312c6a1578e6ac26658e1d47ee7dbe7ae319c49c8c2894c58f73ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629747350, "uuid": "1e083459-dfc8-4493-aa5c-2cc6ec5e0d92", "comment": "Malware payload (RaccoonStealer)", "value": "f04bffac54ee8b5603134ef6dc36ecdd82c71e92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629747350, "uuid": "26f6c4b7-db9b-40d8-9753-c191c490e514", "comment": "Malware payload (RaccoonStealer)", "value": "01c7d10ba46410a34832c2315aa58a7c73773ad66f47370bb11d03b8be56630f636141c9bcf945abe87258616fa449b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629747350, "uuid": "e26d5423-837f-4da3-bf1e-b51c2ca8320a", "value": "T1BBB4D030A691C034F4F612F859BAC2BCB93ABAB16B3550CB53D52AED16346E5EC30747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629747350, "uuid": "5987120c-8292-42d3-be3f-e9c87a6ce7d5", "value": "ab6a8b01372d51e7fed6c22dcfc42852", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629747350, "uuid": "7efaeeb3-a3b5-4576-9a6c-8c568cfceb18", "value": "12288:+xx2/Q1zPC7AA9OMr2ANXRVc0W3fAfq4qtn4Tcy9ZTjxC:fQ1ztF4a0W3l4Qy9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629747350, "uuid": "2ca39932-96c3-465a-a329-4e9fbb5416ab", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629747350, "uuid": "97d9601f-bb4b-41a7-92ec-84d8e5f53dab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629747350, "uuid": "4603914d-b9e6-471b-a7dc-0106d270bc7d", "value": "8b3c9cd19c312c6a1578e6ac26658e1d47ee7dbe7ae31.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9799f8bf-03c5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629690772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629690772, "uuid": "9a03bc94-37ab-45cb-a0d9-3b73143362dd", "comment": "Malware payload (Mirai)", "value": "e16c8e27e4b5fdba5c52dd0751b54ced", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629690772, "uuid": "d0c4d9a6-ab96-4723-830a-28b71b92f92b", "comment": "Malware payload (Mirai)", "value": "8bbf683bef4c5faf7b2fd230c95e2c2c23b623403f85245993cbd3f155a0f344", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629690772, "uuid": "efcde6c1-7171-4654-91b1-dce055e83501", "comment": "Malware payload (Mirai)", "value": "bbcb569ad2233841e221b88b07ec352791d35a4c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629690772, "uuid": "97638029-5521-465b-9a5a-f0583e49e6ca", "comment": "Malware payload (Mirai)", "value": "8c92c20eef968e2656069cc3a319a7f56ac7375abf6e3c3609e35271371642d5f32abe14b4ab54bdc316686c3a6c73aa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629690772, "uuid": "c08b97d0-62cd-44af-9ac3-8035621f5b79", "value": "T117E2F12145145D60C7F53C7FA9AE88D02869A9E0C49C3DD3A8B5CFAE559A0082BE79CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629690772, "uuid": "a70b77ff-6bec-4e6e-96c0-afdb09f6d7ce", "value": "768:OYFazlIwYO6bJD4sXKmrUv8t6hOrFS742MF9xZVLNKyN39q3UELO5:OYFaSwW9bRwv08KM43xZloLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629690772, "uuid": "3f0f4f68-85e2-405f-812f-70301694c1db", "value": 34176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629690772, "uuid": "20309dc4-abf4-4973-885f-e7d58e3b58e0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629690772, "uuid": "97c15c71-200c-4ff8-8e6c-01ce043bea8a", "value": "e16c8e27e4b5fdba5c52dd0751b54ced", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70242020-03b1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629682116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629682116, "uuid": "bc65ab6c-2a9c-4c1d-912c-4b070855bb6e", "comment": "Malware payload (Loki)", "value": "af2f4aae98d6231050a43f558f360382", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629682116, "uuid": "4f03a649-1068-47f6-89fe-44e60e7adafe", "comment": "Malware payload (Loki)", "value": "8bc12d691078419b2999d7bd3799555e3af5888ba29a81aca469897992cdf84c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629682116, "uuid": "365a65ea-e4fb-4f17-988d-9399422acc22", "comment": "Malware payload (Loki)", "value": "df4b4dce0f8e50f5098f0f280a7bbfd3c377dced", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629682116, "uuid": "2dfe54f9-59d0-4384-9cdd-f907405684c1", "comment": "Malware payload (Loki)", "value": "cd87413910d0795a5b9ef5a0454e32c3eb225195e04b2a29e8bd5299e289b1543fbcf1928aba1140a488eadb4ea9d430", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629682116, "uuid": "9185a350-69e7-4a04-9054-6565f5d40877", "value": "T180255C26B38077DAD46A0F318826968C43F19E477771F76F28C426E86E71627C71B293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629682116, "uuid": "3d1613c0-93b9-4de9-8bcc-536ccacdb230", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629682116, "uuid": "336eccbf-1dcc-4e23-a5ab-d927881de456", "value": "12288:w7a8dId13T2u9Wcjx3QsLhBN9aTom5Ou6aaTxjQBu:w7ahdDhf9aTXEuCjQBu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629682116, "uuid": "dc40e175-4659-4754-b885-76e334c928d3", "value": 1000448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629682116, "uuid": "bbf69ef2-a997-4ee7-8916-9ff8589f901e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629682116, "uuid": "baaf5d65-55e8-4827-b8ac-0876554af965", "value": "SKLCL21080236_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3ad93c9-0407-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629719220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629719220, "uuid": "2cfa4f3a-521a-426e-9dc8-398a05d626a2", "comment": "Malware payload", "value": "158e59dfc68ccc89934c4abe0b8e5686", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629719220, "uuid": "0158dbb5-2363-4c23-bae8-bdad8375ddbc", "comment": "Malware payload", "value": "8c66f65b3642f96a12fca70aa160f1558c5de0ddc67b02b9fc20f32c0e4881b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629719220, "uuid": "05b70613-849b-4eed-b3b0-a43e890006b3", "comment": "Malware payload", "value": "b1634b72adaebcc73b1a0a9622d2563191abe793", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629719220, "uuid": "4fceb905-e796-4876-be66-cba6f133ec2f", "comment": "Malware payload", "value": "8b0f359372c4ad4dd79e7a40a16e195c951b4fec7994b0736b96633aca11af5cf60a7a0b222e9848e1b4661fc834af82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629719220, "uuid": "07d025b3-391a-4ae3-8122-9a11d6e53b21", "value": "T1C605D0E07740C999D86B8E7A98369963B573921D8D68CA1D3CD2BF4B3C36347402399B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629719220, "uuid": "12303d5d-bb75-495f-9936-3b64b67d36dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629719220, "uuid": "99bda206-cd13-42b3-9c43-bd8c64ac81f3", "value": "12288:+PXMyiYeYqWBGSMBDHgZRdKHEEisfQEGgmuGND405/2+74nEKZH+dAA:w1eGelARMHwEGOQD1O+7ouA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629719220, "uuid": "99210742-2de9-4ce9-9c41-204c1b6fe7e9", "value": 824320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629719220, "uuid": "25341324-bd49-4600-97e8-42071079fa0b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629719220, "uuid": "c5177aba-3dae-4b7b-b862-8ab6f1374540", "value": "5 DRT PURCHASE PROPOSAL (DISCOUNT AND SHIPMENT TERMS EXWOKS).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a20929d8-0441-11ec-8fa1-42010a9c0011", "comment": "Malware payload (BitRAT)", "timestamp": 1629744047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629744047, "uuid": "dcffbeb3-75d6-4524-b5dd-4bcab6314e4f", "comment": "Malware payload (BitRAT)", "value": "51d11fe38b54b9b7968ffba3da87b319", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629744047, "uuid": "bb30823e-3351-4d88-9392-9996829396a9", "comment": "Malware payload (BitRAT)", "value": "8d3637cd959d0ea44c713b76b6ad46614b8f91a58398cad0f5929cf179cf9e80", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629744047, "uuid": "401aed85-d4f0-4ef7-a14a-a45bc3446b9b", "comment": "Malware payload (BitRAT)", "value": "691963d26a4390d2fe0b3e51e4085b7dd17a692c", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629744047, "uuid": "1dd4e084-afb4-4cbe-8a36-fafbc030d585", "comment": "Malware payload (BitRAT)", "value": "a99997455cc9c6950634e48b52b61d862bbc5755a7373581f437b470b9d876190383d92c1622c364913c8db5bd9eff43", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629744047, "uuid": "049f0a9d-5e9e-445a-ac68-22ed0cbdadb8", "value": "T1208512207261C075E4B607B8687983B967147EB05B3051EF62EA36FA27742E8DC3167F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629744047, "uuid": "f31d1b66-cb28-4c4c-b9be-b45df81c222a", "value": "2c5742c7faeedb0cbb7897fc9cc83de5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629744047, "uuid": "0a115090-26b3-44e4-a859-c3b62ce32d83", "value": "24576:LnUVXZQoEVesE6IcY4DCrmBW9M6LbDFUPi9Uu64l6CCV6qvPjLJ+vSCyvtVKYnFI:zoieJhiumBL2k0YcqvX0Tyvt8Yv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629744047, "uuid": "01b1031e-976d-41cb-a46f-32cba6d53555", "value": 1744384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629744047, "uuid": "628c2a9e-9dba-4311-8954-dac5770d0259", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629744047, "uuid": "cec7ba16-41b4-4696-b65d-f0d4107d6c8a", "value": "51d11fe38b54b9b7968ffba3da87b319.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "accb86d4-03cb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629693385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629693385, "uuid": "7366d4c6-544f-4b3c-ae9f-fbd9617929b2", "comment": "Malware payload (RedLineStealer)", "value": "7021cbf39452b83c63c57bbf706f9a9e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629693385, "uuid": "0e332579-9bed-4f79-8a69-7fcb9e046023", "comment": "Malware payload (RedLineStealer)", "value": "8f308760b57ddfb34fbbcd49563b3056dabdb589d1999265bc8952453c36d261", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629693385, "uuid": "954572a4-7809-4197-b21e-9a685ad298a8", "comment": "Malware payload (RedLineStealer)", "value": "414a61b96e04762d02e6ab60095ca8845017908f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629693385, "uuid": "565c7ccc-ac14-4458-9cd5-aee33ef178a1", "comment": "Malware payload (RedLineStealer)", "value": "5c21d4215aea35dbc911f8d089bc161cfe462ee5f196c4574886ad586acaf6ff2d532b29cdecd2ff9ce1300cba59bff8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629693385, "uuid": "7dff514f-8254-4876-b82c-24ec3e88fd3a", "value": "T15A74AD30AB91C034E5F712F855B983B8A92A7AB16B3450CF63D11AEE16347E5EC30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629693385, "uuid": "4beb976e-d136-4377-8811-81b1f051ff1f", "value": "4aded8f080ac4b6e892c4de31a213f2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629693385, "uuid": "59c999dd-883a-4868-a655-6c5c2554da06", "value": "6144:U4qlidWj/GqawU/u/GgGHy745hD4E+5DRAoFU+MoJri0K0AzTIbCGlM:+6WjdA/yGHyk5h3K79MCAfIGp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629693385, "uuid": "5014ba5e-bcd2-4ebc-9b41-b226702451f5", "value": 352768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629693385, "uuid": "95f2b815-a02b-4819-92d8-def0dfad37c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629693385, "uuid": "dc82099c-f8cf-448d-b00f-bfd5029abdf1", "value": "7021cbf39452b83c63c57bbf706f9a9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63297265-043c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1629741794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741794, "uuid": "8f0a8823-a1c9-4735-a020-9833109c9ba8", "comment": "Malware payload (DanaBot)", "value": "70dcce0d0c03f18e490fdf8bbb693376", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741794, "uuid": "341980ba-fe16-4ddf-b6cd-abf464e1be6a", "comment": "Malware payload (DanaBot)", "value": "8f438be9087893eb89cc179a9ddde3c868ed1998c4f87ad0abce6c56ae3b1ecc", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741794, "uuid": "29ce2e00-b2bd-4c79-a085-641d2d1e0540", "comment": "Malware payload (DanaBot)", "value": "5057845f47f7ab526cd9c47bf5d02731b6f07ac8", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741794, "uuid": "04a148ac-f4b5-4eb9-b18a-d10e620f5cc0", "comment": "Malware payload (DanaBot)", "value": "191b02be32b54ea954c548a2302eee585f9562240508a3e8411d3f0c0330e3ff239707a751fedc59a251b3a300113708", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741794, "uuid": "73f20f6e-c69d-4f28-b1a9-e6e2a0e6c9c1", "value": "T1E635234A6DECC872E0F6CAB21EA38B311552ED7035BAD2069780FC5D7674522E735B0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741794, "uuid": "da6d06ef-dc20-4aab-ae96-d9ca8f49f209", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741794, "uuid": "463a4b94-6e3a-4df0-84be-3f989a28d040", "value": "24576:lq1ZaQZyWHw0sin7rvPmds+nx9XkOFDlerCkGhQZCS:s1ZaRMgin7rx+xFkoBerCkGh5S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629741794, "uuid": "1c89b115-c3d6-465d-af68-7100484292d8", "value": 1090916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629741794, "uuid": "eaa5d06a-d1d8-4e2f-b4a6-e8344caf00f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741794, "uuid": "fdcae149-def6-49cc-807a-fad9158877d2", "value": "70dcce0d0c03f18e490fdf8bbb693376.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f92cf5cd-0462-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629758367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629758367, "uuid": "96c671e7-726c-4ed5-90a7-b0098d2a7fa9", "comment": "Malware payload (AgentTesla)", "value": "2d3ca3b39e4f9a0fc0f7b91c096484fe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629758367, "uuid": "867f3e01-2575-446d-9f8b-8e0c79cf315d", "comment": "Malware payload (AgentTesla)", "value": "8f68a40ad1e007b49bdd1fcf9ef3618cba648f5b19c311c13a9d7ced266e3d73", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629758367, "uuid": "bfa455a2-3020-4917-a7eb-8ddd6ab480b6", "comment": "Malware payload (AgentTesla)", "value": "4d6fad61d684117c23876ca2ec05a73e347b5ad0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629758367, "uuid": "55e03004-b607-4ce2-b9ab-466f2e6144bf", "comment": "Malware payload (AgentTesla)", "value": "77312cbd640d6249546b4900f83cac68e241db7caa06910a4e8aaf2d5f5ec8f657a178b6188a6912059358657d89e46b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629758367, "uuid": "b07a5982-1a16-4083-aa84-778109e60e59", "value": "T17105F53D1AFA1637D1B5C355EBE58423F149985FB410AE6A6CDE03A7030BA9734C722E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629758367, "uuid": "20bfadce-e66c-43bd-b7bb-c2d4acd438fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629758367, "uuid": "d8c3cf16-5548-461e-b9fe-ac794ecd8212", "value": "12288:GT6GFSN+RBeowAkIGFbHK0R9iI/dUeG7tggpSfgKVGjLJ08iT8:2xFYordMH3B/dRut8fSja8iI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629758367, "uuid": "0868efdc-c5e7-4985-a2bb-b0a63b9c21c5", "value": 868352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629758367, "uuid": "93683081-a45f-4bef-9f39-a002c0889c5b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629758367, "uuid": "813525c1-92f0-4d41-8ae4-15d5fc8a7563", "value": "ANTICIPO DE RENTA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcc665f2-03fd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AZORult)", "timestamp": 1629714940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629714940, "uuid": "e30702c5-d28d-43b7-a706-f192eb56c543", "comment": "Malware payload (AZORult)", "value": "bf2e8493970a57649cec55d38f5a542b", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629714940, "uuid": "d890baec-aed9-4daa-a6ea-fdc330867c39", "comment": "Malware payload (AZORult)", "value": "8f9648879a2d781dbb8390f7b5b0eea36201fbf15a02b0c5d374271dd211bbdf", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629714940, "uuid": "33ff2857-bbf8-48e0-82a6-fcb4b138680a", "comment": "Malware payload (AZORult)", "value": "4b515de9d55f7201c19fe177ea7a4de4569221ae", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629714940, "uuid": "88a4a3c0-de29-4305-ad39-9e6823ee6d6e", "comment": "Malware payload (AZORult)", "value": "d8d08ac759704633049a22a96c344cca9a840716db6ef09d610aa925948c32b116d6a4399cc841a3031217c16a3a6254", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629714940, "uuid": "29589c9b-23b8-420f-9f7d-b5a1810a8e01", "value": "T16EA402213608FB7AF7E446F05891D6B62A097FF12B1F266FB7417F5E08787D0191AA10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629714940, "uuid": "a5ab78b4-06b3-49a0-b944-55fccea73f03", "value": "6ef74f7b87fa15b6df54d064a5b8ef31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629714940, "uuid": "4b5a62ce-5f19-489d-a225-728aed6f2df7", "value": "12288:OGKE6iuzAoYSrQb5lAA7OZBq7yeIGa6cA3l:OcxuSbUVWcI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629714940, "uuid": "9f25367a-5a66-4da1-9ef6-ac3712ec68c6", "value": 468936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629714940, "uuid": "45f8dd75-71e2-4c0a-92fb-586e1cb89e8f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629714940, "uuid": "741839b3-2256-4739-8994-0893ead805b5", "value": "HalkbankEkstre20210701173131248421.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eda100e-0464-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629758940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629758940, "uuid": "f2d69513-7100-4769-8f3e-7d264d9b9946", "comment": "Malware payload", "value": "008608dca212d3f45e4c7fda3cacb663", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629758940, "uuid": "50e48e58-9291-4a6c-ad0d-cd21df6943f6", "comment": "Malware payload", "value": "90b0a7ab2ee3b49561d7cd901395a6abf0011d452f77f74109e8f21fd32f3b81", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629758940, "uuid": "8373adb1-2f7c-4da7-92f2-d96707f74698", "comment": "Malware payload", "value": "f25f0409b2bfb0ba306890eb4499abc7f058c553", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629758940, "uuid": "179c320e-ee3b-4b9d-a19c-bfea99f03d61", "comment": "Malware payload", "value": "c782f426ec4dde82b422c10eef8b5e4dd1c1d850bf0f178c2f65c933cfe8cf4ce42ec7c9bb74f8dbb8aaee5c39d4952b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629758940, "uuid": "86c7c315-69ca-4f36-b8df-b207a8fe9a1a", "value": "T1C9D523223B888E0CC6FD9535A4DB151547F4EF832832D228EDC676D95F72362AB075CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629758940, "uuid": "2f7f7983-c216-4e88-b00a-da61b33348d2", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629758940, "uuid": "1c014876-2115-483e-88f7-1c44a0a59c16", "value": "49152:m3u2e68NKdJQlNOTFHOHANoZs2+DEPexwU7oczEUXqjoIr5H2p+NmA:Ieg/UNIFHRO3+Ya7q8e5Wp+Nx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629758940, "uuid": "d127e7f4-4972-46c8-9165-c81a92e24bdb", "value": 2770760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629758940, "uuid": "d53b5ba9-91b5-4960-b7e4-c4bb58375e0c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629758940, "uuid": "6c9ab7b2-fc89-425a-abca-3f838523c8ff", "value": "008608dca212d3f45e4c7fda3cacb663", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89d98e5d-041f-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629729404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729404, "uuid": "a718a29a-6de1-4699-af21-93203ca826be", "comment": "Malware payload", "value": "5c29a5e79abdb210fbbec5e1a78cc0f4", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729404, "uuid": "f735743d-ec07-4ce8-b7d1-179ee7ae4d7c", "comment": "Malware payload", "value": "91377ef04cc388371a9cfc541a5495ec690fbb099075e402c51c83598d58db81", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729404, "uuid": "a62cdeb1-af9b-43ea-b20b-ce7b6ab99fb5", "comment": "Malware payload", "value": "7632e461fb22e416b32baefb1686903574d0a0e9", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729404, "uuid": "fe94cabc-7b8f-4981-a001-0154920063fc", "comment": "Malware payload", "value": "c979bf8d33ebc206df754f3c0411c6786978174d3a82a6bdf836a8fd127a444f3e4cac7b1c065edb1d61af7d6671e3ec", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729404, "uuid": "5dcb682d-30ca-4348-b040-17703823594c", "value": "T1DD4523426DCA0BCBCD27C235E642F64A0C26CDDB6DA4464E97CC3A4CE135736DA52A4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729404, "uuid": "1d81331c-78e3-4a99-8771-2b5ce921a139", "value": "24576:iT5YJPAlAEJfa7jMSj6oxxhJE6NCmeSJVEjqLCytK+MOm4rZZ0BtLE:itoPwJEMSm0s6gmnRLCyM+MENibA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629729404, "uuid": "903578c6-9712-4b58-ab76-74719ed64409", "value": 1269272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629729404, "uuid": "56de63be-ecd7-4682-ae47-fb9812adf662", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729404, "uuid": "ac2b326b-0f4d-4bd7-a6f4-00ab601fc8c6", "value": "express nouvelle promotion.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adbc502e-040d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Cerberus)", "timestamp": 1629721733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629721733, "uuid": "3d060039-6327-4a4c-bbb1-771ffaaa8faf", "comment": "Malware payload (Cerberus)", "value": "99559267fc932d7dc65e0036fa2531ec", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629721733, "uuid": "bb93d87e-4d4d-41d9-bb93-2fdec29d707d", "comment": "Malware payload (Cerberus)", "value": "924872649ead11a01fdbec876bd3f6f1f6b184403c2fa5f2f625b646092c7c50", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629721733, "uuid": "625e4ad1-a255-4e58-8432-2e87b28f77b1", "comment": "Malware payload (Cerberus)", "value": "7604689c05cec08efeacc55b1e951fbe51e914a0", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629721733, "uuid": "da4e9126-53a7-4823-ab17-dc03c96c09bf", "comment": "Malware payload (Cerberus)", "value": "b8132f39796d60b4f06dfdf0f283604ad40d85594e517395d8839d2a7b11ddd8589e3b59524fe7cec992dde4c0f2960b", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629721733, "uuid": "48119008-a9eb-4595-897b-286d0c54c96e", "value": "T143D3F183179425BAD4BF66B842DD93B62A735E80B6E5B3C32C055048ACF37B71F49E24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629721733, "uuid": "3de68887-d9e2-4035-a991-7886679642a3", "value": "3072:9RzS7bpOsRmLlbWHdh01MJaEmdEYKGv0muLuIQ2XzXcvNP:9RKxRmlyqMmE+0movQ2jsvd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629721733, "uuid": "f56d01cc-e125-4290-b5ea-39dcc42440d8", "value": 136613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629721733, "uuid": "9ff61dff-2999-4d61-8aa3-4490c3a5e3e5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629721733, "uuid": "e8e99f55-1508-4ca4-a238-62bfabd7ab56", "value": "playstore.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c05d1514-03f7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629712316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629712316, "uuid": "d0dbf134-5206-49a4-936f-2aa0f55f437c", "comment": "Malware payload (Loki)", "value": "09d153feb21192d1c2638f9d166cd03d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629712316, "uuid": "597e14f5-a345-47f5-aef0-0d6a1ddd3d66", "comment": "Malware payload (Loki)", "value": "927097c49d737917b78c855a8cffcdd299a348231bd2e75622897e3a96326e25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629712316, "uuid": "7bdbce0a-0fa5-4df7-8f54-b9e756bedd99", "comment": "Malware payload (Loki)", "value": "2a88b9f57fb98ebe70a9c00c9ba49411cb7bd6b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629712316, "uuid": "eea95240-9bdf-40c2-8ed6-66009509c35d", "comment": "Malware payload (Loki)", "value": "744c20a1a2b4b807251a0c31020e4d6d5841626b3641333724a2c0a6f71b33f2a021b15e8e5bc5b290bb2e0b29755877", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629712316, "uuid": "233d84d3-b58f-4d38-af3f-f3e0ec749e16", "value": "T1E0B4BE11B9C0C032C673387107B5E27248BDBD3029655A9F67983A3A6F741D1EA39B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629712316, "uuid": "7d6cadc9-f3fa-48ed-aad2-eef0235f350b", "value": "bf08a978649b718b66012803a6d17e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629712316, "uuid": "f5db2ad2-2740-447b-9b30-32e48731265c", "value": "12288:Rg8tD+p1h79i/DdVedE5fJD7uwkRPcQt32eBR/a:RgwVDdcE5fJGtBTa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629712316, "uuid": "171a7187-497b-4bc7-a4ab-dbe8549d44a2", "value": 529274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629712316, "uuid": "6606f98f-1e2b-4ff7-b6da-35b20d233ed7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629712316, "uuid": "ca722dbc-ce3a-48b0-bf03-8ecc8303196d", "value": "SHIPMENT ADVICE CMA G4K400939000 -PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76f56ac3-03d7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629698449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698449, "uuid": "e5e9be72-5787-4b5b-a0ca-84ec2171d026", "comment": "Malware payload (AgentTesla)", "value": "53b2f71c3200d92f0164faac5485173e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698449, "uuid": "91a41129-145e-4237-aabb-cce529ddcc9e", "comment": "Malware payload (AgentTesla)", "value": "9372d4579b0eb33be8eff547f11b719d145eb5e0bccf7104b45da13fd46c3a09", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698449, "uuid": "6a6c7a5c-c265-4f0a-a1bb-83afd175fde6", "comment": "Malware payload (AgentTesla)", "value": "8d030de23ab0496adbb2f5ee979b508ee122f04f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698449, "uuid": "70289457-29c2-4ae2-be64-ca561a1fea69", "comment": "Malware payload (AgentTesla)", "value": "67ec6fccbe11a4649befbf67e80e3bda9c09e64b939b3f338c923b0f98467b0e80e90267b7085ddf45971df1529d453c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629698449, "uuid": "5e148cb5-603a-468f-a66f-dffcbc6681df", "value": "T1567220ACC0A742988F856BB86B2BAF90118C762DF784A672317C97342BD1D7B5417C7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629698449, "uuid": "55b9ea6d-3389-45bc-82f5-3acae6292ba3", "value": "192:uBc3g100nUqBxhQvzyZ2ZHChYCSSSKstBqqc3NJ6EmtqH9X:uBcg10vqBxhQvzyZ2JCbSSRstBzq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629698449, "uuid": "d0b0ac21-df1a-4248-a2b6-f7d9c4073f97", "value": 17096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629698449, "uuid": "0f6d5b23-9e6a-42c2-add3-2b014fea5f15", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629698449, "uuid": "812269d8-4492-479d-86c1-210476f4b892", "value": "RFQ 73992002.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7e9b076-03dd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629701215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701215, "uuid": "eb0a2def-9ec7-4c64-8b0f-f12b653512fd", "comment": "Malware payload (Formbook)", "value": "776747c98a79cec7441b62cb4f1dda85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701215, "uuid": "ab5d5f74-e401-4c99-80b0-c5ef5f5097bc", "comment": "Malware payload (Formbook)", "value": "937618b9f0559b09566c4f2f86275b04dc9de0978e0fa08b25869e246d87a9f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701215, "uuid": "c321aa70-faac-43b7-a6e6-fb5549bec5bc", "comment": "Malware payload (Formbook)", "value": "1c6b9a49e6c905111cb45745b08e58082185b853", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701215, "uuid": "b57ac580-e7cc-4ccc-a9e1-5a660d680428", "comment": "Malware payload (Formbook)", "value": "9ae3c34fc080f9d346b0046ac8dfbbe073ae5dc23c0d80a8c0ffd351907a06a6846de8d5e89200fdd85fbdc8f32a50a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701215, "uuid": "fa42a718-3e45-4509-a832-dca05153148a", "value": "T14515166265F23476EF61FFBF9A4982A20C58BF91C65B388367E538044A36183F7125F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701215, "uuid": "a4931262-2f33-4b51-8e7b-0a9122c3aabd", "value": "294cc3722913504c95d229781103fe5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701215, "uuid": "34f8fde9-0893-4a5d-912e-2fec138090f9", "value": "12288:F1JL2cht6G8ZeBIkTuuRRt+UrTzXqrWer2waWHv:FfLQGoeBI9ubhfuaer2waWHv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629701215, "uuid": "8336b153-2655-4b4c-a917-52da36c6ccad", "value": 903680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629701215, "uuid": "f73f39c1-be83-4614-b70c-d84da864b462", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701215, "uuid": "f6214d20-a0f8-42f7-8c3f-8bba77577460", "value": "776747c98a79cec7441b62cb4f1dda85.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d191962b-041f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629729524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729524, "uuid": "6984ef4c-7574-4400-851b-14f5e89f4445", "comment": "Malware payload (Dridex)", "value": "11f8f9028c6f5be72efde75cd177515e", "object_relation": "md5", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729524, "uuid": "e2046b66-73c9-4c44-93e7-547c7f7ee74f", "comment": "Malware payload (Dridex)", "value": "945de16b7780b22c96087724a576577b397716a1731dc2e540bce2f21f07c175", "object_relation": "sha256", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729524, "uuid": "04b62553-2fc3-4234-9a50-8a26ddb9b6dc", "comment": "Malware payload (Dridex)", "value": "35ff2216c6e7b1bb89bcd2299f4a8062a713f434", "object_relation": "sha1", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729524, "uuid": "ab087422-a1aa-4994-8932-cfd53c11a226", "comment": "Malware payload (Dridex)", "value": "aefd4de8dcb1f15eb445b558a8299261f831d1cc990497ea77692d40d5dad2c5dc1e4b03eb607b2465fc6041bd51cc8a", "object_relation": "sha3-384", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729524, "uuid": "8a37c1f4-e2c6-415a-adcc-807e6e8a9dd5", "value": "T11DD3D0AF7A36DD1CC42A533C46EE5E776BB0C74552E207131168F86CAF139E7AB18218", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729524, "uuid": "1db13989-dd66-4e59-a9ab-03835f955a67", "value": "3072:oU/k5Ch8rhYUfxe+FCQIWi63LD6z2qoaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaB:olK8cL67Moaaaaaaaaaaaaaaaaaaaaa0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629729524, "uuid": "ae562171-b2e6-4fd2-bac1-612025ae3b30", "value": 138808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629729524, "uuid": "1f5b9633-510f-4a9a-87c1-b7abac7744aa", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729524, "uuid": "7a7bf970-d515-46cd-a2cb-29affb687138", "value": "Invoice-364680_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a1f2a4d-0463-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629758637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629758637, "uuid": "819a9646-449f-4dc0-93cb-e9ae473b6e3b", "comment": "Malware payload (RaccoonStealer)", "value": "89af8d786625c48a71ce9cb93a8d367f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629758637, "uuid": "f987bb44-dbcf-4738-89e9-430c1c84ace2", "comment": "Malware payload (RaccoonStealer)", "value": "948c35c2c7611793fcc9042c65ca6224829ee9c923efd4e9845ab32857727721", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629758637, "uuid": "14f7a598-4211-4247-89e6-7e73d7b754de", "comment": "Malware payload (RaccoonStealer)", "value": "acd7797f08dc53e22f46ba8fe80e31599f0f8be6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629758637, "uuid": "bb6186b3-109e-4924-985a-2c8ff75fe71d", "comment": "Malware payload (RaccoonStealer)", "value": "869e0c46c5f2d90790fcae7937d41e3c5524e1d1819b1bd378c09e8fb8c99f2dae6a857cb2be1ec58cda49142371f003", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629758637, "uuid": "856d7afe-f3e8-494a-a017-0a242ce2b1c0", "value": "T1ACB4D02076E0C035E4B712FC6975C2AC69297AB1DB3096CFA2D52ADE26387E4DC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629758637, "uuid": "0c370f5a-e8dd-44a3-ad5e-97e5da413aea", "value": "275552e3ca7b68357f0bcd3ffef4eefe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629758637, "uuid": "1258bc76-d814-48c4-aa4f-a026be364f87", "value": "12288:+GiSqTyW8LAxRBOatWxPzXKJPjr8SbeXjD5hPMO+F:RqTyWpUak56xNbeXv5p+F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629758637, "uuid": "2c378c37-5737-4f63-847a-88ad30e6c0f4", "value": 528384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629758637, "uuid": "b950a810-f451-433a-9f82-789157f31324", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629758637, "uuid": "52942df6-e521-4138-9665-0362c9a6b36f", "value": "89af8d786625c48a71ce9cb93a8d367f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af8f6c0a-03e6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629704986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629704986, "uuid": "2b193798-6f1c-4463-b3c8-21af9b2ee911", "comment": "Malware payload (AgentTesla)", "value": "691180d2c31121f24a2fee1ee8a34b2c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629704986, "uuid": "e9c63a77-7348-4c2e-ba5c-e5b37756a4b7", "comment": "Malware payload (AgentTesla)", "value": "94a92351cb8d3dc47240f362df959f1d063bbcd5014aa440583f58baf1126d38", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629704986, "uuid": "3bce43ee-2dbe-4920-be99-d0383556c448", "comment": "Malware payload (AgentTesla)", "value": "34fbe84f1fc8687dc49bc51fead4de37723fa451", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629704986, "uuid": "bdbf3d10-6848-4da2-8c2c-8c90014ea776", "comment": "Malware payload (AgentTesla)", "value": "c7ae04b2420b1f4bb7f68fd6c2655e68b8b246d06963c9ef50bad03e48fec53d0606e70d6628c517106697aeb2ba45af", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629704986, "uuid": "0a339b89-f670-4040-a390-83db142546ec", "value": "T15E05F63C19F91637D1B5C365EBE19423F148985FB404AEAA6CDE03A7034BA9735C722E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629704986, "uuid": "e51ffd25-ffa1-4743-9368-20782cb6f8e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629704986, "uuid": "6e494f68-c465-4bc7-8018-857d56b6cc9f", "value": "12288:3ipSL4TKI6gDcfH2AaAr7U86X8nCsphK2kUAo5EU:3rL491cfWGvnYOphK2kUAo5EU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629704986, "uuid": "1f45a328-8ca4-4509-b663-698c7feda909", "value": 804864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629704986, "uuid": "a2a1d9e5-c5e0-49e1-9c5f-6c0824315442", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629704986, "uuid": "374fae59-c5df-47c0-a442-bbff732190d9", "value": "691180d2c31121f24a2fee1ee8a34b2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "606a7f14-0424-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629731482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629731482, "uuid": "4a0774d3-79b5-4e4d-8963-f27a8029a629", "comment": "Malware payload (Dridex)", "value": "6e7c1f6882a7519f9d187122533b265c", "object_relation": "md5", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629731482, "uuid": "7e7e9a3f-0d30-47a3-909a-a7f55e16b6c1", "comment": "Malware payload (Dridex)", "value": "9526c196746d330e8325d255833b0ccab912683d85ee577e96bb6aec34b8bac6", "object_relation": "sha256", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629731482, "uuid": "58975274-3f6d-4914-b9ef-379a90470f60", "comment": "Malware payload (Dridex)", "value": "90df1559e5afd19b030be4507440045e31b38328", "object_relation": "sha1", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629731482, "uuid": "e2b51aa5-693b-42bb-a700-d4f3e46762a0", "comment": "Malware payload (Dridex)", "value": "ad3211b175bc373ad1f18ec7752fa67007a32d83a9c3040da122b4a7900dd3937959cdad1b047563237eb71fd1e5a0d4", "object_relation": "sha3-384", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629731482, "uuid": "b520e4f3-e769-4233-9d50-16b4c66db695", "value": "T17C84122896B2CC0CC80E903E95DB0F7197716606A6D1B72B95B0B90D6F07D3E4A7F16D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629731482, "uuid": "8cc10538-25d3-4f45-940d-6d934abdb87e", "value": "6144:orSy/HdNIzZ6iygOP2LohOGYw6CC5jTT453mjEIbWiGVAKSLFN+YInSCRvuPsxN9:USyvMzZtrL2OGY/TTy2jEIJc6FNu3uPI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629731482, "uuid": "0ed0e7e7-57c4-46f1-a3ce-6d53813e8d4f", "value": 382662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629731482, "uuid": "6c51fce0-bb1d-4176-a251-04649d99b3c1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629731482, "uuid": "b1a64270-13ca-447f-9b10-57fa6be61a66", "value": "EoY_TAX_Notificaion-0527466991_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32f9f17f-03c5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629690604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629690604, "uuid": "72f9416c-aec0-4cd5-a75c-62b7e3ae21b5", "comment": "Malware payload (Mirai)", "value": "89ea59bdea9f6673452cb2b37641ac41", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629690604, "uuid": "9ce33203-ca95-4b1f-bcf7-4f54049c8573", "comment": "Malware payload (Mirai)", "value": "953c3a3f31d5f1e65121ef0bba203c3f26ec42d9bc972808c0c767e5986be148", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629690604, "uuid": "fe8d0a36-07cd-498e-9747-328cf1d9b11c", "comment": "Malware payload (Mirai)", "value": "6b8885bbe7d3144197563c1914e53b38530f701f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629690604, "uuid": "843ebf3c-3edd-439b-9514-e10a6847a3d9", "comment": "Malware payload (Mirai)", "value": "7825b805d77925e8a2b32930b402f166b00e3c891e4bdb92eb36f641d1d722dd680b59d09ba576557f5b9aab6225a4d0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629690604, "uuid": "f7569e92-c769-4068-8c87-b3dc2d67e2c2", "value": "T117D2E11F84FC4AD9E61B55304BEF37985201F82F14A85AF1EFC8F51A74DAB456026AC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629690604, "uuid": "eb32e8f8-958a-40e4-95fa-e7033769b802", "value": "768:F+eiZIiTk9Lv0lxi710xWN+XxIVU1xnbcuyD7UHQRjq:FYNyLWQJ6Xx8snouy8HyW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629690604, "uuid": "126547e1-6d67-4018-82fe-4f1e2f2582cb", "value": 29564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629690604, "uuid": "67484cf7-e2f0-4226-8509-aa01a5f7ad58", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629690604, "uuid": "f995210f-2290-4166-b599-675752d418f9", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8957b0ed-042a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629734128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629734128, "uuid": "b51888b1-ada7-44cf-9396-6d0b7bd34f44", "comment": "Malware payload (Formbook)", "value": "e9c5234672c791846a076210769b9c87", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629734128, "uuid": "96cafcf3-dacf-491a-8223-7f3a03e83502", "comment": "Malware payload (Formbook)", "value": "95fa5bac570a78d55bc2494fbacdbf3d38402df53894c5c321db7f3d33639e1c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629734128, "uuid": "6c2ced08-550b-467e-9a67-b1c789ea44b8", "comment": "Malware payload (Formbook)", "value": "058cb8c1c22dac1d6be4379c5515015fca4a21cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629734128, "uuid": "7c8e254d-916f-403a-ad85-f288814f34ac", "comment": "Malware payload (Formbook)", "value": "7f27aaa85df3d4f84c4f0b42e60452fa793bccee29658b7ea26f955d5863b04dd0b91938cd63f8c1e99d0310ba564a03", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629734128, "uuid": "08bee131-f8d6-4791-a7bf-6395452bd2ea", "value": "T103F412053704EE8ED67F4E3BAD6A2860A7F5C5621753E716ACD612F9080EF9B4A001DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629734128, "uuid": "5b728f2f-409b-49d1-abd4-fcc40e776e11", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629734128, "uuid": "1fe36c74-c6c8-423a-8b86-ef2796153bbe", "value": "12288:vAEfnNjvsf2JH8dL/a8R779KMHtc5pcryW86x3RDXyX3wX5NpSp5LAUDUOV6ajuj:vAEPdirQaym3RDCHGNwfLAU3a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629734128, "uuid": "bddfc380-1789-4373-958c-3fcc314c8f1f", "value": 751616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629734128, "uuid": "39236449-3fa6-457c-aac5-97393002c994", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629734128, "uuid": "4bd592b7-79af-48e1-bf4b-08ab023d25b7", "value": "e9c5234672c791846a076210769b9c87", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c154f39c-0403-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629717471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717471, "uuid": "dcfe5fb1-6a31-4c59-9e56-29604db4614f", "comment": "Malware payload", "value": "8c25cc5e2bfea86164e0d9288e5d5dcb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717471, "uuid": "4dcfa91a-6501-45e2-9871-61dd0a0bf8b7", "comment": "Malware payload", "value": "964a32e3b4170aa8a5d45ce250e3abbbd424ee0a9d956ca872d405bdf5abe88d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717471, "uuid": "d34c90c2-c799-49c1-87ce-185f4d05ce2e", "comment": "Malware payload", "value": "26b6cf2e5d05f159ae27305be979c2f8aab57f5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717471, "uuid": "74f9da15-d729-400e-b1dc-9771d399ef23", "comment": "Malware payload", "value": "855bf35c12ca96626b4d278c1fa0cd0f1686b4e8d46218a2bd7622a130a6332b5e163a9687e12c1a409747fb73a88f8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717471, "uuid": "f529eb3f-161a-41e8-8d71-aec6129c6f10", "value": "T126059DA2F2868877F6B31A79AF46568466357C205F3854C27FD83C88DF333553A2818B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717471, "uuid": "a78396dd-cd23-4ab5-b3da-3e21dc664702", "value": "1abe4551dd4f8ef04deab38d0027e326", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717471, "uuid": "53927c70-4f5f-4335-9b7d-7cb3c704f566", "value": "12288:WhxUck0fyI/Xv94r0umLKC+pvbIAsrxPD+o8wcB:WhGdkF4r0uvnDIF5P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629717471, "uuid": "b88f5445-558b-43af-a672-22c2eb077dae", "value": 846848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629717471, "uuid": "0002eb14-a899-4b80-bd71-a1f6778192d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717471, "uuid": "d440b65c-199a-4c71-9f28-74524217b2f8", "value": "RFQ_AP65425652_032421,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05832bd6-043b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629741208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741208, "uuid": "7b5c8ab1-38cc-4a35-8639-ddb9f2d8de86", "comment": "Malware payload (RaccoonStealer)", "value": "c4a9bf4c298c56f98ab79b64b1a54faf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741208, "uuid": "dff5042a-525e-4bc3-9c0d-5692724fe003", "comment": "Malware payload (RaccoonStealer)", "value": "967ded397e18cced0157f172cea7183c3571817fea99e3a1bb0a91a3b52e665f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741208, "uuid": "64ba5736-dee7-41c6-9c73-5350cec1ecf2", "comment": "Malware payload (RaccoonStealer)", "value": "6ad4124bba5eb24ce2e6616d99c56c42e9728167", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741208, "uuid": "900d1070-1615-48ed-8cc2-ebddafa469ab", "comment": "Malware payload (RaccoonStealer)", "value": "8b8cd4e63339e8c479b4bc0104aebc218d17f4d1ed593720992f5054c3d88191d9e075664d22e8a4b8751046e32fc0d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741208, "uuid": "3f805d9d-26a9-45fb-964c-4ff93ae3ef1c", "value": "T19FB4D030AB91C035E5F311F8557A82B9693A7EB06B3490CF93E12AED16347E5AC31B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741208, "uuid": "072e3ad3-1fa3-4abc-999f-b9c5320ff419", "value": "5c06a288f07d43206aca52d5d94444b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741208, "uuid": "129e041e-f959-44f0-82aa-6771b3a481ef", "value": "12288:nte3xsLst98KsTae1IHQc732rO9q08CK4GuroGbqqO:IsLs/pHQO2rO+lp4tO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629741208, "uuid": "74202e86-cc61-49c3-a519-85b330ca78ae", "value": 539648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629741208, "uuid": "c0e84679-c081-4020-8d9c-b532bd353952", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741208, "uuid": "a2365efc-b319-4508-8b42-d945cfde4a78", "value": "c4a9bf4c298c56f98ab79b64b1a54faf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2706ed17-0426-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629732245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629732245, "uuid": "164e8c1e-2f44-45dc-b7bb-d4a17e62f15d", "comment": "Malware payload (Dridex)", "value": "871071a9adfa42c59820c30882fd5240", "object_relation": "md5", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629732245, "uuid": "37de254d-1c56-4329-8ff4-39de700d203c", "comment": "Malware payload (Dridex)", "value": "9727ab7aa15fec140b13d599341116a1eec882bc53e6f5b08197f4e3f93f4ba4", "object_relation": "sha256", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629732245, "uuid": "8c790944-210a-422b-a388-5f31f11ad347", "comment": "Malware payload (Dridex)", "value": "c37f4c617434a902d9a3063f15e43a9c6324421b", "object_relation": "sha1", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629732245, "uuid": "9c6415f1-fd1c-44c0-ac32-a1b78d66480e", "comment": "Malware payload (Dridex)", "value": "8ecbf8a61dbc882e6a3a59437bab61b65b640d9d93cb4c6569d5111f4f05637cb2fb893d9a36fe373a42ac9d097d9963", "object_relation": "sha3-384", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629732245, "uuid": "5286d6bf-8f03-455e-8167-e53801dcd031", "value": "T1AE04D0CADACBBBB0F15B1931B2479D7324BC3806C378D14BC9C6D06649B493F91629B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629732245, "uuid": "57d3b7cb-4875-4ab3-bdf8-deee8fd69988", "value": "593be5ea62e24a49dbd6f68a4587d600", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629732245, "uuid": "98e4d77c-a315-4c3d-a30b-bcb302d49c99", "value": "3072:ypBt4RUnGdP8IEQXzCPzA6TkHZ2pClbpU9q3XpO9adx1Gyy8EG+pt55la0:ypj4anGdSu2b020lbpOApO9+x10lG+pr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629732245, "uuid": "03d9e734-42d4-4245-baa5-8b498b5f1652", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629732245, "uuid": "fe47137a-19b6-493d-a7de-79851bf91c7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629732245, "uuid": "959c4afb-d545-48f2-a16c-5d45c8193425", "value": "39.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcbb9582-040d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Cerberus)", "timestamp": 1629721758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629721758, "uuid": "35c7c300-c5f5-4300-a1ae-b9530d4b8aa7", "comment": "Malware payload (Cerberus)", "value": "dd270c4680162ff3dc32ef54af37ee5c", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629721758, "uuid": "b841b558-7c92-4527-921b-6bce151c65bd", "comment": "Malware payload (Cerberus)", "value": "9767d501e9a5c1f125d568645e42f057884258ceb38d1641a99a219b77dd3ba1", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629721758, "uuid": "1b2dfb70-a3d5-42c6-9bfc-a64e58e3f333", "comment": "Malware payload (Cerberus)", "value": "c74378e7489b682a84b0457d158b8d6c068707a0", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629721758, "uuid": "7375b253-7fd3-49a4-9428-ac5105264625", "comment": "Malware payload (Cerberus)", "value": "f4487dfad6c7f28c9f5ee09f5e033d8ce9c9dea1d710e1b902516da0b8b461effc337ed9e233049d30429a2db4f09fa8", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629721758, "uuid": "efa6c17f-e098-485c-8b79-f50d01c4883d", "value": "T17FF53359EB86D48DC57F8331D0476B734BA5184A92C672BF897B048E90CFD684B13CBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629721758, "uuid": "73dfa3a2-bbc5-491f-a1d5-0203116c0339", "value": "98304:7Ua0ymRUaKDkw+tkAn4mqpGp8wqzj0YuCuo9S9:H0y+KDoeAnhq0ewqzwYum9C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629721758, "uuid": "cbe12f65-400f-4331-b743-32d821f6a196", "value": 3404640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629721758, "uuid": "58e1eae2-c5b1-4e05-8f5a-acf9d35aacd0", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629721758, "uuid": "bd8b0b5e-705a-45b7-a674-dd81e4a963c3", "value": "Android-Update.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b452dd42-0402-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629717020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717020, "uuid": "ca46bf27-41f6-451b-83ad-d73bd42a3196", "comment": "Malware payload (AgentTesla)", "value": "235430ee1dcde985724ee7d77970b5fe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717020, "uuid": "6f14a626-d8b5-413c-8c47-cefc72b0f18a", "comment": "Malware payload (AgentTesla)", "value": "98820c448ed33b0dc124a9cd34f83254cf55ea8044ac5eebca9b8415bcc02e97", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717020, "uuid": "460f09e0-1205-4005-9242-64c417897c34", "comment": "Malware payload (AgentTesla)", "value": "1417b592570da680ee1d2a9b47af328cfc1ee8a9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717020, "uuid": "67b37576-4346-4c7e-af62-4c86f2291620", "comment": "Malware payload (AgentTesla)", "value": "f9fbe13a229864f5dd16fa16ae564e96d9bfc04e5482f84a9ffbbfb591bfcf4ae3ab1c8e04cf10c7f43e4237334c4516", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717020, "uuid": "a62047d9-b308-4405-82e5-d99ea45c399f", "value": "T10DA4F141B210E497E8BB13F19C4FC71031A6AC9D91B38A0E32DAB73995F73564167B8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717020, "uuid": "89c68a5d-386b-4be4-b103-f0bea61eab4b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717020, "uuid": "ec7955a4-c6e9-41cb-95e4-26654c4bc322", "value": "6144:VbAXJrRLvFQSfsSs3UyBB1sSjI+ER/Ry9K178X+py/T+DUHBI6JlqdHh8BGubjpF:q5rRLB1b+LjIJR/Ayns7+Dr4DcuBbec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629717020, "uuid": "b2630a31-fe69-4b8a-8578-21c461b8efb3", "value": 461312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629717020, "uuid": "1bb92ef6-4080-4c48-be51-71e9b4001a0a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717020, "uuid": "773abf11-e1c1-4535-a2ee-31cf7d688962", "value": "MV. YANGTZE AMBITION V.S2101.xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4472279a-043b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (QuasarRAT)", "timestamp": 1629741313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741313, "uuid": "7e0e9bbb-ac23-4860-8e3d-548e3e5964c9", "comment": "Malware payload (QuasarRAT)", "value": "0b8650214b8620cab46ec081c65240a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741313, "uuid": "b3195d5b-b859-4de4-af4b-e12e9c8e0b3e", "comment": "Malware payload (QuasarRAT)", "value": "98ed685e58c13887c499cef7806acfd58d771bdcf95b60d8c7604fd500a466ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741313, "uuid": "d020338f-8362-4228-9de7-e7323cc177dd", "comment": "Malware payload (QuasarRAT)", "value": "c831e277e42db175ebd8048d581ad30b0894b8ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741313, "uuid": "889e7da7-f6ac-410d-82cd-b64abf69e1e9", "comment": "Malware payload (QuasarRAT)", "value": "f3a033142810d9450e390dde3adab33a6f87725c765497ab0dac2d81482600db1eb7791b27ef7e8ddf1893fa6c83573d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741313, "uuid": "1f60cef3-0c8d-4ee2-bded-c89a17e11cbe", "value": "T134352914E7E855A5F06E7F36747198050B38FE03A97DD74B2B96A0990E6A380CC72F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741313, "uuid": "208a4e31-203c-437a-84ba-fe243668b6f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741313, "uuid": "d49520b5-6b4e-46c9-accc-c0636342e4ca", "value": "24576:1HhfC41BrFDRPNL5XVThfEIfyBvlelc5ww2H8p:ZhfC41BrFDRPNL5XVThfdfyBvlelPwG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629741313, "uuid": "d0eaaf14-c4da-45c5-9fdc-ef68ae0b40af", "value": 1085952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629741313, "uuid": "aa0f0226-5d91-40a6-9187-4fba4bfb07da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741313, "uuid": "459d0057-cd52-40fe-9d07-8590f1b07472", "value": "0b8650214b8620cab46ec081c65240a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c3819ee-03d7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NetWire)", "timestamp": 1629698323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698323, "uuid": "fbf20a6e-c60b-4aca-bc0c-8b192eef4527", "comment": "Malware payload (NetWire)", "value": "efa94719f0d14b3f8f330e5c7949dd2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698323, "uuid": "d235e663-fe0a-4a5d-a13c-0582688fe8a5", "comment": "Malware payload (NetWire)", "value": "98f868900b27ba82ac18f919dc551ea15dc310813eb1538ebf2d0ab3afaa8328", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698323, "uuid": "b1410a39-8946-4942-aa76-44134dfd9d9a", "comment": "Malware payload (NetWire)", "value": "6232070998c6d992941b4a5be9008efaf4af2370", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698323, "uuid": "6f574be8-323d-497a-81b6-11d032b9d360", "comment": "Malware payload (NetWire)", "value": "017f8a5090aea8e5b0a5aa02ca2cfc4babcc96f864e5f7ee126777fca295578c6807570bae582b641eae8ba075cde6c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629698323, "uuid": "f68f4a1f-2dc6-42cb-b4ca-961b09d56bdc", "value": "T131E48D16AAD58132D073CBB90D0F6681A1A3BD522B6978E77FF41E08AF376123465373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629698323, "uuid": "088a89ea-c19d-4426-91da-15ee95e75c97", "value": "8ba7b45407a54e1cc2cb82bc2d24f0c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629698323, "uuid": "0db28484-2f24-49db-92f3-a0562f56e086", "value": "12288:OWHQioUx/2JW1hxrQe+IguVZRFzODnQJ0+NpYuJTquMvC:OI52JWhZvP4p+NpBs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629698323, "uuid": "bc4bd19b-fe58-49d4-9b20-edf8a75a2a67", "value": 705536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629698323, "uuid": "5dc83962-a6a4-48e1-8214-beff4f8a5172", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629698323, "uuid": "8abfd68d-0136-4133-9bcf-309bd9b050b9", "value": "290321 de bon de commande,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7ba1058-03db-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1629700329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700329, "uuid": "a3e40036-3c7d-4129-a32d-294e9007dc8a", "comment": "Malware payload (ArkeiStealer)", "value": "5be9bfad00f219b0d219261448a57bda", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700329, "uuid": "501ef988-eb12-4692-870d-e38de10606bc", "comment": "Malware payload (ArkeiStealer)", "value": "996c8bc5c0ce6a773b8d401860ea39c714485bc6e9e58d75eaff99c26e384609", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700329, "uuid": "8be97e55-7ed4-437f-af53-e849c13dd3f3", "comment": "Malware payload (ArkeiStealer)", "value": "0600955c1006e2569a1e396c0f086e62e8521fdb", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700329, "uuid": "f34bf34b-9ca2-431d-8eda-91d5122d43bc", "comment": "Malware payload (ArkeiStealer)", "value": "5e753033fe44e783ae65915e009359c3a5cce3ccfec55d82fe4b88d6e7374f86263476437c75b1efcb8fa89a87a3174b", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700329, "uuid": "97715f49-16c1-474b-8ceb-ac0eeec2b025", "value": "T165F2AF55CB821C12EE53CD3531E1CA222734B7526AB6CAFF875DC2149F8178711E86BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700329, "uuid": "48e49470-b381-460a-80e7-49e68dd64020", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700329, "uuid": "cbd8d5ef-407a-4281-b951-6f283979e642", "value": "768:I+ZoDwj73SO/JtmZ6tbGkRsZlrHEzOKXI9PIBw9DGrDGqh2O:LaDY3ltkkRukz22BwxO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629700329, "uuid": "420ce1ca-deb9-4d90-83e6-569c8acf65f7", "value": 35536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629700329, "uuid": "86740dc0-8244-41a7-866b-2506b78f3693", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700329, "uuid": "254a3f06-040a-4cca-a608-1553c09575c9", "value": "5be9bfad00f219b0d219261448a57bda.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e15be3c2-03da-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629699916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629699916, "uuid": "e7d2a08b-40fe-4bba-94ed-8082d1e9463f", "comment": "Malware payload (RedLineStealer)", "value": "e36bb066704e69c1cd7451a6c3b088a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629699916, "uuid": "f8e95386-2853-4d47-b43b-bbcbce3a8330", "comment": "Malware payload (RedLineStealer)", "value": "9bc6d20da16865822eb0510b8e4d26a36af0b1f7568a214b374c5c0c61d220b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629699916, "uuid": "9fe70128-5fee-4bee-8fe2-b75dbd5317a0", "comment": "Malware payload (RedLineStealer)", "value": "9deffcf1e30b044ed118f666b2e96cf50bf2e736", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629699916, "uuid": "f43c888a-8819-45b5-b31d-e1a762604f45", "comment": "Malware payload (RedLineStealer)", "value": "bbd31c4453bd5988450a3fe99efed9e10f83d39a13bca163dfb2bc689d55e1fe93750066f8a79511a1087e53400d3e0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629699916, "uuid": "5665278a-6beb-40e2-9787-0b3f1877aa1b", "value": "T11732E90A67F89B37C5BA0B7608A355400BBDB215A572CA5E6DC210EF5D6270406A3FB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629699916, "uuid": "8292f563-fcb6-45f2-8a01-84cd20ebdf4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629699916, "uuid": "90a72926-ea76-441d-a1f8-bdd293bba70b", "value": "192:1rHXcaPGRnTCwIprgLmQLdYNHKdIP+V5mbRyfLV7mBp:17XcaPGRnTsgLXLKNHKdIP4IgfLV7mB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629699916, "uuid": "3718531c-2950-4565-b8e5-505302ab58a6", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629699916, "uuid": "26cc59e6-d13a-4f3a-955f-3b5f03a6e282", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629699916, "uuid": "f178a95a-4bdb-4592-bc0a-540c7f4a6600", "value": "e36bb066704e69c1cd7451a6c3b088a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e60b91f-0402-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629716929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629716929, "uuid": "a8201e20-17ec-48f8-99b6-2e776e032050", "comment": "Malware payload (Formbook)", "value": "655c04854d41d9a9a0284441760f3ab9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629716929, "uuid": "93e16484-ee53-4a5f-9627-60146680f583", "comment": "Malware payload (Formbook)", "value": "9c57a34a8d84a4cf8cc46c1881137e6cd6ed897fbbf6cad5e8ae966919c6057f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629716929, "uuid": "55f2a801-8a90-479c-b4cf-871617a94226", "comment": "Malware payload (Formbook)", "value": "78035f35fc646c027eacc3f57f5199d84a500618", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629716929, "uuid": "23b10bd0-49a5-43fc-8405-e8988d714b89", "comment": "Malware payload (Formbook)", "value": "def8478dcd4b9cd0c8cf2a49917c349e91ae5de462b2055d111fe01a6e488951bb9c7f21c9bf3d573429275c88d23210", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629716929, "uuid": "b766cea1-cbfb-4223-bcba-506e5c7aef99", "value": "T1E305CFB071E78696F51F4A742538BD5003B271B3F9C689391B2A25468FEDE987F4820F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629716929, "uuid": "7676dec0-df03-487e-9934-c61754fec173", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629716929, "uuid": "f830c4a4-5b50-4049-8118-b856d1b0fcdb", "value": "12288:UqOz9LwUOjQkL2Bto7NxL6c1HChB39Y/rIiyLrJnAh5JOEPpBja9Y:TOzFjkL2/eN16c1HuB39aIPL9AjHPi9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629716929, "uuid": "bed15a4e-9e8c-4113-b4f4-c9f863130de2", "value": 804352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629716929, "uuid": "991381cf-2056-4ef7-8f18-7672338f0159", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629716929, "uuid": "65143d34-0d4f-4245-a309-f2897d7d4eca", "value": "Alkhalo Trading Specification N0-00180091 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ea9d50a-0432-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Vjw0rm)", "timestamp": 1629737438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629737438, "uuid": "69b02b4c-601d-40ec-a5c3-56333bd3a253", "comment": "Malware payload (Vjw0rm)", "value": "ec187870c12d12639f5c90d00e7c5b8e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629737438, "uuid": "397cee51-9489-4165-8776-06dfc685b7ff", "comment": "Malware payload (Vjw0rm)", "value": "9c93430d461f06f4193e4130261545c936dbf23a41654005672b099772e10efb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629737438, "uuid": "762375ef-4c95-40ac-8aa9-a5f46cafaf8f", "comment": "Malware payload (Vjw0rm)", "value": "949e87f2d785e32e944f1a992eb1814256393f98", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629737438, "uuid": "06c9b92a-bdb8-4dc9-81db-6696b78eb6ab", "comment": "Malware payload (Vjw0rm)", "value": "472b58993fefabccbd7b3c313ca3acee3b58430e8a928e7df44b41d22e26bfd4e5bcc3dc61d10eba8b251df393383057", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629737438, "uuid": "fe65f986-57ad-4e64-9fc2-f6497789a075", "value": "T17142AF94354A83F342D6C378A43F84F6FD6B896D9292B86D8190BEE4DD26F13764240A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629737438, "uuid": "b67ec735-e4bb-49c3-acea-aa4fa994f0ad", "value": "192:eA4X6rkfDrGK93aZAsZkAewnpjKX2KLpYlLDVbKv+gR3uTRw2qwWT5m7u5QZ7H:ef68DrGA3HRAj9QGgR++1kcI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629737438, "uuid": "f5c051c2-cf80-418e-975c-4370ee0c2cd2", "value": 12195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629737438, "uuid": "66503277-1268-4b34-b917-ba0378981d8b", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629737438, "uuid": "6b561912-b54c-4133-9d32-36467c59802f", "value": "WOO61InvoiceCopy.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ee57385-043b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629741331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741331, "uuid": "8cc16e5b-6c93-4985-b10a-0c0a3835a4a5", "comment": "Malware payload (Formbook)", "value": "6a68e624ba14f631ab3fc2b9444d7811", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741331, "uuid": "58021d8f-5e02-4829-bede-89a4c7e3fff9", "comment": "Malware payload (Formbook)", "value": "9e69e22a336f4e2b17aa52eaa7183bdd92f17f577657c227f37419d38f42f920", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741331, "uuid": "0a44321f-03c1-420d-a4e3-1b4239cd5ca6", "comment": "Malware payload (Formbook)", "value": "ee5d7356701cd89d0f4db4903120b8a0cfa39ddb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741331, "uuid": "ba990e55-3d97-44ed-8159-84d7d9b00683", "comment": "Malware payload (Formbook)", "value": "cec94bdd369282157b323523726587965dfdcb2ccc7371ec2be18e90cbe6386936773186482f2712925e98b26a0fd66e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741331, "uuid": "52240f2d-2c05-4ba8-b1e8-36316f436acb", "value": "T1C5F412063385A64FC52ECEBA99164CA8E6F0B6365707D706BC8319F85D8E7198F112F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741331, "uuid": "7c42eab3-4ded-4fe7-b8fd-eaaafbc0d981", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741331, "uuid": "626b05fc-494e-4366-9254-2c4116f81e4c", "value": "12288:1Aw/DnE6e/5gPmgSqXgtuq8SAf8y12u6L92MtxUF7OwOVRFt6VeEpUnml:1p/DE6eCPmdqwtb83f/1x6xdxZZLzI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629741331, "uuid": "bac7054a-bb58-433d-8bc5-e01c27c0abdf", "value": 751616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629741331, "uuid": "f5ec72ef-34c3-49f7-8a8e-58bbea691e88", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741331, "uuid": "d9d1ceb9-0b7e-4c01-8988-24ca7d1b5c98", "value": "6a68e624ba14f631ab3fc2b9444d7811.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d894c6a3-03a5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Amadey)", "timestamp": 1629677137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629677137, "uuid": "fa43be59-7c39-4495-8549-9ce1899b2575", "comment": "Malware payload (Amadey)", "value": "5c65af376bff0067a2109686755b36db", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629677137, "uuid": "b304fd78-ce2c-4f3c-b15e-c262e54ef239", "comment": "Malware payload (Amadey)", "value": "9ecbf71bf0f2833437b61948eb635a404d5d835fadc13669ccc433bc6e9954c1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629677137, "uuid": "15f9e08a-8adc-462b-9bb9-74e9b193ffab", "comment": "Malware payload (Amadey)", "value": "97fe279e6107f0b1b8a6b34073f21b85b71e9a38", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629677137, "uuid": "3f4cb429-462b-43b7-83c0-50df0426ca63", "comment": "Malware payload (Amadey)", "value": "6f46d1f31fd08500f08063e657da70be9263c737f4cb6b22b26777e4a83adc94de3dab5cc80b1a3967868cb0cf52aa2d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629677137, "uuid": "0fe71024-fac9-4a66-9168-76e8c80150ca", "value": "T11C348D20B7A0C035F5F712F455BA83B8B9297AB0AB3450CF62D516EE56386E8DC31397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629677137, "uuid": "97cdd557-90ad-4e0e-b0b4-602550c5189c", "value": "0651d9dcd3efcdffaff927d730c581e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629677137, "uuid": "c05afcb6-e166-447e-87bb-4fa9dc48ebba", "value": "6144:Ifs8yKSn4A/vLPxXdB982jKD0zldXDNXH:shSXHLPxD982Og5dTF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629677137, "uuid": "f10d0d22-9fbf-4f40-a343-22bdace121d2", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629677137, "uuid": "4f26a2ec-4a7f-4bb4-920d-14d7dba9a8c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629677137, "uuid": "ca4958d4-fe4d-45a3-a66e-29cab6ff1047", "value": "5c65af376bff0067a2109686755b36db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4213897-03b7-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629684888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629684888, "uuid": "4cb8bf65-ebbc-449c-a92a-adf4330dc435", "comment": "Malware payload", "value": "a5fc40fb9d1a23c787ec34fbac7b5f0b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629684888, "uuid": "7cc7a4de-3cbf-429c-bbf6-80c15ce74321", "comment": "Malware payload", "value": "9fe95a6421cbcedfcd831733d3b4a0711f8fd245034b67f0fb059d070adbb49a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629684888, "uuid": "e71b2f23-0433-4c0c-b849-72db1c4e1ab0", "comment": "Malware payload", "value": "6e8cf98b999dc16ce649735aaea7ae1f0ab30d2e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629684888, "uuid": "c91c3d96-5767-4471-8720-4b35c2dbbaa1", "comment": "Malware payload", "value": "57ce3d60deb3b8c04b20558673efc69887fb98dd7513e871f8069abe825ac9cff208c71e85f6d4814f9fbc95bdfbcd73", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629684888, "uuid": "801f7eb2-1df7-49bd-bd9d-f933d13a4525", "value": "T1C0E479919EEFDDCEC26F323FA51A0C93159EC7060797A6E58B464E30B3841278D661E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629684888, "uuid": "67387a28-ef3c-4d8d-9a6f-6b21ce75fea9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629684888, "uuid": "d2d73faa-5b76-4c07-981d-7c6864c99f18", "value": "12288:/eSW32rUGpeh+itusS/rWQvO8BoPWV3j6spzrzvi6jzuKrEj:/eurUPhHMrlvO8t59JrrRzuKrEj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629684888, "uuid": "211681ed-324c-4418-baf1-3a6dd563aba1", "value": 714752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629684888, "uuid": "04b5b1c4-0ce5-47fd-9d8b-d05adba4cae6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629684888, "uuid": "9abe921f-ba9e-409f-9c2f-403abc17f8a1", "value": "a5fc40fb9d1a23c787ec34fbac7b5f0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc658efd-03e1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629702914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702914, "uuid": "50e21a66-0384-4700-8f53-55d4fc1437c1", "comment": "Malware payload (Loki)", "value": "4c97f8d9315768649d7e81215b8dde9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702914, "uuid": "721d9c07-5945-48b7-b296-a13bf84f78ab", "comment": "Malware payload (Loki)", "value": "a10dd1a1aa7b1b1679e080ed263c43eed30aaff500c0c1144183b5d04b74249a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702914, "uuid": "84d75349-cf1b-40de-9268-d4ffb276ac77", "comment": "Malware payload (Loki)", "value": "0f02bd0cbecd5e634550dfb922734d66d28f520f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702914, "uuid": "b56676c5-f231-422d-ad33-cdfc91b2d8e0", "comment": "Malware payload (Loki)", "value": "61eec206e33ec1f8813f8b5174108f19e24191f8740ab33abf2baab401166a2c2e8d414df3ef117524c0e81f4fcbd034", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702914, "uuid": "14ecb5d4-4424-4bf6-bcdb-02dcf959a2a3", "value": "T141D3B493A6D21B27F14A6C703062610133D5EC7E44217A1FAFC4AE9E2BF0693B5E475B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702914, "uuid": "ae7b7a41-346a-41c1-bc65-bde845f828c4", "value": "f00c063be3ee9625aa526de886ebc41e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702914, "uuid": "433c9292-2bd2-4d2a-9d29-57c2853de471", "value": "1536:1n0c4DL5Ejuo9TUtt33/o+5WT27jV6zY8N0semPhJF78xBYAxuMp6vwp:zsL5EjtyPVDV20seMwxBYQuSCwp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629702914, "uuid": "22771291-3ecb-44f9-94bb-e9a8fe66a552", "value": 135247, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629702914, "uuid": "5505fda6-a44d-41e8-a6bf-58d5385d8a87", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702914, "uuid": "a95f272a-2b07-4fb8-a5c7-1cf22a285acb", "value": "RFQ No3756368 Norma Pacific ORDER.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3ffee6b-0429-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629733877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629733877, "uuid": "3b8b68cd-4cb5-4276-90b1-9bb990ed0791", "comment": "Malware payload (Formbook)", "value": "6e33655754e13782626f4b2282a8264d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629733877, "uuid": "0f4d37af-ef5a-495e-b1fb-d5228a713ad4", "comment": "Malware payload (Formbook)", "value": "a28c1aa7b9aae861040aea6d14c8d2f860101502a18f7d8d8dc7592fde73a31a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629733877, "uuid": "2ec98900-4545-46c8-a883-81b80b67373c", "comment": "Malware payload (Formbook)", "value": "0da7d6be6e434642c0dd70fec884c6fe50c2aeb4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629733877, "uuid": "cb77f9f6-9a4b-4d29-bb8e-ef7cc7e83d63", "comment": "Malware payload (Formbook)", "value": "a42615aea8843232fb8f4d09540647e07938ef90c97e68d4931a57111bcf47e143477c578458042323376659a3e47e67", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629733877, "uuid": "8ff20105-4aa5-4a81-affd-31fe85b989c1", "value": "T162E401493781BB5FC9AECEB6A5125C20D3E1A5320317E712BC8311E9668DB968F513F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629733877, "uuid": "8a387647-10f1-449b-b732-c9bd09e358ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629733877, "uuid": "a4f27f3c-19a2-4b50-aced-8dea991014c1", "value": "12288:3cuFHocVk5S+LwyamUunc28UNnc5rm6UUdjpM3YLzkE2zm4OOX2A2Hmu:313C1LwzmbncnAnc5rm6Uj3YB2tD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629733877, "uuid": "764480bf-612e-4091-9003-f4506b4f77f4", "value": 699392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629733877, "uuid": "2354f7f7-d134-4c1c-99f6-299007a19d71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629733877, "uuid": "1773d6ba-c7ed-418d-ba02-f25f6f841675", "value": "6e33655754e13782626f4b2282a8264d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a4faca3-041b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629727606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629727606, "uuid": "6a153563-9931-449f-9e2d-68c111a2db5f", "comment": "Malware payload (Mirai)", "value": "1a8903119efa4ef3ec5194af036122e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629727606, "uuid": "b934f2f2-d9d1-4b1c-abe4-885efb549df5", "comment": "Malware payload (Mirai)", "value": "a2e10d76cff7177f2e681bcf841a3906fe37aa9440f3c7b21eb50e73fcb14724", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629727606, "uuid": "69b32b7f-e88e-4e5e-9660-065efe3af80b", "comment": "Malware payload (Mirai)", "value": "2ac8233cf5d1136fd8cbbc90279b1214f5dbe744", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629727606, "uuid": "e513036b-991e-4ba4-88a7-33fc9720b724", "comment": "Malware payload (Mirai)", "value": "20c05acd5d2ff60570eb5cac823e60a397a57e32da9e893f2d8e63e1dd49d6ea99a84cc1c5bc0fc7d3a344aea80937c4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629727606, "uuid": "6dacb644-1e58-41e2-91c2-c016eb9690d1", "value": "T18D63964D3E319FACFBA8463457F39E10A35823D526E1CA85E19CDA011F7034E645FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629727606, "uuid": "992623bc-78ee-4b35-95d6-3ce74f4904c3", "value": "768:RzZWyvL5MsRXxPx2pqV2Ucz9HX8iJ3GecFgoSERFImpPxs6vvSp+ozXeyt42egHO:OKzPxkqV2UOGecFgoSWlHs6t0egwsnM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629727606, "uuid": "f95eed2e-3eee-4c13-9a7e-b2b2da4ddcb0", "value": 71856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629727606, "uuid": "a7e698bc-4b47-42db-9fdd-3e29756900ac", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629727606, "uuid": "adf9aef9-e3ae-4172-8464-ad94d5bb38be", "value": "1a8903119efa4ef3ec5194af036122e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa7d81d1-0439-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Adwind)", "timestamp": 1629740760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629740760, "uuid": "56351b89-505f-4c6c-83e4-1233ac05210c", "comment": "Malware payload (Adwind)", "value": "47a81bb95d5df66aaaec60f43a16f5a9", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629740760, "uuid": "690a4762-5812-4c4b-98f5-c6ded26400b9", "comment": "Malware payload (Adwind)", "value": "a31ec5c2a3c455a99004163f3ec88fc999c4da53f9dd61e0744309ab3d410756", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629740760, "uuid": "9765b7c1-6c4a-4ca8-a518-f165871b94ae", "comment": "Malware payload (Adwind)", "value": "fcfd743de4d69531257a90c49d9c39108baf0d19", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629740760, "uuid": "32db2bd8-0c0f-42b1-9cf3-32cc23f9930b", "comment": "Malware payload (Adwind)", "value": "86320b049ba6b49425bdf0bdddd3c0ec86e3904737f961e57311d6a5f4a2df124f9728fb26dac91a70b6d5c0af222ed9", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629740760, "uuid": "2f97a1ff-719a-4e8b-9080-b190082f11fd", "value": "T1E1E4236CE799DC71EB80622CF4013628DC869D14194BEEE12EE0835C0F6B75FB67825B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629740760, "uuid": "ba6f8edc-192e-40a7-a12a-65e2724df272", "value": "12288:kntjQFFn2Kyc8Y1dvauoLOdaSYUppmw0VCnEQoDdZJcxUOCxBwbsIvgCg0Ah92qi:kMFn2hcp1dvalcdYUppmw0VCnEQkcGV+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629740760, "uuid": "57358db7-f868-4943-917e-63ff10b47644", "value": 662887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629740760, "uuid": "ad383e6c-26dc-416a-b6ce-9ae161bff679", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629740760, "uuid": "2fa4c653-bc3b-43b6-a549-cd5ed0a2a43d", "value": "BANCOS20210823.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e28dc4cd-03f2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629710225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629710225, "uuid": "5416e716-57c8-410e-acc3-f4fab1c8c129", "comment": "Malware payload (Formbook)", "value": "f84e59e42690ede739531d41ebea3d07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629710225, "uuid": "b840db7b-f509-47f1-bee2-73719b77b17e", "comment": "Malware payload (Formbook)", "value": "a42fcf07a49813ee9169d0c3e69fd3b7dd98a2d3316d9861dcc8de4caa7487cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629710225, "uuid": "3a6ed3aa-c8d3-4a4b-bbfc-27c4bfc83bb8", "comment": "Malware payload (Formbook)", "value": "03544033cdd8cf9c911e3bad6095da4256495606", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629710225, "uuid": "b8f8c9ec-bdd7-467e-8324-6a1fec12fdbf", "comment": "Malware payload (Formbook)", "value": "a5f275fe4906a7ded154f6006363c3d46a4318e030db00690b59c663bebcc004a7acf61f977a12b64da044be37ab9613", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629710225, "uuid": "13b25b6d-89b4-4022-a5d0-305d15aca761", "value": "T16CF412067745FB4FDA2FCE7A9C914C2093E0E6355307EB16ACC326E4568D79A8B052E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629710225, "uuid": "354b5400-00f8-498c-bf32-7262a330d7fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629710225, "uuid": "ac14e0bc-3d8c-4440-a81c-72554ea66920", "value": "12288:IFfumitB/fZhhgDweuBiMkk5i5jcQnmQ9AuchIOixdTVIzUUP1AUnzUSM/:IFWXzePuUMkB5jcsmQ9A5jiPWzZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629710225, "uuid": "cfb5e13a-88ed-43a8-9218-f0542870deb8", "value": 729600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629710225, "uuid": "be03ea0c-3008-4c97-a09c-542ca0a950f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629710225, "uuid": "cf07ce35-a01a-40dd-9b04-9e51549221f0", "value": "11317693065_03162021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7f350c8-041f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629729481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729481, "uuid": "da3df297-5794-47ee-bbb7-758c4fe1decd", "comment": "Malware payload (Formbook)", "value": "bcddd6487a0e1ef2e7d32cc59be48383", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729481, "uuid": "98d396d6-c48b-41a1-bdbc-38f1036e46ae", "comment": "Malware payload (Formbook)", "value": "a452c3adad157b098a28aea1626cff66e0c97de0a34c429de85d3fd6c0faaa72", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729481, "uuid": "82aeb03f-ba5d-4a14-a11e-fb8cf1b9a323", "comment": "Malware payload (Formbook)", "value": "caa9a616139af3ffa83f19f71e5a723380ca405a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729481, "uuid": "86a59be4-16f5-41a8-be25-941b680f0e7e", "comment": "Malware payload (Formbook)", "value": "3d3aa7511ca4e9a68abd4ba7969870448509fa7c8bf8a41f0cdd959a149068eb64d6e9f97c00197c38e9b9274e57b696", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729481, "uuid": "ad8103f5-6695-49af-9931-819cf4cb7f10", "value": "T1994512D04DF68A05F195563F61ADEA0F3DE9CC59AD8E7C1222D436882A7E7307E4F881", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729481, "uuid": "e0c32100-1970-4ee0-8561-9ff2f4054d72", "value": "24576:fL86kpw8zialFsGQQAEYCyoO+vXiOcEa3XdquYOtW81Ul/mbRFi6L:fLsw8zyaAzXFsyOcEWdv5tWNNmbj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629729481, "uuid": "b9021561-6bc0-4cbf-b0d3-5fd2f56d039c", "value": 1257048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629729481, "uuid": "1c099832-5f94-46b3-a901-197faa166e51", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729481, "uuid": "3e30ab6d-a46b-4033-8b11-c146e5ae5d05", "value": "XTRA POWER SOLAR PRODUCTS - OFF GRID 2021-8-23.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9b23488-03de-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629701621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701621, "uuid": "a840cf16-7979-41ac-8e8d-fa43184510c5", "comment": "Malware payload (AgentTesla)", "value": "09a2c816079b386a73ff74bc885bee5f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701621, "uuid": "6cbabc64-c6ea-49d1-9e19-7872f49ecec1", "comment": "Malware payload (AgentTesla)", "value": "a4ec2ac3baad67429c9f8ea54690178bfb6e1af5adb6e95a2fae5748706b4dd0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701621, "uuid": "7b46328d-29ae-4b40-b3d1-49aaa68d5beb", "comment": "Malware payload (AgentTesla)", "value": "24f1a52e44df2faf28820d539862e3b583b3083c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701621, "uuid": "58690c41-2c28-436f-b556-09fc8c48380a", "comment": "Malware payload (AgentTesla)", "value": "df51f26133b7b807669699db8864e53f801067993888e4e86e3ab6ef8e42c29b31194f3afe0a0530d75f8befa5286312", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701621, "uuid": "9bed7393-389c-421e-96ae-2a1b27ce2126", "value": "T12F45D73916B82B27E079E365E6F44417B3E0A55FB225ED59BCDA03A70206F4265C333E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701621, "uuid": "f50d52a6-0ca7-4d53-a3e9-27c902f55326", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701621, "uuid": "8b447254-8361-44ad-a23a-43836e9740d5", "value": "24576:U7MfWRkFYSblhBA1H7ufsZCaodvnksozfNqt55G:Vdyq1A1H7Wsc/nksoIL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629701621, "uuid": "512cb5f1-04a6-4850-9121-c2e2d0c7741f", "value": 1214976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629701621, "uuid": "c2cfa644-5a79-43f5-a0da-c0a7812037da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701621, "uuid": "fd8e9510-53f9-441c-90aa-f66cff3dbe09", "value": "E-Remittance Form_z.TXT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "005e5326-0433-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1629737763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629737763, "uuid": "013924c1-f0c3-4d9e-a9a0-a17961f17b0b", "comment": "Malware payload (AsyncRAT)", "value": "a97437bd6a6ffa2fe4589185311296f9", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629737763, "uuid": "bd96a05f-b6ea-47f6-ab5a-66b7336e27a5", "comment": "Malware payload (AsyncRAT)", "value": "a51e3f484cc5b8d1dd6d39bd886c71fff244d5eaa063efbf9225453da53e4a52", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629737763, "uuid": "f0960752-369b-4de7-98c3-fc00ebc90e2d", "comment": "Malware payload (AsyncRAT)", "value": "8c9be9b7ea19c23f9f7524d244428ff88c6e8c13", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629737763, "uuid": "1ab73728-2b9e-44c0-9a2b-95a89873c076", "comment": "Malware payload (AsyncRAT)", "value": "973b8c8d8764fc44af0e7044bccb00e32f337f845bb5913807f429670e2601404e83cca38f72bcf85fa23b7151996152", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629737763, "uuid": "fd450f81-d72e-4c12-acc6-73f38faddbb7", "value": "T1CA232C007BE8C26BF2BE4F74A9F22145857AF2673602D64D2CC401DB5A13FC696526FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629737763, "uuid": "7ca07154-9090-4190-bc0d-680360807294", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629737763, "uuid": "90045a04-c546-47d7-a0df-b1a7f40e52f6", "value": "768:Oue8/1TYQZ3VWU1Dmhbvmo2qjtwywelqPIwfvi8uSJw0bwMBYqzy+buzZD/BFx6E:OueE1TYiwhN2QwWTc6vgbbwk++qFD/Nh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629737763, "uuid": "d70261b8-fc4f-48dd-88e4-84997afb6760", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629737763, "uuid": "13cfaf16-f0b7-466c-96d5-e0f89fd02693", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629737763, "uuid": "2eed2317-b7a4-443e-81d7-46221cb209f9", "value": "a97437bd6a6ffa2fe4589185311296f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "215577de-043b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gozi)", "timestamp": 1629741255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741255, "uuid": "895809ed-e5d5-4c04-979d-fae93ff74d3c", "comment": "Malware payload (Gozi)", "value": "ed60097b0bca7f9c4649ba5d5a088fc9", "object_relation": "md5", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741255, "uuid": "1af34be8-c4f4-4c91-a4ea-bffc71c49360", "comment": "Malware payload (Gozi)", "value": "a5540f6dd0f7761dd3f7e52f5e1d25332b99d95cccf63401d202406160948750", "object_relation": "sha256", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741255, "uuid": "205e56d2-b0f6-4ae0-883c-fb85d3d9a293", "comment": "Malware payload (Gozi)", "value": "19b5c95728b212a75adf3e4d2932f411f6c68f9d", "object_relation": "sha1", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741255, "uuid": "ca9746f7-54c2-4936-90b9-d430ed82bb93", "comment": "Malware payload (Gozi)", "value": "85ee67669305681569a3d26bd2aaf866f9d827db2ac693844fe91d1d30852ef6b99b1763008a262f1ce1a0d971e4a3ac", "object_relation": "sha3-384", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741255, "uuid": "01b07531-8122-42d6-89d3-888f7f150409", "value": "T1A6C49D12B791E024E9B952788F75D9D8AA2D38215B3850CF39E13B9F0E396E39D35343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741255, "uuid": "720e33e5-b758-456f-a9fd-98d6b4eac4c7", "value": "12994b2554048ef1e6f7b4dd1e874109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741255, "uuid": "95469101-fd67-4abc-8351-4b39d02cf6ee", "value": "12288:rqru80paIRPWxvFzhzFIkofIcYrIAfDE0cb1Yklllll/lllll7K10QUNI0H:rs0IIFWx9zlFIkofDY8kcbHlllll/llH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629741255, "uuid": "8944f4f0-df50-4192-a236-4e8e22543bc3", "value": 557056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629741255, "uuid": "84b28837-e29e-4e7f-b73d-4dd7be726258", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741255, "uuid": "45b2adff-1c04-4520-a6b4-b526f66a3f95", "value": "7.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a13dc5a0-03e9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629706250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629706250, "uuid": "d660f6e2-95eb-47a4-a353-008e3da5cdc1", "comment": "Malware payload (Loki)", "value": "292916360ec52e19ca5cf651257338e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629706250, "uuid": "94682340-a7dc-4822-b1de-124e6b51f577", "comment": "Malware payload (Loki)", "value": "a59c299c9bb91fd7646909a96c26f2095ed41a00099d95f8262bd064699f26a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629706250, "uuid": "8f53d6ee-5358-43d0-9216-d755d11090d4", "comment": "Malware payload (Loki)", "value": "60b941d624a532ac3ec1782182b78810bd00f6c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629706250, "uuid": "a3e3af92-9ff3-4494-9ee6-f012f4c61834", "comment": "Malware payload (Loki)", "value": "9e04a6a9ddc82eee670b21ce74850f5046e78b7daed07d95f6d439f56769398442049500504dee5f2107a812be5ad9d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629706250, "uuid": "a1f00541-f86b-4f06-9fcd-d998c65ca683", "value": "T14CA36C13F2C65B63F0864F3AA5A6819631D2FC3D4A26B22E9FC07F2E0BF5640D95115B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629706250, "uuid": "5ccb55e2-0952-4118-9cdd-55ef7e0c1e60", "value": "877d76f42120b733733986666dfbed46", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629706250, "uuid": "405e5531-2824-4af3-874c-aebfeecd631c", "value": "1536:KYxPxrkoF88JlEPNOu0mFbR0Izf3FXOx0E6q3+nLh+:txrkoF8alEVO6PjFqgLh+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629706250, "uuid": "923c19d2-d22e-4963-a317-b6b0cd982702", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629706250, "uuid": "89c00efe-367f-4910-b97a-f11f86e4781d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629706250, "uuid": "2898e464-3c48-4eb9-ace9-19e1c2f0e558", "value": "REQUEST FOR OFFER 23-08-2021\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5caa3f0f-03e2-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629703129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629703129, "uuid": "7cc0689e-50ca-4d80-bc2b-955cbe8025c3", "comment": "Malware payload", "value": "803f602b33de6790b7bc85d7d74cbe61", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629703129, "uuid": "3a25f565-1bba-4c05-907a-ca0f5e0f37a5", "comment": "Malware payload", "value": "a6c83f4616dfcdfbbf3e612a8972f39b1824653ec2cac4468a6036366cd4e5d0", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629703129, "uuid": "c1241679-cb33-4e97-800e-902eea9c1f2e", "comment": "Malware payload", "value": "e18a5d74157178c21fdfac76a750b3d3e944d8eb", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629703129, "uuid": "82a6f3ca-3b68-4ee1-b261-1b1bd933c35e", "comment": "Malware payload", "value": "458e07b70e08352343983e11696e9bcdccf6f2bb39546d334da33d2f60d939a89aea13e01427c0e72205b827740d294c", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629703129, "uuid": "f05cf86c-c777-4a04-82fc-2bb2e81aee50", "value": "T1774159046EDB61D8D2738B316BDDF3B34566FCA1986E66F6124048891FB1780EC62F39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629703129, "uuid": "4a6e4c38-9454-4bd8-9a1c-edf614806cc9", "value": "48:8fTvlDbakVfmfyDi1Nqdk4LYp35GzRMqdk4LYkwyDCKabEx:8fTt3Vsqm4LnMqm4LB7DCKZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629703129, "uuid": "55ea9bd9-5365-4797-aa57-941ad17dd6a8", "value": 2004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629703129, "uuid": "8098dd7b-98a5-4a7c-9a29-c0e1ecfbc8be", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629703129, "uuid": "8ae47ae7-e2ba-4884-a848-192885a0e357", "value": "exploit.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f74ce82-0453-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629751747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629751747, "uuid": "800afa3c-be8e-4391-8b39-dcd95e7b16f2", "comment": "Malware payload", "value": "1995b0023c950d538750ede62a7c19db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629751747, "uuid": "1995602a-2b0b-4fb8-908e-9573e228584d", "comment": "Malware payload", "value": "a6da6ad9ccdb4a19150143345b42c6e30af534d300b5cf42e4bafe54c5a496bc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629751747, "uuid": "af594b08-2742-42ce-bb66-7f26b18e8ed2", "comment": "Malware payload", "value": "e8367e6f1668c29233eea8d5ca74b370c9f6b37a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629751747, "uuid": "6dad7f14-f5c8-4e51-b34f-f117ceeb409f", "comment": "Malware payload", "value": "96f2492213f3b9cc21b1e9b68ae806923a8a5cd20a4f328063b02b8250e0f87c5bb994b68dc83f58522a3c98848024d8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629751747, "uuid": "9aa9ac95-2d6a-46bf-ac15-329b39227dc7", "value": "T1CD55EB381D78393BF1F9C339DEE4481FEAE4B55B72116A1671E623670702602B99327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629751747, "uuid": "58efab6f-1992-41ed-9397-3f95a9cfc0b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629751747, "uuid": "966d7465-2982-4bee-b2e8-6948a6303840", "value": "24576:q34oUcucWzloWWrnv0Fn67fAHxeeS2K/R84jkcZ5oE0lFRYBmsuSiJYKK/nS:6dgBn2/qtlF+BmsuSiJPK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629751747, "uuid": "56b5fb57-50dc-4cb0-b745-0707d9893366", "value": 1362432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629751747, "uuid": "5fa88dd0-ee3e-461a-b654-f5e149a2afb5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629751747, "uuid": "7dbb1ec9-9f83-41f1-a27f-1e5f5352e680", "value": "1995b0023c950d538750ede62a7c19db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bdb91b5-041e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629728897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629728897, "uuid": "48f949b0-c817-48d3-9532-7f5408d7274f", "comment": "Malware payload (Formbook)", "value": "10bef7b81cbd13b3dc58d813e7fc06c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629728897, "uuid": "44874996-db34-462f-8994-d5c70f033543", "comment": "Malware payload (Formbook)", "value": "a7c09392aa26962b20d2fc58398b6425ebd062187b2923fbbb7b1866523f1e26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629728897, "uuid": "12e9eeb2-6273-4930-a35b-d325b06ae435", "comment": "Malware payload (Formbook)", "value": "97c623c38ec83ad146f80f4da6fcf083c95dd50b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629728897, "uuid": "c810774e-f5df-4cf5-a06f-b6f04b320801", "comment": "Malware payload (Formbook)", "value": "69f2524f0ad0ed04879e828ec29e7e9b25a4902d7df759eed535589601a87d22754b1d30048b86505fcaa0b89a06bb7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629728897, "uuid": "809449e3-82f7-4b3a-989c-cc15e91da13b", "value": "T14CF47C36FAB1A874C4622F3DD82B44ADCD2D7D45DC7C78562AE60A0E4F39B913426387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629728897, "uuid": "f639a34b-827d-4d09-bbf3-d07c864fe862", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629728897, "uuid": "2cecc4ed-0e0c-403b-b3fe-f0ad31a9e3d1", "value": "12288:RQioUx/2JW1hxrQe+IguVZRFzODnQx0+NpYuJTquMvCEWs:R52JWhZvP4J+NpBsz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629728897, "uuid": "300b9d98-1a6e-4234-943d-781353a4bc5e", "value": 747008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629728897, "uuid": "0d24fcaa-3c4b-4f51-bd6c-7e7736a271bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629728897, "uuid": "0e9930f1-a324-4c93-8086-a7d2228a1e60", "value": "Shipping documentsProforma invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ad1608c-0445-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629745673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629745673, "uuid": "e5922a69-c5ba-4d5d-989f-83ea382252bd", "comment": "Malware payload (AgentTesla)", "value": "5c2f7d7c59e2651c57690c5e76ebf2a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629745673, "uuid": "51bb57b1-9cbd-417f-b7c7-7c3f70a4ed2e", "comment": "Malware payload (AgentTesla)", "value": "a8e95918b0b89f9c8eddfbea9c211c998719835b2efb91c418d463bda647916e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629745673, "uuid": "4512c3bd-de23-4e1e-8c09-149df6dd53c1", "comment": "Malware payload (AgentTesla)", "value": "6c4e991f27528fc8c1ca44082bf8f8258d75bdd5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629745673, "uuid": "c414fbf0-59a0-4b74-8d2e-1a033dcd3215", "comment": "Malware payload (AgentTesla)", "value": "769ea6e4ddc1ca5617526bea8e27f23ec3344a08deafe6fb385450e72ec5039ebbc7ed0bbeb4f1b2845e88277aecc812", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629745673, "uuid": "cb910849-c6c7-4bde-b5eb-eb38fa5ae941", "value": "T16D340206FB3A27FAFA8CA2B47049C8BB1F097EF6B84F51E61742314A55317F61678601", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629745673, "uuid": "2f3dcd1f-1507-48cc-a404-f21d0c1f34f4", "value": "6ef74f7b87fa15b6df54d064a5b8ef31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629745673, "uuid": "e9b60f3e-8a99-4cf8-a198-44353d580a6e", "value": "6144:m+Q/wqo9WFEOuAfL18l22SJUZcBDS4wQiZqZ2:SQ9WpZBa2XUZcBxwdqs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629745673, "uuid": "d734b18b-c79a-460e-949f-3fbd990800fd", "value": 240142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629745673, "uuid": "97c74348-a994-4dc3-8bc3-23d7b5f94a2d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629745673, "uuid": "742c43b8-03ac-49f3-9d92-e596105a7ea3", "value": "5c2f7d7c59e2651c57690c5e76ebf2a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33f621a4-03c5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629690605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629690605, "uuid": "b9022019-7037-4d25-9d2a-ed77c5c70e8e", "comment": "Malware payload (Mirai)", "value": "e03cffab8a3f4558acc7f0e4e5b29d01", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629690605, "uuid": "d91f5418-c720-4cdd-b4df-7deda13ea7ae", "comment": "Malware payload (Mirai)", "value": "a907d019866f571d2a84f1a819db3f087a94530819ddbe93dc086abcb6d72049", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629690605, "uuid": "27d845e4-ed64-4afd-8540-331dfdead95d", "comment": "Malware payload (Mirai)", "value": "83cdf95d9bad618b9f48114f936ee5eb3bcd4a90", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629690605, "uuid": "cb2bf0e6-7e56-4bf5-8503-29f8311735fe", "comment": "Malware payload (Mirai)", "value": "68e0130b60df385461704bbdb6f552587288f2bd94f2f72925b6fa412447218e7e1d600ffafaccb193dd5901ab8b30cd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629690605, "uuid": "aa64cc46-3e4f-42ed-98f8-2eb75900a5fd", "value": "T18633F1E2E3469764EAB01C35E32EC1C06A0A4EDED3AD31932411CF645C97DC3E5B999E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629690605, "uuid": "06835e71-5043-4bea-bf98-c78680fa6d88", "value": "1536:+Y3AmUi3ML4EkwjIQV5WW+P+tL9FtLV2xourk:/753lWI+5P+P+tLLtR2FQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629690605, "uuid": "112594cd-8144-4f4f-a30e-0729f8dd4e25", "value": 53400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629690605, "uuid": "3e2f012e-26e1-4fd1-8b83-e1b15d0bb0eb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629690605, "uuid": "92014be9-537f-4877-aa77-8d89600402ea", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4240810f-03c6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629691059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629691059, "uuid": "5fb37a68-b3ba-4dbe-acb2-f9f6fe772179", "comment": "Malware payload (Mirai)", "value": "65f3e8cc5ff1e36293f067866424d754", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629691059, "uuid": "c9b6193b-6c14-49ea-8c46-48a2dc8eb1aa", "comment": "Malware payload (Mirai)", "value": "a9292dabc30ce9bfcf9edcc61ad8f3f40256917a6368eec9845b66c610a5fd2c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629691059, "uuid": "7f19f914-99af-4959-b72f-c89a942efe6e", "comment": "Malware payload (Mirai)", "value": "e1eee4c3041ecdd8f2e0281c91c7071e1f34e1bf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629691059, "uuid": "ca583a64-7b03-40d8-9333-a0b953d425ee", "comment": "Malware payload (Mirai)", "value": "e5c036f163158b28779b4e3bf3f8cf5d144deb02f781ccfd5b2b923079d4c34499c26c8270705e07109671b42a946905", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629691059, "uuid": "bed2d6a1-7a12-4dcf-98e0-6903eff7bd78", "value": "T137E2E1CDF8FDBCCADA7D2CBC524A17A6261240DA724E5707131919C4EA1AC5A3CCE0BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629691059, "uuid": "e7e98c66-d6c7-43df-a619-7c951f230ffa", "value": "384:eACtY2JghN20yhzC5K03AA3vOjCEi2UDTea/j+HoSBwax42asfHnped1zWVQXW+7:eJVChN20yp0lUeDaa/l4425Bej7WI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629691059, "uuid": "3091c280-cb9a-4be1-b69d-ea20798022dd", "value": 31480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629691059, "uuid": "b6704be8-4e68-414d-87ed-a5b41a5c9375", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629691059, "uuid": "626679c4-ea3a-4e31-89fb-59b18d4e42f3", "value": "65f3e8cc5ff1e36293f067866424d754", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84bc195a-03c5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629690741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629690741, "uuid": "71e7e1ba-fe96-46d5-8958-345a717851c2", "comment": "Malware payload (AgentTesla)", "value": "611fc00c37cbe4f587a0d144c1d6e91b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629690741, "uuid": "fa170af4-a742-4568-b65c-ee569bc0bcd1", "comment": "Malware payload (AgentTesla)", "value": "a95defeaaa2434a0c14c418cd0cbf76e906c8a57ff1770454dac7cc38c86d97e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629690741, "uuid": "c6dd9d7e-4e2f-4f39-9d34-3c9899d308b1", "comment": "Malware payload (AgentTesla)", "value": "72f467c570063669f56d6f9b5cef5808c15c2553", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629690741, "uuid": "18f89007-8d9a-4107-8e2f-62b3572e196b", "comment": "Malware payload (AgentTesla)", "value": "e091933d698c97d905f95a3f9144ef3efc0f89172806d2c00cad1ef3c7c43519081edd3c4ce82baae8a50481c64654b9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629690741, "uuid": "f2d642bc-9a5c-42e3-abeb-f576708098e0", "value": "T16505E53D19B91637D1B5C365EBE58423F148986FB504AE6A6CDE03A7030BA9335C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629690741, "uuid": "bb3ea7b4-4fbe-467c-9e0f-2470023c2406", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629690741, "uuid": "08087b9d-23c8-4de3-b29e-85e3a0714379", "value": "12288:EbgTpE9aINpRspdSb8MhiQmKIpVzrU5IA49gGHsMGO7+S+k//QR:E0SI04pdSbDhiseVzrGP4N5GOaSt3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629690741, "uuid": "97c5ec28-f3b1-4797-bca9-33f56ad29830", "value": 851456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629690741, "uuid": "2d98c914-fa6f-479e-ad31-f446e0243c1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629690741, "uuid": "f0a2854e-7a7c-4de5-950b-e81eba1f5bb9", "value": "RFQ.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "853b982b-03d7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Vjw0rm)", "timestamp": 1629698472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698472, "uuid": "46bc0d93-e894-4ce3-b397-b24236c0287f", "comment": "Malware payload (Vjw0rm)", "value": "137a79bb32e10321f3803bb74e98fd93", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698472, "uuid": "9e55d655-ebed-4860-ac35-4617d8ca7106", "comment": "Malware payload (Vjw0rm)", "value": "a9b5cf89510cfcc9b8ab7e311395540e1810f69f47ebf735134a04b376960ad0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698472, "uuid": "a3cde7da-6b09-4a55-83c8-bd0ef9d2652d", "comment": "Malware payload (Vjw0rm)", "value": "6d6f6567f58794b362f7c6837b8a082e0a9aea4d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698472, "uuid": "c0af9eed-fcdf-401d-8b56-3ba4b0856f35", "comment": "Malware payload (Vjw0rm)", "value": "f65dc7745be9e86b866f9dcdfdacc9860a1101330814dbee3ee429b2e82bb24392ba3f5e84e4f6215df4f47a35b06b2c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629698472, "uuid": "a98737ab-0150-4d5d-9c54-31353e7c6b98", "value": "T13574BE8928412AC94478D71350B7386917B0CA0AE5D66ADDBC6E3F3F4FF9F88D606217", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629698472, "uuid": "038a1b13-39f4-45ae-a5a3-3fb028c88a8c", "value": "6144:hjGBFq/NQhCpVrIIF2jGBFq/NQhCpVrIIF6:K/8N/88", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629698472, "uuid": "6187b38e-6ba1-46a0-8329-efba3358ccb3", "value": 339973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629698472, "uuid": "1e422c0c-a844-4d2a-a472-66637908f040", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629698472, "uuid": "4c221d56-8d62-49dc-93f7-43318fa9d34e", "value": "20200820-28094_75-50.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50a9979f-03db-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629700102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700102, "uuid": "4dd2c766-2c60-42ea-b599-e694eaffe3f4", "comment": "Malware payload (RaccoonStealer)", "value": "96aa01335a023fbcefe17ccea67cf999", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700102, "uuid": "f33bba6a-3618-4a46-a224-d317acb59be5", "comment": "Malware payload (RaccoonStealer)", "value": "a9c5e32e57a9ce99afe5140a3e02b65492aff1904e0dea9b57762f777f1221c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700102, "uuid": "e712b234-4c72-452d-94f1-fc7bf2249a79", "comment": "Malware payload (RaccoonStealer)", "value": "9c30aae9ea4f816c7202d1abe689754b20804117", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700102, "uuid": "c20c85af-c814-4b68-8afd-3c9b7144e363", "comment": "Malware payload (RaccoonStealer)", "value": "e18cd60d3c1256a86e0693ac4df06f8b833eba7f8e1849b646ef09c3d41804bf3450bc0ccf6a35f5b2c7eb2428f23cbf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700102, "uuid": "21934df3-ce3a-4d97-bdee-1a549327150e", "value": "T12DB4E030B7E0C034E5FB02F519B587A8B9297AB16B3454CBA2D527EA1634BF89C31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700102, "uuid": "04654a97-1b63-4405-a062-7e37e261607e", "value": "0651d9dcd3efcdffaff927d730c581e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700102, "uuid": "20bf8bf0-5ca8-4da1-97ac-2d6c748cac19", "value": "12288:YYinWvqrFV2o+6DmH474fiXMuilACcJvWCCKxWxWbePo/4KfCoC9:UWvqrRmHmsi8ui/cJv/qWKA/4mC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629700102, "uuid": "111e50fa-ca6e-4e40-923e-2e7cfed76c94", "value": 500736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629700102, "uuid": "4b881335-571b-4f8c-bb92-26c870fcde72", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700102, "uuid": "f63a635b-b78b-48b0-8d44-7b61e5bd5045", "value": "96aa01335a023fbcefe17ccea67cf999.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10722855-03e3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629703431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629703431, "uuid": "80f4d668-eacc-4ad8-b026-224743481639", "comment": "Malware payload (RemcosRAT)", "value": "68ed33d9d9dcd7763d6acb0198783340", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629703431, "uuid": "55209ab1-eb4b-43ea-bc39-ba561927e22a", "comment": "Malware payload (RemcosRAT)", "value": "a9d3981aedd734cf66fc7b1375abdaef743ae5309556dc98a5d5ce449b06365b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629703431, "uuid": "b5734765-b340-4df7-b077-012a3e5366c8", "comment": "Malware payload (RemcosRAT)", "value": "ba73939380e9efe092d167519bde2c643100980c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629703431, "uuid": "504a4467-870a-43d4-8fad-b6735a9ce1dd", "comment": "Malware payload (RemcosRAT)", "value": "3bc867b3d4864bed094367c2c55c005c2ee1b3175117435892c0c13edc76eec4b384f9b30b6982a1cf5df54c313c4ed2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629703431, "uuid": "4ab5d4cc-dd11-4fd7-92fc-679100d291fa", "value": "T1CAD49F67B2E144B5E2632A7C9C176659513D7FF22E285C46AAE40C8C4F3AF312C3A1D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629703431, "uuid": "2c9c0c9a-2333-4f08-97a9-411989149fe0", "value": "9d9efc27a44fcb7cf802b6cba10d2531", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629703431, "uuid": "aa3b09fa-ad14-4623-bcd3-da5b14168eac", "value": "12288:TKM0u78KU0wzWwGj6ZXwz7ZucobO55Pm6:TQeU04W8gz78PU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629703431, "uuid": "94dca907-f080-40d1-8439-a3b2833826a4", "value": 637440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629703431, "uuid": "f8108a27-4585-4eaf-90f5-79581e593232", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629703431, "uuid": "e7ea1a2b-3fc9-43b2-9e29-dfdfd5ae3507", "value": "Angebotspreis,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b43243b-0453-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629751740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629751740, "uuid": "c8f2d81b-d799-4d00-b9d3-00888c68b633", "comment": "Malware payload", "value": "8c02034958ae86a8d8b42fa5545561a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629751740, "uuid": "bea4b4ed-6982-4aad-91bd-0e806c5d7233", "comment": "Malware payload", "value": "a9f57838861052d6907c1ecae103fa5fed6dd1ac78156a7b41b9c80fe8247905", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629751740, "uuid": "02b5c455-b59a-4e6f-abe6-c90d06986248", "comment": "Malware payload", "value": "bd37c996b4da560ae97b2609458aa048826f5337", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629751740, "uuid": "6f54dc30-580e-486c-b60d-85aef4673df4", "comment": "Malware payload", "value": "78a1a8b662d32adb9655d577aab558e54a33cc5d8bf154d9e67224b6dede0f064c3fee63d504f9a21f38f12a514e6332", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629751740, "uuid": "8ea9298d-f895-4a7e-b0c1-8b6eff3fb35a", "value": "T15D55FA3915B43A37E1BEC379DEE44D1BF6D4B45B7911AA16B0DE03670342A02B89327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629751740, "uuid": "d74ac8d2-06f4-429f-b3ce-9a86667897d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629751740, "uuid": "b9104d73-771a-48a5-8d58-249f666cf6e8", "value": "24576:gVuEoOc8cOzcuMWauyFnW6xmiTlC2VpjrcqgQS0pMDIwnY:4IBZHTl5pjrcqe1cg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629751740, "uuid": "da096210-ee74-4ec7-b4d2-548c2a7ef753", "value": 1375232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629751740, "uuid": "8296ed5c-22b3-4686-83a9-6fcf4c501177", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629751740, "uuid": "ae927e9d-cf4d-4429-abe7-4a72ebf0d47c", "value": "8c02034958ae86a8d8b42fa5545561a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb1d7a42-0444-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629745405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629745405, "uuid": "6230183f-9bfe-4479-95c2-04cf163bc282", "comment": "Malware payload (AgentTesla)", "value": "d25769efd533ba3d13a13a3274fe69ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629745405, "uuid": "d955db9d-1499-465a-972d-83711dc4856f", "comment": "Malware payload (AgentTesla)", "value": "ab678f5bf745e3b2d1a5e7e07d88b3430c846e8c18068c4fe97329bef73ab5de", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629745405, "uuid": "f194c8ac-9175-4ef4-88c2-3ce30f1848e6", "comment": "Malware payload (AgentTesla)", "value": "f78b47c9a3e5773ad2b154da22455065100ce794", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629745405, "uuid": "483e3e49-8614-46c8-b2aa-2d4e229d6b35", "comment": "Malware payload (AgentTesla)", "value": "9f182bebeffedf161f3b42445d0426e64a463295aeec18b0b8c47570b6a0be1763eefbce4a1d45e6a8f9634e96a2f54e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629745405, "uuid": "98a36e35-e333-4c61-9cc2-47dfcdea2578", "value": "T1B03402959FBD851ECB900975292449BB78505FB2060F38B77760334E39F6EE9202CE67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629745405, "uuid": "e41b601d-52b3-412c-98d3-b385e011eaed", "value": "6ef74f7b87fa15b6df54d064a5b8ef31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629745405, "uuid": "d24bda46-2afe-43e3-8f51-e05d072173a1", "value": "6144:31M/RpTMLCj60ClGHIj6/RTa22PNtDhWFdYm:3spT+jdl8o6VaJPNN0FdB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629745405, "uuid": "02274068-d33a-4e80-8b60-bbec414e3fd3", "value": 240108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629745405, "uuid": "2da29c57-58a7-4da8-bab6-274afd522099", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629745405, "uuid": "c7875ae8-adb4-47be-8f9c-c80beb3acebc", "value": "d25769efd533ba3d13a13a3274fe69ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "425493f3-0413-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629724130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629724130, "uuid": "ac857bfd-9e43-4b8e-92f8-22e7f7a363e7", "comment": "Malware payload", "value": "1f4c1140deed1606fa2de015f4b2fa8f", "object_relation": "md5", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629724130, "uuid": "a3ce9e5c-15fb-4130-8def-48fa0da32eb7", "comment": "Malware payload", "value": "ab6b2e477d2e6b5420f6b586f049408518cfe55b34057874ff57ddcd216e1262", "object_relation": "sha256", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629724130, "uuid": "dfe4c6a4-0c9b-4d7b-8be2-93d6803c1192", "comment": "Malware payload", "value": "29ba116810a0580ba363f6c5109345a7708fce19", "object_relation": "sha1", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629724130, "uuid": "310b6aa9-e283-44b4-b1b7-04a368df5394", "comment": "Malware payload", "value": "b6dff54d62be6da65214eda27694ea5784c6a151858609634bedd6e5214c32b1504f1182cb134609870f171d69c8be41", "object_relation": "sha3-384", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629724130, "uuid": "bb5cf174-8852-46b5-a220-70bafe4c7dfa", "value": "T14BB4231764F954FFCCEA26740F70A76A8BB78F422650279B2F54BFE8F87015AA001356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629724130, "uuid": "990686ba-7219-46b1-8ebc-783ebf91b93f", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629724130, "uuid": "fe58ba93-11f0-4026-8634-8d48701e9b62", "value": "12288:BBT3AUKunSBiRAaJYOXDNUFrG/iIx0G820+Pnco3yPK2:PT3AWnSFcTRUwh02Z3yP7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629724130, "uuid": "9d69787c-6235-429b-8dcf-1ad4a9b01869", "value": 498223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629724130, "uuid": "5feeebd6-6477-4914-81bf-23816e9a7ef8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629724130, "uuid": "30dfc84a-12f1-47db-977e-9615834478c8", "value": "setup (1) (2017_05_10 17_07_12 UTC).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58ce26a3-041d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629728463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629728463, "uuid": "c0464567-c8e5-417a-a6dd-8e9394be726c", "comment": "Malware payload (Formbook)", "value": "595b61d0ba6cd466d35ed22c5fa7be9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629728463, "uuid": "c859c1af-4fd9-4a35-9aa6-5830c038b6f2", "comment": "Malware payload (Formbook)", "value": "aba30cfb1f3ce3760e9cbd42f49cafa3582d349d690f1ee91674e2998f4b290e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629728463, "uuid": "ce13c901-4982-4cbb-9c7e-16763fef890e", "comment": "Malware payload (Formbook)", "value": "3112e77c14a701f5ce0d11bb261e1c5a0a564105", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629728463, "uuid": "8ef32362-9630-4d9f-9400-a0c317371689", "comment": "Malware payload (Formbook)", "value": "f76f349de2810648863ea22686691cc98801bbb252871dc7689b8b4f9305cc8685d583de9830d6bd35a9db8884a86908", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629728463, "uuid": "ff154a51-037d-4d5c-b077-eead20bf3b6a", "value": "T19205F53D19F91233D1B5C365EBE19423B148986FB414AE6A6CDE07A7031BA8735C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629728463, "uuid": "7927df8e-f74b-4105-b353-71d3fbe1518a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629728463, "uuid": "02e145fc-728f-47da-b93f-ca57395cce6e", "value": "12288:dKeIRmrn4RNNVbWaUd4i2WuuiL+ZjvTvvRTPVtK3KTMMQBTD5yjqBgUJHK:UPY2LbmCinu01rvvRDP+KM1D5yenFK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629728463, "uuid": "a2613e48-def0-41f8-845c-fab749b047bc", "value": 847872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629728463, "uuid": "641b91d1-84ee-44cb-b692-30e23093a7d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629728463, "uuid": "0920ed83-67de-4fd6-95bb-f780b5f7d56d", "value": "Payment_Advise_[GLV820814452]_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "093f1fb4-03e0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629702130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702130, "uuid": "a680dd07-7f17-4677-895b-9e70e3848aa6", "comment": "Malware payload (AgentTesla)", "value": "12818d7eef11bd965863245508cff3b7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702130, "uuid": "75015a8e-6a30-4fbb-a6ee-f144554af7ba", "comment": "Malware payload (AgentTesla)", "value": "aca33927f7624dfbc213e4a4bf9d1c02b299b06af7d5855a5eb53226bbd32b07", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702130, "uuid": "001ee741-c3ea-4b6a-8056-e454087bdfee", "comment": "Malware payload (AgentTesla)", "value": "8660e27ddaa6b2b6c4b70cabea5b82b2bc7335ce", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702130, "uuid": "863c5eab-f228-4dea-a971-e04d8d496929", "comment": "Malware payload (AgentTesla)", "value": "96627674e22ad799ecd752487140b19fb0495d3e3db09067ddee407b8429ecc98d8f270bc8c53063728a936d0f7d2f18", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702130, "uuid": "56962e5f-6f14-4c4b-a619-f30559fa0b71", "value": "T138556B3D29B82627C17AD775CBE18817B194A8AF7511EDA9A8D343660303F9735C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702130, "uuid": "bbbb9567-c241-433c-a529-8bacd4bf78bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702130, "uuid": "4bd7b9b0-7c46-4cdf-b2a3-ddd62c20abde", "value": "24576:v8a7ejs89tDgglkPpFAYrDRkAmZbId0SpHu1NQwrmMnfk/iQ2+S0d:v3ejsaJPkRyYrDpqKu1mw9fk/Pj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629702130, "uuid": "3712a4f3-ef73-44b2-a66e-1813b272f582", "value": 1383936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629702130, "uuid": "0757dc03-0780-4ff4-9fbe-9ca4d84225eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702130, "uuid": "61b94e69-0a4c-4b5e-810f-5f1ccc5a3c12", "value": "Payment Slip_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92d6aeba-041c-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629728131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629728131, "uuid": "69b1cabd-7476-40e9-8241-4370c95f7f3c", "comment": "Malware payload", "value": "aeac57103b3c82c0c09cc0521db58362", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629728131, "uuid": "83f13344-50fb-42f2-a4a6-46de6823d3be", "comment": "Malware payload", "value": "ade278b6d405437ee6048371f3175f7e9eeb257c6d1f8e6c8612b0316a516f25", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629728131, "uuid": "e8b5552d-7dc8-4541-839f-75a04a78c6d8", "comment": "Malware payload", "value": "f61d0de9c33a1b1c2b7c6d5938cb744eeb7fadd5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629728131, "uuid": "8e6f7435-3136-4758-8732-04a5333fd85c", "comment": "Malware payload", "value": "fa97e16bfaeabd8991a94f7011f029d00317f10c02b108c8e2716bc5177ad6c7361d07f4fac3997fb6bcd511a178f737", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629728131, "uuid": "343e2091-96bf-4e30-8b33-d747ae76d9ea", "value": "T1A496331137894D3AD0335071E4DDA9A9ABA9F6A89544604BAFF606FD2E347D3C337B02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629728131, "uuid": "4abcca91-b4a8-4fed-a04a-a043a82e3996", "value": "9d1f0da408c33eebb70b9bfa17b7fddc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629728131, "uuid": "4293c03d-e857-4b1b-8ee7-d7072df89c56", "value": "196608:D1zSWo0hLdTDRwa3VFy0FQzOkGOU47EpHiO:EadTDRd32GQzOIJ7IH/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629728131, "uuid": "bc32261a-5cf8-4fbd-a566-d15dce50fbc1", "value": 8619099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629728131, "uuid": "af81a0c2-ad17-4907-be23-b40bcaa71a8a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629728131, "uuid": "dc6fa1ea-4c53-4400-a633-bb4652cb1204", "value": "aeac57103b3c82c0c09cc0521db58362", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfd2c8a4-03ff-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629715804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629715804, "uuid": "ef7a651c-0379-42e6-a05d-8a787537b9c7", "comment": "Malware payload (Mirai)", "value": "d81033dab8ffa2e68cf7814c1de2e68a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629715804, "uuid": "9a718ac3-41e4-4886-9e5d-d80c5fc871f2", "comment": "Malware payload (Mirai)", "value": "adfbcb0140fd7e8b97b808b0cd37ab4239ba947da658cccf8b8782223447e5cf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629715804, "uuid": "c5fc4985-d19e-4eb5-a86e-e27a94e393d6", "comment": "Malware payload (Mirai)", "value": "ecc425f793fd84a8c546da0dab140aefeaa576fa", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629715804, "uuid": "38d60302-4445-43dd-b18c-3d45150e29eb", "comment": "Malware payload (Mirai)", "value": "34b9f418577d72da5cdacb0e8a970a901fb746e439eb73ba24e08c1172d084d0367e844950e903fc7565e7665c55ec37", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629715804, "uuid": "41c85a4b-b6a9-446c-aa7c-c331ed7fa170", "value": "T12433F132AB184D039C61BC32A9B946F7A5FBC37EE01E56F5E6074CFD6940902D5B1943", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629715804, "uuid": "9954dcfc-6316-4310-9b4a-0e5be50659d7", "value": "1536:QBd49Pl29hwd14wElc8y/T76JsRL4LAN/fBZ/q2li:ZPlRdFd8yr766RL4+JJq2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629715804, "uuid": "002ff2b1-8729-413a-8665-f23b04cb67c1", "value": 51692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629715804, "uuid": "ef1469a2-5ae6-496d-bd36-cde44edde3c5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629715804, "uuid": "a4e5bd5a-65e2-4852-9edf-046369616ff4", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b4ea0e9-03d7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Amadey)", "timestamp": 1629698429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698429, "uuid": "230b9ca2-757b-476f-9fe8-fcab93804a2a", "comment": "Malware payload (Amadey)", "value": "be598a3f36e8ef92fd46be3885fcf803", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698429, "uuid": "adb9d467-006b-4cb4-8937-e73c181954b8", "comment": "Malware payload (Amadey)", "value": "ae2ff88e2ad964e8dff6d14a2f183a1f4232020d678c0bc0e8043025f8d0f199", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698429, "uuid": "3ba378da-91ac-4ea1-a8e6-2d383dc77eba", "comment": "Malware payload (Amadey)", "value": "e17878e4ddfc808dab36ec2bff7b7ddb4e5a5da6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698429, "uuid": "c63da27f-7614-4b14-8fb8-9e48652b6d42", "comment": "Malware payload (Amadey)", "value": "7425a0c55a43668781fd757383cd08a7418414c7c3cad8f1c8e21d898a3e7f5d770a9996b1501518be5a389ea4231ff1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629698429, "uuid": "d05aa243-7335-4c24-bfb9-dc73fd8be4fc", "value": "T1B4649D30BB91C034F1B712F495B683B8B93A7AB16B3450CF52E51AEE1A246E5EC30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629698429, "uuid": "fa900e5e-aa99-4c2c-ad30-d059ea9b1f22", "value": "4aded8f080ac4b6e892c4de31a213f2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629698429, "uuid": "b4496b95-1ce2-4956-ab34-3efd932effee", "value": "6144:O4EULixnj/GaedD8/D//EaOku3ZShiqxNHQZpYHlqF/ekEiiWYYV5:5L6njheq/oaO1JSh9wfkqF2kJdY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629698429, "uuid": "a0bdab34-386b-47ac-9ac2-93d846f5226a", "value": 329728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629698429, "uuid": "6b275454-9d4a-4f6a-96e3-6ed4a430385d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629698429, "uuid": "089e9b20-83d9-4997-94a7-2f4cb395ea2d", "value": "be598a3f36e8ef92fd46be3885fcf803.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f7f0410-0414-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Hydra)", "timestamp": 1629724501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629724501, "uuid": "05c5d552-edba-44ae-b542-a91467dcb3cc", "comment": "Malware payload (Hydra)", "value": "45830da853df876cc3e46716c7da738b", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629724501, "uuid": "91a0ccbf-f34f-4463-a900-de30e51b8e4a", "comment": "Malware payload (Hydra)", "value": "ae6f5521304808c1871efeb9168ad649aa4996c9c55909c6c3580f43203a40b1", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629724501, "uuid": "f7c2b4fe-06d3-432d-a7be-e037135d06c6", "comment": "Malware payload (Hydra)", "value": "cfac92065b0d115504e008683ec792e8ddc54925", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629724501, "uuid": "6bb0a96b-29f5-4c9d-8a3f-ae70c51c1cc9", "comment": "Malware payload (Hydra)", "value": "eb1a808db6d5ab79cb5f94f931da5e6e22ebfbde2f26230723a97993f8ebab81a3b903c3f86ae0939d5570130b87cf00", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629724501, "uuid": "934c6224-21c2-4f59-a6ac-172b8b3a03a4", "value": "T141F533887943CD6DF54FE8F1C9994E4782028FA520D8B1370D7A459C88F5C6AA963E3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629724501, "uuid": "64ef6049-47e3-47ba-89a2-bd25309e8923", "value": "98304:iXvfTET+HggtmXEo6S/FMiwCoDkPpx3O9iEYNLrX4qzclf3W34:iXvfHm/6S95e2pRVEYe8cp3V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629724501, "uuid": "3b423b8e-4fbd-4901-b443-b79bdcf45208", "value": 3367537, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629724501, "uuid": "e46a43ed-52a6-496c-a147-ba912fd8d8df", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629724501, "uuid": "163809e8-dc7e-4a93-9574-16937a7617d4", "value": "49506_Video_Oynat\u0131c\u0131.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d2aa941-042f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629736281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629736281, "uuid": "8c9c6445-d8c7-4f8b-bad1-8fedaf670831", "comment": "Malware payload (SnakeKeylogger)", "value": "262620a626153ab06d1aa1036f36476e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629736281, "uuid": "9bec775f-0836-482d-b50e-a12dae0b8ffb", "comment": "Malware payload (SnakeKeylogger)", "value": "ae958197a4e528127807ef23cd3b999086376cbaafbbcd416197b40bd97e07ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629736281, "uuid": "8c9640d0-3dd4-408c-ae67-fbeb480f141e", "comment": "Malware payload (SnakeKeylogger)", "value": "6f31db329443b5d1c43cfc29ffbccd86b79fa367", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629736281, "uuid": "d7ead493-d733-45ab-9659-dbd07219a5fb", "comment": "Malware payload (SnakeKeylogger)", "value": "b5fd508cb1cfae81b2b6552d546b43adc71e2f8f5850d33cef4a8fe0ebe1312a995a92460ce2d5304c07dcd165788171", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629736281, "uuid": "d153507b-fb6f-432e-8fd9-93ef7629c89f", "value": "T13105F63D19FA1637D1B5C365EBE58423F149985FB410AE6A6CDE03A7030BA9335C722E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629736281, "uuid": "339807b7-da20-49b5-994f-ff76ea055263", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629736281, "uuid": "888e3b3e-3afe-413b-9db7-bbef4bd4b6ad", "value": "12288:YhM6y+IxvE/dm2/fl3Es5V5IRp/Eg/7PwtbTJRRvH62W:l6ZIx8/V3u1/Ek7PCTJP6B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629736281, "uuid": "e43eea34-02a2-47ca-9c49-4b9ee3e1cdd3", "value": 845312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629736281, "uuid": "a30fa22f-1f4c-4764-93e2-14a8e4de4bb2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629736281, "uuid": "0a2e3836-51df-42d7-a8a4-db51c364d47e", "value": "OBL PN210700369.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6ced7a2-0402-11ec-8fa1-42010a9c0011", "comment": "Malware payload (a310Logger)", "timestamp": 1629717051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717051, "uuid": "47fe8a06-4edd-4574-aa9f-51de1f4f27d4", "comment": "Malware payload (a310Logger)", "value": "9aceea76f4ccb33286e37aa91e15cb44", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717051, "uuid": "e17b1331-9ebd-406a-86d6-bab6218fb317", "comment": "Malware payload (a310Logger)", "value": "b11cb95a4f8665db55cc8a9f54cc0107d37c224adca1f3dfe9bcc50074a23cb2", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717051, "uuid": "b9b96a66-f5e3-4280-8fdf-1b8813d78663", "comment": "Malware payload (a310Logger)", "value": "c01c60f47bfabda0c99f6d434e6bf772e54fa9a8", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717051, "uuid": "dd62167a-bbd9-4590-ad88-5c473c0e5f3b", "comment": "Malware payload (a310Logger)", "value": "c1fc08dd9ce81b4c6d56023c05af581f632e1015c912eb8f33fa1a9e03119fde3d1882fd0a3dcf1e77182c56cd54a9df", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717051, "uuid": "a60d560f-97fc-472e-bbb8-1109fbf229c3", "value": "T11C25D0B071A78A56F11F4A702538BD5403B271F3B9D69A391B56214ACFEDE983F4820F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717051, "uuid": "29ed8531-3b9d-4dfb-be38-09484a027dae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717051, "uuid": "4e76f5c3-57d5-45a6-b331-e2e9c3a7fb6c", "value": "24576:ebb58UKrHWcxaW7lSR7BJkmjw2tjy1JiVJHPi:25+rWKaW5Stkmj381g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629717051, "uuid": "9a78ad51-e2df-455b-84ad-3b3f8c777b4e", "value": 980480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629717051, "uuid": "1191a1aa-8589-4822-9617-edceb0357ec9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717051, "uuid": "a946ada9-7763-4ae1-b482-1ecf09ac6159", "value": "hesaphareketi-01.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f723fa2c-0439-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629740754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629740754, "uuid": "5137db68-5c09-4b4d-8908-bed2794ff89c", "comment": "Malware payload (SnakeKeylogger)", "value": "6b6efb8dcbc087063264f2dc550e38f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629740754, "uuid": "ed3a1c2a-b324-4b03-a490-60e0073ad278", "comment": "Malware payload (SnakeKeylogger)", "value": "b28859d6dd253998cf1ed68d8c40cfb6a5a4e43a2ca8c24d8f8e46d176d44315", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629740754, "uuid": "8f330618-9aa2-403b-b4ed-8d15f2d2eb32", "comment": "Malware payload (SnakeKeylogger)", "value": "10866fc0e8889e412e66620ff82a3009195848b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629740754, "uuid": "5bb8c033-8ef4-441f-81c9-5117fadc8582", "comment": "Malware payload (SnakeKeylogger)", "value": "0d08154788a39d8cb4f93fb8d9bb30131a569c50c09e0bcff9f098b7b6b3778fbaed6886dae90f87d08209014ac41d5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629740754, "uuid": "59019463-a6a5-473a-832e-b219764e212d", "value": "T193944DBB18729210C6A501BF8990CE7C766E4B9119F1BF8DD7A8B46210FE945E081FF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629740754, "uuid": "d4e42156-c161-4ff3-bfda-557112ce2904", "value": "6ef74f7b87fa15b6df54d064a5b8ef31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629740754, "uuid": "6d7bef1a-190d-4931-8304-69838ff7bbea", "value": "6144:xeN3Xy0fAsXUPVER+36Fx0VILu5oGEVclk7umYBxtea:I5XosCEs36zYIAojcld9Rea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629740754, "uuid": "12ffbf36-a742-43c9-b4c0-8dd23a3236fd", "value": 438421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629740754, "uuid": "4d994499-2d36-42f8-b756-9c8f2edcceb6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629740754, "uuid": "0c62f87e-1bb2-44e3-834f-68beff956017", "value": "Teklif Talebi.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2674e051-03df-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629701749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701749, "uuid": "9636a2a3-0116-4bfb-9800-69c91a2bbcb1", "comment": "Malware payload (AgentTesla)", "value": "9fef4c6b7eccf77ee4468f1458d99181", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701749, "uuid": "78bd9570-d18b-4cd2-84b7-e70cba587c48", "comment": "Malware payload (AgentTesla)", "value": "b3bb7880c3f9356691eddc15d69c01a609ff865c78586ade25452c9c6c6c576f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701749, "uuid": "efd57975-729b-4d86-925c-8a69824b3a72", "comment": "Malware payload (AgentTesla)", "value": "552783b59016c147534b6a9827c3848fc39cfd2d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701749, "uuid": "049849ee-a9da-4a05-a97f-99cd63d52f78", "comment": "Malware payload (AgentTesla)", "value": "50d4ad55c75eb4905ef0e9bceb7608dcdfac74e3c26b58051cbd8d001ae906a081e02784e672e26374a73a173ada73da", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701749, "uuid": "6b263842-bb1b-4278-b570-fc981c1309b8", "value": "T117D4BF2179818032D67238304B75D6B15D7DAC302D509B9BA3D83E3B7F70692A639B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701749, "uuid": "c1fb6d28-b12e-41e8-b859-5a4426d1a95c", "value": "7e10d8f3c6a91a68257beb0c2e7d22cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701749, "uuid": "f27f2d1d-4338-4688-b71c-3ff47465c75d", "value": "12288:0dRp+tZYaWvuEiB1EoFw3AlomBqz5+MvLd81lmHGWKgBGPCPehHt:dEiB1U3AlomBs5+MvZv+gBBPaN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629701749, "uuid": "66d13808-6572-4c94-ab4d-fad8281d3e8e", "value": 601086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629701749, "uuid": "2fba7279-be96-49ab-b142-c7d971d3acac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701749, "uuid": "ab5b071a-b1aa-4efa-bbc8-d6a2effc7278", "value": "chima.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1bfe471-03bc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629687004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629687004, "uuid": "c69db073-842d-4b69-b946-efed2e758da1", "comment": "Malware payload (Mirai)", "value": "8b60fb9d2660b653c0ba2f2203373938", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629687004, "uuid": "51e1ce9b-e17c-4c72-9b81-9df0fd7a31bf", "comment": "Malware payload (Mirai)", "value": "b47f1da97a147179f3daaf7bfee70fc9a7e98befd9ac6225fe85beb251f20238", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629687004, "uuid": "54ffb194-4dde-4dc8-a51a-567c005c33aa", "comment": "Malware payload (Mirai)", "value": "9e3158a2286506f353dc8e8a2524ae665e9a2283", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629687004, "uuid": "d7bbf379-00f7-4c2c-8dd8-e21be1e05bcf", "comment": "Malware payload (Mirai)", "value": "7a84941b00681997ce71d27c4f508322870af02e64f9679130478535627e7b8d4b7a21d2c90c0ae2459240b461cbb841", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629687004, "uuid": "cd1960f2-3e42-4ef5-90e8-0eafd0c9b576", "value": "T1CCD2E131C5FA9BA9E06B1135E4CD3A8EA091E72E5C186CEBC5E8701744917787D7C3CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629687004, "uuid": "f7766b1c-3f02-417c-a234-749b0b7a0c0a", "value": "768:04jnve4BVBRjOviQYnUSQg4cmMB2YnbcuyD7UHQRjF:04z24BVBRgiQeUdnunouy8HyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629687004, "uuid": "dd552616-0969-47ea-92f7-7c32ea954430", "value": 30880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629687004, "uuid": "6ebaf77c-c6c0-44aa-a2c0-e12c99256b14", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629687004, "uuid": "65839a5b-7c61-4381-92e3-ec063f1f8a1a", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6371a6f-03c0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629688730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629688730, "uuid": "b13f0fe6-8c6a-4817-9e91-680881470c42", "comment": "Malware payload (AgentTesla)", "value": "a8c2cac78788d898c750178302e8b5c6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629688730, "uuid": "72a9ea15-2bcd-4ad3-874e-f146b3753f8c", "comment": "Malware payload (AgentTesla)", "value": "b48e8c617a3fc65d3076a09e02c252e5dae46a540d57d27052ffa5133b161053", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629688730, "uuid": "d663953c-0496-41d8-9c2c-6cbb4f594822", "comment": "Malware payload (AgentTesla)", "value": "2031c756a88ff94cab1aa4de54c602c20ec02507", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629688730, "uuid": "b9f6ed6f-c6b1-47fa-85d2-c5c4fd668cb5", "comment": "Malware payload (AgentTesla)", "value": "0816ec5dab41ab2b91739c4050a010b7a44be5db96901053c38eca4c7129ed76f39767f9ee5cf32f121a8b37d53cd85d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629688730, "uuid": "738538f1-2045-4763-b0fc-e3bfd9317c7f", "value": "T187F44948379071AFD523C9338B974C30E67164AB979BC343D053D2ADA91D2B6DF086AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629688730, "uuid": "722eb78e-1101-4468-92a7-256933c1e3c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629688730, "uuid": "f0ca341d-757c-4ced-b303-4b04c551e4b2", "value": "12288:UhTVETqJXGYyNGz94oSMMCyjwCPj0SU5BUjYUCtjdRqxJjmiGJWrj7jSOvmqNM:iTAqJWFozmCM1tY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629688730, "uuid": "92bb62bb-3e26-4180-a326-099e19c9ea85", "value": 753152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629688730, "uuid": "b002d722-9e9b-462f-a069-c08b349d64d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629688730, "uuid": "07bf5f76-811f-4a15-8666-8429d68f2545", "value": "TT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "631ae655-0409-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629719890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629719890, "uuid": "e68eea43-55e8-43f4-93ca-d2749131dbe0", "comment": "Malware payload (Loki)", "value": "e2bdb14a06a159e0bff5e8c38c138093", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629719890, "uuid": "e076099f-06e2-4f80-a3a0-1496b6158669", "comment": "Malware payload (Loki)", "value": "b4d606664475463ef5538277959a0c5f679bb47ef9dd1e00d25d5999d129c09b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629719890, "uuid": "5b771b1f-72f6-4a69-b64e-e5262f9703ba", "comment": "Malware payload (Loki)", "value": "698c24f4a8ddc574a2f7d67508c9e19c2ede5d4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629719890, "uuid": "c197ed92-37a3-4194-a16a-d4b31751a661", "comment": "Malware payload (Loki)", "value": "a490eb9bbd5360a537e3cefec6dad7e2faaa65b5e366602c289c4df9eb5f12ce5ee37764e4860de7f51d4690b38a2441", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629719890, "uuid": "ee41c80b-152b-4b2a-bac8-b5ad7ce841c0", "value": "T106D401497744FB5FC02FCEBAD9261C20E7E1E5750317EB16AC8311E85A8D7998B023A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629719890, "uuid": "dad7278f-6025-4f38-a92b-9d80d9b1cdca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629719890, "uuid": "abda75ed-f4eb-4efb-82bf-7a842b9362d0", "value": "12288:8s3rANw4h9mzDYtP3ZMfrCYaPDueN+tmmzn5rGM:8s7ARh4zSP3I/mmzn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629719890, "uuid": "bad79348-1e0d-4c1c-a364-3fe564d76ac3", "value": 608768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629719890, "uuid": "dacf5e3e-9e92-440b-86ca-acfc26d4ff96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629719890, "uuid": "df8cdeb9-639b-4992-b691-a28a1a154400", "value": "INV#202170607#SGNBM4809600#BL_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "725aed91-045a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629754705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629754705, "uuid": "cb674862-a936-4aac-82d4-7fbb6ffff186", "comment": "Malware payload (RaccoonStealer)", "value": "16f6e28f08f2a401fc9462bda8185fca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629754705, "uuid": "2aa092a5-c3cf-46ee-8742-eb2083930c78", "comment": "Malware payload (RaccoonStealer)", "value": "b6f53baac36bea3aa1c2337ee0a9f1f99aae8dbf12ad02ab3abd9c1c850ef24a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629754705, "uuid": "8f3530eb-fe37-4f6d-ace5-c059a5fa650d", "comment": "Malware payload (RaccoonStealer)", "value": "513346160b6ed1f738b5bf6305ebbd112bb99e16", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629754705, "uuid": "29ca334e-4da2-4bca-8f24-9bcedc54e358", "comment": "Malware payload (RaccoonStealer)", "value": "f12767010f56818caf258dabdbe3b1257808abf56875ee2c41e97596bce8b44001aceb36fee08004d80ab9d634132118", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629754705, "uuid": "5aa43784-dfa7-4223-8a32-67dbb746c24d", "value": "T1E1B4E030AA90C434F5B711F855B686B8B83A7EB15B7440CFA2D12AEE56386E5FC30747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629754705, "uuid": "761615ca-028e-479b-a5bc-f7f1710d3137", "value": "4dcb3c3a3fe5e134dd41266130cc79d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629754705, "uuid": "9b5a6a8e-8383-4295-93b9-45d9dbb585f3", "value": "12288:6TAFmENoTwPkN3K9D/0XeLjdOyZ1rdslT9+PI6KnTrk:NNEwz//hOy3+R9GyTr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629754705, "uuid": "d54ba60a-59d1-4adc-aabf-10d636a69ab4", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629754705, "uuid": "d1fb084d-5add-4eb4-b1e6-0991bc656fd3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629754705, "uuid": "702da581-c3ee-455e-b56d-215fcfd27dc0", "value": "16f6e28f08f2a401fc9462bda8185fca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc340dde-03c8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629692230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629692230, "uuid": "b8bf2d22-bd28-4eec-ab32-3a873bed29c9", "comment": "Malware payload (AgentTesla)", "value": "0d7e0cc68f65ce59286b5fb245ead3db", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629692230, "uuid": "43c5b778-30be-4026-b5af-545968e3fc7a", "comment": "Malware payload (AgentTesla)", "value": "b749b4fbee63a62c60dbc94694a64fad5907d26016c7eb67674e8e640d0791be", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629692230, "uuid": "935e7a4b-1c3d-4492-b40a-a30a9284107f", "comment": "Malware payload (AgentTesla)", "value": "107f801fd5e7cd9c6fe7dcbe5cdf4fda494f5ed5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629692230, "uuid": "1ed6dd74-f931-48f4-bb25-d8a95ea01b8f", "comment": "Malware payload (AgentTesla)", "value": "356125ace4cf4b7fd0bb0a9db81f22ea8f1d24d429d6db17b26895685013a35d2f1ab7646763fc7a4b7a77b42fdf5286", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629692230, "uuid": "9eb1540d-a6dc-45af-90f8-7336b6388d27", "value": "T1CA05F63C19B91637D1B5C365EBE48423F1489C5FB414AE696CDE23A7036BA9334C722E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629692230, "uuid": "4c00734b-250b-4462-9e96-075b01e840d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629692230, "uuid": "8fa1e962-5694-4a0d-a72c-ad46fef0a047", "value": "12288:0c9228+IDBG23xuke2xVLubBBsoMFXvNr+echWoNy5nwuU90Mo6wj:0xaIM23wke2oBB+V6Psm0Myj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629692230, "uuid": "464b31e7-e852-4830-9111-e4b4d900e8bf", "value": 845312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629692230, "uuid": "183f7a95-b13d-46c4-bc57-86c7c6f64075", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629692230, "uuid": "d68b710b-7d21-4e03-bff1-ee7621d16deb", "value": "New_requirement-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21e09224-0410-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Alien)", "timestamp": 1629722787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629722787, "uuid": "5ba9decb-4353-482b-ae0b-e5492a997bd5", "comment": "Malware payload (Alien)", "value": "15b4ef12a281c43662138a9bb37d9456", "object_relation": "md5", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629722787, "uuid": "44302687-1ba1-49dd-a0a6-dd5717b8957e", "comment": "Malware payload (Alien)", "value": "b77decb8c8407f3081f009624795035f912dd842224acb55b437dde937a338e6", "object_relation": "sha256", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629722787, "uuid": "141668c0-6b95-4886-a7db-000bb6f89acd", "comment": "Malware payload (Alien)", "value": "1a9fbb759957025602457517995baf73ab615142", "object_relation": "sha1", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629722787, "uuid": "81507c71-1c47-44f7-9567-8b05a1a08e5d", "comment": "Malware payload (Alien)", "value": "74f26d734507e1a6dedc152d27fb9cae051fa8fb19f954d46d3cfc8b54af59ce61c191cc702795acf0f26994125765b5", "object_relation": "sha3-384", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629722787, "uuid": "6f038976-5d83-4a68-9a1e-7dcccc9fa2df", "value": "T137F53379E781C90CF6170932820765637689B8AC22D2A4BF453D40D01EF76E99F47EBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629722787, "uuid": "2e7a95a7-ec38-43ae-9263-147edd46c551", "value": "49152:zfNfFh0ky8itaHUrnKvVBxQhozddqwhDjbjxxlVWC8K2maOqvyYSKTEj3vO7VXjh:B0FnLupF1jbjxxldsaYSKwjii5gl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629722787, "uuid": "8107f8cb-cb98-4a30-9b49-5a17f6785d6a", "value": 3405570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629722787, "uuid": "6a28be37-5841-4b21-930e-f932c08c2e09", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629722787, "uuid": "feb00d7a-a9a5-48b6-9131-4b7cce1d0e57", "value": "Porno_Izle.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d58814bb-03dd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629701184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701184, "uuid": "984e48aa-8d27-4328-96bf-5593dec505db", "comment": "Malware payload (AgentTesla)", "value": "c980d2a8648d29a3ea7a69bb3cd7edec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701184, "uuid": "0550d702-3416-4996-93db-b4862ff21567", "comment": "Malware payload (AgentTesla)", "value": "bac760db1e30a4c82bcc4e781de8993799f198974a02b96482734b487f2206b6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701184, "uuid": "1b47d3f1-4967-4111-bce6-f85cb674b05e", "comment": "Malware payload (AgentTesla)", "value": "9640c2c41a550cfd49ca4d69a618667a5269a1b8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701184, "uuid": "148ca58f-8eae-4ca5-ab00-1f9001eb5b2f", "comment": "Malware payload (AgentTesla)", "value": "689de0a5d643400a6b738c9178e5fa591f040825d089e8c932b1217ed3fa7ab02adff4214f2568622bb9ae14fe353dc1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701184, "uuid": "e604cec6-e2ff-4685-b773-4a1858c442f0", "value": "T10BB42376345BB111D80B0E330AE54D4D05EFB6592900EAAEDF05EE505BA0B9E48B7DF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701184, "uuid": "0977b0ca-c825-410c-a63d-cafd13eb71fd", "value": "12288:n569Bj8R35nXfprodSpDyutO49GXArgIv+Jy/u8LUqX7d:CBIRpPprodSpDyuM49R6JKZLXp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629701184, "uuid": "5d3b4396-4dc1-41b7-800a-207cbc64ba7e", "value": 502824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629701184, "uuid": "b16d0ab7-f32c-4492-8a9b-06a27da2df10", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701184, "uuid": "97c3f994-e503-4149-a8ed-5cb3502aad11", "value": "TT COPY.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91bffafc-03d7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629698493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698493, "uuid": "26c9f9bf-a8db-4d92-a061-151eaf9605fc", "comment": "Malware payload (Formbook)", "value": "03e2cbb7654214780a7d3fce7709f9de", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698493, "uuid": "9d28c865-f913-4cc1-8da4-43de4d871244", "comment": "Malware payload (Formbook)", "value": "bafa6d4a5c89e6aacc50f80b8b6248cf4a1d2b65addbe97687b6119925b2d5e8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698493, "uuid": "1422e291-f7f5-4b83-98ce-1b98080f7de7", "comment": "Malware payload (Formbook)", "value": "24f5d1b92980053e31a2522ebe1513023454e642", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698493, "uuid": "c845fe41-e5d6-4ba3-a1c9-d5120108e684", "comment": "Malware payload (Formbook)", "value": "8953d6db912f3d0e0fb449423355827a7ee7c7eee92831588414be76af68c62c2340482c94c00561a7e52c0636041290", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629698493, "uuid": "d80e44eb-f5eb-445a-86b3-50b0bad1c20e", "value": "T13D552347F6598A4AD30EE174578A247D02BDFCEC1FE4C432ADA67012D4B89353F82E99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629698493, "uuid": "51c479d6-d71a-4c80-814f-e1bda27c8195", "value": "24576:S+vGeYENZi1EDb0EAgoniVFk/Y3Q4rNwG4g+yMLOg4aOx3ti08zUH:bOYa1wQfj4rfNTouBw00UH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629698493, "uuid": "3e5e5a42-cc5e-49d9-9655-0c3b7b4ae045", "value": 1304408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629698493, "uuid": "67e6efc4-20d8-4864-9fc0-30f08c265457", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629698493, "uuid": "6d7e125b-4b5d-4cd6-89e2-540c8024c54a", "value": "Advice From CTBC BANK.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d46c0fb-042b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Amadey)", "timestamp": 1629734429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629734429, "uuid": "b2c3e9df-1e1a-45e2-9ce1-ef845c4e7789", "comment": "Malware payload (Amadey)", "value": "9e78e53abdf9476f2880b40cb768e7de", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629734429, "uuid": "29da762b-83c6-42a0-bee2-ce71da762c82", "comment": "Malware payload (Amadey)", "value": "bafecb2ac5babb0d176722b04693d16b2345a9dc104573b21376ba6de29fb10f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629734429, "uuid": "3c48b0d4-283e-4511-b304-f7fa535b9796", "comment": "Malware payload (Amadey)", "value": "a7af0beeffad2407f892118ae48ccfa3316e7ee5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629734429, "uuid": "f349f959-4e02-4594-b063-48a97164a2ee", "comment": "Malware payload (Amadey)", "value": "3c0e9da3be5f30a4aa12960ebff4b88526dca641867d7dcfe5f16708b4924bd245c350fe7b2e255b65a08fe862e50806", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629734429, "uuid": "03c7114d-6d87-4b38-8f07-3ae4be109a6b", "value": "T11B64AE30ABA1C034F5B712F845B683B8B93A7AB0677450CF62E51AED4A346E5EC30747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629734429, "uuid": "63c81b10-9036-4488-b124-b3b52de17da7", "value": "9d905009ce289bf09ec9a9fc544fc23f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629734429, "uuid": "f193d3e6-426d-42ee-a79d-85aeb9b5e635", "value": "6144:E+Li4ZeHSaUkvE3R+mTfQ8E768BjB8T+eakrQ36oc0W:Bicey7kcBTfQh76KjB8Jr86oc0W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629734429, "uuid": "bfe2b751-99fb-4267-ba23-7898249da171", "value": 327680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629734429, "uuid": "e270bfea-813a-4437-983b-c5a5ae9328d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629734429, "uuid": "73316215-6031-486d-8805-beb52847b3fe", "value": "9e78e53abdf9476f2880b40cb768e7de.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69470260-03e5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Vjw0rm)", "timestamp": 1629704439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629704439, "uuid": "4fda3902-564b-4051-b7fd-60760e2bdf36", "comment": "Malware payload (Vjw0rm)", "value": "92aeab75b19a2fd42eb1da3f71e58554", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629704439, "uuid": "b18a835a-7e6b-432d-8898-07fe65c9c862", "comment": "Malware payload (Vjw0rm)", "value": "bb22cb56b476332b2148367891089954d3e9f5af18104615920af794601c817d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629704439, "uuid": "33def977-6a51-41c3-a699-19696cade81e", "comment": "Malware payload (Vjw0rm)", "value": "dad3bfa343407c9269bbe928ef061bf4264bc429", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629704439, "uuid": "af7ec278-503d-4be5-854a-0424073f6eca", "comment": "Malware payload (Vjw0rm)", "value": "fa9dabfc0cf2b66364e55f0194839e654083bf934bc849a5b1a8e11c8db788253d0b72f09a5254402355307bc1a194d7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629704439, "uuid": "e2bba320-b46d-4029-aa68-02303c7a326d", "value": "T17282E8CB7A97B0E54696B1BF3E1EF091E119CCC1B6488818F690F46DF8D531441BAFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629704439, "uuid": "e8299c2b-8e40-452f-9595-56864c74c29a", "value": "384:shmlC69MnDpvmWaQUQe1LoMvEguiwO5mHj+sRwzPIJHE05Vb:shYit2ZvvC8mHjSc1/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629704439, "uuid": "a743e795-f3d3-4cdc-8289-a3598deda108", "value": 17972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629704439, "uuid": "f91b46a3-773f-4a52-87e7-74a87c506925", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629704439, "uuid": "2602d43d-27c7-43b6-82c2-c3228ce4b64d", "value": "ISO certification.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfe65c60-03f8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629712744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629712744, "uuid": "c3cc2725-1a8e-4f1f-9e3c-f2af96f9c915", "comment": "Malware payload (Loki)", "value": "08d088a71840d7bde4b360d7b66138f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629712744, "uuid": "c8dc31b3-d874-43ec-a85f-4323dd4af55b", "comment": "Malware payload (Loki)", "value": "bb9e218e4ff28cff9230bef951bfe3bd22b9eb2a247c01b0d5cc363c890c5161", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629712744, "uuid": "7a7a79d0-fd7a-4f72-928f-18189feb2132", "comment": "Malware payload (Loki)", "value": "85399344c0e749dabed82fe663b6961a2f6e37e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629712744, "uuid": "d313ba34-1cde-4a2c-a657-ccf3b78d9d4c", "comment": "Malware payload (Loki)", "value": "15ecc864eb267cc7a4a032d2278bb28a9fb997bad8cee23e10fa7b10f6c4e1c707d621e13fd0daa3fa14c9c13ed75999", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629712744, "uuid": "fe75dbab-8f13-4328-9a82-edbf136bd627", "value": "T1F8F4D43D19B91637D1B5C365EBE49423F148985FB405AEA9ACCE03A7034BA8735C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629712744, "uuid": "a6f01efd-0c4d-45ab-9558-d73fd6ec6ff7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629712744, "uuid": "72fd1b56-befc-441e-9363-d032c1fc3894", "value": "12288:HdXf5Cf+NZ7U1mo0kUGUIwaULdHpj9DRNtvJOoM5xI/s1fgMgW:9XhW+NhqmdbCGH3HtvJOogi13W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629712744, "uuid": "7b2349e7-915a-4933-8cd7-67d176bbbfe8", "value": 764416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629712744, "uuid": "4e16d48e-6807-445b-9284-89b445417fc3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629712744, "uuid": "bee59091-e394-4764-86e2-086e015f819a", "value": "INV#202170607#SGNBM4809600#BL_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8afc7cc9-0419-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629726829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629726829, "uuid": "7a7d9c04-f279-419d-b46d-ddfdcdc064cd", "comment": "Malware payload (AgentTesla)", "value": "f630679b8e2ee16cc1b6f252ca0f1067", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629726829, "uuid": "51119f51-4188-4e4f-8571-bd96a4fc05cd", "comment": "Malware payload (AgentTesla)", "value": "bc34ae8a507c4020fbbd565b4507190df16083db2fc6496f3a2df724bbcb5a26", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629726829, "uuid": "dc796739-f360-4edd-af31-35185a16eac0", "comment": "Malware payload (AgentTesla)", "value": "70c20212c9b0fc4f878602f142e6b9818e73008e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629726829, "uuid": "41607a28-cbae-4b09-997e-0947644600f4", "comment": "Malware payload (AgentTesla)", "value": "63f2ef798393ed966d63979c5d5aa57d25f3a2d47a0573f74979879aface15fbf86473f86b8cb0978833bf4be0f91975", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629726829, "uuid": "98494b86-4513-4e67-a385-4fe79f96b873", "value": "T16FF401063759B7CFD15F8EB9C9156C20ABE1B676430BEB56BC8306F4498C75A8B012B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629726829, "uuid": "c861f8dc-8a86-43d8-87d8-3707e11537dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629726829, "uuid": "4bd001e3-c264-4ca1-a3c4-92bba5231de5", "value": "12288:s3UElJq5x+5zUCRPz0cOLsONdaSmZ8YmhfSTCzoA99si0QviJLUFF3E6oDFPkYFm:s3k+pTRPwlLBNfmo1OwRtvAeboHr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629726829, "uuid": "b8239b2e-fe6e-422e-a1f8-770c83aaebc4", "value": 725504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629726829, "uuid": "8cb088d7-a0bc-4bf0-b0e8-f592edf17a6c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629726829, "uuid": "d1917512-72cd-4396-8f07-675ef78f5de4", "value": "Telecom Over Due Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9592c4c6-03e2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Amadey)", "timestamp": 1629703224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629703224, "uuid": "5d6b1ec6-a6b6-407d-90b6-64609cf20547", "comment": "Malware payload (Amadey)", "value": "fae2e545f02ae234260263b48db05f8a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629703224, "uuid": "d3fda2e1-ef45-4547-816a-98d3a39bcbe5", "comment": "Malware payload (Amadey)", "value": "bc48dc26e90b0a3c9a5d27433469e1e8937536933a30335c6ed266961b4f6bf9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629703224, "uuid": "c7b86b1c-2a6d-4634-9c04-5c22671d836a", "comment": "Malware payload (Amadey)", "value": "c66d29fdef784a8b214bafd0a82353e487935be7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629703224, "uuid": "247427d3-2911-4081-aef8-29841d400264", "comment": "Malware payload (Amadey)", "value": "b64ef25cdf795fe1a645d7161761520da2d3ec7fed3e9fecd71714c748397f7ae4ef1c4f7464a94b0aa078a77a16b7b4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629703224, "uuid": "efdff29d-642c-4ff9-91cb-a10d7783e968", "value": "T14164AE30A7A1C035F1F612F856B683B9A93A7AB15B3450CF63D11AEE16346E5EC30B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629703224, "uuid": "01d337ab-8f26-41b5-8ff8-41af74ab5d53", "value": "47838eb3376cd956f1ad4ca3d2e871c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629703224, "uuid": "2aa873ea-2956-436c-84fc-b405a86e07fc", "value": "6144:jDti1uiejMOVZ3O0Q4X5aVPE2xGAhOWPMfCqwO5QehCLfo0ji:F2uXQaZR5aVs2xNxkf3D5nYLg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629703224, "uuid": "8e658299-5a6e-4044-abc1-5554eb0fb113", "value": 328704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629703224, "uuid": "221ede52-7e8e-4ff3-9a2d-2aa07e833a3e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629703224, "uuid": "64f2132b-0807-418f-bee7-0c9588ff3b78", "value": "fae2e545f02ae234260263b48db05f8a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "908fdd03-0446-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629746166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629746166, "uuid": "2c30c93d-c4f0-4469-b8ba-bdd255f2fcb7", "comment": "Malware payload (RedLineStealer)", "value": "062401fdf91ee2dfd86865f3bbe90ed3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629746166, "uuid": "72714f58-9370-459c-b84e-cd034726c943", "comment": "Malware payload (RedLineStealer)", "value": "bcac2fa6bfe6424a6fe7eddf71615569f02ab3f907cec97374b0972fb9f899f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629746166, "uuid": "33cd7de6-2454-4708-8479-b902303cc2d3", "comment": "Malware payload (RedLineStealer)", "value": "f0ca0e8010159e8b430e367a7c5a3f249fbed993", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629746166, "uuid": "cfeb0f23-3b32-4f8c-b409-1d54ce37ed1f", "comment": "Malware payload (RedLineStealer)", "value": "20f88ca9553d11234c8b60cd5d875fd97845e2fb6e9de7a20a2fd48b83a80a7166e9559ae74614a35a6c60b7446c14cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629746166, "uuid": "aa55464e-c918-4125-b5c0-52a08a7ca5f2", "value": "T14FD39EAE1D3D562DF748CB7CA8C56F066EED97A03A68D6B34131C419017E3628623F39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629746166, "uuid": "563fe17f-f7ac-4df8-8911-b3223c3c3ac3", "value": "8c3ad5eaeb5dc6d2a26273bb5a0f65ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629746166, "uuid": "b5077ffe-94d4-452c-9b07-fa9e04f15c7f", "value": "1536:TQnXnz9kcCxJgh9RvuMEbeoCvns2ikYg26J+kg+ZL78IbUtRpJ7Zq0u1NmeY6nbq:TQXh+wDPnRvnsX6EkgXIUZy4eYqbyvO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629746166, "uuid": "e8d22800-d713-4fdb-ab49-ddfd290e7f6e", "value": 131232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629746166, "uuid": "64089ab5-7fed-4416-a051-7d426d2b37ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629746166, "uuid": "8e112211-f0b8-48f9-ae10-8d96ab7f52c3", "value": "062401fdf91ee2dfd86865f3bbe90ed3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a36eb5ca-0402-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629716992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629716992, "uuid": "e76f5962-2e3a-48de-b356-9899b215bd48", "comment": "Malware payload", "value": "031349d08f47663a12520cfa6a7a04da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629716992, "uuid": "8da28ee6-e96b-44bd-b6f1-f186645fa872", "comment": "Malware payload", "value": "bd1a32d919982c93f90c87338d43be0ba26245407a00c3ddb897eb806d561256", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629716992, "uuid": "3e747ad5-c4e9-43f0-936c-8d50504e6759", "comment": "Malware payload", "value": "cdd11d4fd2dba3fc68bcd9175652828fb1f8b267", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629716992, "uuid": "461e25d7-ce42-484b-a486-9fe356024689", "comment": "Malware payload", "value": "a1c0c7e99255169e0760679d4ac33f95a1d6f3000d4aea6f26653857453fbd757d749c211f684b6728604655a819d811", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629716992, "uuid": "b3a4c34f-ab5f-45b4-828b-6d73f5f856c5", "value": "T15B05AEA1D2D28473E0635BB81E0B5AE8953E7D00663C908BEBB43E855F777693CB6143", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629716992, "uuid": "de54eac3-da17-47ff-853a-76af2e5db10d", "value": "1abe4551dd4f8ef04deab38d0027e326", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629716992, "uuid": "dd3d446e-2056-4b97-818d-aafc25707eee", "value": "12288:WhxUck0fyI/Xv94r0umLKC+pvbIAsrxPD+o8wcB:WhGdkF4r0uvnDIF5P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629716992, "uuid": "6530eec7-17ab-4320-9a2c-8c685d0e8897", "value": 846848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629716992, "uuid": "951c7b29-6110-476b-b053-1874d83a8d96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629716992, "uuid": "fc659ddc-3df7-41a2-824e-c3db68244137", "value": "Dringende RFQ_AP65425652_032421,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f7d5641-0463-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629758619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629758619, "uuid": "1f555d76-2503-484a-a71c-3f15dd0742fe", "comment": "Malware payload", "value": "abad27b663c16a7458ce9bf4e21b9989", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629758619, "uuid": "da27abe9-ea4b-403b-b6d9-0bb8023cc6e3", "comment": "Malware payload", "value": "bd535149d1a579080708482ee5e4789a83dc33f9e50d27c20624333de5299670", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629758619, "uuid": "c73e6562-3412-4b37-bc0e-967db11d2376", "comment": "Malware payload", "value": "e1a502dac844ae19c82a9aaea77a0a4537649255", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629758619, "uuid": "9c9f22d1-9944-4b3a-ae55-3340c9755095", "comment": "Malware payload", "value": "6cdff397670a363697db794adc876aaf0b3cf133fbb3995b03fccf2a4ab6c8146e3a60a91dedbfc230f2e2bb2b758d9a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629758619, "uuid": "fe05a1f5-2101-49ac-88c6-5df32ad28459", "value": "T1F525B2DC9D5DD043FAF478F19C66D914A0EA2CA9488BC44E2AF9726B5072BC3EC055CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629758619, "uuid": "cd91e100-f64e-45f8-98ae-86d6cfeceebd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629758619, "uuid": "757a32ed-a262-4703-a816-d66b8b9974d7", "value": "6144:KRbPgxNUKolPCKZxeUkxChx4ZfAb7nC0WEG05iTeHZ:7xenPV/kxChx4S95d5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629758619, "uuid": "62496e6b-b680-45e9-bb6c-a4bce1aeb386", "value": 998320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629758619, "uuid": "ae2f293a-3ad7-418b-afa4-911139a1f61c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629758619, "uuid": "a36a5013-2678-4179-b24d-9703276c4f11", "value": "abad27b663c16a7458ce9bf4e21b9989", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd5f7ee8-03df-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629702003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702003, "uuid": "ccafa0fd-01ec-4aea-807e-ae935e40ae47", "comment": "Malware payload (Mirai)", "value": "9fbc705937f1c48be50c3634beaf0235", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702003, "uuid": "df1ade76-0a2f-4971-957a-fb53d6ab69fd", "comment": "Malware payload (Mirai)", "value": "bdb46acc6fc9209d1bda8861205aa856bfa15ddd0ddff8cca6deadf6ecc5e1fa", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702003, "uuid": "5705a97d-abb9-4a16-b9f0-f13a10fbd042", "comment": "Malware payload (Mirai)", "value": "9dbcc22214998f73f900898092a4475ae1318479", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702003, "uuid": "ef41a53a-5b12-4a9f-a401-5e668e7de915", "comment": "Malware payload (Mirai)", "value": "8b5184d162709f5fed2d8ba8fa6b29281530a82c748b2feb19a56509423f6900df52ac7a574e71c3a3bc7de711cc5ca3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702003, "uuid": "a81c7465-c284-4ef5-a5cc-95f97fa85e8a", "value": "T16A2302B90B5A99215FBD9DBDA9B406823F870F7D9CC6284D607553E93A804933CF098F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702003, "uuid": "2b8b2324-fc82-4f7a-a243-91aa5795f4ad", "value": "768:cHq8XdG1zvTZB9I3EETNRLbBGdy86lUnlNnkDhKfB9q3UELMyBZ25Z7X30ke:cHq8XdKzLX9IU8LcJnn0vLMHFre", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629702003, "uuid": "477e55bb-2443-4f6e-b909-d4e7bfdbd0ed", "value": 46844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629702003, "uuid": "2832e03e-1ef6-4fce-8a85-6138ff9c4895", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702003, "uuid": "ea642fa8-c6ac-4cc0-a823-5ff90ad795d0", "value": "b3astmode.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b25c4af-045a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629754559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629754559, "uuid": "f3a485a5-a410-4345-a942-fa3bea5acdd5", "comment": "Malware payload (RaccoonStealer)", "value": "2bb9a836f72a1946caaa7817afcb07be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629754559, "uuid": "9e44a8e9-e2af-407b-b679-8569ef7c7455", "comment": "Malware payload (RaccoonStealer)", "value": "bed57529997a2442dec9acba07587037955ab123d68723b215a3eb52d5ed79d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629754559, "uuid": "58809047-ce52-4020-8b2e-96f4c93e2f21", "comment": "Malware payload (RaccoonStealer)", "value": "36e98fce2e330299963ddd489474041ed83091bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629754559, "uuid": "2b401cad-be76-45ad-a86f-eafbb8e82b72", "comment": "Malware payload (RaccoonStealer)", "value": "9dfffc375822eea75f6765327fc7945540d04cfb15080749ff4c398dc0c2ddf528cf0026b2de65d12014e2189a416d73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629754559, "uuid": "aefcb11e-418d-4fbb-9ec6-3aa50eb89272", "value": "T164B4DF31BAA1C035F4F712F885B683BCB53A7AB06B7450CF52D52AE946386E4AC31747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629754559, "uuid": "87411fb9-7d7b-49e2-b435-89ce38a6ccf7", "value": "4dcb3c3a3fe5e134dd41266130cc79d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629754559, "uuid": "4efb0d93-860a-4992-9429-cd99b2d835d6", "value": "12288:CnFImDMyngYqVQRDNvScl5Qc2lFC9hoq2btFu4I/f5n:SMynREcl5b2nCbbn5n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629754559, "uuid": "953b86f6-e4c9-41b0-81af-b1d51a57af9f", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629754559, "uuid": "181bd0e5-30df-4383-834a-3a696f11deff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629754559, "uuid": "3ea1c634-49f5-4460-8711-12c9de8050ab", "value": "2bb9a836f72a1946caaa7817afcb07be.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec25c3f6-03de-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1629701652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701652, "uuid": "5ffee654-54d2-4a57-81b9-8e5f05ece695", "comment": "Malware payload (Gafgyt)", "value": "4b7ce423213ae6f133c774f1cff8aad2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701652, "uuid": "90d75bb7-1907-4c30-a05a-c48944902ec3", "comment": "Malware payload (Gafgyt)", "value": "bf1d4e6a9979a409d3a6ac62ee987d0019df661c0cf9ffef2da93761128aafda", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701652, "uuid": "587c7e44-2b9a-4a8f-9208-2b04653e36db", "comment": "Malware payload (Gafgyt)", "value": "4fd33cab593612f21442640512b74f24fda39916", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701652, "uuid": "069890e2-3b89-43cb-9480-e1240bd5f062", "comment": "Malware payload (Gafgyt)", "value": "3ebba138b22f439cb5a4f5787fb323412ea6470243be5f316311440d49682eddbd86dee07e9cd4da7ef3ae035e63a134", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701652, "uuid": "b989a53f-9ae4-419e-b816-e293f3011725", "value": "T1F2931941F9454727C2D327BAF78F879D3B365A9457DB33016A346EF42BC2B882E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701652, "uuid": "f07a554f-8eab-43f7-8e5d-edf2daaca0f1", "value": "1536:O/n/f7+OsvbgJhPCou9TeVBpOMeOVJRX35A679l5MsLPXC5UC29maRqQ66/QfXCF:k+pbgJhPUeVCONXXLPXC5MmaRqQ66IfS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629701652, "uuid": "dc9b3a11-daf6-4168-9e8d-c4cad4edb95a", "value": 97559, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629701652, "uuid": "0d12adf7-93e9-4f8b-8385-08f80851338a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701652, "uuid": "30389448-afa6-41e9-a9bd-16d685fbed0c", "value": "4b7ce423213ae6f133c774f1cff8aad2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87968a10-0419-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1629726823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629726823, "uuid": "d3725179-880f-4c28-adbd-98d76b20fe7b", "comment": "Malware payload (NanoCore)", "value": "6f4bd9654da82fcf56fbd63491b119de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629726823, "uuid": "48892ca1-eb3d-4e5b-9f9b-9c57baefe506", "comment": "Malware payload (NanoCore)", "value": "bf41232cf8f3b7a59706152858b300a9c7af30e7e0291f120dfd38657daf5b9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629726823, "uuid": "ddb066e5-d4bd-459a-bff0-f478e3437f9c", "comment": "Malware payload (NanoCore)", "value": "45cee56741e1a32b98ee0c9a1eed45f06aed9740", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629726823, "uuid": "22f675bc-096e-4983-bddd-442d4005d956", "comment": "Malware payload (NanoCore)", "value": "72a20d28d67ba39665d09bfd88cefb494637a53d1fa1c1fd6323ee1d290a592211427ef080868470710c354ce0223d0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629726823, "uuid": "4d54e7e9-a0ef-4e28-b1a3-e320f43222e4", "value": "T16EE373676A018828D15D68F074346BA23305FF0762485FEF7190FEB87A758A7B8A570F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629726823, "uuid": "fee2d19b-5a05-4c87-9e52-ac77aa83e371", "value": "fab4938ac1c8c9d7cabba8b6fe9c5ef2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629726823, "uuid": "df5e0a45-5c17-49b5-b83b-e9278b73d230", "value": "1536:aFeaGyU8J6YVVcGx//Zhwae4EjXc9mk4TaTxGcGPXGpeptyNx7:anUPYVbjXe4MBXBTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629726823, "uuid": "127ea37d-2045-4750-b261-8182e7fddd59", "value": 155648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629726823, "uuid": "ac33f92c-89dc-4619-a62f-487b43f14e5a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629726823, "uuid": "7aa9e479-f856-4c52-86a1-1f793577d104", "value": "NEWORDERTHP000002228.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f50b7c6-03e4-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629704100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629704100, "uuid": "ffaef9c0-cd9f-496b-9f0e-50ec7c0d9a95", "comment": "Malware payload", "value": "61994c524c03dee3864c21b6200bd5d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629704100, "uuid": "69cc5877-b0e2-4d68-b691-0b391855c460", "comment": "Malware payload", "value": "bfeb2264c011e9010f1fcb416d52271030d6b9ebb22e82ec4b5a0f575459a990", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629704100, "uuid": "bf9d8064-943a-4a42-9490-abfb7fbf10d4", "comment": "Malware payload", "value": "825d92e2cfd248270bcce897026b4ad59e7daccc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629704100, "uuid": "373942fd-842e-4c06-85df-bbb358cf433a", "comment": "Malware payload", "value": "34c93847a7357130fed1619614aa14b99f9c39c52de0f104c205d4e9c71f7861fde2edb5f44174118c37690b5f01a119", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629704100, "uuid": "d93119ac-a03c-4071-890b-eeb0d830a0df", "value": "T1D2457C2FFF918E31C1281A3B9F6BCC65881D7E50284A140F63E9FA4F5E764A1B52854F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629704100, "uuid": "42a0d02c-0b52-4718-a95e-e584c10ccf46", "value": "7b3d39f86bce9836a8fcdf7d5c6f7f87", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629704100, "uuid": "f0e110eb-a877-46da-8dbc-7ebb58d854e5", "value": "24576:0h4WI1DOj6P0hFORupCAzQUedKPIddHlen0F:8ej+XQUeET0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629704100, "uuid": "284c504b-9bc4-43ff-86ac-338b77531540", "value": 1219584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629704100, "uuid": "51da02be-cdb2-4722-88d2-a2fb498ad42d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629704100, "uuid": "0f2cdb1b-9881-4a1f-b0cd-a63d13c2c651", "value": "Original DHL Versandpapiere 57635553_021,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbcd3b2f-040f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Cerberus)", "timestamp": 1629722643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629722643, "uuid": "aa996048-7004-4eff-922f-db7c4edfeb74", "comment": "Malware payload (Cerberus)", "value": "db6c6bdda89349f8de2be84ed4373c18", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629722643, "uuid": "6e24e63f-cdf5-476d-803b-7563d7e09a89", "comment": "Malware payload (Cerberus)", "value": "bff4c1097f87aac75d64430f93e4df4e4225ab776be31f58080cb58d00325e55", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629722643, "uuid": "f466814d-836c-49b4-9b1a-2fff60ae3e19", "comment": "Malware payload (Cerberus)", "value": "ba6d9778332737c9750e72c98e29e73c932422d8", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629722643, "uuid": "5fe13209-d5ae-47ab-a96c-bc6c2da6e292", "comment": "Malware payload (Cerberus)", "value": "ab57ddf0e2adecf7d5a49b636702f22ed3ef6c308c4f3c147468bc3c3a922dd8264daa5775e65b8f216ec82deb84de09", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629722643, "uuid": "7c47d211-f67c-4b31-b3ad-4d59b79a5ac5", "value": "T166F53393D743985CEC3F823091672A477AAC126C62D37D3F58F900E11DA3D899B2AD9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629722643, "uuid": "edb4ce9f-cdfc-438f-9654-f562969b46db", "value": "98304:oK5IxjqynCxNbPgx8ci4fVNGz0MFyclyMu2:oK5mqyCxNQ8cFfVNoyK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629722643, "uuid": "435be891-7a7c-4837-ae68-b906c39425fd", "value": 3534380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629722643, "uuid": "f829270e-a3e9-4e03-9a5d-b28c90ab77ca", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629722643, "uuid": "5275a869-3c56-43f9-9c60-d006600d1509", "value": "Yerli_Gizli_Cekim_Ifsa_VIdeolar.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3609c890-0420-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629729693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729693, "uuid": "fd8e0405-343f-47af-9e6d-a8fe24750d04", "comment": "Malware payload", "value": "aede206483e77513ef6b9f053644614b", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729693, "uuid": "b3e43a00-5b22-4d4d-812a-e4986b0a78f9", "comment": "Malware payload", "value": "c081b8d289421f2bd1bb8ab925979c0567feeaac31b7426ed6e5a578c49a65cf", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729693, "uuid": "b7e64dc5-a404-49b3-87fd-ea3fc6d35f9b", "comment": "Malware payload", "value": "e904bca0c8f201331e99724d5ef8d9667ce31055", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729693, "uuid": "644b7aaf-d0b5-43ce-9103-fb4a6c0a4436", "comment": "Malware payload", "value": "01a7c729d5d5720de3944c3cb71dc4493301bc0df6f2bb72777ca1970fbb4f0d9840dccb0f112c075da9bc1af4ce6b33", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729693, "uuid": "08c1fb29-015b-4a76-9307-a3cb60698334", "value": "T1EEA50182F355EC22C537C23256751232606A8D549F0BEB972906F7AC6DFFD98CE84AC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729693, "uuid": "178155b7-0a94-4d38-884f-c5e26013f974", "value": "49152:vrdu5f0uwpL8LB73Bjpuwjkp7HOpLv4tmfCK:ScuwpL8173Bjpbjkp788tjK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629729693, "uuid": "f1056628-64ad-45fb-b2cd-cee9032e23b1", "value": 2111960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629729693, "uuid": "086f0638-c1dd-4bc0-a673-a1dac410b0e6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729693, "uuid": "713ffeb4-73eb-4702-9537-f00dded0ff7b", "value": "1.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7171b7f-03f0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629709267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629709267, "uuid": "a56ea5d5-7936-478a-8db8-a9d1423d4d50", "comment": "Malware payload (Loki)", "value": "fda552e1837b5c0df713295b2d915609", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629709267, "uuid": "29573c18-aff7-4190-9f45-58d80061c406", "comment": "Malware payload (Loki)", "value": "c200097018e1ef2bdcb8d1c92ecb73514b3355b3c96575c98b2cb85f4443f9da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629709267, "uuid": "2f3039d0-573d-45fe-9fd7-9c9d4cc2563f", "comment": "Malware payload (Loki)", "value": "9d5d6ee373e9027981a5215834b87c81b5bb7a76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629709267, "uuid": "d7b02166-d7ff-4181-8a31-ed545a9a3428", "comment": "Malware payload (Loki)", "value": "b21d796ca7f52d7815c4fe2b61128e938b2a4640eed75627ed4ce9994f35f38766756a6f6aa6dab301680b2b3ce1e257", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629709267, "uuid": "9b132c40-3670-450d-a264-269143be460b", "value": "T172D4F14A7784B68FC52FCFBA9E612C20E7E1A2324317D756DC8310E94A8D7598B512F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629709267, "uuid": "4d198a43-78c2-414e-be51-b2d6150b2d4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629709267, "uuid": "ae42f824-5136-4220-92ec-314d32fdd0a1", "value": "12288:QphldoLXGQ7Hk8L+ln7faEAVBganceqeS+Dhkzx6uAZbk:Qfoaqkx7IBgaZ9S2g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629709267, "uuid": "147ff788-3fed-4002-a4f2-5d4a4f7b3e4a", "value": 616448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629709267, "uuid": "f0744dc6-5d49-45f3-a4b4-72dd31f445f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629709267, "uuid": "4a6cae70-d839-42c4-bc5c-e779e7022661", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "defd8ad2-041d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629728688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629728688, "uuid": "f937b249-38e5-49e1-9c72-59958881b395", "comment": "Malware payload (Formbook)", "value": "37b5ffb512718c3edb571969fb63b0c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629728688, "uuid": "13b3e4dc-2c1d-4b4c-842a-6ff3a37519a6", "comment": "Malware payload (Formbook)", "value": "c21a5d43b11091efa59562014f69a1996464c7e62b3656b56fad6b521c0d901b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629728688, "uuid": "ecb174ee-9d80-4b39-8606-f27cca780e18", "comment": "Malware payload (Formbook)", "value": "e834163f582242dde55265338c3cc6445293c1f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629728688, "uuid": "8a43e33f-8ae9-4f61-b899-7adac2a3881f", "comment": "Malware payload (Formbook)", "value": "a8fb857c22fa518858923d9faac1d62bf0bddb1c10172874b6ce475916fbb8be22fceb1d7e7fe2ea6aad9b8d9c669ef6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629728688, "uuid": "5a44db11-8138-4383-9d1b-72f1048653ea", "value": "T11D05F53D1AF91637D1B5C365EBE49423F149985FB410AE6A6CDE03A7030BA9734C722E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629728688, "uuid": "f03cad61-40e9-4448-8f51-8b6fd6989bfd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629728688, "uuid": "d2b59ad8-1b9c-4b84-8537-4ad619e93af1", "value": "12288:0IdhD12Srd9glaFVBDCNnLAPDCv71Rd6eSs8uw1uDkQSd3do:eSMa/lUnLgz1n1uwve", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629728688, "uuid": "fb29c512-e72b-4a75-a2cd-649f891da951", "value": 846336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629728688, "uuid": "37eb6756-fc35-457d-987c-c0e92958ba23", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629728688, "uuid": "bd336f30-e9ff-4610-ae6a-20ec8c101816", "value": "BL COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba70ab39-040d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Alien)", "timestamp": 1629721755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629721755, "uuid": "f24c20cd-380a-41c9-9e73-f377785f08e9", "comment": "Malware payload (Alien)", "value": "30c3f2a449c75990d049b3245f2df2e9", "object_relation": "md5", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629721755, "uuid": "2773caf7-517e-433b-9d68-8eff851a07e0", "comment": "Malware payload (Alien)", "value": "c23475ee87755d08d0ed5aadf879454724349798e811af0c33bc20d9c61a01d9", "object_relation": "sha256", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629721755, "uuid": "d3fcb0a0-19ad-44be-bfe3-11d9b92ee8e9", "comment": "Malware payload (Alien)", "value": "af3e95111238f858b94a3a7a8bb4f81a6579dcf7", "object_relation": "sha1", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629721755, "uuid": "01317210-2550-4f18-be8e-b1f2414fde73", "comment": "Malware payload (Alien)", "value": "ea38689af473dd61208db9bc09a15346535bdc7ac1521d91989a313f25aa8b1ecb8419b2ea3b46e5f41de8bd1b8de2bb", "object_relation": "sha3-384", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629721755, "uuid": "870c971d-6e98-421b-b008-b5a9bb6f6b6d", "value": "T186F5335E6752D868CA97937192473333A336313C26C1B87E51B800D69883E659B2EFF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629721755, "uuid": "88b194bb-5a6b-4c80-ab8c-d745f805ca0e", "value": "98304:HG1UR3pqsr74qEOPYD5v7XYhi/WPEMsdAL/u:HG1Gpqsr745v7ohi/Wsyy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629721755, "uuid": "28329f87-2bc3-4868-a5db-934865c7dfb6", "value": 3423497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629721755, "uuid": "d9f2054e-3bc5-4a9b-a40a-2696f46f0ec4", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629721755, "uuid": "01be1279-7549-4d6d-b48f-211e5a8cb610", "value": "VideoPlayer.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f17acb01-040a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629720558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629720558, "uuid": "aede2bb5-3711-4c30-acd5-836ce0935c36", "comment": "Malware payload (AgentTesla)", "value": "acca2f5d5d687476a2715deebc9a6855", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629720558, "uuid": "b8e23c1c-39dd-4afc-97ff-178ea8ef9afa", "comment": "Malware payload (AgentTesla)", "value": "c2511c1e599d86eac6306517a61a23f61682f5f98725dcbda5f53977a6625581", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629720558, "uuid": "1551feab-7325-4a7a-ba47-dc66c1f54653", "comment": "Malware payload (AgentTesla)", "value": "ba0aced2973c32480c86d75f793039059ccedc55", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629720558, "uuid": "5a321c01-48db-4f1d-ba9e-4de39b5cb9c7", "comment": "Malware payload (AgentTesla)", "value": "8fbbc85a78eb8adfd33c0b460934718ba47acba37fe4ea8dc6f07336fd00c6e1068760e7a45590fd135e61aad4935eb6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629720558, "uuid": "5b1546af-309d-4163-a035-16055db0f50c", "value": "T140E401493748F68FC12ECEBE99622C149BF1A6311707DB576C8311E9099DB9A8F413F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629720558, "uuid": "6d7a081c-777a-45a9-89fa-c5fc0379fe9c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629720558, "uuid": "d84d40aa-2e8e-4d61-99e3-468182a1a705", "value": "12288:VqjudvxLkMOJM1GDvQ1Tfpng39nKP/Das0WJ9GImF:VqapLMK9kngaWJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629720558, "uuid": "208c30b9-4e41-4904-9fd4-b84db5a5c249", "value": 705024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629720558, "uuid": "8cf32af1-7158-47a9-802b-6fb2e5c2d4c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629720558, "uuid": "fdeb0577-47a3-4d99-8001-9fea2977dc19", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2e62b68-03da-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629699891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629699891, "uuid": "1cf880d0-f020-4a4d-b4c7-a1aa624f76a5", "comment": "Malware payload (Formbook)", "value": "2e4b5cbafd808de79dee394ce1278cd0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629699891, "uuid": "c625e815-4f83-4a8d-b17b-ebfe566c0591", "comment": "Malware payload (Formbook)", "value": "c27adae0af4b3c5c71d33f4707fc1e0c51cd9ed61f88169014a6022fabc87dc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629699891, "uuid": "a354821b-430c-4f95-b51a-e0175b71922d", "comment": "Malware payload (Formbook)", "value": "a07f59e5a108304b29e3ae13189870c07780749b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629699891, "uuid": "b032b357-9c14-4ae6-b77b-bff33f4e37fe", "comment": "Malware payload (Formbook)", "value": "abd473dc02b150f9135c575a935e3b7a441051d88c16a66cc57e7e80d141cc72134d23c468bec26168586879c99a390f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629699891, "uuid": "fc7a6bc6-518b-438e-aa6c-ca6eb7b4b3cc", "value": "T10015063D19F91637D1B5C365EBE48427F148985FB404AEAA6CCE03A7034BA9735C722E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629699891, "uuid": "aae5dc7d-ed47-4426-b9f9-9948aac9f379", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629699891, "uuid": "cf2f07f3-2c03-429e-bd29-2a5deffb8f01", "value": "24576:Ub4NpPvss1FceTZ1uFC4XAi3hU8gBinA9:UbgtvsAvnmSOQBin4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629699891, "uuid": "e83301a8-659c-4841-a8b4-b77a8a5bd0d9", "value": 883200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629699891, "uuid": "a7d4b4b7-0101-4b15-988a-f0759241169c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629699891, "uuid": "b90d4280-a669-4d2e-927a-61be34278bb8", "value": "2e4b5cbafd808de79dee394ce1278cd0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d52b8877-0402-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629717075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717075, "uuid": "a8b495a6-a7ba-41fb-a5fc-6e1e0fe090a2", "comment": "Malware payload", "value": "eda1cea0e5f54d3ff117808aff6c95c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717075, "uuid": "6722d30c-a7ff-4eb9-a2e6-f84b11fe7ac7", "comment": "Malware payload", "value": "c2f1660c8591d5975eb025aba06a188739dc8be2f9308cba2a319dc8603c0b15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717075, "uuid": "3c20b46e-3236-4303-8a96-20489316db80", "comment": "Malware payload", "value": "47d95c8730796c2f3071d4811c5c89afac4b2704", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717075, "uuid": "b2875e63-eb89-4a82-b397-56e3d5135db7", "comment": "Malware payload", "value": "2bd2e44fc9bf192049405d63d9100695085ca5fd6e13fd93ceea7a38ec9bc18b60a742c2646191f1120ebfdce3edce16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717075, "uuid": "3e6bc37c-5adf-4c27-9ddc-5c8bcc67fd38", "value": "T19C059E2395821837D6E30EF98E8756F9EC35FD103A7054822EE9BD448F7E252719A0E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717075, "uuid": "ceb8b13e-66f9-468a-bc11-4a532ccc2dc5", "value": "1abe4551dd4f8ef04deab38d0027e326", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717075, "uuid": "53783709-c208-490c-b7a3-43dcffb96415", "value": "12288:WhxUck0fyI/Xv94r0umLKC+pvbIAsrxPz+o8wcn:WhGdkF4r0uvnDIFpP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629717075, "uuid": "956257a5-24fe-4550-88d6-bf90cdc627a4", "value": 846848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629717075, "uuid": "08ad66ea-e19a-474a-8e54-7d71c9c4813e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717075, "uuid": "46a5d745-4de2-4f1f-abed-e689998a5486", "value": "HKG0767876 SOSZXJBAR21990463CGazprom Transgaz Kazan LLC - PO#9448 & 9460,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11f08e7f-0409-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629719754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629719754, "uuid": "593f0bd5-c490-4c11-9861-fa662f782e57", "comment": "Malware payload (Loki)", "value": "371339fe934c3d44daa0cde225fec79b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629719754, "uuid": "7541ca1d-7e25-48d3-80b1-df6ee152138f", "comment": "Malware payload (Loki)", "value": "c3982c6d30809bfb88cc1e1e6446aca39512be2ded5cfd55b3d308ef06607b08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629719754, "uuid": "eac9bf3b-9137-4642-8e38-f98269aadcee", "comment": "Malware payload (Loki)", "value": "12fa33d7a0234f42405eb5bb85e9d5bb4c6c8e26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629719754, "uuid": "6a02678e-efbc-49d1-9b75-7d64e237c1e7", "comment": "Malware payload (Loki)", "value": "c29cf12d5bacf989880988facef4d4073ff8e4679c70a95ea5f6f4beab66604a5893c6676548a55845a6baa127774366", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629719754, "uuid": "17ed892d-356e-44b5-8130-9b6b21ebaf1b", "value": "T1A005E43C19B91637D1B5C365EBE48423F148985FB414AEAA6CDE03A7134BA9734C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629719754, "uuid": "5cd9a806-19c7-4c66-9739-40d372d81406", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629719754, "uuid": "a83ecae3-3468-4432-9a7f-a961b082ea94", "value": "12288:GcXzkpjEvL9j4Sir3fDSWdOg7B1XRcmnJj+NGgs86:tkNEv1ir3f+QB1G8Jj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629719754, "uuid": "130f983d-2f16-4f5b-860c-5648abe1d8db", "value": 801280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629719754, "uuid": "d991cead-57e4-4a43-b4a4-f9eaf3e782de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629719754, "uuid": "1aa7119a-ede2-4e00-a56d-3e102d7b8db9", "value": "proforma_scan copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65e1852f-0426-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629732350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629732350, "uuid": "6e50e028-7dba-4f3c-a4c1-b3de4ff44691", "comment": "Malware payload (AgentTesla)", "value": "9298ad5236858bb746546da0f492fda5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629732350, "uuid": "94da08d1-4e6b-436a-a5d5-0be1d5ca4620", "comment": "Malware payload (AgentTesla)", "value": "c3b53b975599992a6454623d9c30a0340ced3d3738a1591b33f515eac7081dca", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629732350, "uuid": "6c7d1f2b-d7b1-4e73-be2d-637dadaceb99", "comment": "Malware payload (AgentTesla)", "value": "a0f2523126ab4447f891ca176c6346e5e9ee2f91", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629732350, "uuid": "9ecfcb67-5486-4057-9a88-e8fd48c5d9a2", "comment": "Malware payload (AgentTesla)", "value": "e3b2651fa611bbc13ac7f6dc8022262ed1dde37cad975e7c3bec357b34960c70268fc2b46cc2b9c3585c934f7b41cbe4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629732350, "uuid": "4052be6e-fbea-4f52-b271-f7173182f526", "value": "T17705F43D19B91637D1B5C365EBE58423F148986FB410AE6A6CDE07A7030BA9734C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629732350, "uuid": "646c6def-fca7-4683-ad43-6b666c0d89c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629732350, "uuid": "1dc62ff7-7610-4b7b-95db-548317f8afa3", "value": "24576:CdyO8fOUWd9DDDbjBmZ7rSShVLWzDmtc9a:MlUWTDDbFmZ7rSShBGw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629732350, "uuid": "953e8476-9957-4c1e-b469-30e56c94ec9b", "value": 846336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629732350, "uuid": "4ab47ea1-ba56-4873-92a1-f1646a497d89", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629732350, "uuid": "19258657-2fdb-464e-a75d-bdaa5915caf4", "value": "vou5I7xmiIBXBCd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "332c74c4-043d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629742143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742143, "uuid": "1768abd4-e405-4549-910f-bd1683128a7f", "comment": "Malware payload (Dridex)", "value": "27635b8e585b6ac169cc402632592a5e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742143, "uuid": "c0531ee6-73c2-4993-a71b-9b9ec9e0f927", "comment": "Malware payload (Dridex)", "value": "c4e07757ff1ba081e31f4486ae988da3a7ffc22c25584fefbb46d91c439e2beb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742143, "uuid": "008da88d-07ad-44ff-9678-c3a274193ca7", "comment": "Malware payload (Dridex)", "value": "382c04dcebe67aae8571cf06e9623ef66f3942d1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742143, "uuid": "072fb61e-4f65-405f-9993-2eec1ec29a72", "comment": "Malware payload (Dridex)", "value": "5024e5a291b0a5a02edda9048abdb8ac0bf4d7d0e69e3bd1a90e12d4a8760a58ce3e3efe91d63e6c05829630eac52db6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742143, "uuid": "97ae98c0-dd14-4c0e-a45e-6acf57452e42", "value": "T1C214D012F39A42FCD57F08B4259A397F951934206733EBF5EA13C388A622266D4F1772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742143, "uuid": "0bf13f65-1a14-4f3f-9c49-611ee2726f8f", "value": "c465286f86f74557d97208a90e0e5e44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742143, "uuid": "803fca0c-47ff-454f-b68a-b3108127ed5f", "value": "3072:R8bP7oCIkCD6Wgk3OIbtRpr1eVE+nxNS5KL/Jcmdzup51u:CoCXC223Ow5uznxNS5WBJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629742143, "uuid": "ffe43b03-7b2f-4912-bafe-9a687a610059", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629742143, "uuid": "706085c0-d0dc-4336-aff1-f01f12038b01", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742143, "uuid": "a88d5c24-47fc-4f0f-8bf2-868bfc2afd90", "value": "27635b8e585b6ac169cc402632592a5e.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93e21da5-03c5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629690766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629690766, "uuid": "2d4f03c5-433b-4d59-bafb-887454830f10", "comment": "Malware payload (Mirai)", "value": "0597f092ae4d89d4e9cb0ccacd6ba174", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629690766, "uuid": "bb478882-5177-4e2b-bf9f-47570607ea94", "comment": "Malware payload (Mirai)", "value": "c55c4212eb58a70976f00e1f88618d3a62d8beb12b6072da69b1f0253b4c4d7e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629690766, "uuid": "df29a53a-05fc-48d5-8224-5c93b632f368", "comment": "Malware payload (Mirai)", "value": "71b36d089b6841e6b2ff2675d7c6a46597a27aec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629690766, "uuid": "f0fa85a2-0c90-47a7-b7a1-22cc60f25f68", "comment": "Malware payload (Mirai)", "value": "6043b20e50051abb8981e2279a9fe883a929855eef7426e7d82d0b3e6c8be40d6f813cc67a6e11dfacd675dcec92041c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629690766, "uuid": "b5b9fd39-2e72-4a7f-86b1-dff57173a2f6", "value": "T1976309DAA0014F6CFD8BD9F9A2214E09F520321146830B16B6B7FDD77FA21AD8D43D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629690766, "uuid": "2c2587e5-d0a1-454e-9c8b-11a14f52a57f", "value": "1536:qyow3P9oBeJvBRATf7a7ZIyg1p1/LqY9Z6TLcI++lEV1o8N:qyvBSGILp1Q/FEHP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629690766, "uuid": "f41dd0a7-06f0-4df4-8373-9d42f7776d44", "value": 72300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629690766, "uuid": "3eef3811-7c66-4e75-92e7-2e51fa0f695a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629690766, "uuid": "a01c4610-6e2e-4bc0-895a-ac4ca6663ac6", "value": "0597f092ae4d89d4e9cb0ccacd6ba174", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70021bca-041f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AZORult)", "timestamp": 1629729361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729361, "uuid": "3f8d965a-4297-4ff7-9210-d6dc136af709", "comment": "Malware payload (AZORult)", "value": "a91aa3e42a28efd37e6240fbc7e4870d", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729361, "uuid": "f24bda5e-5edc-42d2-885d-7a55e97b8990", "comment": "Malware payload (AZORult)", "value": "c5d1fb403be6aff61fd23b5ec08d63f28f22959e8507d33e1259e9326042c487", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729361, "uuid": "48aaf60b-a552-4d7f-9c71-a17af2511752", "comment": "Malware payload (AZORult)", "value": "d604bd3f6999944aa4d17e861b6eb2db896e2051", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729361, "uuid": "557397a9-0d25-4d49-8051-95f9c528642e", "comment": "Malware payload (AZORult)", "value": "e9f36728080090600b62b97779d4f2df59ba0d5b50d1c828a2f99c50eee312f6fd217ce7c76bacf8427a72189c12b209", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729361, "uuid": "ebd38b97-d4c8-4343-8d69-53de95aeb043", "value": "T1C445332B542051DBC45A6D73D265923D558220798BE7AB0F32E0E0D9BE58DBCF21C7F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729361, "uuid": "1bc6d230-a3a3-4a4e-8532-6a59c49e9c11", "value": "9dc580b98fdc55e0bc3b6c6f01e8c0c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729361, "uuid": "6b327d88-4504-43ea-8bb5-754e98c06708", "value": "24576:yo1+ux8Q8ucfxrmpdlqgtt/UP6Fuul/zY5AvEUVxxix:yX7/mpfqgPJFI6S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629729361, "uuid": "56f97164-940e-4ae7-900d-02e7e73a240d", "value": 1164800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629729361, "uuid": "b8bae351-3924-4439-b45c-6f1ba6c45530", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729361, "uuid": "499639f0-e356-4790-8437-5b18e89a3ec1", "value": "A91AA3E42A28EFD37E6240FBC7E4870D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d7cb1fa-0409-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629719746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629719746, "uuid": "24afb4de-acbd-4724-9949-6da71e80871b", "comment": "Malware payload (AgentTesla)", "value": "5280eee416fbb8fef2a0b4ef5628c428", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629719746, "uuid": "87d928c2-e96b-4308-9746-4c0320043717", "comment": "Malware payload (AgentTesla)", "value": "c72d36b0acc4578b43e6be5563e6fb365e7a559a6559811dbf5048fa2798fafe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629719746, "uuid": "4cd2e105-d76b-4101-bb72-56a5c054f58a", "comment": "Malware payload (AgentTesla)", "value": "56ec6ffaa4fe49f8941aa6c8efb0894a7bd45f04", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629719746, "uuid": "72340469-29eb-4341-8e4e-6f8ef654b612", "comment": "Malware payload (AgentTesla)", "value": "9d48701770dda4e3d3042614520c618c85b6687cd51742503dad2e378dc888145b7356875e356e3cf543103f73a3b578", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629719746, "uuid": "db136a37-d79a-46d7-9eaa-9e6d3c4981a2", "value": "T1E1F44948379071AFD423C9378B975D30E66164ABE38BD343D013D2ADA91D276DF182AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629719746, "uuid": "e01372a9-a43d-4405-9d48-6fac81bed6a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629719746, "uuid": "fc7225da-31b5-4c5a-9f12-40073d7908ee", "value": "12288:3DKqn3W2F1IAr3fKPpGBuj+4jLEg4uCqKx9lQWH9SFqKe61G/iGJorsQaPclOxRO:3+8GQ1isui4jLxaqqSqK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629719746, "uuid": "841cfd30-06d0-4181-8bad-594609462cc2", "value": 744448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629719746, "uuid": "42daaeba-c82d-462f-b4f9-9e996bd05944", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629719746, "uuid": "c0a49ad0-3625-4d18-a5ae-53ab9c6c6bfd", "value": "Request For Price quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "551ef5c0-0428-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629733181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629733181, "uuid": "b0945821-d006-4cc0-9fa9-8cf0972573a0", "comment": "Malware payload (Formbook)", "value": "800039ae7f11d89f082bf841d3fe51f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629733181, "uuid": "2ef096f6-3d39-4db9-8c01-8a73a6a930c6", "comment": "Malware payload (Formbook)", "value": "c788d595c8952558670f3420d11677f9455803c953e6614546013efdc4967725", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629733181, "uuid": "947b5dcd-f014-4767-88e3-b7045ffbd0ed", "comment": "Malware payload (Formbook)", "value": "8998e1ee5eae718fa3538a2479b9cd3b5cd6e77d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629733181, "uuid": "1872f3cc-487c-49ab-aa6d-0ef562bd1ddd", "comment": "Malware payload (Formbook)", "value": "d27a9491e9e96aa5f1c0a07be232a92cf26c817ad909d4be954ee6297244820ffc2263e14503564491c3530b01a74564", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629733181, "uuid": "2c0afbd7-7f9e-469d-8e9e-e50569c14827", "value": "T1FB15F53D19BA1637D1B5C355EBE18423F149985FB814AE6A6CCE07A7030BA9734C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629733181, "uuid": "296d75ae-a66c-40ca-897a-8443e76c33b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629733181, "uuid": "4edddde6-0886-4c0c-9f42-2e76178d2d07", "value": "12288:7bPsqxozAxraMsSNPi0OY8cEr4Zlvm8u9U65HwPGMaIGH8y9:kzAx4SZi0OmEr4TvZu9U65Qvg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629733181, "uuid": "4c79417e-3cb3-40ae-8907-5b4e6f415c45", "value": 880128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629733181, "uuid": "f8276385-b53a-4faa-9b88-b3d278b23b13", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629733181, "uuid": "f5e6ed6b-4d72-49d3-8746-91a7f49a85b2", "value": "Confirmaci\u00a2n de cuenta bancaria.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f599cfa-03f8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629712529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629712529, "uuid": "e7621650-a0c3-464f-9a08-a95568ce1992", "comment": "Malware payload (AgentTesla)", "value": "bf96e6712e73fbfaed7487f8cc5f0d72", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629712529, "uuid": "7e26a0c8-1fe2-481e-82ce-311045157c6f", "comment": "Malware payload (AgentTesla)", "value": "c7dfb5506ce5f7bfee82f1de42b5054c0edc165a6fc165a41886a8c23c83420c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629712529, "uuid": "e8c8cb69-d7b9-423a-b259-a6bb06cbb09b", "comment": "Malware payload (AgentTesla)", "value": "261ce481c44cae6d97c98acce24f399c7b5cc4a0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629712529, "uuid": "cb72ca38-f8bc-446f-b937-dbaeaa42df2d", "comment": "Malware payload (AgentTesla)", "value": "a91c688147b2071822b60ffa985fece44222966cebd3005e86107857d85f02021504f5e4c6b3ca591715b6366c0a20c8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629712529, "uuid": "77503242-1659-4cfa-ba3b-52be61e60768", "value": "T14FE402057744BB8FC67F8E7AE8522C20A7E0E1361703E752BC9366E8598D7958B013E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629712529, "uuid": "fdd222f4-612e-43cb-86b3-7ec0d16335e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629712529, "uuid": "87356f22-c322-4e83-8e81-1d171994bd64", "value": "12288:4g5+mZ1IUq0cXrx0dPY6qUG0LLMYs489+fgpT0d8VdMV6doek8anNbuGk:PJXS7x0JYNwLts4/f78VdndI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629712529, "uuid": "c62ca2f6-0264-4214-9da0-d0ffc197e10c", "value": 673280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629712529, "uuid": "d97c4dad-8013-40f9-9bed-4a8d56d444ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629712529, "uuid": "bdd084bb-9ced-4c44-aecb-868ce8579e4a", "value": "PO docs. PDF...................................................................................exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "317902f1-03dd-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629700909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700909, "uuid": "ad5de1c0-84f1-4f29-bca2-a661c003e29a", "comment": "Malware payload", "value": "81863f76e9198a603197b434416e1a63", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700909, "uuid": "23e27b95-eaab-4024-a365-ba2497d8cffa", "comment": "Malware payload", "value": "c8afc6b7c59910dd2591d152dd6772e6e8bd0994ee2ea076b91da17fe313bdc6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700909, "uuid": "8e70fab7-8dc7-419c-b86e-f2c36b05c8b5", "comment": "Malware payload", "value": "c18649568aa196bd3d6a5bae6b46ec50878c48ee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700909, "uuid": "ac6484b0-84e9-4fbb-ac61-86a7d4adfc40", "comment": "Malware payload", "value": "aa8bd53394edfdf24e671c85d189fc321b048047cf78b56a635e0c46c1856b142a48023852e9ff0f1db6282cf01f5df1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700909, "uuid": "208f9cf9-027e-4ab7-9eed-fc09a4829865", "value": "T118930896F801DFB6F40AE67604D74B217630FBE20E931A62731779B69E721D43822F46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700909, "uuid": "35214fa5-5289-4028-b47e-98527e3d9386", "value": "1536:BxHHwqc5A3BGAHW78NAqqUfUyzuk1/UfOLLMd+Kv679l5MaEL3WmztqVoGjrEfW0:fwqmAUA2ElfUyzuk9UfdEE6m5qVoGvEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629700909, "uuid": "72d119dd-78b4-40ab-a8a2-6e5032dc750e", "value": 95930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629700909, "uuid": "069c4ece-187b-4680-ba25-3ffba7346995", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700909, "uuid": "d4661104-fed5-477a-b78d-0b6a1e7b5651", "value": "81863f76e9198a603197b434416e1a63", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d218152-041f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629729329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729329, "uuid": "886d1c8a-af9d-4bbd-b49a-63a1ec8c061d", "comment": "Malware payload (Formbook)", "value": "1769589c5e336e15b77de5cb960e1fd0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729329, "uuid": "7f760db9-0057-4ee4-bfd5-e58434ea76c3", "comment": "Malware payload (Formbook)", "value": "c991bf983458f62d5c6fe6dd695b5d7e13a07a35228cd0b677afd6b6da6a5e1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729329, "uuid": "37921039-6b5d-4632-ace5-faeaeedf634c", "comment": "Malware payload (Formbook)", "value": "27ac8143d42a6c42b64f6cab74800a6be0697d5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729329, "uuid": "4cd11128-3e0d-41d0-abc6-232b14b08959", "comment": "Malware payload (Formbook)", "value": "a3ce55941aae105b7ddf856c67ec3ce7eb9af1410c8c58c71d8a5603a37a52e192f996c9423c453237da84d3bfa26d51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729329, "uuid": "009d007d-7301-455c-8a4c-8324aecf35b7", "value": "T108F402453396F68FE63F8D7A99115C609BA1F4350307DB1BACC312EC9A9D7898B412B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729329, "uuid": "7c4bb1ff-3549-4aa2-a4b3-f7bf6757b3d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729329, "uuid": "311cfcc8-8828-468f-8dc4-04b7a9751aaa", "value": "12288:h56m+o/WEdMvu+9pdDpLDAAbPfk/DTlF/gBgfQocqPjNvrEt4Vdzq31kTqrdsix/:6mT/WEdMmspUIPmEYQEvgWduFWy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629729329, "uuid": "62e46890-5318-4b30-a321-af84244b755a", "value": 734208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629729329, "uuid": "ec497a09-8845-4f4e-a8af-2e24cca29aa1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729329, "uuid": "ad5f34a7-6cb6-41c5-8099-743d44eb1303", "value": "000335308232021.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eaa7dc5-03db-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629700045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700045, "uuid": "311a703f-1d89-479b-891d-098a318c99a9", "comment": "Malware payload (RedLineStealer)", "value": "688ab665c1dbb8c0ca7660f80a7eeebe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700045, "uuid": "ef8b1996-e2d3-4589-937c-8e26e5142b5f", "comment": "Malware payload (RedLineStealer)", "value": "cb3d5d5034a9b2034732e9d9f805cc355ef2259285631154ad841e1c0a4e6381", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700045, "uuid": "8eb84b05-1f53-49e1-a440-d24b4649aa44", "comment": "Malware payload (RedLineStealer)", "value": "105086d5674fae103f3c75420b2bf6a52c92de17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700045, "uuid": "9ed34bd8-9705-4c74-8b93-37d1f3d50b11", "comment": "Malware payload (RedLineStealer)", "value": "dda2617fdc94d51e19b8920a3a6bf52bf61224dff6042f0e1f5236154b982fcfd5a3ad0b1cf0417045f13d3d5f439605", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700045, "uuid": "b7e68f10-f8e2-481c-a087-1161902fb37a", "value": "T1E2D4F130B6A0C034F6B712F495B687BCB9397EB06B3454CB62D116EA56386E8DC31397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700045, "uuid": "2e69dd18-d408-4ba9-8656-01a8e2118c16", "value": "0651d9dcd3efcdffaff927d730c581e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700045, "uuid": "2d8efe97-f68c-41b0-bbb2-a6e34dde3470", "value": "12288:YIdqiqfHmGl69LritqEH2W1AoBK30jldwkNCPtcSwrxYzJU:oiqfHkLDW1AokEj/wkMlNzJU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629700045, "uuid": "6120078f-2fd2-4301-a78e-394e60ae2e35", "value": 619520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629700045, "uuid": "621baf77-0e86-4f10-8de2-4f80766b9cf8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700045, "uuid": "29b99379-ef75-4ccf-ba3d-622550d9c443", "value": "688ab665c1dbb8c0ca7660f80a7eeebe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d83de05-03b8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Amadey)", "timestamp": 1629685118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629685118, "uuid": "4161f6c2-b888-458e-807f-802205a3e501", "comment": "Malware payload (Amadey)", "value": "8c9c230a06892e01cccbe75a6d0a8405", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629685118, "uuid": "645dd2fd-0284-4d77-8ba2-b1dbeffd7465", "comment": "Malware payload (Amadey)", "value": "cc36394828f6560fcc8cb64709a59371d85a35d618708905682696096c20872b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629685118, "uuid": "711293ed-cf38-4be1-8199-92a9470eb6a8", "comment": "Malware payload (Amadey)", "value": "7dce826c6c40ad891e9e79b25a2c4cfbbbe95b8b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629685118, "uuid": "50450765-6d6d-4697-a270-7ea68ab5f630", "comment": "Malware payload (Amadey)", "value": "3d85be28337b3f7063338d03aad7c380133537fcbbe7621d056970a09156d6630f4b28a684e8658eea7b7b7ded1a4ffc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629685118, "uuid": "bc090677-947d-47cb-b57c-b08545c7651f", "value": "T166549E20BAA0C039F1F712F459BA87B8B9297AB1AB3450CF63D516E956347E4DC30397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629685118, "uuid": "48086e2f-e9d1-4b3f-a6d3-eea0dab4b479", "value": "0651d9dcd3efcdffaff927d730c581e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629685118, "uuid": "db3c8dbd-00d7-4b36-915a-9771fe44cd7d", "value": "6144:z5nyLWOA/VqcvdpOtE50zmc0RHXpeuuGYtU:JIWptqcHOtEu9655uGEU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629685118, "uuid": "12441ba2-2486-464f-805f-a481682cde7b", "value": 290304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629685118, "uuid": "48d38025-33af-449b-9601-aca02ed0b250", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629685118, "uuid": "788c9c20-424e-44e9-8eb7-027a3318f849", "value": "8c9c230a06892e01cccbe75a6d0a8405", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6880ab59-03fa-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629713457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629713457, "uuid": "ba52b6d0-aeff-43d5-9339-425b28759730", "comment": "Malware payload", "value": "a3ca7c39d4034bb64c9e4838aad581c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629713457, "uuid": "5e8f2f0a-d079-4b33-b4ff-b221a03ccf5b", "comment": "Malware payload", "value": "cc7600e41c6ce224a7edae5a81db751249c5f07e43a63afe606d40079bed602f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629713457, "uuid": "513dbcc9-d9a9-433b-929b-9da2f0bed083", "comment": "Malware payload", "value": "d3423d72b36732bdd6a01e295bb97a41c9b0887f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629713457, "uuid": "8a7b9245-33cc-4734-8c0a-d0aee2b3e708", "comment": "Malware payload", "value": "2f42e3aa01c7ae682f85cbc368d4a63673a20ebb9d7e3a39309faf61961a2493193d296dca8384e1a75fbe6b33e02317", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629713457, "uuid": "04358d4c-d659-4a06-a39c-c5fa3047b10c", "value": "T103D35B4AF29500F9E8AAC279CA935647E7B3741917209BCF473086565F237E2BE3E311", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629713457, "uuid": "af25beee-da65-45b5-81d0-f4e84228ca3d", "value": "3072:KU0ngVr1FzxB0NISqdDxW5/UWgfNv+WqyHqIlYF1uhF95ayb6:KU0nsr1FzxmNISuDxWUzlpqK/uFGKyG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629713457, "uuid": "ff6a8d33-eebf-4056-8dde-01d4a1575c34", "value": 138752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629713457, "uuid": "d78d17b6-1c87-4816-ba46-53a5eb4f90dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629713457, "uuid": "7df09ad2-ad54-4dc8-b5e2-a9aace589b90", "value": "ec20000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19fba96c-03de-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1629701299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701299, "uuid": "caaa0e1a-aed6-4761-84a5-d441ef031f8b", "comment": "Malware payload (AsyncRAT)", "value": "a67266b308664a9bfb7adb0ed7fb31de", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701299, "uuid": "dc0f9869-6965-4073-aefd-47b4735d3ba4", "comment": "Malware payload (AsyncRAT)", "value": "ceaa77ed1417edc98d05331de211aca01801c4e228955ca36d6cb7953fca65b4", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701299, "uuid": "baeea9a8-b295-4d11-a924-9e20aefca5ae", "comment": "Malware payload (AsyncRAT)", "value": "05950813b79db6f68e4aa67c7c4e12ad320f97c1", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701299, "uuid": "ec57620c-dbaf-4029-b20b-1f9fc1639f81", "comment": "Malware payload (AsyncRAT)", "value": "12b9f3e32b2401b66183a8ed7184bf767c9e4be83944771aef2764bc0cf563bfeac64b58e0e462e7fd73393d68ad8b24", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701299, "uuid": "6e596660-5127-4663-a97c-b1f2b43c21ff", "value": "T1C9845A003BA86A2FF539D67B5743813643B246CBE8D6D384CA80D6BD2D713719A4E64F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701299, "uuid": "5dc858ed-3a90-48d9-b92a-1c21f7012ff1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701299, "uuid": "11b05780-e879-4376-8124-9f74363a6bb8", "value": "6144:MAULI7GCpSdLnHix5a833r7fUwcTmBnHBJCzwsFpbXMBIRspZJiKUe:8LI7P0Lchr7cJM47bcqRsZiKU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629701299, "uuid": "26406312-59bd-4457-b2c6-1e9336ca4d9a", "value": 401920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629701299, "uuid": "020da6ad-c230-4426-9632-ca60e083e0eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701299, "uuid": "fcfb09a3-04c0-48af-9d9d-269e5f856057", "value": "swift copy2000821.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf38b7b8-03d3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629696852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629696852, "uuid": "85da0c0b-b3d7-4320-aae1-b869d1c8f534", "comment": "Malware payload (RedLineStealer)", "value": "012dc7a9772612267948c79ab8f52c94", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629696852, "uuid": "12b7c156-e640-401f-aa26-a927efac4ab9", "comment": "Malware payload (RedLineStealer)", "value": "cf149347cf39386229225de9128d40c7d5cd6c7e0a922bbe1d42f96b39d69864", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629696852, "uuid": "ffee502f-f574-4ce1-8668-bb305ebbdccb", "comment": "Malware payload (RedLineStealer)", "value": "8bbb042eef86ef7dad4c3a8e418363afade51ff2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629696852, "uuid": "1140a2d9-5a57-40c6-8f5c-01e041ce2fc9", "comment": "Malware payload (RedLineStealer)", "value": "ca61d70b8c405c24ac01593614a01132e5241624ade0e1e879269a7581af165c06f95444a174589f9407a7110f059a5b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629696852, "uuid": "739ae588-d25e-4938-8067-1e5bb836d873", "value": "T18674AD30ABA1C034F5F712F459BA83A8A93A7AB16B3450CF53D11AEE16346E5EC30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629696852, "uuid": "726ee34d-bb27-47ed-a66b-8f93d8a0a812", "value": "4aded8f080ac4b6e892c4de31a213f2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629696852, "uuid": "4c1287d0-10e8-498d-9a94-3db869552d41", "value": "6144:R4qROidWI/GdT2v48u/dsb4QacfhFD+LL30m5owkMDRrMOZKhX48rwxq:FO6WAWTN8tb4Qvfhh+L7Xowh9fKVXEq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629696852, "uuid": "038671f7-e942-4efa-9b1f-cbe6e1ce50cf", "value": 352768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629696852, "uuid": "7c252779-2a23-494b-8af8-d5502c1fb239", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629696852, "uuid": "bd534ede-6906-4915-ad4f-16fee0345b30", "value": "012dc7a9772612267948c79ab8f52c94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50a4769a-0449-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629747347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629747347, "uuid": "2c5daf3e-afde-440d-a13e-f571f095f891", "comment": "Malware payload (RaccoonStealer)", "value": "39e39011e767632bdb71ff5da8ac82be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629747347, "uuid": "84341be0-e785-4252-ba6f-1031308031aa", "comment": "Malware payload (RaccoonStealer)", "value": "cfcb21c8c129c8c2c525ecfac8bd883260eda6038e3991210765e582007451dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629747347, "uuid": "4da732e6-e807-484e-af99-a1027b260f7b", "comment": "Malware payload (RaccoonStealer)", "value": "53e1d34c2678a08ef900414a024a8bb78f061310", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629747347, "uuid": "e9e611df-dbb5-4a9d-b245-50d50f223abf", "comment": "Malware payload (RaccoonStealer)", "value": "3b238214b3d641fb2e44eaffa1c51f651ee4bf52e57b4756757331ee72302aff553741e245ae5a619d05c6e6c6728255", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629747347, "uuid": "9f1a989f-8dcc-4818-86a9-b4a939a2cd15", "value": "T113449D20A6A0C138E4F302F4597DE3BC69297D716B2050CB63C62AEE66776E4DD30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629747347, "uuid": "d5da9b37-ffcf-48d2-9ae1-e2540e7399dd", "value": "87931c028561c299d538d462f4889ea0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629747347, "uuid": "c7adf4a2-6d15-4193-9ad5-b8bfae8219cd", "value": "6144:9jC+yK6YvYgTH4ZSVha3jDdpoZArBQdv9zmHz:g+l6YvYgTjVhShrBAvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629747347, "uuid": "fbecc82c-eb07-4568-84bf-a27d33a09b24", "value": 276480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629747347, "uuid": "3805745f-0279-44a3-ac24-a9abd2722ac1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629747347, "uuid": "0af1e76a-8785-4644-b957-f1b128f53f0f", "value": "cfcb21c8c129c8c2c525ecfac8bd883260eda6038e399.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fea1c585-041b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629727882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629727882, "uuid": "aee89b1f-ec17-4e1e-9fc6-66eb37b250c9", "comment": "Malware payload (Mirai)", "value": "a89970fe7af784541a4a113b4301d231", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629727882, "uuid": "97ef6bfa-a7ac-485a-8715-5c5db2fc0cec", "comment": "Malware payload (Mirai)", "value": "d014f52c1dba8c99e0356751b4d2424c74038e07780c60025b3648406ddb12d2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629727882, "uuid": "d71355ef-6bb3-40ac-8ee8-6ec1048f065f", "comment": "Malware payload (Mirai)", "value": "f3b53a52502bb6681ed6d644973cdbd8ed58d0dc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629727882, "uuid": "2ad1d065-eb4d-48f2-b257-e7552d326ab7", "comment": "Malware payload (Mirai)", "value": "ec06bd127cfc28556e258cfbcd3d9575eb4dea15d7de8a0d5671925e66ef3fb50b1a989a50d6847d053f53f80922c44c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629727882, "uuid": "07036ce8-9869-4ee5-9a98-96c60931a01b", "value": "T13C93A309BFA05EF7E8AFCC3345D92745288D655A21A83F79B930D928B21B24F15E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629727882, "uuid": "22e79809-d05c-421d-a4c6-b6e54d25b9e0", "value": "1536:a5DnSB+v5AjQm2w17xk49d6xZLu8vJ4TGo8S:a5TSB+v5AjQmF1GFrvhrS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629727882, "uuid": "76fb2c56-a6df-4ef4-a0a7-db996966a3ec", "value": 92512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629727882, "uuid": "a87faabb-9b6c-4084-aa25-7ee317984e05", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629727882, "uuid": "dea618a6-40a5-4e46-8752-026c956a6ae5", "value": "a89970fe7af784541a4a113b4301d231", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2e3e9d7-03bc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629687006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629687006, "uuid": "4caaf06e-02fb-44ce-9093-25196c4cc94c", "comment": "Malware payload (Mirai)", "value": "8a57b70a19f7f5d4d706bf54ab59ce90", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629687006, "uuid": "badc533d-6a17-4546-a1bb-57094b0ad739", "comment": "Malware payload (Mirai)", "value": "d06bbc01da3f13138824a1ecec964e11246bfe4a30f9465cf03f64b2e91c3551", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629687006, "uuid": "253277e5-ca53-4051-85d5-1321ade2357b", "comment": "Malware payload (Mirai)", "value": "4c2f20d8f49069462a583c4b7de4aa81cf655294", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629687006, "uuid": "6fae1f70-e5d7-4f0b-84bc-d1bf77a3812a", "comment": "Malware payload (Mirai)", "value": "6518fa6a8005009c4bf58bc8fb3fa8861e4abcf2693d7e17c8f28806a9e6343c38ad09c3dcb570dc4cee98439df3bda9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629687006, "uuid": "01e81767-8be8-4f0e-97c8-241487f9a4a5", "value": "T11CE2E1B4A6259874E1B00837CDBFA6E71A511A38C0F93B1A090C8795E22B2D67D75EC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629687006, "uuid": "65cee2ba-31ce-4792-ad9c-d700691448d6", "value": "768:1L6y1JlHo+YXU1IxDqxNvkQC/oKfd2B9x16jNbJxWjbs3UozF:Fh5uhDqvvkX/oKsdusGzF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629687006, "uuid": "69a6c5eb-297b-4b95-8f0a-4eaa2dadb1ad", "value": 32016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629687006, "uuid": "6d7227f5-b6ed-4337-83a2-662dbc68079f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629687006, "uuid": "c411697a-4ca6-485d-8f32-c814dcec4a5c", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e9fea70-041a-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629727130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629727130, "uuid": "d3c3d34c-e6aa-4732-849e-3cdd71f59b4f", "comment": "Malware payload", "value": "6349f827626c6684cabc496d3c66247a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Themida Packer", "colour": "#1D82FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629727130, "uuid": "47657a08-6888-4ecc-b8dc-290bf3bd764e", "comment": "Malware payload", "value": "d0b899ded3675e80e59b1e228f1e4c84b3cf16e2a45c83af62ccaac3392da79e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Themida Packer", "colour": "#1D82FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629727130, "uuid": "90043f8f-e158-4e19-8109-93ea1b8f8092", "comment": "Malware payload", "value": "016b6a11b9fb7af0dbf2344e3f6b2ba7f44a5fb3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Themida Packer", "colour": "#1D82FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629727130, "uuid": "4f727ccb-032a-4815-938c-ff060c842a98", "comment": "Malware payload", "value": "6166bbbf0cc546b4b73390cc0e38f26948a83e6092d873f39b6d1eabacb4660f923e7e431da6d90998d74d7bea5bf85c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Themida Packer", "colour": "#1D82FA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629727130, "uuid": "3e67e861-a266-463e-ae69-4bd82bd737ed", "value": "T100867EE2B50A72CFD09F26B8995BCE42991E07F942344D02D86DF4BE7F93D8125CAD24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629727130, "uuid": "fe67b369-0280-4dd4-9ada-6fc64d94ab2d", "value": "3164af3987e1e88e354a10d43ada020d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629727130, "uuid": "effef9d5-be6c-4640-ab6e-b843971a4fee", "value": "98304:htW7zKq7gpW8L/YJSY5Ls+lXQpvqPGOmjhdqU5tnQvgNWrCsTCcn6T9NTCnldkjQ:htW7zlcpv7YJSY5LwR9dcdkQ04j/h6Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629727130, "uuid": "d5759464-6aea-4911-9500-9b2fa73d62fe", "value": 8531456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629727130, "uuid": "d7316a7b-bba2-45a3-b3bc-324208e7ac27", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629727130, "uuid": "42445360-78fb-402b-9551-25aa0a94d0b1", "value": "MFLaEhUCAO.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "623feebe-03e7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629705286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629705286, "uuid": "1df8d33f-e8be-4f6f-a025-9c663e85d255", "comment": "Malware payload (Formbook)", "value": "7c207438745687fd62777e3b18535020", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629705286, "uuid": "eb4b00fd-b314-40f8-84ae-807237657eab", "comment": "Malware payload (Formbook)", "value": "d1a1c263b4343b91e2d8dc0ac2bda68cb43490b98cd59afa6dcc7128dcbb4d0b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629705286, "uuid": "12c77e94-ab4c-4742-8b41-21e308398693", "comment": "Malware payload (Formbook)", "value": "58f4bd7b9ff178ccb194befee4c3105b8cbac1fc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629705286, "uuid": "2f3ea28b-7f4e-4abd-ae43-8e5cd681558c", "comment": "Malware payload (Formbook)", "value": "f6a3ff01c5034a2e3d64dc39e09f2d73845f3eaf0b095a8386e423d353ae28a873d7f87aeddbc453a168d478af493ba5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629705286, "uuid": "d0f70c97-0691-4832-84ac-17c0fb32f601", "value": "T167258D29B390F7EAD8690F368823568847F294472735F76F1CC866EC6C21B1B871B653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629705286, "uuid": "f921deb1-a2e9-41b2-92f6-45b72d3eb2c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629705286, "uuid": "7c7b4035-ee7f-4cbf-9682-a4aed9017c5e", "value": "12288:yKK6Z9ERTG/c9t04QsLhBN9aTom5OuoUT3uiG/wpGMQu3Mxv8aesb34FA:ybA9GDt0Ghf9aTXEuos0NXZhb34FA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629705286, "uuid": "1760a670-8a5b-4860-8263-065b334b1b30", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629705286, "uuid": "2b25b724-e314-4629-aa12-46661cf48e8e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629705286, "uuid": "b15932f5-1629-4bc4-81e9-4bde392306db", "value": "7c207438745687fd62777e3b18535020", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8703249b-041f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629729399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729399, "uuid": "223aba8d-fa68-4689-be5d-1c9dbfdd22c2", "comment": "Malware payload (Formbook)", "value": "2325b95e951ae0184b0769a45fecd797", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729399, "uuid": "cbfe4da4-4446-4def-9f69-5d2693c51d14", "comment": "Malware payload (Formbook)", "value": "d2fca057b452e2ecec70cca26e9425a5f4ca44d50fccb90115ff64b1b537e2f6", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729399, "uuid": "2ab3dd77-e0bf-49b1-a1bc-63e6d59a17f2", "comment": "Malware payload (Formbook)", "value": "5a1ea433a2a73788dcb0582cb2153a15244a436e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729399, "uuid": "ca9c1873-85ad-427c-a738-8a276963a22d", "comment": "Malware payload (Formbook)", "value": "93f202518a3ad2cb044fc3e499181e8ad8603d5e02f1a2e9b338713f872bf209586b3b5ab81c3faa7e8cebe03e649d2e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729399, "uuid": "ca9cff13-e097-4d74-912a-0441de91e872", "value": "T1A7A24EBCC49B09A48F86A7F8670B2F45054C766EF798A6373678973827D2C7A411383C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729399, "uuid": "76755e9b-f23a-4c08-b238-c1286ff95419", "value": "384:OwO7QzzISfG7ePavaMycncRYnbx30n1p8LL1/D53:pO7QISflPPmLnJ038vJD53", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629729399, "uuid": "0ba63562-9d1d-4cb5-9a82-2c8ad11f6455", "value": 23333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629729399, "uuid": "f1e98ea5-1ca0-4db7-af73-507b106ff70b", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729399, "uuid": "d4c939e7-2452-405f-83ab-bdf3ef32815a", "value": "MAWB DRAFT.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9f22a74-03de-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629701594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701594, "uuid": "1a752666-4afa-4c3e-9c50-79639ffecafe", "comment": "Malware payload (AgentTesla)", "value": "e33efebeccd989b28837bbb56f3fe070", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701594, "uuid": "28655880-5f51-4ff2-991a-a9a48ba097d7", "comment": "Malware payload (AgentTesla)", "value": "d3bb22def2c8bb2e680bfb68c31a37608e11b891aa88249c236bfbc92d15bd63", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701594, "uuid": "9e1fc342-1f33-4afe-9824-732828ec4c85", "comment": "Malware payload (AgentTesla)", "value": "37ff5c6b456d7caa84b7114caa7923ab06afcfc5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701594, "uuid": "20cc606b-0e4d-498b-a169-0f6c1467900f", "comment": "Malware payload (AgentTesla)", "value": "bcab2eb70a04b6c076606fa2bd9316a09c98347eb82a8eda8d678c442941c8bb7a6f77aeccc5ce63b8773d195a556f7e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701594, "uuid": "022185f8-871e-41f2-b2b5-c67ec8079e22", "value": "T11ED43342B822E92699DBD812F77AAFB518E2C0EE35153E0C7E874F4CE4EC752940719D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701594, "uuid": "eb042260-7d44-407d-8ace-3a82dfc06caa", "value": "12288:1TGq/VB2JI0BsysmtL7eN0w5/TAu592U7Udq6aqS/+14:1GAibGysmNm9TAu59sz4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629701594, "uuid": "d179dcab-fe0e-42d1-b4de-a43f1df012db", "value": 625232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629701594, "uuid": "64294ddf-7614-465b-9967-cc3af1732443", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701594, "uuid": "06d71a73-deee-4606-8634-acb1794909b3", "value": "262320-pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e772d8fa-03d0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629695631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629695631, "uuid": "033ec2ff-b11f-45e5-a2ca-237645612f47", "comment": "Malware payload (Loki)", "value": "d2cd3274a7a1827a17b478b481f9e0f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629695631, "uuid": "d6bd6c21-636e-4599-a484-7d385436790d", "comment": "Malware payload (Loki)", "value": "d5a03c57bae086a6428d6aae55d1518e74331236c24e65eb849298418b08e8dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629695631, "uuid": "e9fe8b3a-d653-4248-a98e-d024be2d81f8", "comment": "Malware payload (Loki)", "value": "7db9a82967ead20cdd22368767be14b104f9723f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629695631, "uuid": "bce0e393-ea4e-4ac0-8e8a-0b4f1c06ac85", "comment": "Malware payload (Loki)", "value": "5b16e1346daa125d1cb6eb48300fd26a119e9fb1d445bd9c5fe6831cb52985d9b31e370335a4708e6f3ae47a5f21a52d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629695631, "uuid": "224e549c-b6f3-4d8b-9910-84ee1180818b", "value": "T1FBF4E43D19B91637D1B5C355EBE48423F148986FB404AEAA6CDE03A7034BA9735C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629695631, "uuid": "23546f19-a893-4446-88a9-9fef5574c5ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629695631, "uuid": "30f392a0-a2be-40a5-be5b-2fadf91489a2", "value": "12288:IoSDsLOijlOzAa1B3LjZg9ZWsQ4ihqVlxk1i2OZo3+3F7:IoSDVOlO8a1dEiuCFGP9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629695631, "uuid": "c3da1c63-a7e9-4100-a9cb-5fbffbd278f9", "value": 768512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629695631, "uuid": "1e836a4f-db29-4dfa-a075-decce103a45f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629695631, "uuid": "6a7b91a5-2687-4bd3-ac4f-220ca048c924", "value": "Shilla Valve Co., Ltd. August Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79068506-0403-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629717350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717350, "uuid": "8f279249-4c83-4595-8582-648591891429", "comment": "Malware payload", "value": "30149b826af406e89afa950aa4f3ce55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717350, "uuid": "bbe0b611-fd67-4bd7-a735-055a20881c6e", "comment": "Malware payload", "value": "d5a3ea57e5b06d762dac32cf4c4296643a552803e9ff9e80f801f7085b4b891a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717350, "uuid": "ccaeedbe-bf58-4d1e-a098-abd0a246bdb0", "comment": "Malware payload", "value": "4c8855af039f82d26bf9142db0c751f2515e3ae3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717350, "uuid": "ad6455c5-42e3-4402-80f3-adeab1807ddb", "comment": "Malware payload", "value": "cfd63e9647ef8c95beaf952f4737d1814ccd27483c98419d9d4a991f4063ecb1b6172df5ba0b76368b4a9b0ab137614e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717350, "uuid": "b1f4b8ab-f7c1-42b0-93dc-332c2ffe3cdd", "value": "T10D05A069B142433BD0A24B399A0EF79BD926FD022D34D5571FD83DC84F352A23D7A0A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717350, "uuid": "93e52253-9217-4ff8-9686-81e6770250ac", "value": "1abe4551dd4f8ef04deab38d0027e326", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717350, "uuid": "7a61c85c-b618-4aed-a00d-e8b1e66f9ede", "value": "12288:WhxUck0fyI/Xv94r0umLKC+pvbIAsrxPz+o8wc9:WhGdkF4r0uvnDIFpP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629717350, "uuid": "4b04240b-9e11-4d09-b140-b5cd80e75565", "value": 846848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629717350, "uuid": "72dcf892-f142-4e99-b63e-c0ddb7f130b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717350, "uuid": "bbb492e0-44f3-4268-99b8-73e4fabbd1aa", "value": "RFQ_AP65425652_032421,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3fd7ab3-0419-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Amadey)", "timestamp": 1629726925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629726925, "uuid": "afc7b866-6b3d-41bf-962a-e1c1f409056d", "comment": "Malware payload (Amadey)", "value": "836747216f2c97639a5ad8314646970c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629726925, "uuid": "2d71b812-f8df-40a8-a43a-30b289f7950e", "comment": "Malware payload (Amadey)", "value": "d5ba57c3cd3f10ae9a818f119beb7581a9476ebc3251f26affe6c84938873f2a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629726925, "uuid": "91450056-eb52-41de-afec-5a6106bbc99b", "comment": "Malware payload (Amadey)", "value": "1b55b4c821ea1971c5a3ff7204944785a29e8518", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629726925, "uuid": "317874b1-eac8-4d32-9a82-08216c381060", "comment": "Malware payload (Amadey)", "value": "b50d3f597ba110460816e429a46ae72003d342b9f476d1adb52eeb993bd0a15e2aaac1ab14e6bfcfd5b800febbe06092", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629726925, "uuid": "d201f698-5bbf-4e19-a31e-6a6d784d46d3", "value": "T11A64AD30ABA1C035F5B611F855B683B8B93A7AB12B3450CF53D52AEE46386E5EC30747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629726925, "uuid": "b819d0d5-4b2b-496d-8f8c-6f05cbb4aef9", "value": "3431c4d066a67bd4eed073be41b2ef83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629726925, "uuid": "ce09c837-6cf2-4766-9239-4fe72dd55b50", "value": "6144:qZGj488W+z2A9kPrJanyOtb1HlrRCe3yCDnP4Waz66F1:hjYWW3kTsyOtJHlgevnxazT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629726925, "uuid": "0d47ea27-7ab3-4089-b7b8-980c7e1ae545", "value": 327680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629726925, "uuid": "b3fb4df5-d4b2-4f5d-82ed-6eb82d7fad22", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629726925, "uuid": "95531159-cd22-42e2-912f-b4cba0c470ab", "value": "836747216f2c97639a5ad8314646970c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ae53f24-0439-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629740573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629740573, "uuid": "95dd267e-a05e-4f46-886c-f5f04bf2fc60", "comment": "Malware payload (RemcosRAT)", "value": "a4e598ce08cf9fe3c45a1eb66488e558", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629740573, "uuid": "ab726593-26d4-4cd5-bd5e-da6a47b9f0ef", "comment": "Malware payload (RemcosRAT)", "value": "d5d37e6b4aaf499d297bf05ad18cf2873100dcc0f9fc7d97f9bc7d4cf62e1465", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629740573, "uuid": "e206173d-f8a4-4a43-8d72-cf2c24de5afd", "comment": "Malware payload (RemcosRAT)", "value": "7b61ba1a069c4bba245201f54262879609f55217", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629740573, "uuid": "bf3959d8-45c0-444f-a125-5aefa48cdbca", "comment": "Malware payload (RemcosRAT)", "value": "c9e3e2d695a26b87addf78a955110074629ec77786ff5b42b4fffdabb2b93b34df54a15d88a6ae39e0ee7d9b7327f709", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629740573, "uuid": "8b69a3c2-0acd-4f00-830b-ac6f34909092", "value": "T17025283D1AF91637D1B5C365EBE58423F149985FB410AE6A6CDE03A7030BA9734C722E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629740573, "uuid": "99bbf8b6-c5b6-472a-bca7-ec05bc2a21f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629740573, "uuid": "28dbf6cf-294e-42ac-9386-b87d8ef636df", "value": "12288:0wTf7UrMZ4FYJrghqvn0u35ensy+/wYcM3UxmN1CjxZWkEGijBvV/L8ctFXR:J0YVghqv0u3ASk6C9ZWk8BNttxR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629740573, "uuid": "88010c5f-a52e-4fc9-9d48-0f3c83960528", "value": 1015808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629740573, "uuid": "30954154-db76-4570-abe7-8d93d56d4d35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629740573, "uuid": "8699da92-2fe1-4253-a3cc-0a13df9baa02", "value": "CONFIRM BANK DETAILS_pdf__________________________ (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fb6d92c-03aa-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1629678948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629678948, "uuid": "caf90cfa-27cf-4d88-9bb1-b132d2ce8eed", "comment": "Malware payload (NanoCore)", "value": "b0e8edeb5cbf2df69257c01f323e9eb8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629678948, "uuid": "c21b8143-fdbd-4eb0-ad84-ab3c13870ae1", "comment": "Malware payload (NanoCore)", "value": "d679d6613e06d554b15466aaca0982fe77132188696d7c09d7873d460b3b4c79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629678948, "uuid": "8d5e1cfb-1125-4df6-a461-cdd7e3d296b2", "comment": "Malware payload (NanoCore)", "value": "e11331e7e051a22736526c7b3e1bf188d4d9aff9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629678948, "uuid": "66536efb-27ac-4669-84ce-45fb07062224", "comment": "Malware payload (NanoCore)", "value": "6533f1fae18403bdc1d314807e300521aeb9182514e25e06e825b99e4f75a1b96036ff41b3b0804f52b353834704de3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629678948, "uuid": "443b3931-cc2b-4d4e-8e3b-bfbd17250ad4", "value": "T1E6B4BF10B9C1C032C673393047B5D6B258AE6D302D359A9F67983A3A6F74581FA35B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629678948, "uuid": "4ab78b11-90a4-4ba9-b832-96f4c00a280f", "value": "bf08a978649b718b66012803a6d17e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629678948, "uuid": "a9f04c09-0878-4ae8-9a9b-0ef0b11dc23c", "value": "12288:ng8tD+p1h79i/DdVedE5fJD7uwk9P+hNs+kHyMbqxBhFHHiVboXGzW4:ngwVDdcE5fJwTbqxBh8Vbot4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629678948, "uuid": "5a94d631-d25b-4345-af99-7351c97bc056", "value": 538584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629678948, "uuid": "e477cc53-63da-45ad-a42e-21f94b870012", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629678948, "uuid": "b8a5cca3-d9fd-4ba0-9d37-b45ce3911f57", "value": "po.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ec78270-0403-11ec-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1629717279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717279, "uuid": "89771213-dd7d-472d-91e6-2a33cccf1d2c", "comment": "Malware payload (GuLoader)", "value": "e06c8f5682360fb49c5c4b6b090037c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717279, "uuid": "6f8676aa-f91d-4cdd-b283-e7c8ce2ac7cb", "comment": "Malware payload (GuLoader)", "value": "d6857aa5fd52de7b5f61da1d7556c2aa04ca9040fbd399ab797b927fc06aef12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717279, "uuid": "3a448e8a-a42d-4ca7-acf8-2a9a0a800d38", "comment": "Malware payload (GuLoader)", "value": "6c6135bc7737bd680f74311edea4cf3a3058b824", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717279, "uuid": "7d89ec68-64c8-411e-8c93-a17d852cb06f", "comment": "Malware payload (GuLoader)", "value": "1ed5c1c7170a6c86e4fc08dd05d685c272036d502eb89ddea1db9a53b41a007fca5967ee6020e6a8ba9c9a49ac133c40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717279, "uuid": "6082f569-59f6-4a94-99ae-b7ff336c654f", "value": "T1A1B39FD577C3DC6ADB4AC6B01BD1867810F1587015B117EFA1DBEE0C0663AE0AA6DF28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717279, "uuid": "d0d217ab-82b0-43f6-9ced-31b377435d1c", "value": "75bc8475f06791375ef37dcd653cffe7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717279, "uuid": "605f2682-1b55-4341-9e90-c462dc9f5355", "value": "3072:nFHWPoFS8qLpv78sJcY7ly/++7wSnTw8zCjKYLK:nZWPoFfqLx7Feog/++7wSnTw8zCPLK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629717279, "uuid": "eaf46f6f-9b43-4eec-9d1e-faf760a7af93", "value": 111656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629717279, "uuid": "d6997a35-b73b-41be-aba9-a5152bec8d9b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717279, "uuid": "ce239004-2ff2-4fca-895a-560aa0c35d38", "value": "COSUTEC S.C.A. Pedido urgente N\u00ba 5202135876.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28544ebe-0409-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629719791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629719791, "uuid": "7033f790-e37a-436c-bbac-e881b941d33a", "comment": "Malware payload (AgentTesla)", "value": "302e6dd79a7b72f7bef6a614a267aa50", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629719791, "uuid": "62f961f5-20f0-42bf-9815-1d52ff2acee0", "comment": "Malware payload (AgentTesla)", "value": "d6c10d4bdea16e927c8522be588215e799d4556c92375c30d44fd55da585778e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629719791, "uuid": "db2696d7-d6e1-4373-9575-56cafd930b0a", "comment": "Malware payload (AgentTesla)", "value": "a3e948ba3e0010bd02896b02da651b3f4597cb49", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629719791, "uuid": "9fb4179e-9ac0-4015-81e1-e0efd20500e3", "comment": "Malware payload (AgentTesla)", "value": "fdf0b83f16d9e2c02bb885cf6c00417afbfcc25ffa448c19d45f5d7e8d2d0b1b11f01c285ff483d7e29b5444c5926ad3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629719791, "uuid": "71317b58-dddd-457a-b906-cdafb298d46d", "value": "T186E4018A7740B79FD22ECEBB95512C60D3F0A5714307EB57ACC306E9A18D35A8B512B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629719791, "uuid": "5e40ab33-2dad-49fd-9715-0f4b40d2d633", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629719791, "uuid": "2eeb6575-93b9-452d-b848-1ae846a434f0", "value": "12288:P7uH8ioJa9EC7I796Kj+7NDKMElWeRHaXkrZ40AN6pIWQUKh9:TuH6a9vI7907NdqdH20BIWQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629719791, "uuid": "d3de854b-45c7-4ae1-8702-175adca88369", "value": 694272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629719791, "uuid": "032e7507-c970-4e93-8bb1-978e115bcb5f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629719791, "uuid": "cd4e08ed-45d3-4087-a866-46c5f92dcd7b", "value": "Payment Slip_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "797bf1df-03de-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629701459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701459, "uuid": "ddac7466-f6f7-4a90-a9d7-13981d86e04c", "comment": "Malware payload (Formbook)", "value": "b9ae3318bd0b90467b0a83469b0c818f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701459, "uuid": "d9c6f1ef-23d3-4c6a-80ba-4e341ce2bd86", "comment": "Malware payload (Formbook)", "value": "d835bb8d896d0a858feecf968258bc9d5d53e8013e01463db68ae2b5bae8fedf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701459, "uuid": "42b20d92-00ee-48dc-989b-9acdfc6071d9", "comment": "Malware payload (Formbook)", "value": "15148fb5a44cfbe1f292997193f40edf02e61f70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701459, "uuid": "17f76f0b-2ce3-4707-a9d1-df4288453466", "comment": "Malware payload (Formbook)", "value": "d4b237ba996193367b76da42d45336c4c544b4c7710285d1c21e9a66a87b542f7247757554b037795fee2f0ffdfd8805", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701459, "uuid": "7bc2d54c-a284-4480-bdbd-0f7c0109223d", "value": "T148D4CF48F610E5CFFD1ABEF948913B10DA709C26460ED6836BB337ED857D2858E071A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701459, "uuid": "d112f8a7-8a33-4134-976c-0d9f613e46d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701459, "uuid": "f13619d7-3b91-4bc9-9d83-790188050e1f", "value": "12288:eZWrnQD832Ce4cUv6mb6HYvzyNHkZWKVq6wi:eUcDsSUvLb6HYLAHkZtVT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629701459, "uuid": "88dfcd89-3590-49e0-8018-d9d767bf22f7", "value": 642560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629701459, "uuid": "bbb6d0c8-5531-459c-a292-cb033644b15d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701459, "uuid": "fe7ae789-8941-44de-9750-4c8c9d284c0f", "value": "digitization_pdf.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bb94774-03d7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629698403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698403, "uuid": "59f7e7b4-5445-456f-b437-a8876873e2e3", "comment": "Malware payload (Mirai)", "value": "7a9373616411a2006b4a8e88d3df36bf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698403, "uuid": "16827707-9ce6-4933-ac37-0e31ca0d9406", "comment": "Malware payload (Mirai)", "value": "d908fba19921396bdc9ba7ad17bacf8b2e027e693de5faf75f785d2095b89cea", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698403, "uuid": "19641382-6e6d-478a-9d75-6e0ca8d13ce8", "comment": "Malware payload (Mirai)", "value": "e2f5e61f40e4073accc0109cc7e941dd1a6df9dd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698403, "uuid": "fa2295e9-30c0-4749-8357-598ab795217d", "comment": "Malware payload (Mirai)", "value": "915cd03116825cda7e18d77f1a9209f8ae2cbb21bab2c327ebd7dc18e9d8e0d1dadea83b95308796411798107a4844e9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629698403, "uuid": "bcf81f8f-03fb-45cb-b5a8-0662cd140b49", "value": "T187D2E11F94ED4BD9E62B58308BEF37989210F82A149C5AF1FFC4B11AB4D2A446125EC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629698403, "uuid": "a47550a6-e2a4-435b-8ee1-1d06dff45857", "value": "768:a+eiZIiTk9Lv0lxi710xWN+XxIVUFDLnbcuyD7UHQRjL:aYNyLWQJ6Xx8ynouy8Hy3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629698403, "uuid": "4646aab7-da45-43ae-990b-be282ccbbd15", "value": 29564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629698403, "uuid": "a37dc44a-284a-4f68-a16d-d403520aa299", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629698403, "uuid": "05fe3097-451f-4cde-b13b-800eb3dfa908", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f3f00cf-0418-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1629726380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629726380, "uuid": "00f77fbd-b529-49da-8a73-44786e6b307f", "comment": "Malware payload (AveMariaRAT)", "value": "a96c1c2b0b245740ae897f75cfe80db8", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629726380, "uuid": "a769debd-ea66-4db2-88e1-fa9f0679bba4", "comment": "Malware payload (AveMariaRAT)", "value": "d9740755673a2b1025f0a9ea9a579657b0d22d7c00a049d113f84326d37b66bb", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629726380, "uuid": "292df988-624e-40ac-9c77-268e6115cfd8", "comment": "Malware payload (AveMariaRAT)", "value": "1cd3e303ae71082e72bd0ff4a57c62dc56b17687", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629726380, "uuid": "35bc2c6d-6c3f-4444-aff7-537cf8719f2f", "comment": "Malware payload (AveMariaRAT)", "value": "01268ebe59748771ee5c58c311c727828ee1cf0e608dc8f1f2f79782c5693abc793b5f6a65cdda8d3fd84109994949d2", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629726380, "uuid": "22e3ab6a-adc2-40d0-b652-e57d68cbf500", "value": "T13B946A017B98AA2BF135D5775763813283B24AC7E1D1D745D840D3BE7A32370AE4EA8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629726380, "uuid": "6d59c9cb-9ef0-4659-a749-571b9cb1262b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629726380, "uuid": "c6802766-82b0-4ba6-a3ef-196e6e136463", "value": "12288:zE1aF6hgv2p/MKnBnH/sjhaTtbEBsomPI6r:ugv2p/xnBn2aTtbEmPI6r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629726380, "uuid": "fe7c0f15-0efa-4d32-b7cb-87d4a1f45abe", "value": 448512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629726380, "uuid": "bb18fa4a-173a-45c5-8940-8b1595a99f3f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629726380, "uuid": "d2843761-a37d-4e40-be82-4e0bb66a96c6", "value": "231021b130d7eda4a42618d731d66c86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f72b893d-0422-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Vjw0rm)", "timestamp": 1629730876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629730876, "uuid": "0a015846-51a1-4759-a221-401d44cb03bc", "comment": "Malware payload (Vjw0rm)", "value": "c895f5dae03d1e6030775e0161975b14", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629730876, "uuid": "1c4a8b20-a855-4d97-b3ba-a7bbbc9201c4", "comment": "Malware payload (Vjw0rm)", "value": "db2ecbc435d932b7947857e4f9108ffe48c7a5af8ad9a34836c9d6cd96193ed0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629730876, "uuid": "bc0b6cb6-8127-4002-83d5-315d4cfffb09", "comment": "Malware payload (Vjw0rm)", "value": "18c28bce01ba6d6e3fce7bdf568baf302dac77df", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629730876, "uuid": "9efaec27-c8ae-4be3-ac27-8415a91e8edd", "comment": "Malware payload (Vjw0rm)", "value": "8468431f6203a6d5a24db348b54e96492737c92b26ea8b86c3c8881b285ae51a06d099eddd52216c942a969918008bc9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629730876, "uuid": "995ae290-06ad-4a9d-9126-44179e3f7ce6", "value": "T196441815BB84964EB5890987F06D9A4AB6F37F02D5E3B2CC378B3247271FE5E6219C40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629730876, "uuid": "9977f97c-5d30-452b-b2cd-9a262d2b640b", "value": "6144:AJHzPHIzMi9nhZpsdaisFaRdL5svoPYypqvj3jt27wl3Y:KTRdNo1ygj3s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629730876, "uuid": "0763d675-cedd-4626-9b3c-c62e971ec9a3", "value": 254133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629730876, "uuid": "f7d27255-419d-42c0-a0a8-b085c21907b4", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629730876, "uuid": "555ca3ff-6f9d-49f6-b3f5-850132fcf19d", "value": "BL_SHIPPING_DOC.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1598765f-043d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (BitRAT)", "timestamp": 1629742094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742094, "uuid": "be10259a-53bc-4797-a6be-c1f0c14b392d", "comment": "Malware payload (BitRAT)", "value": "024cde85d1a11c1b2e6749ec80b50fad", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742094, "uuid": "0d4dff64-14f8-4622-a82a-7cf342c2d6b4", "comment": "Malware payload (BitRAT)", "value": "db5d4a5090c7303616f88db08a22abc975804ae1abdef9740c208c004648255b", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742094, "uuid": "572a2c0d-925f-4297-ae15-b81f4340aaea", "comment": "Malware payload (BitRAT)", "value": "5f7226f27b0106f6050ce61d78e9c0fc8cfb8373", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742094, "uuid": "d9691507-7805-46aa-9746-ac49c1973281", "comment": "Malware payload (BitRAT)", "value": "1e350e7e108b61f8878902b1ab6c384e5059631f4f3a389f8c3774b6dab07557b4a1b8531d48f5a8c6e561e843d18582", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742094, "uuid": "fccef587-78b8-45c8-8268-585cf1e99116", "value": "T101D5235036D25731E472183A0DEC5665AABCBC312B35588F6368253E9E348D0E736FBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742094, "uuid": "0b4a038b-1d42-452e-a9d6-586329ac2366", "value": "ae9f6a32bb8b03dce37903edbc855ba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742094, "uuid": "268b8831-35af-4c41-aab2-3ca866427a2c", "value": "49152:KynUHNR9PKXUm1WHyilGSvn/5Kaq1rO5n8UXRaa/B03ak8JqFJ7BHKQk6j:KyUHNjSXUmIHy8Zv/Uaq1yJqak8JqbFR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629742094, "uuid": "b18a7364-389f-4813-934d-f17197c58a30", "value": 2907759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629742094, "uuid": "823e9732-42f6-4e93-83f2-dd7e122818cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742094, "uuid": "116404e9-fc28-4110-b06f-4f191eeb71be", "value": "Attached PO 30745.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e1c2fde-03d7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629698407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698407, "uuid": "13112cf0-b44f-4a98-98c9-89a4114b3e9e", "comment": "Malware payload (Mirai)", "value": "298c6130e581b7cdcc1ee8ae0854ae9e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698407, "uuid": "69d0826d-7937-44ea-8b1b-c6270a86bc7c", "comment": "Malware payload (Mirai)", "value": "db64bc1ea9208b1852ca3aa1dcc3af55dbee4ca2a4f8e549e0aa3221a713435a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698407, "uuid": "c8b907e1-e8a7-4ebb-b8b6-492b03f90a1a", "comment": "Malware payload (Mirai)", "value": "a5a5351343c17d8782bbdc347acfe95f50e7119b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698407, "uuid": "49ff04ea-41f2-4874-b2b7-6b3167116dec", "comment": "Malware payload (Mirai)", "value": "9ec81cb033b88e2a9fd4ef49155e3275465537c5f0dc964ddb42b54e2552172cd23d7fd8e87b4e28ce42ee590a6c42fb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629698407, "uuid": "ca0ec45a-2958-447c-b408-5cb82b7f04b6", "value": "T1D4D2E19CC19A7C22C0910967FDB947CF13AB51F4E0FA3352ACC81B197A4D64E497496B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629698407, "uuid": "006eda19-5791-4494-a498-f8892f1f0800", "value": "768:WI4Xb1OBviHZPtp7WO+VaQxOxTedf9p//3EEmyl/ws3UozQ:h4BOBvi5P+OCaQ0Tk9/0vKdzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629698407, "uuid": "d633fbcf-e57c-431e-8e35-79da826bc922", "value": 29732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629698407, "uuid": "7518a73f-098f-45f0-b446-df87bd8b8201", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629698407, "uuid": "cceeaf20-d66c-4abb-98bc-ff0bc63e18af", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4697162a-043c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1629741747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741747, "uuid": "1337e6c6-8dd5-468d-9710-71091918456b", "comment": "Malware payload (NanoCore)", "value": "f359c569b703f59767d4f322c08ffd1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741747, "uuid": "4525441b-cf21-494b-bb29-1cc2212d0ba8", "comment": "Malware payload (NanoCore)", "value": "dbfc1426b8273f1490e9f8b61929a3e00fdeefaaef7a4400a1dae2ed2f953a38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741747, "uuid": "5127c7cd-0a65-44fc-afc7-9456fb92200f", "comment": "Malware payload (NanoCore)", "value": "176ff19dad6778406d0ce0033a3f4116a2877f57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741747, "uuid": "272d30d0-ec0c-4c9a-8388-9caf14380452", "comment": "Malware payload (NanoCore)", "value": "cb7295e7429c6bc0f3b80f41769be42852f249990fac887f190a0e3ea1c0a81ed258e37c86ffd62b2e10b339f53d97ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741747, "uuid": "7406428b-c8ba-44c1-88a3-0ffa9e4a0dd7", "value": "T17D15173D1AF91637D5B5C365EBE08423F149985FB411AE6A6CDE03A7030BA9734C722E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741747, "uuid": "d4ac99d6-0238-42aa-8d5e-f206e64fa54c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741747, "uuid": "ab68c09d-6f29-4225-9685-48141af344f4", "value": "12288:6B/QmMeIgJ/dfZdm1zBmbMMm21dZL4XsgL0Ec:g/Qg4pBmo3W40r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629741747, "uuid": "12db510c-03b0-4cfc-8574-5775627e2f7c", "value": 907776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629741747, "uuid": "32bdd3eb-cf8b-4118-8ddd-45f3ab256d5d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741747, "uuid": "1407558a-dee7-41ab-82bf-017a580a1b04", "value": "f359c569b703f59767d4f322c08ffd1b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c04b3d37-03de-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629701578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701578, "uuid": "a17bc797-976b-4984-9a2c-68c0d5122966", "comment": "Malware payload (SnakeKeylogger)", "value": "0ebd40c15ce9355e56170600833e71ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701578, "uuid": "28055b73-1718-4b37-8790-70dd27448878", "comment": "Malware payload (SnakeKeylogger)", "value": "dc989069c67e628372454838622268ce5f0913ddd1c267fba3c56cb78bf1bc9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701578, "uuid": "61b7b37b-e761-4088-ba23-230081124e11", "comment": "Malware payload (SnakeKeylogger)", "value": "ccaccaf5cd26f71e0c3ff167403d0cd93852ec5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629701578, "uuid": "5232ef8c-155e-4a38-8190-6d37f6b76044", "comment": "Malware payload (SnakeKeylogger)", "value": "1c962ac13285c10608e446415ec9fd1913ebf1e2b7d3fcea7d2fddaf89d9ae42781b3c4855fba12736b1202d94af6945", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701578, "uuid": "1f30c195-ed5c-4dbd-8081-344d8356512c", "value": "T13315063D19B91637C1B5D375EBE48423F258985FB404EE69ACDE03A7031AA8734C726E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701578, "uuid": "f3ed811d-98d1-4bfc-91a7-cd3c09b0021f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701578, "uuid": "4dbd229a-90cc-46a1-84e3-99d90385338e", "value": "12288:FZZi970DLnhMH50sOIvhMmxLpAdvdW9k19MDmlM7HHzd6qx8vMm:FZZBLn1sVZMGpA7W9ElM7HBiZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629701578, "uuid": "1751fe22-6537-4622-8559-4fc813fb72d9", "value": 951296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629701578, "uuid": "b798844f-bea0-45dc-8a00-e86c0552f2d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629701578, "uuid": "9eec3a0f-b670-4515-874e-13af2a158b2d", "value": "hesaphareketi-01.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da9f8df8-0401-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629716655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629716655, "uuid": "0df6e422-ecc4-4a47-a191-e809df17189e", "comment": "Malware payload (AgentTesla)", "value": "7bda5add0d4ba2c5b1810e9f44a6c6fb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629716655, "uuid": "0ac4a58d-5dd2-42c7-b8f0-a2c49d6f46ba", "comment": "Malware payload (AgentTesla)", "value": "ddfa7fe7c01cfa34c2413acc83e9f11eace8bc09e80128da2b5e2e61284df9ff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629716655, "uuid": "c16dfde6-5d7d-402b-8431-2def460faf46", "comment": "Malware payload (AgentTesla)", "value": "857ec2f81068823ea37da355fa8fef8396230eac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629716655, "uuid": "d0e83554-9984-4c94-a6b6-6178431b607e", "comment": "Malware payload (AgentTesla)", "value": "57fabeacb5d3c8282eb86009b154c353da8458a3d9afba41393ef31c3c1e87bb462fe1659b33435a1564ceb392ec7f4a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629716655, "uuid": "7b8b6108-d159-4bb1-a750-4ac8fc93a85c", "value": "T10C25813C19FE2637C0B5E375CBE28813B00568AF7521AD9494CB5B2E5326B5236C727E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629716655, "uuid": "50fba1e5-5555-42d0-80f0-4416a9dce2a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629716655, "uuid": "3a1084d8-99c4-408f-901f-f608729b00d2", "value": "12288:5SUkOyTh0sQQ3XFkdhhgxw56hHb4ApqblAOnGh:5lrRLQnOJgsKMAAxG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629716655, "uuid": "37d786c3-d7d1-43a8-a2e1-a7185dbc79e6", "value": 1041408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629716655, "uuid": "d2f4c705-45d3-4d00-aabc-a167d14324d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629716655, "uuid": "eb766568-b0ef-4bd3-8700-2f99aa58c4d9", "value": "SPECIFICATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d080acb-042a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629734134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629734134, "uuid": "9d4bd3cc-4f9f-4d1c-a869-9e52893f34d8", "comment": "Malware payload (AgentTesla)", "value": "8901adddca065dc397595e7d835171e2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629734134, "uuid": "395c7ef2-49fc-4194-a795-da48a7aff2bd", "comment": "Malware payload (AgentTesla)", "value": "de32015805c55828e2fe94a92b24cf699b522dfa78c26b7b837a9edb6555ab0b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629734134, "uuid": "e7ab00fc-322d-4166-942c-34960dc8bd11", "comment": "Malware payload (AgentTesla)", "value": "259085e173943014381b8a58f7aab013ae965d4b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629734134, "uuid": "d9b35997-9a26-4fce-be0a-d9c195b95226", "comment": "Malware payload (AgentTesla)", "value": "52c9d03f72857a71d22b4dc8b516416d7fb42f1913616564f5c765e0128b8f7cabe7b5ef412eaf0b77c8184591ea06b8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629734134, "uuid": "d818005a-a1e5-49b0-b22f-7022d7d39144", "value": "T17115F53C19B91627D1B5C375EBE58423F148985FB401AEAA6CDE03A7034BA9735C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629734134, "uuid": "15e24a19-1b17-4a72-95c8-add00220b200", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629734134, "uuid": "436ffdd4-e84f-40be-8719-7b401ac67dea", "value": "12288:+emvi0gkwclgFj6ZeCCsVd9Caqnp+gmkWJdtEzPwVqYDqdiy:+Ti0gkwceNiHVVHNIE1kWJdtEzsUiy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629734134, "uuid": "266728de-303b-4f86-9f2b-c9e1d9afff47", "value": 904704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629734134, "uuid": "1ce1cd7b-0ce3-499d-97bd-6ee326483d5b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629734134, "uuid": "d9768a2a-a598-457f-b7e3-ed5ca7b5b563", "value": "8901adddca065dc397595e7d835171e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddb1292d-043e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629742859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742859, "uuid": "205b3b59-6706-46d9-b247-bacd68b21d06", "comment": "Malware payload (RaccoonStealer)", "value": "88337815ca9738ea5df7f734a7ae4dc6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742859, "uuid": "db9d8f6b-7e03-4ca6-a464-a961008bc4e4", "comment": "Malware payload (RaccoonStealer)", "value": "de3c93fe49775276393b43a5e39d71b9ade06756977134f2b7ec0204def6b374", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742859, "uuid": "125425c1-121d-4aa8-aa67-ed5538cb0391", "comment": "Malware payload (RaccoonStealer)", "value": "89a47da6d37de3cec41a81739f2ff4b173763e1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742859, "uuid": "8d14bd85-b2f8-4678-8a5e-a364d63a5639", "comment": "Malware payload (RaccoonStealer)", "value": "0f0ec5e35c22d7ed5bdcb8b7260365bb95c084b6c5bc0c182fe7786578e8795c59e2c6aaf43a974c951fa8adfd5056a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742859, "uuid": "79f85502-1eb3-40d3-9062-d94265c03503", "value": "T1F1B4E030A6A4C138E1F712F84A7DA3AC692D7D716B2040CB62D726EE56372E4DD30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742859, "uuid": "5dd52638-23a3-450b-9162-283e8c02bcd0", "value": "0579ae0629fc2c520498364f1f007f60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742859, "uuid": "f1b41de2-bcdb-4ac4-9e5d-3d7cca3cacd3", "value": "12288:6rqTJbk0kmr/3oO/LNDqROP1JaVYPqS5bQu+bll99kJq:Dbvkst/LNaw1JjPqmF+B79kI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629742859, "uuid": "0bf9b77c-8ed9-4032-a81f-1626f1f6f42f", "value": 535040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629742859, "uuid": "6ab39ae2-c77a-48e9-b4d0-502baa62fe3a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742859, "uuid": "8b6aaccd-224c-4694-8b13-cc6054b40e05", "value": "de3c93fe49775276393b43a5e39d71b9ade0675697713.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fbae0d8-0456-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629753063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629753063, "uuid": "0af90c1c-041f-457b-853d-5eb01030980c", "comment": "Malware payload (RaccoonStealer)", "value": "4569edbd7c219bf06c4e9b4f14a58fd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629753063, "uuid": "119a6dc6-9ed0-4a4b-b14a-4192d6228bfe", "comment": "Malware payload (RaccoonStealer)", "value": "dee5a4188daae44966c5b8892b85d5e50990045d8d32668e8debb40825dad5b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629753063, "uuid": "bf6b3dcd-0c36-4264-ad4b-894d9601f763", "comment": "Malware payload (RaccoonStealer)", "value": "8924d4bb8c0b4534750db21367b17b5b8f50a391", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629753063, "uuid": "948383bd-2581-41c6-901c-76104cfeb5ff", "comment": "Malware payload (RaccoonStealer)", "value": "16cb1d629336addb2ff910d62b3bc292ca0229f0f8b3bf29df8ab1efed92dd758bf48fbaf69716ddbb24145d7c7c84aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629753063, "uuid": "8c7d5d9a-d75e-474e-98f2-a69d16cf03ea", "value": "T18865F01C33D678D3E0A09A3F2561B36D8CBBF75B206796A929B00C89BCD54D85944BFC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629753063, "uuid": "63aee710-afe2-48fb-b2de-124858c36f53", "value": "67260fb2ac11e8fa504fec7af97d8fe1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629753063, "uuid": "22244175-9f87-4f8e-b1b8-b1d75298d24f", "value": "24576:6ZZn6rg7mqeZPQ3uYaQx7SD95AuT1PVeT5u+aFAKDKf2iI9q3HCrchjfL1fZXzwJ:6Wrg7eQ3uk7SDLneDxdC4ZL1VzwJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629753063, "uuid": "100d3639-55ef-440a-a76b-a2bc6e48b8df", "value": 1513984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629753063, "uuid": "ab0acdb5-96b7-41a0-8125-561dfd9bcfb9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629753063, "uuid": "3010a57b-b13e-4de7-8f51-dd89c04e90a8", "value": "4569EDBD7C219BF06C4E9B4F14A58FD7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7728897f-0411-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Alien)", "timestamp": 1629723360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629723360, "uuid": "debc5b2e-c786-4ab6-a46a-a629767e2257", "comment": "Malware payload (Alien)", "value": "479dcd56775e176083561ebbeeb40954", "object_relation": "md5", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629723360, "uuid": "246ea6c8-d65c-45fc-836a-3aaf1f0e3de3", "comment": "Malware payload (Alien)", "value": "dfa0b638bcb149da421ccb28395c625e2b28cdb036e78e0937d10764a083f82b", "object_relation": "sha256", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629723360, "uuid": "1730cf6b-cae8-4c69-bbcc-152d8054f403", "comment": "Malware payload (Alien)", "value": "462a7c02a47a464d9a39f1c97a7a94072ad40e99", "object_relation": "sha1", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629723360, "uuid": "4287d075-dda3-43f6-afec-dcc41e10aba7", "comment": "Malware payload (Alien)", "value": "6e02cff9264a1e6fe0ea858123016bd4115937d6861942018958b15d2e98f984d9071043c4808f71f1dc3156daeea273", "object_relation": "sha3-384", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629723360, "uuid": "f060f388-f3db-4fab-9d92-526c0e6bc4b8", "value": "T17F061225EF80DC77E1534D31B10683A3A51A4BA76102F82B0697605E2A67F741F36EFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629723360, "uuid": "56b82284-5cc0-4d47-bc0f-43e342f37944", "value": "98304:n44rplYwrtY9L+NWKIQJK3hhjU3pigBmHZb0HUa4KQL/aHfTZEy:p9SwRuDKIQ+hjcBe3KkOf9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629723360, "uuid": "31911297-b471-435e-b3f6-53f5a2bc1fb3", "value": 3657005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629723360, "uuid": "07780219-d37e-45ea-8c51-a68069b8634e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629723360, "uuid": "67af41a7-805d-4a13-90d1-f63301044843", "value": "Chrome630883.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5e7f808-03e1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629702849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702849, "uuid": "e29f90a0-b613-4fcf-b319-12be8f84514a", "comment": "Malware payload (AgentTesla)", "value": "d1a96c0403fa60fad032ef30198a9c78", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702849, "uuid": "f776f084-9703-4d7e-8aa8-f26199d0294a", "comment": "Malware payload (AgentTesla)", "value": "e088c002556f104e0a7a4ebe6f5a154f230c6dee1d3dc3c1c44cd7515c51f37a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702849, "uuid": "29a09370-5e99-4699-8efd-53d7f58ddf0f", "comment": "Malware payload (AgentTesla)", "value": "17de960ed6de1d20f525e2227253d4b4b86b740b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702849, "uuid": "de009396-9bc8-417c-a857-877416136482", "comment": "Malware payload (AgentTesla)", "value": "efaa97e18ed1213ab93f037e44cd616f490e850e7f80d05c4a7825e7aff3abefed94632c88709d4c1925a0c2089e05e7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702849, "uuid": "44a01fc4-773d-4ba3-a76c-df0813016ed7", "value": "T12597173D15B83627D0B9C376EBE18413F194989F7511ECA9A8DE13A74383A9274C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702849, "uuid": "f1e2220f-21c7-423d-a638-7f2ddb18c972", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702849, "uuid": "1b29a177-1184-44d8-9873-ed2aa95181a3", "value": "24576:5TJBd4oVjW6J8mIdk9FE2lsthASTR4cV1S:5Tbd4ohOmP9FEB+wxVQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629702849, "uuid": "7e5156ba-e9ab-4be4-8105-cbcfe46b49c5", "value": 39845888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629702849, "uuid": "d4d27e40-7b50-4920-ba7d-887b3bf7453d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702849, "uuid": "f7f71f86-9d16-4de5-8345-d9016b184df4", "value": "Comprobante.pdf__________________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2e34c34-0402-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Amadey)", "timestamp": 1629717017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717017, "uuid": "9904c6b5-e561-427e-8384-583b95e4ad70", "comment": "Malware payload (Amadey)", "value": "4e2b50fc5195ba5495791cebdf191f17", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717017, "uuid": "54e91ad7-0ecb-468c-9616-ddbb211d8c2b", "comment": "Malware payload (Amadey)", "value": "e0c69859dd0b972fe3b982924ad386eafdff569d49f3d285927edff317d9fa59", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717017, "uuid": "efb3ff98-c534-4094-b4a2-48dba2c2ca55", "comment": "Malware payload (Amadey)", "value": "8d5a970506886d536e2a6411b0f4101409692f70", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717017, "uuid": "97146333-1c80-4513-9883-5af28081c2f4", "comment": "Malware payload (Amadey)", "value": "744157d154e92b1df4cc65241707e3b3497c0b97d2add5231badd119b5c4263a4a4297361d46baea88362771d755fe0c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717017, "uuid": "753beacc-4071-49fa-91ca-a4cc3061d4cd", "value": "T12264BF30AB91C035F5B712F856BA83B8A53A7AB0573450CF93D52AEE16346E5EC30B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717017, "uuid": "3aeff2a3-4f4c-4399-88bc-659b99e16c9e", "value": "5c06a288f07d43206aca52d5d94444b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717017, "uuid": "d990714c-d9f6-46c6-a4b8-71f84a70c55c", "value": "6144:i44D4ZqtiaXO4Exe0xT7YtiaAjki4g1IWMq7CYmKzAiqGZh7:iDUq8AO4yxT7oia+kiT1wfP0Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629717017, "uuid": "3caef717-9007-4404-9548-d40b5bd5ddfe", "value": 329216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629717017, "uuid": "69979b1e-e723-4293-9612-964d19d2ca94", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717017, "uuid": "c26e9e4d-e038-4b74-adf4-78a1520182a5", "value": "4e2b50fc5195ba5495791cebdf191f17.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aebf220-03db-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629700012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700012, "uuid": "2eb41c65-18cd-4e89-8290-9376dc83ca9e", "comment": "Malware payload (SnakeKeylogger)", "value": "c585e2eb5a21e3c975fc4aa349dc8a14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700012, "uuid": "30bbdde9-57a4-47ae-84a6-85949112c2cb", "comment": "Malware payload (SnakeKeylogger)", "value": "e17f1bd08149cfe18bd2a9ee2e04e3a9b6a46f85577885f1e74066a73e1debd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700012, "uuid": "17c12837-e8f6-4641-8a85-751378b7c099", "comment": "Malware payload (SnakeKeylogger)", "value": "7e157987181e69b2190370b3ba7accbfeaa8d8ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700012, "uuid": "c8659d5e-7cd0-416b-a877-74ddcc9c29fb", "comment": "Malware payload (SnakeKeylogger)", "value": "158523d580a5bfcda1e81748f7b679d8c129cc304d34ffc063c10f3b562a80a4c247d1ba5440ba8e2bb36bc0fedc2d98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700012, "uuid": "43fd74c8-60c9-4c3b-9a92-c496a5b5af7d", "value": "T15105F53D19B91633D1B5C365EBE58423F148986FB410EE6A6CDE03A7034BA9735C722E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700012, "uuid": "626e078d-86a4-4f4d-b815-2d3f8b79fdc1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700012, "uuid": "1134f2a1-1bd0-41f7-8674-524fa70ab4d4", "value": "12288:GHa5ZTsx3qWX7hmYNiZ+RpLTJkaY8mC4shKCqtq/8gBSAKC:GHaPTQqWX7hmyicRpLSx8m/shzqM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629700012, "uuid": "395006ae-7256-4261-9749-2233c3da0759", "value": 807936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629700012, "uuid": "6a82d662-c582-441d-8f45-22f32962df3c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700012, "uuid": "0259a1fb-9917-427b-99ac-988f72164b6d", "value": "c585e2eb5a21e3c975fc4aa349dc8a14.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bac88051-03e0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629702428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702428, "uuid": "6df2bcb2-63f0-4bb4-aae4-e1222a1a96e0", "comment": "Malware payload (Formbook)", "value": "32629d67b51e086c95a79a066af68a00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702428, "uuid": "44930f57-3b3c-42ef-af49-4b86ac0db014", "comment": "Malware payload (Formbook)", "value": "e1d5a5e2eec63b43bfd11dc16712c3c55a1f2d2bd0171c7d87e9ae137db0fad4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702428, "uuid": "1fc8cfd9-8557-4799-b887-08613cbdebd7", "comment": "Malware payload (Formbook)", "value": "2e000f12dc46b6786d8c136d7e6dec8931c2d9dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702428, "uuid": "8f349cdc-729e-4a94-a05a-b63868b6ddbf", "comment": "Malware payload (Formbook)", "value": "4b43856ec7a1da150e16bc2bc665d391444bd96bafb397fb9254cf89bb5503cd8d48b407189b768cfdcaa5312179acda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702428, "uuid": "b9352426-04d7-4147-ae53-567b12c8511f", "value": "T1C015A13F59BA166FC4F5CF64EAE084D3B148989BB4019D556CCE036782CA5F2378722E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702428, "uuid": "a1a82c58-2a7c-49d3-8617-f0ea5d8be8da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702428, "uuid": "bb961185-adc4-4cf9-88a2-7ad1aff90739", "value": "12288:hM1T7ESsYbx/t9gwOIQ23I4qSuOBRWZx8NnDsgB9ewXJELoqY9hc/QeOkG1RY6fM:/Srbx/PdYGWsNnhDlXJSn4lRTE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629702428, "uuid": "05627fe7-c209-43c5-acf6-760ae572224e", "value": 954880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629702428, "uuid": "534f78e4-f948-4678-829b-cb7488887ea6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702428, "uuid": "47245871-90f5-49a5-9c83-a393d70c8bb0", "value": "Rfx_AMAT 0042-43812-P4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeac13f7-0410-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Amadey)", "timestamp": 1629723023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629723023, "uuid": "fb5de9f6-231a-4bb5-8b7a-2d91f1fbfc6d", "comment": "Malware payload (Amadey)", "value": "a6b88b96b9e71e1597c6cf48e6c90cb0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629723023, "uuid": "3444e406-5750-4180-bb64-915b25391f2e", "comment": "Malware payload (Amadey)", "value": "e335beb935b38081fe344a7b68e9ce57e2103f9b04cf52b07eeee2c87f4b703b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629723023, "uuid": "d4ef2b80-86db-4aae-b60a-f8bcebd84d7d", "comment": "Malware payload (Amadey)", "value": "4c09772541f7acea6f6f44e97021ba3f1bc994ae", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629723023, "uuid": "fee4fa43-c45f-4d03-bbc8-2f35bcd7fe2e", "comment": "Malware payload (Amadey)", "value": "f8f5bc8af85375146726f1299b46b4a35e71b8a46e43fb6246e7bbd538a4188f54fa566dcdb83c90526e34bb2515af3c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629723023, "uuid": "970af871-209f-4f7f-bd59-41ba2df5d922", "value": "T1C9649D30A7A1C034E4B711F855BA83BCA62A7AB16B7440CF93D51AEE16346F4EC31B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629723023, "uuid": "d6853461-7c69-4053-afed-c480f6d058a5", "value": "fc0498b1146c20d46fc85d16ea8a2b68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629723023, "uuid": "7ac9268c-ed9c-4d03-93e1-7fac19f72422", "value": "6144:MiazZ4DzE6XTpzbN/M7MvkeleUcBFin5s7O2UM2TToJppmDAxxJT8V:MzZqzRjpz67Mv7leg5IO2XwMJp4MxxJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629723023, "uuid": "a81d5cce-f2a6-4cb9-a2d5-4a37736b85ad", "value": 328704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629723023, "uuid": "61d2b322-12af-4674-84e7-313460a844a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629723023, "uuid": "54bb7e2a-8179-4a58-a6e9-eead776dcdc2", "value": "a6b88b96b9e71e1597c6cf48e6c90cb0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bc0c575-040f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gozi)", "timestamp": 1629722347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629722347, "uuid": "11d61e4e-af32-4811-b76b-87d75b8ccb2b", "comment": "Malware payload (Gozi)", "value": "a17de50fcd71c572f423c943f926c2a9", "object_relation": "md5", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629722347, "uuid": "a8e705dc-e3ea-411a-a59b-b2107316a7a7", "comment": "Malware payload (Gozi)", "value": "e4a5317a1b7c1ab91bb131dba5fea06fdb89e38c291e17f71b5c1634cfddecbe", "object_relation": "sha256", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629722347, "uuid": "106511cb-71bd-428a-96b8-7f1cca0f12e6", "comment": "Malware payload (Gozi)", "value": "bd34e4d57bfc1938ebc93d8f404dbe7e019db0cf", "object_relation": "sha1", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629722347, "uuid": "96950bbc-b0a4-45c9-a755-e3e96d511454", "comment": "Malware payload (Gozi)", "value": "836d9eb15466d4dedc37506429bfd1328c1bf6140f12c595425b8ed3656744acd7fc6d87b1af3fc8979a0d15a09fcf9c", "object_relation": "sha3-384", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629722347, "uuid": "87630146-9e35-44ad-9bea-3adb86ace416", "value": "T16EB46C027A93E024E5F952F94FB1C6D8A71D79224B6850CFB5F43AAF0F285E39831356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629722347, "uuid": "87454684-5a67-48c0-bb3b-899c440251f6", "value": "241e3141afa42b2aa84ab0b3655f0b1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629722347, "uuid": "cd9ca550-9623-48fa-be9f-26a1c87e6db1", "value": "12288:B7wAjlh98sQ73RBgy6aqGT8jSXxhYb/iWVEJ10mVSV/+K/BCz7uW:B7wAQsQ735TYb/qhVSk3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629722347, "uuid": "f91b339c-fd78-4a78-8dea-75677e22f5b2", "value": 516096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629722347, "uuid": "4c56db4a-b36e-4ccc-88c0-9990cfa321ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629722347, "uuid": "85ca0046-e898-43a2-bc24-1899dfbb5397", "value": "6.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b618fa1-03e4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629703905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629703905, "uuid": "915248dd-76df-485a-87a6-b5c152335416", "comment": "Malware payload (AgentTesla)", "value": "97413a29b40525aa1cb0960d32c61e58", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629703905, "uuid": "f85f18d6-07e2-49d7-a452-637a4ee87c46", "comment": "Malware payload (AgentTesla)", "value": "e4f01051766e7904d0ddd35a7f86584234eea16157a1e08c17d5a5c23a3615fe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629703905, "uuid": "512df7e1-df63-4576-bad0-7c3c544583a7", "comment": "Malware payload (AgentTesla)", "value": "3b18fdb08fd9fef14dee2abcd8c4d49e62228fe0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629703905, "uuid": "a25bd1a3-b1d4-4d57-9130-463140fcc458", "comment": "Malware payload (AgentTesla)", "value": "a88bb28204bea2dd4218ff839473aac0c565ba96597343a496564187173937d47e721f8c04841aacb400ef97b4005ef9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629703905, "uuid": "ad727090-7fd9-4ccc-8117-193bb12d3dee", "value": "T157F1E62AD7BC4672D9B70F365C57A3400A7CA71A9E93DF9E6440100E9E233154BE3BB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629703905, "uuid": "71306269-0949-49c5-b664-39ca274bf5ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629703905, "uuid": "9b6afdf7-1ea3-4b65-b477-6ebc403da0f3", "value": "96:n0tChn1Ip2w7Is6IlqBwLr9yLFMsyRekL3LWne72/JQK2PJIxpA+E/bLIHAzNt:Ph1I3J5l0wLrYL690kL3LA9+K2R/+sb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629703905, "uuid": "995e6732-d79c-4706-9f62-f68b38bf3935", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629703905, "uuid": "c0f63944-97e4-410a-a377-7f8591f9a9da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629703905, "uuid": "390015d0-e8f1-4103-b5f9-8e904011a016", "value": "PONUKU.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36175638-03dd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1629700917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700917, "uuid": "2d382b94-f784-499e-9167-5e2b3e8ac534", "comment": "Malware payload (Gafgyt)", "value": "06d638df59b1a9761131cd98a6be31be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700917, "uuid": "e0f41ccf-ffd9-4dee-b904-1e784f3b4c66", "comment": "Malware payload (Gafgyt)", "value": "e5cac3c9f6322d4930a4a8a35f065de26c24867a587746ac452bca595d2f260d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700917, "uuid": "1e5e5bf7-e842-49fd-85c0-bbb837c905bc", "comment": "Malware payload (Gafgyt)", "value": "21eb10557bbb90cd712ec63f7f6ac54e538d6906", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700917, "uuid": "861c10c5-ea29-415e-97f2-88fbfeab383b", "comment": "Malware payload (Gafgyt)", "value": "06d55bcab7130ed23f07bbb7301d0b45a3223d939928a040d58178eb61bc48701b247d07642aab166f3af975f0cea241", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700917, "uuid": "24b577a4-6cf9-4dc2-b1b4-ca383baaec52", "value": "T1AF732942B781CA73C58305B616DBDF121932F9BB1A4A9E52F36C7CF08F1A484B512F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700917, "uuid": "2f438f47-f7a1-443d-9f65-2de4f8cc1db4", "value": "1536:6vw1rmnHCi8LQPA1RegNvSY7GZ5G/t2HKJ679l5MH9hdmTJxVoBjY4fZ4P:6vwQHp8EPA/ecqYOG/Ai9hdmFxVoB84Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629700917, "uuid": "a132410e-918b-48e0-9ee1-8466c24116e8", "value": 78255, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629700917, "uuid": "104eaf83-0f94-4b99-a9dc-dbdce60d5788", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700917, "uuid": "39e4c480-2c3c-4c92-9a35-fe5ba4dc8e57", "value": "06d638df59b1a9761131cd98a6be31be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e8e87ca-0402-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629716903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629716903, "uuid": "46febfc1-2e18-43e1-abd3-ab32b6ff0057", "comment": "Malware payload", "value": "56ef619d1965433b35eb2b740ab45be5", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629716903, "uuid": "54e4ab2e-2e91-4c38-a647-8267b4de5506", "comment": "Malware payload", "value": "e664d99a03492d10c0a929a3ff63f876170ded35fc8e0322e5d9b47429678df6", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629716903, "uuid": "77ae7a73-a06a-44ce-acdc-ae338ab8de0c", "comment": "Malware payload", "value": "576480056fdd51936a6c855134f634e7ae6464bd", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629716903, "uuid": "6f507cf1-abad-47b3-9eb1-67d6c2edf4da", "comment": "Malware payload", "value": "adcc46ac828fc77c1707ed44f5c68a4f2e3e357b831e553af58ac9396e306962d8f779da08b5b53a0d2cabe076f57428", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629716903, "uuid": "046bae03-9aec-413b-a6b7-cc6af03d53d9", "value": "T130226D7DD206F81BC21146BDE11982B5E768A157F612BD2DA094719E07902C7CFCF2BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629716903, "uuid": "f1217fb8-0b96-43fc-beff-2dd0ae717c7e", "value": "192:ScIMmtPZG/bEpOlNggEamWBXpK0ydJb3FVmVp:SPXEEpOlGNoEP7bLG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629716903, "uuid": "4b715dd0-91a1-45a4-ad35-afd05ec69ed7", "value": 10327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629716903, "uuid": "0d8df125-03f1-469d-ab6c-4bdbb5b7515a", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629716903, "uuid": "9ada927b-76e7-4bcb-b2dd-c9d91678863f", "value": "order12124.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "952b9607-03e3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629703653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629703653, "uuid": "508a5cec-5e06-46ca-92d4-dc27fb03d01b", "comment": "Malware payload (AgentTesla)", "value": "f259f003d603f6b9f7b36a24712384af", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629703653, "uuid": "1a2ee0fe-c38c-499b-bb42-fd26c5cf5352", "comment": "Malware payload (AgentTesla)", "value": "e6a50d3b91eaa5c64ad45cf6798720b270fb872c32153b193ea47881c99ffbc1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629703653, "uuid": "2a0749de-7db8-4315-b08d-f96973287860", "comment": "Malware payload (AgentTesla)", "value": "b306fced635968971ef0651b298c2b46549d5027", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629703653, "uuid": "5a8a9a61-f092-43bc-8181-2fc6416c83f4", "comment": "Malware payload (AgentTesla)", "value": "79f037b93530443ce3e2a2eba2fe6d866d871a8f46a40886d2a7cfe87af828c439a412859bc29bb0a158347154e7e110", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629703653, "uuid": "7f173bb1-7736-4695-89aa-7f4c4177a8e4", "value": "T15215C4BC19B9B62791B9C765EBE18817F0409C9F3151ACA5E4DE23B7032EA5234C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629703653, "uuid": "e681cdd8-3139-441b-bd9f-d0cf3eea0e5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629703653, "uuid": "4a4f8191-2b11-48db-82e7-40b13fbdc2da", "value": "12288:qwDc9F3nC0Py3gAhQQwoit8YyItZKuMHu3nXR3zVLkgxKkfdUCcs3EwxINHBgsH:q/HoMx4rgX1hLSUdGDwaXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629703653, "uuid": "5d9acfeb-768e-463f-bdf3-cd9127ce2579", "value": 881152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629703653, "uuid": "7ad82ccb-f33c-4e11-b2e3-d986c1400cc7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629703653, "uuid": "44c33ab3-2049-4917-95e4-6c2aeff62d52", "value": "Purchase Order _18-D0286_2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da836bdf-0462-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629758316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629758316, "uuid": "6fd6f51c-a1d6-4d83-9da5-bcfdb9f49d11", "comment": "Malware payload", "value": "af93c6b29531289459db2cbe41a0cb1c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629758316, "uuid": "1be9a437-a3e1-424f-b5a0-87b0a7dc8352", "comment": "Malware payload", "value": "e6ca993622f30ef00a363974264e50490b09782104c79d87f02ba17cd3746da3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629758316, "uuid": "697b6710-c5c6-4b62-89e9-d8e115a585ca", "comment": "Malware payload", "value": "47a683d335dcceee5b98e9f9f6499950bfb57bc4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629758316, "uuid": "f1a2680e-6245-41d2-ab61-f827b8f5ab17", "comment": "Malware payload", "value": "ce19d958a2ccfa8f31992c427afeb1921a52aed659f4a4492c7ae352b55732d16cc56b3c9120b8b968c082b45dfec64b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629758316, "uuid": "7614f5cd-1ab5-42a8-8d78-019bd64b675a", "value": "T18A64BE30BAE0C035F1B712F455B683BCB9297AB16B3454CB62D616ED16386E8DC31397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629758316, "uuid": "b6ffc6ed-f3ad-45ca-b32f-7991dd680fcf", "value": "0651d9dcd3efcdffaff927d730c581e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629758316, "uuid": "544a7eee-60e8-4798-8b2b-4f512269c896", "value": "6144:2cfyWA1A/yhoJdl6puZUKgoLkshQBsS0m67b6BiaLL3a:NdASqhoJ6puKxoAdBZ0m67bafz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629758316, "uuid": "ba7b0cfc-c1d4-4157-8a23-64b437e20854", "value": 316928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629758316, "uuid": "fce054a2-d5c2-4666-ac66-5b49143c86f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629758316, "uuid": "fed12417-30b3-4b66-bf06-91ee80e56229", "value": "af93c6b29531289459db2cbe41a0cb1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c0f5237-03b5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629683747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629683747, "uuid": "7aaa8494-696a-4c89-9aca-54d8301ea00b", "comment": "Malware payload (Loki)", "value": "61cd3c5d85ca00cf80a744226c020ac3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629683747, "uuid": "99459f34-9144-465a-abf1-a6e5a0894cb8", "comment": "Malware payload (Loki)", "value": "e7f436bdb5efd5b5162c1c7310e5cec3b35cc110a5a7a9bc0c2d5a595df39df0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629683747, "uuid": "39223631-21e5-4156-ba70-bef7113fc4b5", "comment": "Malware payload (Loki)", "value": "26f3485125d60b51d75de3ba118c291d7b950a4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629683747, "uuid": "a79ee05b-5374-44fa-8a8e-48a4029c41ae", "comment": "Malware payload (Loki)", "value": "83f70bf26a657acecdd9e4744e1e82e9c5718ff4b7dc9eefe39505718adad45291f7ad961f69f29e1e3cd5d155ebc04d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629683747, "uuid": "e33cc2aa-e425-43f2-95f5-17507432b678", "value": "T123D4CFAE3250BADFC85BC97689541C24E7A1B4B6430BD307A86316EE9D0D69BCF111F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629683747, "uuid": "c25ff102-0e94-4bb1-aa68-408b7fcee311", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629683747, "uuid": "5aabfd39-2f1b-4f5d-a90d-433800eaf5f8", "value": "12288:pkURzXWg5zQTWhi+9LksmHfYw8RI+Kf86QmjXf:vtL+ihiILkz8e+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629683747, "uuid": "f084c0cc-8c75-41e7-bdf1-6aeb7ab12e1e", "value": 652800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629683747, "uuid": "578e8896-fef7-4b94-be48-92dc3cd4d66f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629683747, "uuid": "9cabbceb-fc73-49a0-ab5f-5b42a99cccf8", "value": "?? ??? ??? - PO 60100073 & 60100493.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79286560-041f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1629729376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729376, "uuid": "621b905f-2f86-4d7b-bfaa-4363252a9688", "comment": "Malware payload (NanoCore)", "value": "97743d81c54205bcb2244b4e16e5ff64", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729376, "uuid": "81a70d3c-cd22-439c-9569-6111237e5068", "comment": "Malware payload (NanoCore)", "value": "e8c962f875deb51ff487faeeef40cee746dad2a388e8dd5b85e94f651517977c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729376, "uuid": "40c90025-d373-4fe1-a924-c3a0dc5c7129", "comment": "Malware payload (NanoCore)", "value": "6b9d3d0e4214685720e3e0fd0f697154bcf81813", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729376, "uuid": "e8e10238-f758-4979-8f5b-7643862317a6", "comment": "Malware payload (NanoCore)", "value": "d3ca726ecca0aedf20ea44beba7480187baebe166d48d2a09ec735260a87ab32ea62cefe0fe56bf98d83d674fb723688", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729376, "uuid": "dc3e72f2-c0a3-44a9-bc60-5fc8636c2c25", "value": "T191C21EACC4AB46988F865BB42B1F5F49018C7A6EF784A173793C9B312BD2C7B401657C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729376, "uuid": "4b9a9f40-8942-4588-a86e-b1e45a8d408e", "value": "192:N/5zcLc2DIEhglQ3CiKGVyOR4qpUKe5vHXj5NDxhG9CaKbC/rITbysDr2s:N/9EjIEaQlfUrT5RxwCfHTbRnp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629729376, "uuid": "43c5bc61-7a7a-49b1-b7e1-37a705aa28bf", "value": 27487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629729376, "uuid": "531a7cf4-a1fb-403b-bbe2-bd8d5ca810e4", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729376, "uuid": "cf980dcc-8400-4db5-a1df-a153de180106", "value": "NEW ORDER.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a33cf99-0460-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629757322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629757322, "uuid": "74e6d0b2-9a29-4ea2-8917-e7178091c53d", "comment": "Malware payload", "value": "bf1381ad6978cc1ece3887636e47c16f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629757322, "uuid": "defc223b-8950-42cd-a0c1-4263016ebc44", "comment": "Malware payload", "value": "e8d9c5a2ed13e0bb2afd61d3f0e3f55acc6693cac053ce47cf6768129f6b8b62", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629757322, "uuid": "e6b8fa3c-e2eb-4bd3-828c-c31ac72796ef", "comment": "Malware payload", "value": "b785ecfe83b593d11875f84c70ee65ab8dd5a580", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629757322, "uuid": "93b4d75e-eaa3-4840-9a55-21fb8b51e8ee", "comment": "Malware payload", "value": "228f4a78e212c7092fba6bb11d26475602935ed7d74ad39ecbfebf080a09681c7a3320f70b71d1d53ca833a4ac1a2b3f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629757322, "uuid": "64d8f7ba-d751-4e6d-8c0e-af6b8278f6cd", "value": "T15CF44A483790719FD423C9338B575C30967164ABE78BC343D013E2AEA91D2B6DF196AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629757322, "uuid": "c1e41ba5-f02e-4b76-adc6-fb29c6f6d413", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629757322, "uuid": "9df60735-a3f8-449f-943d-48a1a662c694", "value": "12288:lC4OFUSNj9NGleNwzuh8K6Evj5bYKRAdrwNxp+jxqSNXXljJyjE5YUOjAiD80wwi:lDOKk9NZQrTEpYp5yv+Fqc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629757322, "uuid": "81418bc3-547b-49c1-90c3-9f0ba63ef371", "value": 765440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629757322, "uuid": "1d847d28-d12c-4767-aea1-3fc2c009e93f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629757322, "uuid": "fc263cac-8e76-4b6c-a178-d35729557b65", "value": "d9AvwAbKTCdvemu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be4db3ae-03df-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629702004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702004, "uuid": "162bc750-ffbe-4241-bd12-a9e212c9a914", "comment": "Malware payload (Mirai)", "value": "18ea04dd4f9c3f1da4178669fbcb86df", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702004, "uuid": "78dbd20d-f9d4-4ab2-a50c-3ec36291602b", "comment": "Malware payload (Mirai)", "value": "e9ebf9973572d7064efb2bdaaafe2e352c3d59896475ded07d182818f10f0e5f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702004, "uuid": "492caab2-4265-41b1-a380-7e3ba53d2acd", "comment": "Malware payload (Mirai)", "value": "e9a4d1643806e220fc2e928b962cb231e50076e0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702004, "uuid": "0932205e-af32-458f-b007-2db28e9e62b9", "comment": "Malware payload (Mirai)", "value": "bd43f2036805a2d299c20c656c8fb45b661abe277b6a742bed86aab7f69a76afa0d373fb63602936eaee8668bbc5dfdd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702004, "uuid": "0e8430a4-77ce-4719-abd6-44a44c3c5041", "value": "T1FEA2E175F9024C4FECA696B1BE76CE4B41206CA0524993EEE67EC1E11BEF386D0509DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702004, "uuid": "fb431485-2872-4fef-bbcc-a6cf9144659c", "value": "384:MyX206yHsN1yGbE3F2hHCM6ZHLZIcbQPKLEqJKV+s8Z+VNyS:V2/XbE3eiMUrSdK4qIruS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629702004, "uuid": "15042b4b-7ef0-4362-b230-1f6c4d073fd8", "value": 21992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629702004, "uuid": "67c762a8-d0dc-46cf-97b6-75fa6df67361", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702004, "uuid": "5392d3c5-19a7-41c0-8c5d-ffcf2af53037", "value": "b3astmode.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa88482e-0448-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629747068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629747068, "uuid": "bc4266d8-fecf-448e-8afb-335368e92486", "comment": "Malware payload", "value": "724326854d7a9a690804dddd1b2a8238", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629747068, "uuid": "9274444a-0f05-4fb1-9efa-c0f5c456500a", "comment": "Malware payload", "value": "ea467ca29a1c33e37ae7beac8fe68f2866cb9dcaacb579ec3b53fff70e17b1fa", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629747068, "uuid": "485acccf-91f9-492d-9c99-12dbc27b1611", "comment": "Malware payload", "value": "77648e958dae35902a2da8e78abf1f63df6fbaff", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629747068, "uuid": "65fea792-63dc-4ba7-a76c-b156bc8262c4", "comment": "Malware payload", "value": "07f737c6f618dace136c25062547e52e29fb41566b8689b1072654bbd633bdbd48755d21a22fd0f5f72f3e77f709886e", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629747068, "uuid": "c6cf2ee3-76e2-465b-a5b6-a9f627d143a2", "value": "T133F533A99B026A00D6071379801762537A78707CABE175BB4F3604F13D6FCE4CB5AEAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629747068, "uuid": "ec958163-d480-415d-956b-acd49b2b3fa0", "value": "49152:FjswnszFXACO2rlrANH99yeSmjpHe/4zXLc8CycUsrYPPbk5/Ehi7vXBYc:4ZACOIW9EeUIbc8WUa4kGyp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629747068, "uuid": "4ff94a4a-a7ac-4e22-88ec-7663ffa8b718", "value": 3387212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629747068, "uuid": "a64ab969-4234-49e7-b2ec-9c9600bc18cd", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629747068, "uuid": "db0821cf-62bb-4949-8c34-2c7e7d7fe756", "value": "Android System Update build_obf.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2cc4de5-041a-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629727325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629727325, "uuid": "d4d6814e-8bdb-488f-878b-f93d0b98f076", "comment": "Malware payload", "value": "f9d327c5065f1b317c4db0148d15a3e7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629727325, "uuid": "3e4cd124-0350-46ad-897b-7371a41d11ef", "comment": "Malware payload", "value": "eabfca6fb37cd39ac18b5d72c3c6c7c8dd795f59833d65bf0bf2f2d9fa9d5bcc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629727325, "uuid": "d3775e34-234a-4b4d-9d0d-fb4eef457395", "comment": "Malware payload", "value": "22be3de842dc49ff2aab6ea2d5e7c283b05ec916", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629727325, "uuid": "0c2b2680-aba1-4de6-baf4-79d45c9bf8b7", "comment": "Malware payload", "value": "f58e89bea6f4760e86c3c6817c1603d519c054c0366585fbd0343621759c47e7b58e6e98438abda8a6e9165c497e14ad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629727325, "uuid": "43357740-f1da-445f-a9d7-03fc6ba43369", "value": "T13507336235A75433DDFA42700434E374DD31EDB9A340A57FBB84AA3A6A30FC64762927", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629727325, "uuid": "8484143a-c22a-4646-9372-9a22695ae0ba", "value": "9d1f0da408c33eebb70b9bfa17b7fddc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629727325, "uuid": "fbe7fbcc-73ac-4686-a074-7ddf05011268", "value": "393216:A98bEQqMRzQi9zYJARA47oNfcqttWvkAKPUuj9cfQKRHZECk/l:A0EQqI9LAaonSv/KPpCfr1kN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629727325, "uuid": "1329836e-90b3-42be-a9af-b3745fd3aad6", "value": 17766051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629727325, "uuid": "5d8611c4-8e4e-4531-ac46-b8df17edfda5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629727325, "uuid": "79130722-9b5e-4ba0-81af-1010a864103b", "value": "f9d327c5065f1b317c4db0148d15a3e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aa4ec76-043b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Amadey)", "timestamp": 1629741243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741243, "uuid": "88c5e633-e046-4fdd-9261-ef152926c1b9", "comment": "Malware payload (Amadey)", "value": "ac6cb13532f44589c27560c79a844932", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741243, "uuid": "ff1cffa5-7175-4a5a-ad8c-5b37f2b72817", "comment": "Malware payload (Amadey)", "value": "eadaf3f7c18b694c646b4e402388fb050e1188a3bb1b35367e62d214625fd06a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741243, "uuid": "0e3a87c7-9a3d-4dba-a247-639e2251dc4e", "comment": "Malware payload (Amadey)", "value": "bd4ea8ad8ac2cbba0aef550f510b9a9b00e1ad18", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629741243, "uuid": "33fa2f44-4309-4327-accc-16fd55e6c2a3", "comment": "Malware payload (Amadey)", "value": "c9c88eb3df3c92726eeffbfa3cfd34c8c11db9776329f7262a57f8e07d56d48550d22c80aec540fd0e82018d33a27ec8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741243, "uuid": "3a59f69f-c7f4-42f3-8d4d-a0a23748c54b", "value": "T16C649D30ABA1C034F1F612F855BA83BCA53A7AB15B3550CF62E11AEE16346E5EC30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741243, "uuid": "4cb32e2c-d7f1-4207-848c-764fd9172ad1", "value": "47838eb3376cd956f1ad4ca3d2e871c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741243, "uuid": "4c86fbde-22bc-4a51-b4cb-9a535f25fd39", "value": "6144:ecFijYcejcjyrxOiQ4ZJjNdAYxD15hm+J0qqO56y:jUYNgmrTJjN+YxhnxqSJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629741243, "uuid": "7f216ac4-0b7a-4d06-8182-552e82194ecd", "value": 329216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629741243, "uuid": "aa6700a4-2e90-47cb-9e9c-141d06fe5e16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629741243, "uuid": "e4856d33-4388-4737-af3d-f1267f352550", "value": "ac6cb13532f44589c27560c79a844932.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53fbbbde-03e0-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629702255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702255, "uuid": "62296cd2-1c0b-4ad4-bbd7-a9c88ad11f66", "comment": "Malware payload", "value": "eeb1a7fb3e482ae6c280173bf552f0ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702255, "uuid": "936440a8-5d7d-4f95-9208-317f304d1231", "comment": "Malware payload", "value": "eb0d0d1da7286bff8746a29e869cc86d06c35240a9727749fe5e49f23b23107c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702255, "uuid": "a05d874a-8d11-48e1-985c-5f79edbd2bdd", "comment": "Malware payload", "value": "3101de9e50c7e89cc3217c9c1e4df204cde0f586", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702255, "uuid": "b4c3b518-8a51-4f4b-b9bb-ae0e7f5f7a6c", "comment": "Malware payload", "value": "387a1ead0acdb6b9f3bfd967206b0a9f6fcd5999b58de109381d5c3aaefa1c1aa55322f84ae3207f6c855bb85c8a0ec5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702255, "uuid": "7f22e50b-c757-47ad-b97d-f3687ae1708c", "value": "T14115284265B23932CF52FFFBD60663611C542F42DA277857ABA1BA0889389C3FB150F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702255, "uuid": "c62a913a-df46-49f8-a220-6defcd31e001", "value": "294cc3722913504c95d229781103fe5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702255, "uuid": "2e1d6445-933f-41c9-897e-a9c417211c2b", "value": "12288:F1JL2cht6G8ZeBIkTuuRRt+UrTzXqrWer2wQWHv:FfLQGoeBI9ubhfuaer2wQWHv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629702255, "uuid": "fd26be64-7a7c-4444-a08a-7ea0ddb6a668", "value": 903680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629702255, "uuid": "cf94774c-e9e3-408d-b2f4-f69dc3944c06", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702255, "uuid": "999af3e7-9a0c-4e41-ab50-d1586de8acda", "value": "Kronen Neuer Auftrag,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57477d39-03dd-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629700972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700972, "uuid": "6f0f49f2-c45d-4f75-b1ac-8c9903f3c8a9", "comment": "Malware payload", "value": "c17a525c437eb5cb833cee99e8843bdf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700972, "uuid": "f813efd4-6490-42be-bc28-1bf6644d6479", "comment": "Malware payload", "value": "eb4705110281270c51035b1c956350e6a0ae986897b4b36924b4a2b5d9d3665d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700972, "uuid": "50863b80-367c-4ad3-8d08-52c2026ac664", "comment": "Malware payload", "value": "fc87b79a755831ab0572d6415d48ae0054e77a36", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700972, "uuid": "fadc04c0-76b3-403b-a8c7-c56eb2669df2", "comment": "Malware payload", "value": "c49112ad75a74d65870adb64992f26184cc0b1c30623cc6b955be953743b3358502a2c34566e7b727f0f6df175716539", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700972, "uuid": "7ab104e9-562e-44fa-b3e2-38bfb07cda04", "value": "T139C3952A7E12BBFFE1A8823107F35F70979521D227919386E26CDA581E7128D1C5F7A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700972, "uuid": "59a06c1b-7e34-4ac0-ae97-d4382454120a", "value": "1536:r7jh1TQSq+DlApWBA2rKi4bWPWTMW670Vzo+irwae3679l5MGg2D+FrmW5jFz0C3:dStWj4DIwV83rw6tSFrmW5jFz0DTsGk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629700972, "uuid": "8c532518-73f0-44fd-a683-b730f27f0329", "value": 122462, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629700972, "uuid": "91619734-b625-4acf-9db2-37652a021963", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700972, "uuid": "f6246663-3b23-47ac-8fea-e24d6edde06a", "value": "c17a525c437eb5cb833cee99e8843bdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c45be69-0444-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629745273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629745273, "uuid": "4107a74a-abc0-47dd-9b8d-df1d1923b040", "comment": "Malware payload (RaccoonStealer)", "value": "7300c32bbc90a1eca209b154cfec937a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629745273, "uuid": "dc08e9ff-fe15-4b59-97e7-182c3c965015", "comment": "Malware payload (RaccoonStealer)", "value": "eb711eee5afe353053bb43ba1f4dc8f3892b471f16c79a28c9bef8f974019fd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629745273, "uuid": "9249cf0b-2fc5-48a6-94e2-4a7674484f1c", "comment": "Malware payload (RaccoonStealer)", "value": "fa4c17dd4d619d7475bcc095f6c27c0d46625d64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629745273, "uuid": "7c27aacc-8965-4d78-b113-f7a6eaa62b44", "comment": "Malware payload (RaccoonStealer)", "value": "985734efec733bbc9940f5376cbb749a5e3edeccb8a568c3190529b85a6962e20281b1cb9cbb16ca354a62e4d01f86ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629745273, "uuid": "4b060648-fc78-4a1c-b778-b27725230397", "value": "T142C4D120B690C475E4A613B059B983A87B28BDB16B6450DF73DA37EB53382D49D3027F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629745273, "uuid": "e929fd7e-3d6f-4128-80cb-aca61459f4ee", "value": "c373d93df8b60680e045175a45030767", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629745273, "uuid": "59fc8752-1e37-4015-89fb-0b0e5da79049", "value": "12288:XRo9u4Y2+f73rVhM3Q3L7BHXPGima7TGITzUI776:XmY2+f7X3L7BH/GiH7TGIPn76", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629745273, "uuid": "9dc99b9a-e598-4296-a7fc-ab9eb96cc978", "value": 546816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629745273, "uuid": "7b61fb98-20f6-4bd8-b22b-869ba96120a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629745273, "uuid": "432ede7f-8fb2-42bb-87f6-137c79aedda4", "value": "7300c32bbc90a1eca209b154cfec937a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50ce750a-043d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1629742193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742193, "uuid": "eb58ca64-cb98-46e2-9d18-1c83a3132d6a", "comment": "Malware payload (GuLoader)", "value": "045d96197f2a812ea05b2481ee854ba4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742193, "uuid": "e2755817-5be5-4f47-b168-3d94f79c27ea", "comment": "Malware payload (GuLoader)", "value": "ec557f074316cadc0b768d98830fce492b5694c8bdf6bd45b5853659cfa9bbfd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742193, "uuid": "35f4c01f-cf90-411e-b964-cbe66b6a642e", "comment": "Malware payload (GuLoader)", "value": "745ac8a8dcf8cd156f264b55bb3e70767bfa0909", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742193, "uuid": "9cc8a459-9f95-47d6-9127-8a4061dee2b9", "comment": "Malware payload (GuLoader)", "value": "c8df555a106bcfbdc67b093f3c218f4d9e07cbb4adbfd63bb72fe0021eca2925840b0bf76963c1bfa0e377a6814459eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742193, "uuid": "237016d6-0868-4218-83eb-84728978cde2", "value": "T19D532893B7E4C759EF0B0A7515AEC27C09E5AD610488BB0BE7413FDA0F724411A9B3B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742193, "uuid": "52b0b06c-5fb4-4c83-a4ae-ab35d1812bde", "value": "24d521a9ced4e83546d3fe0326ccb9ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742193, "uuid": "215a927f-f751-4aeb-a719-092a7ac6191e", "value": "384:ADfURflgqjhc3mTw3e2QZIHvLE6vBWz1ItaH5fCVX05+GrMhqBSI2G5DA6KRmjA3:ADfUvc3uxZkHMyWf4X09rMGPM6KaADA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629742193, "uuid": "4de48b41-6705-4112-afa7-c2961f81cead", "value": 61440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629742193, "uuid": "2a5e3c82-29e9-4460-9560-f5306b8069c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742193, "uuid": "f89ffe51-e562-4a09-ad0e-23a068a9cf96", "value": "BILL OF LADING DOCS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6a1e1c5-03d8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629698958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698958, "uuid": "45185b5d-ca60-4646-ba89-24dc0e2cf4f9", "comment": "Malware payload (Formbook)", "value": "6e4954dda9c273341b0b5ffff01639bd", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698958, "uuid": "cfe53f47-e89e-4aa5-ad68-765fc44afa60", "comment": "Malware payload (Formbook)", "value": "eccd3cc4b22869b3059427ca08a773926e078e31996de9c1deeb71160d04cee4", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698958, "uuid": "6f9df393-6a0a-47ad-bcf7-465076dab12a", "comment": "Malware payload (Formbook)", "value": "675bd4a59cb4f9a4c445a14b1c084a7282aac9f4", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698958, "uuid": "a6eecc70-8e17-41df-a8ce-d34226b8d7b4", "comment": "Malware payload (Formbook)", "value": "dd500d5d9316969c99991a075b00ffe9b2e83bca5deb0be6e4c1adf8ed7c78ce4b2fe888dafa39f91d1ca945a46eaa35", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629698958, "uuid": "1ee9b3e8-d8c8-48bf-946c-d0b6d992b2ed", "value": "T10E75174F746B6393C50F1AF018AA751CD2687C8980DC19CA4C6286DF3C619EED395EAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629698958, "uuid": "d910fdb7-34ce-476b-b7d3-acc9e38aa4e4", "value": "1536:pWuM/uAyDDDDDDDDDCVDDNDmcGyCUG2v1DmXHWuUhHmcGyCUG2v1DDDSDzDDDmXz:6f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629698958, "uuid": "5f99508e-c38b-425a-a352-a26f8c78b825", "value": 1673037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629698958, "uuid": "44a658ea-5b51-4a04-8cf2-d9c105fc1f46", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629698958, "uuid": "5af847de-fb0c-4733-907a-23436b5b9751", "value": "QA13429-798-AUG.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18da8f57-0408-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gozi)", "timestamp": 1629719336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629719336, "uuid": "c481b8d7-2cb0-4f60-ab77-3b9a03adf7f4", "comment": "Malware payload (Gozi)", "value": "5f25557c3a67cc816c456e44f9a89bbe", "object_relation": "md5", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629719336, "uuid": "7a687a3d-aa79-4e44-9658-da58f0921db5", "comment": "Malware payload (Gozi)", "value": "ed18be391960160a2cc40164ef901bfa6650db47474756449cd08c22154ce031", "object_relation": "sha256", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629719336, "uuid": "ab29db3b-37f5-40ef-8a17-988727554e8f", "comment": "Malware payload (Gozi)", "value": "b7aee160e54dd305357337e12be022617539188f", "object_relation": "sha1", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629719336, "uuid": "83d39750-5195-4362-a8ca-4bdd43bb5ba1", "comment": "Malware payload (Gozi)", "value": "7eda4124efa9b62141d33c92ecaa8426d6c265fc2cc0bb383382b28be500805ff72dc002cb7d0c92d8042ea18a2d39e7", "object_relation": "sha3-384", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629719336, "uuid": "5b34781b-4c8e-443b-85c3-8ae6bbce15c6", "value": "T1BDC31C227912D555E943227888F392A4E221FC40E916CEF7720CFF3EDB7F585844A7A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629719336, "uuid": "9c5e0e5d-46cd-43ee-9730-cb216dda2bc2", "value": "3072:GhlYkEIuPm3fNRZmbaoFhZhR0cixIHm0F0IBtZ9i/OwGbqLgtL:ElYkEIuPm3fNRZmbaoFhZhR0cixIHm0/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629719336, "uuid": "8bb996b3-2016-4ad7-a2a8-09d0b6e09217", "value": 129024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629719336, "uuid": "d46c7e7a-612b-4a4e-9d96-b0fec832c846", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629719336, "uuid": "2dd47aa2-daa0-4eda-8bf2-ebc599e310cb", "value": "Fattura_01019097.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e763768-03c6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629691052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629691052, "uuid": "101eed46-e042-4ee8-b843-95a9c4f964b4", "comment": "Malware payload (Mirai)", "value": "786b03c511c4b1a495d1144366087a39", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629691052, "uuid": "3dc57517-c330-40ac-97b6-e26d61afb391", "comment": "Malware payload (Mirai)", "value": "ed4146c5e1cfabf91d87b325098c92f9bdefb34caef1b7d2cdfce6db7296094b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629691052, "uuid": "19c7728c-556a-43df-abba-d8c15277e1db", "comment": "Malware payload (Mirai)", "value": "c7e9ff6fab73a7841c37556edff99bae8fd1617e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629691052, "uuid": "db84655b-2389-48c1-8e7b-72475a39c60e", "comment": "Malware payload (Mirai)", "value": "ec06d0d24812993182c1535831ebc79ea40bff39c0a13ad2b59f7e46c16533f07f44be9ab4d5d87ca7685071205fd226", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629691052, "uuid": "f224523e-b4b8-4634-bb5c-94a38d143dfa", "value": "T184637CBDE1795E44D25108787D108939C723F40BA6E62EB2DE86864FE85BEDCF114BB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629691052, "uuid": "ba1aa34c-c371-4581-afc1-7edde5834828", "value": "1536:p/3FDRTDak6EXIsYMlJ849TP8vNvfs3+Xgqa6CFBC/y:pfFFHF6EU4dP8Zf+SS6cB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629691052, "uuid": "0644c28d-cc46-4a06-a1bd-1c9d4567d4d0", "value": 67904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629691052, "uuid": "55a692c9-96ad-41e8-9432-3f9f722382d0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629691052, "uuid": "21a4ace7-b00b-4e9f-8c3e-d4f22ccc61e5", "value": "786b03c511c4b1a495d1144366087a39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2726f7ef-0454-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629752002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629752002, "uuid": "c4e2055c-c4bd-4bcb-8bf7-da7c8585af02", "comment": "Malware payload (RaccoonStealer)", "value": "1546f706667a63ac60fa5239ae344507", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629752002, "uuid": "1ffd7e69-39ad-4a95-84a9-c11b58d9ea3c", "comment": "Malware payload (RaccoonStealer)", "value": "ed4dd7a70716601bd085d56f6d4ddd38d1b3d32e9d9da0e8af719f31e9fec3f6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629752002, "uuid": "826b67bc-c3b4-4da0-b46b-9b45757c183e", "comment": "Malware payload (RaccoonStealer)", "value": "15a4a7f85e1989eeb437fda64fb9bcf0116763a0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629752002, "uuid": "a7a85337-34ce-496c-9483-f02a64bc6aeb", "comment": "Malware payload (RaccoonStealer)", "value": "8245c62cecaaef92869cd51fb1c0db09dd049cc7043efb7380ad3c72b7442d00f31a12561d56dfa2b4127575063ee1a2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629752002, "uuid": "81b06e0d-313b-4ce1-a433-a3c1353a69f1", "value": "T179B4D130BA91C035F5B716F885BA83B8B43A7AB15B7050CFA2D11AED17246E9EC30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629752002, "uuid": "4e2b9e6c-abfe-40e8-99af-2b3eb09f93cf", "value": "4dcb3c3a3fe5e134dd41266130cc79d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629752002, "uuid": "4534c7a5-9e71-4daf-838d-9c10a01576d0", "value": "12288:LzOvmmHs83jnkjATPoUH0RNDMDaDzQeK6yIFG12kFUmxmDJEGZBSdin+:gHscbaDd5knFUKozZBSin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629752002, "uuid": "f4a9abb5-cbfc-4555-a6ce-21b5671e4c58", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629752002, "uuid": "a060c8a7-192d-470a-9b3a-4fab1e9cd38d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629752002, "uuid": "3942be0b-4b88-4fe8-9fef-5f324e166309", "value": "1546f706667a63ac60fa5239ae344507", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf519b7c-03df-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629702006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702006, "uuid": "ea877acc-601c-4279-858b-6babaa1b9396", "comment": "Malware payload (Mirai)", "value": "a757a38baca15a79a4d514a9d5227563", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702006, "uuid": "e211e8d2-122d-4c93-8556-4df3c8bb2ff9", "comment": "Malware payload (Mirai)", "value": "ed63734b20d8f05d189d69ae9a90b5a3c06a676d1882edb2fec05f6f3e3b00c5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702006, "uuid": "8a52ca3d-8aa0-42fe-9edc-8116ea201138", "comment": "Malware payload (Mirai)", "value": "f04721b2e02433877ed2047d252b4c2a968b9492", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702006, "uuid": "17bc86e9-421b-4bb0-9592-e493f5222fbb", "comment": "Malware payload (Mirai)", "value": "dec12288054370bc9230f7cb2825b4ae620711238f4a36f59eeed28b50c184683354fe423ba76605b64eb3d60998bd4b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702006, "uuid": "31cca91f-6e8d-44c3-90bf-06c4c09f4fd0", "value": "T1D7A2CF316204DCB6D7F00476FEB98B872E172D717259713712212B747ADEC662DBC981", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702006, "uuid": "708fa39b-4691-44cf-9b03-d0f3351d6723", "value": "384:Ul2HHc4Jn/LD6xS9ktSqnm3mA5fQGhCs3SuhymdGUop5hD:St4Jn/SJ3nKmxGhC4s3UozJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629702006, "uuid": "39c3a1ce-5636-4a82-8ec6-2c356f7edcb6", "value": 22480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629702006, "uuid": "70b6f3f2-5e38-43da-8c7a-df9344fee7e3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702006, "uuid": "97e6b300-244b-4248-8571-e9617668411d", "value": "b3astmode.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e83a917-0431-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1629737089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629737089, "uuid": "d4093ddc-2b2a-479c-a3ca-62e749710401", "comment": "Malware payload (NanoCore)", "value": "3b9f8c0400a8e5410a37101b6691ee5e", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629737089, "uuid": "391a6c14-cce3-4bd2-8ec8-5ee1f39920a0", "comment": "Malware payload (NanoCore)", "value": "edee53b05abf379ea0c5069145f161cf3404c56e16bd1a54c059a12e0040fa38", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629737089, "uuid": "26799af0-b7f8-423c-a0d7-3c42cbd57136", "comment": "Malware payload (NanoCore)", "value": "faf4319c03e19c01493e4089d6f3663eb8b58c6c", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629737089, "uuid": "c8e1b51c-2769-4ed8-afa9-f4bc7f2bc865", "comment": "Malware payload (NanoCore)", "value": "0ef209b3cc46ef37edf6ae6de5e684bdad9cc46f72bbffd1a417561aa9c494ff98fef2f42bc877320d105265ef2f8aa0", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629737089, "uuid": "09e3903c-f2f8-4169-a28e-2157f222f157", "value": "T145E42383AD0B0584BFE721EC0705E9DFD0AE4519785D8864306EC72B29B1EE689F35DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629737089, "uuid": "20a99f0e-94e1-4074-a8ff-44a4b2169d1f", "value": "12288:7NqXE1FalIAzafmt8a0apazDrHLAWp66f9Ll+WhutjwD2KwzHX1XTlf:7NqSWPCmtaapazDrp66f9LcE4j42prj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629737089, "uuid": "ac1ddd10-27b9-4614-aa74-1b206eb913d9", "value": 686988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629737089, "uuid": "f5554c6a-15ac-4a46-9bdd-eab236d1902c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629737089, "uuid": "181b80d9-f302-4b2f-9d71-073278f3492f", "value": "FW RE TEXGEEK INVOICE & PACKING LIST - SCAN & SOFT COPY.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07d6009b-040e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629721884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629721884, "uuid": "4aa6a881-5f84-40ef-85a5-0a36ee35c081", "comment": "Malware payload (AgentTesla)", "value": "c984bf590ebc9ccae5d5c7d4ab6166cf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629721884, "uuid": "f7f91bd2-18c0-40b1-9e9c-afb23859d6a6", "comment": "Malware payload (AgentTesla)", "value": "ee38c337749db260f84ccad87db5245a2fae65f86d8cd57562c72081d3300f97", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629721884, "uuid": "411d3053-395a-4a0f-ab85-f6a274f0627c", "comment": "Malware payload (AgentTesla)", "value": "4446fdbc4ce5e00757f98430389bf267051c7b08", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629721884, "uuid": "72e5e3dd-c8e9-45c6-8639-6ba084787da0", "comment": "Malware payload (AgentTesla)", "value": "89da3ef63887f8a6067251a0ce508b3dbce39d7db5c9e87582729c4ed30221b03a1191469f373a9c8b95ad5cea4543e9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629721884, "uuid": "fc82b9df-ccaa-4448-a476-dc1a5fedfca6", "value": "T19BF4010E7781B64FC52FCE7699155C20A7E0E6320307D756ACC325EA2A5D79A8F063B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629721884, "uuid": "219c3801-6e91-4253-8350-4ce14dfa517c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629721884, "uuid": "79456d1e-7af5-43a2-b1ac-a3b82e1d613b", "value": "12288:bggCZOQJLeQ/3qnxTc7mKTH7q2zPYFeHClFG1Pc/36az:bKLeQ/yTc7myq2UMiuP+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629721884, "uuid": "4335e45e-e98e-4896-89f2-6d6bba2852dd", "value": 723456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629721884, "uuid": "e1715588-ccd1-439d-900a-387472648abf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629721884, "uuid": "7054c5c3-0913-4ca9-9811-dedd88114108", "value": "NewOrder20212308_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54ebd514-0452-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629751220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629751220, "uuid": "bba775ad-a4aa-4223-85af-1d7d37bf3310", "comment": "Malware payload", "value": "7de8ca081578b160483afc1f4d84c960", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629751220, "uuid": "251e19f3-1d2f-456e-9995-0e6b8d68a875", "comment": "Malware payload", "value": "eefb7c976c4962bef2c3553df1061326ccb68dca91224fe81b4cbcf93368bdba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629751220, "uuid": "b51b54f4-ae6b-4335-9984-568380f648d4", "comment": "Malware payload", "value": "ccaf562fb5e0a172bf3f9b78aae277893bb202fa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629751220, "uuid": "79524a4b-8e7f-42c2-a398-60c95b89a626", "comment": "Malware payload", "value": "dc8dc68a846f911cdf9c9cb68afbc1a6cfcc9cf27c90f455b6b14801f9250491c984f02b8f838277e5a27b989fae90b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629751220, "uuid": "7a5442a3-868d-4277-bd7c-69fb4f428ae1", "value": "T13655FA3815B87B7BF17AD339DEE4480BE2E4B45B7311AA1670D613670703A12B99327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629751220, "uuid": "c6d15923-a6de-40fe-90f2-869fd08ed6ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629751220, "uuid": "4ddb1530-d233-4eb5-935c-e5d7ab0b0a4e", "value": "24576:k8tc6c4cOz5AIrpe/FnJuo0qakdutV05GKAKiwvFTsGUdjG:JSBiqfduE5BJRvFT3Udj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629751220, "uuid": "3ff70055-d5c5-4233-b602-a6fa98367d8b", "value": 1356288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629751220, "uuid": "accec30f-2801-4331-bf48-049f8f5f5324", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629751220, "uuid": "d78a62c7-160f-4b10-8bc4-a522b9f34a1a", "value": "7de8ca081578b160483afc1f4d84c960", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9467e168-0463-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629758627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629758627, "uuid": "95bdacce-4890-468e-9737-df3b3cb309a7", "comment": "Malware payload", "value": "92bfafc1e9023665745fee7ef443712e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629758627, "uuid": "829db09e-a31a-4d89-bf3a-bf2bdd3ac216", "comment": "Malware payload", "value": "f017121c738f72b1b65e4abe141f1659b13c53a0fc8d253c0bc8bb419ecc34af", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629758627, "uuid": "94d78f71-5478-4067-ac72-c60d73c20b0e", "comment": "Malware payload", "value": "16be133e8deb4455da2452527d5f72e068f73417", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629758627, "uuid": "ae6e3d64-7d58-4d47-938d-6e275da011c9", "comment": "Malware payload", "value": "effc14b022062edad47fc3e16c97b46fbfa8a2c0cd924d2b050bf8ac43a171e4c1e23ad08a5065d3cc5b8c4ceb0e46a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629758627, "uuid": "0177da75-5de6-4e5e-9762-27d66ac3c379", "value": "T1E5253E3D19FE162BC0E1D376CBE18423B0549C5F7810ADA568D273760BA7A9735CB22E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629758627, "uuid": "89f27c24-d1ee-4185-9ba5-9dbbe1cadc3b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629758627, "uuid": "a839e802-e590-4352-af6c-2d1bae439074", "value": "6144:Od/hAxno0yu937wR85lwQpsZG0FHBLLdJZdrvPkYxs4tLm8O/Qk8boAvRc+rM6dW:4AxquZwBQSZGcH5TPxhL3XK+wLQ7gVv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629758627, "uuid": "423fdaa4-970d-4c06-aa38-e1eff1d70d8e", "value": 1047552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629758627, "uuid": "e961553d-ae47-4463-b836-281a42e32381", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629758627, "uuid": "06bf28c0-b63a-4c1a-b562-41afda17ea59", "value": "92bfafc1e9023665745fee7ef443712e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b935906b-0446-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629746234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629746234, "uuid": "a3e497d5-7739-40cf-bddd-e4e403b97e1c", "comment": "Malware payload", "value": "0d6cb0ad6a243cbaa6e0baf76a29d796", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629746234, "uuid": "b72fe40c-6d9b-460e-8f5b-530feb6e37ae", "comment": "Malware payload", "value": "f0236b0ba3d99fac225741bd2751ee4517e1f2159d19248ff0800b8304d48421", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629746234, "uuid": "1c5222d0-790e-4b5b-a515-7bb88f72f4f4", "comment": "Malware payload", "value": "3001f4a8107eba4f6b3c7b2fc43f31d3eb2dc152", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629746234, "uuid": "cdc983da-cfd9-4ecf-b8e0-da42ca706eae", "comment": "Malware payload", "value": "5e6d9656595f5c5382086e785b9f8b532f72f61adc70a0f72c4ebed0d72e3591f91a14204f4974adb4708a2b82c5a614", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629746234, "uuid": "47bdd904-e07f-4f4f-807a-4fdd324ee99e", "value": "T153357DD1F150D8DFEC6B49F2AD2AA83014D3BE9C55A4C10C599A7B1A66F3342209FE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629746234, "uuid": "b482e61d-8c9e-4771-abd4-90ef2545930d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629746234, "uuid": "e96af45f-4bd5-4031-9fab-51fbae3151b7", "value": "12288:7Ze0H4rdL+9QltfcXCh3PdXUouNRZd+MO+QWYw90kti0lGPefNxT:7o0Y5LWUDVXUouM+Kw90vi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629746234, "uuid": "6c284290-79a5-4109-9b6d-50bb9d598f62", "value": 1065984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629746234, "uuid": "a4b4aa70-bdf1-4d24-a78a-a313d5655af5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629746234, "uuid": "e227c566-c4c0-4cc7-a53f-5b631a327386", "value": "Container ETAbest offer 8796___pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bebbcc17-03d9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1629699428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629699428, "uuid": "46c265d4-f950-4c23-a00d-9fef9a0eca76", "comment": "Malware payload (NanoCore)", "value": "d703b3cc46820009bb6c4ab14666ea9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629699428, "uuid": "e1dddf3e-1a8e-4972-ba1a-78b3902ac7c8", "comment": "Malware payload (NanoCore)", "value": "f089621fa865a1406a660945a8376953b51dee4e39b1d7cde0ca17b27a0ac7eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629699428, "uuid": "7bc7e532-b8b7-4ceb-bf67-5ecf2edf9752", "comment": "Malware payload (NanoCore)", "value": "d4180c699f8f7fc340854dcb66cbb37c7b7584cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629699428, "uuid": "46e34d59-77a0-41d1-a33b-b808be5e7194", "comment": "Malware payload (NanoCore)", "value": "4e871b982c08eebc286d326e3aa91cfbf6f29037d2216c748dcea729e881b927dda605fb3e2dbe6bb5cc40d3929fc996", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629699428, "uuid": "b54a0bc6-b5ee-4316-b632-c1f617340180", "value": "T1BA358D25B381B7E6E8A60F328833258443F295572731F69F28D516DC2D21A3F8B2F657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629699428, "uuid": "0da97ca7-0ee6-4133-af8f-41072a2d4bcf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629699428, "uuid": "c569757c-c848-4c25-b360-4e11a7df36ba", "value": "12288:kZZLnAQUNkJfqwybQsLhBN9aTom5OusQyh3jNMhI4iZN3i62O:0nkkAhf9aTXEuswi5Z9i6h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629699428, "uuid": "64b2194c-7775-4889-aaf8-ee8a8f6f45df", "value": 1127424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629699428, "uuid": "837ec7be-f27e-427d-b86d-6cb45364b08e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629699428, "uuid": "7dd873ec-d9b0-4a62-be78-abf1d54a8c2f", "value": "d703b3cc46820009bb6c4ab14666ea9e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5021527-0400-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629716135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629716135, "uuid": "ab6e943c-8ad9-41e2-9665-a9391cd7b0fd", "comment": "Malware payload (AgentTesla)", "value": "41d03e0ba98a2dee7519754558a9f528", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629716135, "uuid": "1eca330d-dc7b-4e5c-91d3-a4e5b573a2f1", "comment": "Malware payload (AgentTesla)", "value": "f0916d0a5c76f29cfa34f43b68ead1840ae8499715aa7865cd17710f485af5c4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629716135, "uuid": "d2f9ab30-817c-41b9-9de3-62239a4608cc", "comment": "Malware payload (AgentTesla)", "value": "5d97838acbd7e751d97b180d6990f4ab9613e2e8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629716135, "uuid": "d8e976bf-0bd1-4e02-85fd-8c098c7f62cf", "comment": "Malware payload (AgentTesla)", "value": "58c17af40e706738a1521e6e8f24bdf2e77cfcfe43c56c182ca70f96dd9f784f0be09091286a19c7119363d0aeb5069b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629716135, "uuid": "db5a5f32-fbfc-4dbd-9dce-6eba87bad53d", "value": "T1DFE2FBBDD55B05988F85ABB81B1B9F84118C3A2EF7889573327C973867E2D3A501393C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629716135, "uuid": "6c6f5cf7-addb-4f5d-9ea9-220db18e2eef", "value": "384:rqsMkgRtwySdwT8ItNHDkq7XspKEiteYU:r+kgROyP3ja5ozU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629716135, "uuid": "e2efeb7b-52ad-4853-9c89-150a34bdb391", "value": 31458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629716135, "uuid": "e3361a9c-a7ae-4c55-9c86-a160d59c85d4", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629716135, "uuid": "b046efe5-3da3-471c-a0aa-96d50a9d49a8", "value": "Payment details.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c41e766c-041f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629729502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729502, "uuid": "06d2bd44-cffd-4587-b3a9-288a1b4f8d4c", "comment": "Malware payload (Formbook)", "value": "e4f8fe5b1214945e4f9253ff5a019030", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729502, "uuid": "fc4cbc87-103f-4531-b8e7-4f7ae600d3f3", "comment": "Malware payload (Formbook)", "value": "f25a3df2dc1d74c6bd66ffb87c8b48f2393b0a84239f27121f323ad0dd561fdf", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729502, "uuid": "9fb93579-c9c4-49b4-b962-1324c56384da", "comment": "Malware payload (Formbook)", "value": "3151fd3bea5a082c78fbdea2544fe7de09015587", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729502, "uuid": "aa9b4215-2d4e-4457-b43b-a0c2a96cafe4", "comment": "Malware payload (Formbook)", "value": "f2869c8d59e92da6ebbcc3bfcae2d85d6a554c54adf5cb0a3ab2fa28d0313eb12107aa455a1b17b00ef8f324cf7b495e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729502, "uuid": "a3b396cc-d6e6-4dcd-99fb-aa16334b0d21", "value": "T11B551397BB596F6FC389A4BB39267869099C2F92F42888C35714F6090632F53D7C03B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729502, "uuid": "b3a7d050-4b98-4e4b-bc40-5f56dde5aab2", "value": "24576:qjRQLVfpf5oAQi+0ITh2b9/yZeOr02xjaNtz7y5DhUG53hqiodI+StpqzkG/yQL6:OI9ITEyZQ2xaXq5DKGhhqi+zSGzkG/yf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629729502, "uuid": "924c25bf-53cf-49bc-b715-2c6e9863f3de", "value": 1366600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629729502, "uuid": "371a9de4-247c-410f-8720-dc5e0d84f7b7", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729502, "uuid": "03c4bb92-9535-4ca4-ab65-c925c2079b0a", "value": "order 2240821SN-HYM.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a6d5d9b-03fb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Amadey)", "timestamp": 1629713728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629713728, "uuid": "8050706d-18ac-4e84-95a8-101bf870a38d", "comment": "Malware payload (Amadey)", "value": "f7ffebafbab18bd5bf244a150842de52", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629713728, "uuid": "ad78070b-df4c-4f8f-bdfc-bafd671f4480", "comment": "Malware payload (Amadey)", "value": "f267c38c46d549c675acbbd6110fc9218b75fae795f0d6d96f4070d9b1173866", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629713728, "uuid": "efed7054-5c96-4cde-9de8-098027d5e321", "comment": "Malware payload (Amadey)", "value": "f108d4d902d756df2890998f254f75c0d55ac723", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629713728, "uuid": "dc6df51d-2e86-44d5-ab74-efe64064044c", "comment": "Malware payload (Amadey)", "value": "9db91a8523971deaefad2e69498b841fd47c4f9f8bc3ae027b1634c20edd961c0d6f02c90e072749788790f3a641853f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629713728, "uuid": "0e4920e1-b214-43ae-970b-bbe6571a5f03", "value": "T1A364AE30ABA1C035F0B711F855BA83B8A93A7AB16B3050CF93D52AED16346E5EC31757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629713728, "uuid": "461ef40f-eacf-4f85-b42d-2359522b11ae", "value": "5c06a288f07d43206aca52d5d94444b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629713728, "uuid": "b32e94c0-7bf6-4ad1-850a-a9e5eaf14ae9", "value": "6144:9BjR4yNHiaigSynxeXZcnhk2aR6XPpZ9TOYuuzI3ET03/V:zRrNC1ByQZcnC2aA8wI0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629713728, "uuid": "98cf741a-3789-48a3-a2e0-3a5d02a47ca0", "value": 329216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629713728, "uuid": "e791a8d4-05f1-4f1e-bfb4-82d3629bf582", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629713728, "uuid": "cc9914af-db2f-4f54-8e6a-59ec5e4fd3ba", "value": "f7ffebafbab18bd5bf244a150842de52.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5500cc17-0409-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gozi)", "timestamp": 1629719866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629719866, "uuid": "085e33e4-984f-4b78-b571-c685357f3dbf", "comment": "Malware payload (Gozi)", "value": "349b17e618164143782e1d8d506e21aa", "object_relation": "md5", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629719866, "uuid": "84f1d3c1-23e1-4da2-b7c0-ef1b33d90898", "comment": "Malware payload (Gozi)", "value": "f28c1c6e9c3c394739a6d79e4d748941b9c0a3576d084380485aa8d807a2266d", "object_relation": "sha256", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629719866, "uuid": "5bd3d265-9d4b-47ad-a750-70dedf51050a", "comment": "Malware payload (Gozi)", "value": "4296742cad27bdbed286f1df84c0f162ba216237", "object_relation": "sha1", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629719866, "uuid": "9ee97eed-1668-42d5-a789-3bb79d5f6f2d", "comment": "Malware payload (Gozi)", "value": "ca01eb7b9cba94fb95a64b384881a11115737b7ed7ce7aa36d3dcda9b3c27cad01441f66e6a465c5a213fd2196a6f3fe", "object_relation": "sha3-384", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629719866, "uuid": "3f71f779-4bac-45c8-8b2b-b2acb97da082", "value": "T111C49D12B791E024E9B952788F75D9D8AA2D38215B3850CF39E13B9F0E396E39D35343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629719866, "uuid": "64031bd3-534a-4c85-8b15-6f05df49d528", "value": "12994b2554048ef1e6f7b4dd1e874109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629719866, "uuid": "c532a0ed-0974-4dd8-a59f-98f87c8675fe", "value": "12288:rqru80paIRPWxvFzhzFIkoAIcYrIAfDE0cb1Yklllll/lllll7K10QUNI0H:rs0IIFWx9zlFIkoADY8kcbHlllll/llH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629719866, "uuid": "57646b20-d9a1-42ec-abfb-c3276275650c", "value": 557056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629719866, "uuid": "0fb895a6-e3fb-4553-8e1a-490bcf4c24be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629719866, "uuid": "b074722d-d95d-45de-a7e4-a4b0978926e8", "value": "61238d0f9a956.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "449130f6-03b0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629681614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629681614, "uuid": "2535346d-7e6a-41b3-b24b-e9eaa3f24a04", "comment": "Malware payload (AgentTesla)", "value": "236a99d0d1d3b3e3aea3aa6884e94b1f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629681614, "uuid": "b6e9a51f-ba47-432b-9d56-92751bf21601", "comment": "Malware payload (AgentTesla)", "value": "f2a4a912e8b1d5a94cf97a1a67fa2f8f70450f192d1b0c4bf449d859ab281251", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629681614, "uuid": "c451cf72-062c-45b1-a5ed-0ceefea9301b", "comment": "Malware payload (AgentTesla)", "value": "ab028020982978cd059b4182aabc37d980d53e3f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629681614, "uuid": "8451adf7-0ed2-4ea1-8551-42864f48c840", "comment": "Malware payload (AgentTesla)", "value": "c6e946ac4c526155de8f360cc509b96c1b4ea1a1a224fbd10b4851a5e60b404ad3e245cdc89a699a87fc4e894a22366c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629681614, "uuid": "da7e0114-3b52-4ee7-bf84-97a85fe95dcc", "value": "T14005E53D19B91637D1B5C355EBE48423F148985FB404AEAAACDE03A7434BA9335C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629681614, "uuid": "fe9864f6-394b-4f98-9df7-27b8f37b6247", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629681614, "uuid": "9ffafaa8-caa8-4e6b-9919-35e74bd5d1a4", "value": "12288:qGFHH27zOpaHHdEXgIAnPncu/VIJy7LNodN4o8Ki/iza91cnO:VlGXHdEXgIAnPcu/VIJ8gNyKiKacO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629681614, "uuid": "b5ebef3f-7418-4d37-b73c-2c9fdba60435", "value": 849408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629681614, "uuid": "af1c6d15-dc88-4cc0-91af-270aca0df902", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629681614, "uuid": "ec1d01fa-556d-47bc-b5f2-8e4c88b909af", "value": "SWIFT COPY-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72a72f5d-03db-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629700159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700159, "uuid": "15a0cd05-117f-41d0-aced-5fec43d1dcd9", "comment": "Malware payload (Loki)", "value": "e3bfddac014fbcc71f09c9655562078c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700159, "uuid": "682c20be-4022-48c8-97b2-24c2fc5d6f78", "comment": "Malware payload (Loki)", "value": "f3883b25c2c34ee15f38c81d263146dc94229cfb13f828907f63bf65e017319a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700159, "uuid": "f4adc3a0-b844-4a92-a493-3d819b80301e", "comment": "Malware payload (Loki)", "value": "ef7dae8747dbebef2297f3f419a04e16417b1041", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629700159, "uuid": "01f9919d-3977-4620-bbad-3a5458638d3c", "comment": "Malware payload (Loki)", "value": "3412c3c0b9369d76940d42a0aeac6b5840c43dc07ed10ce77d18d05a15687efcbfd33d2aa8f38f52898bcaefb1604a49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700159, "uuid": "2e0b2c45-db19-4fc6-b659-ada48e8748a1", "value": "T1BC15073C19B91637D1B9C365EBE48423F158985FB511EE6A6CDE03A7130BA8334C726E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700159, "uuid": "4687aacd-074f-4914-9af7-5a116e3e45db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700159, "uuid": "809593b8-a51c-4e19-a739-10afc248fdd6", "value": "12288:PkduFPuU/arkBwIBseGYgm2MojZRP1thcSAoenUBLJxtEuhEk:PkdMGbrkB3Bum21ZN1QSlZB95hEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629700159, "uuid": "07c40f9b-02c6-4ee4-b279-f1096a310661", "value": 905728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629700159, "uuid": "d884ce23-a877-4da4-afc1-8fbd20a793bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629700159, "uuid": "34ffe579-9592-4458-ac84-c65012db7a64", "value": "e3bfddac014fbcc71f09c9655562078c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5aed2f9-03c4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629690447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629690447, "uuid": "fcb129c0-86d4-4907-b6d1-d7ff7962f0a2", "comment": "Malware payload (Mirai)", "value": "3dd5575aac6386b451c671c182835f7f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629690447, "uuid": "38881012-17c4-403c-9595-03e40426c6ee", "comment": "Malware payload (Mirai)", "value": "f4ba4a1aafcd8902f1a0a5ca2aa2069b9a698fd476235c6970a018dd1fb5189b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629690447, "uuid": "e22af2c3-4745-44d4-8f8b-9629d34722fd", "comment": "Malware payload (Mirai)", "value": "abe4d87632eddb34626d3e28c390ad376484d094", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629690447, "uuid": "95bb6a23-8b62-4e00-b536-2f541bb512a0", "comment": "Malware payload (Mirai)", "value": "6622f5bacac4097e409dbd7695815667e128246dbefa9bc2678d0f2ba787dda9bcb52d57995bd7980cc81d58508b1157", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629690447, "uuid": "ec023bfd-fb5c-4c07-b570-aa9aad450ca4", "value": "T167D2E158D2567C32C4900977FEB847CF12BB45F4E0FE32A1AC881F5A7A4D94E44B456B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629690447, "uuid": "a6482d46-d1e1-47b7-abc8-e3a8d78d5bd2", "value": "768:rI4Xb1OBviHZPtp7WO+VaQxOxTedf9p//3EEmylVGoAls3Uoz8:84BOBvi5P+OCaQ0Tk9/0vK2oz8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629690447, "uuid": "be42e314-8e86-4a1b-a033-5e21e22cdc6b", "value": 29740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629690447, "uuid": "cf0c2a53-2804-4bb9-a61d-d9779eeed960", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629690447, "uuid": "a7a61f57-3e87-4bb3-a909-c233021951cc", "value": "3dd5575aac6386b451c671c182835f7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cb0a704-041f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1629729355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729355, "uuid": "41afb7d7-6379-4a22-9fce-2440394fc30e", "comment": "Malware payload (AveMariaRAT)", "value": "1ff2867813d4a0f7d7aca4b831cdee3c", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729355, "uuid": "c8b7f9a7-ee35-431e-b72e-58b18669a892", "comment": "Malware payload (AveMariaRAT)", "value": "f5c015d4e4e2112d6e62b8cd4852e4cbb700aa4df7cf4c2eb56069041d257c64", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729355, "uuid": "c32b6785-e478-4fc8-a7af-a5f44147dfad", "comment": "Malware payload (AveMariaRAT)", "value": "0bcc002ad4e3b4c0c0770017709f403c5a2bad15", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729355, "uuid": "9fc5555e-18ac-4b89-bb61-ec006c6abf02", "comment": "Malware payload (AveMariaRAT)", "value": "3b982c6734eebee1598a3fc805203b310b539409777a9b6dc8f2f4f979e47a827bda847d7a6658681399b8cbfff2c630", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729355, "uuid": "81a60337-5336-4d7f-bc68-510e23ac9e0e", "value": "T1CA72F9BCC46305C88FC6A6B8571D278615897B7DB388D63372BC9735639297B9006D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729355, "uuid": "0adcfc66-3bb8-4e91-9694-cc4128874c0e", "value": "192:Peb0iV1UH9mmIpkJbfW484a7zSMzXBwD3CdK/woDd6frdSv0A5gIu3cR0aaW8+Tt:KHUYpyR84QXCD3Wk+gNDTicOD2+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629729355, "uuid": "7678c335-b9f0-420e-8e6e-16a8adc4dc96", "value": 16215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629729355, "uuid": "9724e310-607e-4b27-8816-756e4d65661b", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729355, "uuid": "35a3cb4d-c85e-4cb2-9333-4b908874c528", "value": "HSBC Payment SHAWCOR 23.08.2021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "113588f8-043d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629742086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742086, "uuid": "6872f20d-580b-4d1c-ae85-c7cbea57c69c", "comment": "Malware payload (Formbook)", "value": "2eb3314435b3ad46859e89b18d2a2174", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742086, "uuid": "01356c5f-11be-42a6-9158-111f752e203c", "comment": "Malware payload (Formbook)", "value": "f5c01bcb12e33b32123e1345f1320bc5c4137cb26df006a6ec8a508fdaed4016", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742086, "uuid": "7b5aeb7f-13ca-4fa2-be35-07e398ed5518", "comment": "Malware payload (Formbook)", "value": "997b900935cac4661cfe003ac35f1d544362b3bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742086, "uuid": "5e6cc0f4-c077-4fc5-9b0a-cc1c2c07ef6b", "comment": "Malware payload (Formbook)", "value": "d412f9d04c79ad112c2c32068550a1c67aef7010e281ff4adf4dad8be21e49a0835bb02f3836c91a0f573c1d6ea1999e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742086, "uuid": "75462c4f-9996-43ab-a5e5-e6b3f2d6137d", "value": "T1DC05F53D1AF91637D1B5C365EBE48423F149986FB410AE696CDE03A7034BA8735C722E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742086, "uuid": "71ba279b-2688-46f9-83f1-32ddce46540d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742086, "uuid": "2b6f7bc7-8929-4352-94ec-6d0ee5ba449e", "value": "12288:Zzh9XaMx8nog0xifFPwYCJ+mUd0GXkVagHvS85Vzp9q+IX+G0U:Zzh9XPxgPwYETUdp0VLqmPIX+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629742086, "uuid": "69f82200-d89f-488e-b1b8-1310d543ef2f", "value": 863744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629742086, "uuid": "c7eef844-6975-4e71-8f92-e9b6f71fc423", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742086, "uuid": "f8f6c960-9601-417f-9fda-d9f47a4aef94", "value": "2eb3314435b3ad46859e89b18d2a2174.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05d06f44-03d6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AZORult)", "timestamp": 1629697829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629697829, "uuid": "05a7ef62-5c19-4f17-b827-61f1647ce5f8", "comment": "Malware payload (AZORult)", "value": "a438c81e4e428cc0710aa97a37fdb383", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629697829, "uuid": "59d0b780-f7ad-4017-a2d5-c037b794581c", "comment": "Malware payload (AZORult)", "value": "f73579603fda08d484fd111ba5c0f00ea57d25c79365608995dedb0cd037c66b", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629697829, "uuid": "506a0512-c908-450a-b8dd-75e19bfbb4a7", "comment": "Malware payload (AZORult)", "value": "0aaeb01eaf1228a94233ec0a1d25957a291994f0", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629697829, "uuid": "d8ac3c7f-5b85-4864-be4e-355fe30a3893", "comment": "Malware payload (AZORult)", "value": "1080b8d14e1d20f863a58b593838be56f8d9e4a07f27e908a65169975f93cf2446bd38ebb18531afeb7bde1e08742d9f", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629697829, "uuid": "89adede5-d859-4c38-9bdd-0533b446b68e", "value": "T1EDE439483790B1AFD427C9338B974D30A66164ABD38BD343D003D2ADA91D2B7DF195AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629697829, "uuid": "2e14b5e4-dbe2-4187-b256-cece5846597b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629697829, "uuid": "810939e7-80d7-4b01-bfa4-08f2c5798fc6", "value": "12288:Y1aeNUlfdUmfGhV93GTCs55rR5itbZ3EO1I4ObYF1YZK8f+OVpdgd+ZfM:YkeckPWTV55rWFUO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629697829, "uuid": "7c11ac9d-5762-4339-adef-26d988208f4f", "value": 675328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629697829, "uuid": "77c99998-a92b-4d6f-a5c3-b3ec8edf414f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629697829, "uuid": "ce8ee137-fd8f-4e50-ad92-071dd0e8be35", "value": "PI Request.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e850df8-0450-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629750430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629750430, "uuid": "15bd9b78-7dd6-42f3-a4a5-d7ca10ac6662", "comment": "Malware payload", "value": "39c431294da516a58c2b03b7fbaedf1d", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629750430, "uuid": "88d625a7-d81e-425c-a429-1d1c718d2a93", "comment": "Malware payload", "value": "f77e0238fb5c3171aef7e368907987cf657d9381f8290f07a07a0b07c04829aa", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629750430, "uuid": "4f210b19-5fa1-477a-95e1-20d6b71b1b05", "comment": "Malware payload", "value": "4775bed7340785ea6235a3ac23af2e35392dda54", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629750430, "uuid": "91c1223b-6f54-4c08-b922-75ffef202fea", "comment": "Malware payload", "value": "8a86e8f81f8f5d1213d349ae4482c031de3105ea26b35341978f89018294c769d129d0261da3e6de1f79db2ce31570de", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629750430, "uuid": "a7800b33-4401-437c-ad30-b861b6eec2d2", "value": "T1EC21877729C2D2130315E392F644886CE729E4078993345CA1DEC54D90E0FA33BDC2FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629750430, "uuid": "6019b21e-a81a-48fc-aaba-8363b88a5dd0", "value": "24:paP4mXjvTCkLKCPWvWkSkEGAkZbxIkyyD++ETTTQ/Tviwdy:MxTvrtWv9Skvp6yri", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629750430, "uuid": "81ff6ab1-56d8-4ad4-b61a-97b377c0e235", "value": 1263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629750430, "uuid": "ca778e9a-80d7-4522-948a-2974a2062102", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629750430, "uuid": "f5aa1364-23f5-4a90-9dc3-00044a3a2c69", "value": "DnxZTYt0.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caa7dba9-03e1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629702884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702884, "uuid": "5eeb6689-22e5-461e-b749-d9fb50667391", "comment": "Malware payload (Formbook)", "value": "ee10aa40ce9a309ed5311465c3c8ccae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702884, "uuid": "e4b9bf45-507d-4f96-9010-910e77d658d8", "comment": "Malware payload (Formbook)", "value": "f7c1ecf2c6e90d8a9a0ac0972b0ab02ca809a85da65d51b46f56a4c81cc4996e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702884, "uuid": "f17b8c8a-155b-474c-86c9-931fc3237020", "comment": "Malware payload (Formbook)", "value": "42f88403038ed536fa7338b8613ad5e790e4295d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702884, "uuid": "0dbf3a8f-5d3a-4824-a46d-bb39dce2d344", "comment": "Malware payload (Formbook)", "value": "5265c4662baee389846cffebb8b1311b77b31a5fdb64dc61b7f86aeece61534148ea0f8eb6aad1c8a26f1092f1f8155c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702884, "uuid": "d8986bdf-7497-4c55-a0d7-a7c34e25c729", "value": "T1DC25173C15B83A27D1BAC766EBE18413B19094AF7121ED99A8DE03A70743B4775C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702884, "uuid": "d341512a-fb0b-4384-a870-c357ea6403c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702884, "uuid": "3d3f8abf-059b-46ac-bf5e-4f92c446b837", "value": "12288:XbWmOYtLmS5fm1/mDDc9F3nC0Py3gAh46gsCipjave3cJ/5u0towdiYcbhSBmE/f:XhyANgRi8Y05hFbz8XR3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629702884, "uuid": "12a3961f-1f2e-4c26-a17d-44d08bbbe1cb", "value": 1016832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629702884, "uuid": "6fe5572f-cc95-4043-953c-19e898954426", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702884, "uuid": "34df739f-cdb2-433b-a20d-c6a3b30f4169", "value": "PROFOMA INVOICE NO2021TD24.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f66fc69-0429-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629733628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629733628, "uuid": "2a95ef9d-20ea-44e5-8ad7-b7be9ab9cd51", "comment": "Malware payload (Formbook)", "value": "7151706b714e5711fc0c3a49fb4cf9be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629733628, "uuid": "d5d85d7b-e46d-491f-b99b-9b1d287dae8d", "comment": "Malware payload (Formbook)", "value": "f8b0b072a061719895c7fba405b3ff7483d4fe796e3fbb402de371d9cbdd3fcf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629733628, "uuid": "7dcce445-f57d-4240-b161-d0cd3420e1a2", "comment": "Malware payload (Formbook)", "value": "394bada67708b9d3c0ace3a57d2cab3a5d882abc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629733628, "uuid": "d3032cf9-21f5-4d8a-8d0d-a02664042964", "comment": "Malware payload (Formbook)", "value": "4b12af98b52b9ab50d2f9427c1eca7e181a5eac8ad7737c5133944a47e255a36b8b96abc534247b70fe01016b95ff0a4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629733628, "uuid": "361f962e-d118-4d42-8249-4388dc4446e4", "value": "T16E05F53D1AF91237D1B5C365EBE58423F149985FB410AE6A6CDE07A7030BA8735C722E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629733628, "uuid": "bddcce75-8046-41d3-98df-fa0b1ce75734", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629733628, "uuid": "cfbfd683-5551-404e-a656-ad563043fd34", "value": "12288:MA65b7RxdamyUA9o4rXauQugBNrHzOe7VyiixW3itxh3855xWUMvMhp:MRbHI+A9ogX5pgBNrHzZ7DiIw8LxWUd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629733628, "uuid": "422cb30b-aea0-490d-b2c8-0b84b6d27b8d", "value": 867840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629733628, "uuid": "90480fec-6d1a-4942-97bf-9bfb4d75c182", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629733628, "uuid": "ce87c27c-7369-4885-9b9f-f6ab4b7cfd74", "value": "7151706b714e5711fc0c3a49fb4cf9be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47712be7-0419-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629726716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629726716, "uuid": "169860a2-8af8-4a12-a770-0251133a09d8", "comment": "Malware payload (Formbook)", "value": "1001ae6d11aebdd54bcfa52197a5c1c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629726716, "uuid": "8d3618e3-1d86-4d12-bf8b-d7ae36623436", "comment": "Malware payload (Formbook)", "value": "f9c533392a6f3638597e91b582264c343ddb6dc20c9f6a70b26ed8327730f95a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629726716, "uuid": "94cf3f95-a395-4004-96e4-4696908f8afe", "comment": "Malware payload (Formbook)", "value": "584eca17f0975c0e36af8cae35369a2f70e49d19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629726716, "uuid": "b4d7d1d6-84c3-413a-ad23-eb3457e49c61", "comment": "Malware payload (Formbook)", "value": "65c1bd642a9a46eb9c8d8a695f8b06c0552373e50baefe153c9de63aca7613f99d863ac955428bca041417ed478c976d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629726716, "uuid": "8e1f2cf3-4c78-4c93-9325-4bfa06eceffd", "value": "T135158C8D4C8D91CDD51ED7D81EA3C6C4A31FD3BB3419693EB45FA2712987929EBA3800", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629726716, "uuid": "87c074be-1bc6-4fe1-ba97-394c83e8653c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629726716, "uuid": "f266f512-eb86-4e46-9171-729dabaa1c79", "value": "12288:9hZeHM482Ux1g6zpc482Rz7lQGtTQ17VwPZfxT0/IahpZiF7Y3Wu1ST73WU+0uXV:9hZeHM482Ux1g6zpc4X3e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629726716, "uuid": "e731303c-921c-4867-b162-c1249dc04878", "value": 956416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629726716, "uuid": "1c35c861-83f1-45d4-96a4-3d212f6e7a57", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629726716, "uuid": "95783474-6422-43c4-b33a-e8c3a459662f", "value": "CONTRACT INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "511f1c90-03d3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629696667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629696667, "uuid": "e217cf1c-fe35-49c0-ab27-b83693f8c0c3", "comment": "Malware payload (Formbook)", "value": "b801ceac333f10ad04d65a9739144637", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629696667, "uuid": "d098706e-735d-461d-8483-ed94abdfdcfd", "comment": "Malware payload (Formbook)", "value": "f9e50a9c0c8c9fc184dd5aea99a439e883cf7cc60031f9e4e979753c09746ad1", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629696667, "uuid": "0e26844e-c8a1-47b4-b9b4-ba2bde8fb48d", "comment": "Malware payload (Formbook)", "value": "b69a988374f3c4fa449f2cad0e5498c642d2d2fb", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629696667, "uuid": "c32d84b0-9564-489b-998e-dcf42e0f722a", "comment": "Malware payload (Formbook)", "value": "c1f0062c35f8f8cf4680100f2c916f1afee6798f7654b84513b5651cbab006acf8e2f9bf024d01ee19ac8f1fc1a4b90c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629696667, "uuid": "64569506-4c8c-4ea2-af8d-53904ce9ff54", "value": "T1D205331C1C3A65FCA87BC2021A544D8E067B8C31172DB91EF7EBC09E92B65BAF15741B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629696667, "uuid": "854e12f1-d35d-4a7f-91ef-d232dedcd136", "value": "24576:FQ4aY0XZn/4W0Pu1PprtIsMZnkITNIM96ZAPM/oZm:FQsol/DVA7nkKIMomPM/ow", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629696667, "uuid": "c47a585a-0199-4120-a15f-5fbe7dbbd177", "value": 867864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629696667, "uuid": "658e3f96-4847-4664-9aa4-89a616cd217b", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629696667, "uuid": "09990488-cba7-44ad-9ee3-42bea3aa7e75", "value": "\u5fae\u4fe1\u56fe\u7247_20181017153614.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a016ffe-040c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629721029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629721029, "uuid": "0db720b2-0c4d-4277-85ca-c6e9578ce51d", "comment": "Malware payload (AgentTesla)", "value": "76e99b1e02001cd3b7b24059a5ce24b7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629721029, "uuid": "8fd88408-f1b5-43ac-b349-4b23b6c5943e", "comment": "Malware payload (AgentTesla)", "value": "fac7e914c4ed1884da2b60a8c43f79d8d48b1417fee01bd0dde614c7c375c8a3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629721029, "uuid": "0bdb8082-9091-4f2a-96fe-3d1c11c5cf4a", "comment": "Malware payload (AgentTesla)", "value": "d43565ecbd171db89b75b39f0e5223ff805b0048", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629721029, "uuid": "3faa89e4-ad7c-4283-837a-4ef5313aa988", "comment": "Malware payload (AgentTesla)", "value": "8c53ddbb0c636e6ad32cf1258dcd19be03dcdc841fd43969a7757e59b7a3e0ee35676b11f849c6ecb7dd2862c38d3277", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629721029, "uuid": "b0de01be-0809-4057-8dda-e2edaa936ed6", "value": "T1C2F401483741BA8FD66FCE7A98826C50D7E1E1360707D7536CC326EA594EB988B053B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629721029, "uuid": "4a39fcb8-8c89-4b2b-88e1-3dd55dcda822", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629721029, "uuid": "7bfe0686-1328-41b6-bc4a-d307286d22ac", "value": "12288:byaXIMNtgGe/8Ci9OG+VpzPc3Ca3svNWYRJtjlxBT5eYIBFXo:nXze0Hn+wjZYRfBLNeY6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629721029, "uuid": "c29afa37-2407-462f-8eab-a5d4b878f2a9", "value": 726528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629721029, "uuid": "2e730d0c-716d-42d1-9ce1-7b0f805bfcd6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629721029, "uuid": "4ebda132-da0e-476a-8f17-1a0d7f026139", "value": "HLX Image.png.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "775eab3b-0403-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gozi)", "timestamp": 1629717347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717347, "uuid": "132b0601-b8ab-4809-9dc5-c337be1b93fb", "comment": "Malware payload (Gozi)", "value": "241b9232ac41657c00c631072f8ca0c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717347, "uuid": "d7004e15-99d3-4829-be65-b69781165a82", "comment": "Malware payload (Gozi)", "value": "facce20218159fa3ce1b7a95dfdc60887455a1d8c1e9b30bc36fc23eb4ef085a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717347, "uuid": "68251dd1-7e8c-4afe-8727-c3b9b50f4117", "comment": "Malware payload (Gozi)", "value": "62e5195efc60f73f36a430d9089fe52e88e75dc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629717347, "uuid": "16f72a91-c84c-4a0b-aa20-c57e79118db0", "comment": "Malware payload (Gozi)", "value": "3e90d8bac25ca95e9df1abf445a185af698d0ec91d0a628969727534b3d054f08553f9b0f81626aba8b957ba59829b3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717347, "uuid": "9aa4b920-9448-496b-893b-82f01572bc4a", "value": "T15B346D6AE2E50A95EDB7D5B9CD93C617E7F234491B64C34F13B0CA5A6F43321B218382", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717347, "uuid": "a191f431-7edc-4d11-8e8b-e8e4b5ef206f", "value": "6144:1mnZO0GDlypHAT/cxkDyPFXkfh+3m33c56Wjak4S3S83x:1MZOrEpHAT/cLPF0Im3s56WjaCi8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629717347, "uuid": "a159bba3-b526-4cd6-ac94-4677bd39ebee", "value": 247808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629717347, "uuid": "adb93541-200c-4c1e-94a8-f6b1163ded11", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629717347, "uuid": "a51ada17-f11f-401d-a3e9-05e4681e60ec", "value": "20591000000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61c10d18-03ed-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629707862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629707862, "uuid": "4a217b30-1059-4380-a72d-011fcf392758", "comment": "Malware payload (AgentTesla)", "value": "94bb55803efe84169dc92671e445897d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629707862, "uuid": "c3eb7f56-7092-4dee-929c-a8ad0061a2d4", "comment": "Malware payload (AgentTesla)", "value": "fb2dcb213dd2f988c026af22882cce2e36a2f84ce380fe088352dd57d591c459", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629707862, "uuid": "5a17fb6e-da5e-4a08-a730-96474869850e", "comment": "Malware payload (AgentTesla)", "value": "fc5e013a11de23f8c9594e8217073c47f3ca68ae", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629707862, "uuid": "ab38c77b-71ac-4024-a724-c31b9934cfe4", "comment": "Malware payload (AgentTesla)", "value": "eef789b420c952f0f6a93adcb947efcd24290389cc34be5408d9aaa66cff6d574e66f6f42abc80c5c0a65b28ac714cdc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629707862, "uuid": "c351eed8-ba12-4fc5-b31a-515841416be2", "value": "T1B1F401597244BB4FC62ECE7E99152C2097A2A9321307EB57BCC312E998CE7594B012B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629707862, "uuid": "f1b1b92a-5c14-4931-ab4a-0332da34dab9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629707862, "uuid": "a2b2cbc1-2b88-4f94-b875-a1bb94a36b73", "value": "12288:o1Y5wcXYVU0Eby7HTE8TecUmO55vnEsGSicBo0U4ilFjNUZLOCTWXy6xoI4:mnco1H7rTecUmO55vnEsHG0URRUZXWXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629707862, "uuid": "05c81af6-b68b-40de-99e9-d20bcc7bfcae", "value": 746496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629707862, "uuid": "bd232e93-20b1-47ac-8e5e-f7dadd64ea57", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629707862, "uuid": "58f547e9-87a5-4267-84b3-7cc32a78f66a", "value": "PP 2108087.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eb88c0a-043d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629742082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742082, "uuid": "b42a3cc3-d974-46da-ad62-f80df1bc5a4b", "comment": "Malware payload (Smoke Loader)", "value": "98856a23e749060d941cab69ae94c551", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742082, "uuid": "2382558b-4375-4544-935d-873098bd2f95", "comment": "Malware payload (Smoke Loader)", "value": "fc7e2d14aca1c37d3ca70c37f23183eb96da7b8db3361b8bfe15dc3a16f71c25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742082, "uuid": "4181a943-d78d-4ad4-9c2a-2bd43274dbf6", "comment": "Malware payload (Smoke Loader)", "value": "c51eb282a6c8a01684b2eddd292751be61cce881", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629742082, "uuid": "92f801e6-813e-47d1-a6ea-46e256554330", "comment": "Malware payload (Smoke Loader)", "value": "55d45c09ef294ca781d01b49f25aac499cca74c12459becc7568f1ef5f1a6102e4369266beca40d0b108d412f8b11eee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742082, "uuid": "322e6073-b3bf-4a45-8646-73564982b08f", "value": "T19F547C30AB91C034E5F612F855BA83BCA93A7AB16B3450CF93D52AED16346E5EC30747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742082, "uuid": "f0adc35f-2beb-47cf-916e-495c45a035ef", "value": "9d905009ce289bf09ec9a9fc544fc23f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742082, "uuid": "b38886b9-7d1e-4257-802c-e48071e91485", "value": "6144:9778j4UwASa/dVbtR+rH6rHBt6vmyGf32D4z:d8j5w54dNiH6rht6LGf32D4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629742082, "uuid": "5b8d284d-8304-492c-9cb0-3ea2ff5d9ca5", "value": 279552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629742082, "uuid": "c82b6ce0-ad2b-4b36-b6da-5c0a8217eede", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629742082, "uuid": "19248e65-bba2-4a0f-8d45-250a70fec7df", "value": "98856a23e749060d941cab69ae94c551.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0008d05a-03e2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629702973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702973, "uuid": "487b2710-c386-4e6b-9136-c6441e3bd8d3", "comment": "Malware payload (SnakeKeylogger)", "value": "bd39da96ea6335cb83c079a0ae55102d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702973, "uuid": "686554b8-bd72-4d2a-9c76-1e09a2746afa", "comment": "Malware payload (SnakeKeylogger)", "value": "fda39b4d8dfaaa330236eed3b262ebb51f41380871945d3f38a4123a91c0057b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702973, "uuid": "e1f80895-dc93-48d8-8e69-ed2c6d2ef441", "comment": "Malware payload (SnakeKeylogger)", "value": "319f4486d439ec40687ce25146f2bdc099ed2431", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629702973, "uuid": "74c80330-08e3-4907-a597-a2e392e79afe", "comment": "Malware payload (SnakeKeylogger)", "value": "37d117fe840d9c2021f88cb18da1230eb88ccecc49a17d7e99c7e15edb5170c3fea0cc9d44ae5f56deff188e33f04a06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702973, "uuid": "fc56c44d-5702-4f97-a35d-2d208fa3cf25", "value": "T1A515063C19B83627D1BAC366EBE18413F1A094AF7211ED59A8DE43A70743B4675C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702973, "uuid": "a293325f-0fb4-41a6-a238-6379c83c4dab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702973, "uuid": "16fa362a-0d6b-4f66-9803-f68e76a040e7", "value": "12288:iL6Y7ONDo9SGMxX/Dc9F3nC0Py3gAhC/obHEKAx0caXIzfvKxbuOHfd73L0cQVRH:QqNleobH/ZXIzfvobuAfJ3L0PVSq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629702973, "uuid": "c07f6361-baa7-43e7-a7ef-8c080f90c28d", "value": 930816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629702973, "uuid": "463714b7-8fb6-4983-bf4f-5f9e5250d288", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629702973, "uuid": "2b9d02e7-09aa-47ca-92ee-6b8b8a2409f9", "value": "hesaphareketi-01.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "790cf0d9-03d7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629698452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698452, "uuid": "204b414e-3649-453b-83fa-9d107959700f", "comment": "Malware payload (SnakeKeylogger)", "value": "edb0c26de82005b63a9ce7acd5435712", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698452, "uuid": "3da795c2-f8b7-467d-8a8c-9c9f543f6c6c", "comment": "Malware payload (SnakeKeylogger)", "value": "fe464ee01219356378e111c721ee618a9c9e4c8bafc73de5c0f6a47ce05f8d85", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698452, "uuid": "a7bc7927-df2b-4e70-ac6f-f3c7c8fe8e3b", "comment": "Malware payload (SnakeKeylogger)", "value": "3ce89766969c5dbc07297b2269c74ce14cc8c9d6", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629698452, "uuid": "1caad4b9-3819-4294-83ee-c40da7f2cefd", "comment": "Malware payload (SnakeKeylogger)", "value": "dcb790c86545006bab74f3786710e598c9ae35d660bc8d382c159889e5833fc1913e483d3de7f17f22e6f700e6a9c8c6", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629698452, "uuid": "b55bc3f6-7bb0-4f11-889e-1b62285e315a", "value": "T186B24EACD0570288CF85A7B85B2B6F41128C3AAEF7899572317CA7B42BC5D7A5013C3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629698452, "uuid": "7dd372e3-f8f8-41cb-aa49-4ce26d143bb5", "value": "384:rZcDBGZumhg3t2QbRmStGXYQrtPYK363x3kpyj5k4:rQBGZud37RmSRQZgK3CTv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629698452, "uuid": "d249b8ab-8e65-4da5-be83-4f00a06fa05c", "value": 23423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629698452, "uuid": "ed5028ae-00d1-4817-a25d-cd835bb4008c", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629698452, "uuid": "dbc5cec1-95fc-4d09-9d62-7a826a3f33de", "value": "BKG_HASLS19210801718.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60580a10-043a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1629740931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629740931, "uuid": "4b29b329-c308-4438-9bea-3c9979693a31", "comment": "Malware payload (njrat)", "value": "72423e7df618328f5f6d7e8cb43acfcf", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629740931, "uuid": "2e7619f6-ec56-4567-98e5-dee3b5192d2c", "comment": "Malware payload (njrat)", "value": "fe962c612248fb612bcca5eb506dd010e4799fc5f290aa00887644cd9154d05c", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629740931, "uuid": "5b74e1c3-c238-4645-8e1e-15430273bafa", "comment": "Malware payload (njrat)", "value": "bc3cc8799a26e30d482dab2632528a6e6cfb9730", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629740931, "uuid": "5f7f884e-c791-4567-a279-8dbbce0b9a65", "comment": "Malware payload (njrat)", "value": "cdb41889bf6e89f04843c40204449931249a5c2ab5bd74005b84dd99c88907837783a9d447d20255e344b8b0bce9f62f", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629740931, "uuid": "8a0d98ab-7a78-43ee-b795-fee3402a8a41", "value": "T1DC012B0A4D29CDEB0049F18202D34DE9C6604AA78F806E7A347479476CAD22F6DCCD87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629740931, "uuid": "9559da41-2e85-487c-9f90-0737c69e1402", "value": "12:0ChGF2MBNXyXNoxAbOJk82cG2bwELPdg3Nfd+aaiTC:HgF2SNCXQXG2UE7kNEuC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629740931, "uuid": "a291be08-7212-4085-aff3-9680f48785a2", "value": 726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629740931, "uuid": "10cb5740-6c85-4179-8373-344e742c3860", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629740931, "uuid": "42526b56-e35b-4a26-8c37-0a396fa0d029", "value": "WOO62_InvoiceCopy.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a0089bf-03d6-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629697944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629697944, "uuid": "86a356aa-3243-4679-b7e4-95e99fa98b5b", "comment": "Malware payload", "value": "604a8a23a0558eff3eea5793987cc6d5", "object_relation": "md5", "Tag": [ { "name": "39.104.77.83", "colour": "#928B7E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629697944, "uuid": "c9cce52c-d589-4bc3-915a-5920a5bf5a4a", "comment": "Malware payload", "value": "fefb3a746547cd568eb363b808da4a4d7571628a24ddbb9dc596811f0cadb6fc", "object_relation": "sha256", "Tag": [ { "name": "39.104.77.83", "colour": "#928B7E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629697944, "uuid": "13b31c65-c56e-404f-bcc9-83ebd774a8dd", "comment": "Malware payload", "value": "d29fdbb434a848cdf5da00ac32e77b107c495566", "object_relation": "sha1", "Tag": [ { "name": "39.104.77.83", "colour": "#928B7E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629697944, "uuid": "c0d99e84-c483-45d5-8487-5e8ee49b05b9", "comment": "Malware payload", "value": "0590bc9e39d50d851bee81edd85968654d80193bff2049716143fe8c2a461485db691a88f3623862ca416457bd675fb0", "object_relation": "sha3-384", "Tag": [ { "name": "39.104.77.83", "colour": "#928B7E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629697944, "uuid": "25790e50-6cc8-4e9f-8c95-439e7f629c33", "value": "T14DB1D9241BDBB509A8D72503BD7AA8C15E3C2FA797DA3C00B5F49620B58BC24F1B7B54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629697944, "uuid": "f040d6af-fa33-4328-811a-723a35e2d87d", "value": "96:9gOOMM3vvOmIecH1Yn64S/psvvOmPe991Yn64YkzkHD0lgwD0lB:DS/vOkcH1YnjvOR991YnzkAdg3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629697944, "uuid": "dfb8aa3e-347e-4621-9a51-a5651bd48a25", "value": 5281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629697944, "uuid": "6a7caaed-2410-439b-bdfa-2b4e9b21c29a", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629697944, "uuid": "17689063-3189-4ffb-a20f-9e4ae0c3ea9e", "value": "ps1_.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b00e9d03-044b-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629748366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629748366, "uuid": "4285c77b-04cb-4481-b50b-315d37996a4a", "comment": "Malware payload", "value": "69adfe1dc1de1b39dc6115bf9c4b0529", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629748366, "uuid": "3b6556a1-f73c-4a50-af2b-b9ac4818fb68", "comment": "Malware payload", "value": "ff080d24b804eecfa01b6decb9c1b8c37ef675c2f5cef61079a62aacdcb2276d", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629748366, "uuid": "29ddb363-2e56-4a96-9f60-747e70962229", "comment": "Malware payload", "value": "d8feb7b8139cb68c4e55f63d1548463f3740c31b", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629748366, "uuid": "b370bb76-75b9-4522-9eb7-1de88d55ca18", "comment": "Malware payload", "value": "fd680466c30bc02cbbebc001106b2211bb994661002c3b3915b8e6aaa3450c7f32c4fcf50303f41e9f7fdd1ac0cd1afd", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629748366, "uuid": "8c8dfdc1-c84f-4747-a687-e2dc2567434c", "value": "T1D551871AF847D15C9BB9235BEC978562FF1B811B9DA2104C71DCC2495F2080996ACF9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629748366, "uuid": "6cad409a-aa08-411b-9506-e82040af718a", "value": "48:AxB48iLuDQjvUKmc4TQ7QZE96pAUYRAGqqkS1HoyWKLrj6l1CelkEJmZVOQBozlp:UGhrffvIypvK0elkEYZ85zf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629748366, "uuid": "2b12c50e-7c04-4e59-b3b4-860ba1c31574", "value": 3142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629748366, "uuid": "4306a45e-0a22-4e97-89f6-45a9c576cf9c", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629748366, "uuid": "c373d158-4cfe-4ad5-9222-a0b19a42d66f", "value": "aUUNNbL8.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "151f18e6-041f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629729208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729208, "uuid": "9888b12d-2e43-4908-a46d-cce4e0f27481", "comment": "Malware payload (AgentTesla)", "value": "e2ab6d0f90bf3ea44084a2945e4f1eb9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729208, "uuid": "8cb9339b-e763-4f16-b6f4-44ba62c873a7", "comment": "Malware payload (AgentTesla)", "value": "fffe5fdbf0750c069521be1bd6836979049524e62474b2cd3a25f5ed69534a17", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729208, "uuid": "b8688700-0029-4df9-acdc-9d7b2b40d58b", "comment": "Malware payload (AgentTesla)", "value": "d0a0802eb6a7253323a261bb0d20bcb2d7340353", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629729208, "uuid": "1fa2c0e4-f826-4119-b9dd-0b6dd2f7996c", "comment": "Malware payload (AgentTesla)", "value": "87cb0b71d9af9eb0e25ed66deb93ce7ce42fa46308e73c252ed887b9862f237b59643bb53ec82685d6019508ece6e8b9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729208, "uuid": "528d81fb-1696-48ab-b6c2-510dc12f353f", "value": "T158551278BE83A355E007CBB29C9E0C31ECA36E825756C90D6264B63D0D786BC5F76708", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729208, "uuid": "02ec878b-9d5f-4796-8ae2-e35bec927b9b", "value": "24576:V4dXSHNWpJFGdQRKLNYv68xV0C46Y+bNew:V4teWpJnKLNerKCrY+bNew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629729208, "uuid": "04db6573-a46d-4cb1-99d4-b9746cecaef6", "value": 1299144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629729208, "uuid": "dcdeef43-a94e-47f7-9eae-9b4ffeb59dda", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629729208, "uuid": "4cafdb2e-bd52-4154-8b9f-171037f21086", "value": "swift Details.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }